Forensic Analysis: Death, Data & Digital Legacies

Successful audits and fraud investigations are all about getting the right data. Documents, emails, text messages and even social media can all be critical to getting to the truth. But what do you do when the owner or custodian of your data is deceased?

In this session we will take a fraud investigator’s look at how to deal with death from a data collection perspective. What are the best practices for collecting data for your investigations when the suspect, witness or even victim is deceased? Without the benefit of interviewing the person, how do we even figure out where to look? What steps should you take to preserve and collect data from devices and cloud accounts? What options do we have when devices are locked or encrypted? What do you need to know before reaching out to QuickBooks, Google, Apple or even Facebook when the account holder has passed away?

As fraud investigators, we not only have to collect and preserve evidence from our cases, but from our own files and data well. What are some best practices for storing this data not only for the short term, months or years, but for decades? Data stored in boxes might last a hundred years, how long will data last in Dropbox? What is the best way to preserve this data now when it only exists electronically? Finally, we will talk about the emerging field of digital legacy "wills" that enable a person to indicate before they die how their data is to be handled after their death. Can these digital wills affect our access to the data and who decides? We will look at all these issues and gain a better understanding of death, data and digital legacies.

You will learn how to:

• Explore best practices in audits and fraud investigations for data collection when dealing with a deceased custodian
• Identify who owns the data and potential legal gray areas when accessing cloud accounts and social media
• Navigate the trend toward digital legacy plans and what that can mean for your investigation, including who controls the data
• Consider digital data storage for not just for years or decades, but for hundreds or thousands of years

About the Presenter:

Derek Ellington is a nationally known Certified Fraud Examiner, specializing in computer crimes. He is also a Certified Computer Forensic Examiner, an ACEDS Certified E-Discovery Specialist and a licensed private investigator. He has testified more than 150 times in all manner of courts and jurisdictions. Ellington is a popular speaker and contributor to legal publications, and he regularly trains law enforcement first responders on processing digital crime scenes. Over the last five years, his lab has processed more than 1,500 cases, ranging from civil to criminal and family law. Many of his cases involve adolescents or young adults as suspects, witnesses or victims, and he and his team have developed unique understandings and strategies in dealing with cases involving millennials.