The Subject Today Is Death: Digging into Digital Legacies
/
How do you conduct a digital investigation when your subject is dead? This was the central question of the 33rd Annual ACFE Global Fraud Conference session, “Death, Data and Digital Legacies,” presented by Derek Ellington, CFE, senior consultant of Ellington Digital Forensics, LLC.
“The subject today is death,” Ellington told attendees.
Ellington recounted some of the investigations he’s conducted in which the subjects had died and he needed access to their digital data. In one case he needed to access the cell phone of a woman who had died in a car accident to determine if she had been texting or distracted before her crash. It turned out the woman had been using her Bluetooth, and thus was not at fault. In another case, Ellington needed to determine whether the owner of a construction company’s death was due to foul play. Initially, his death had been ruled a suicide, but digging into his email communications, it turned out, he had indeed been a victim of foul play.
In each of these cases, Ellington had to figure out how exactly to access their information, such as a passcode on a phone. As Ellington pointed out, people might prepare their estates and wills for their families but they generally don’t prepare and preserve their digital legacies before they die.
“All the Things That Digitally Show You Were Here”
Ellington led attendees through all the digital data investigators can access and the steps they must take to access it. But first he described what is meant by the term digital legacy. As he put it, a digital legacy is “all the things that digitally show you were here.”
Specifically, the digital legacy includes social media pages such as Facebook, Twitter and Instagram, as well as personal websites, online photo galleries, email accounts, cryptocurrency wallets, Steam libraries, stock trading and banking accounts, loans and other equity. Ellington offered another way for attendees to understand their digital legacies. “When you die, what do you want to have happen to your Facebook?”
Investigator’s Questions
According to Ellington, investigators have several questions to address if they’re working an investigation that will involve digital data. From the start, investigators must consider who the subject of the investigation is to determine the scope. Is the subject a suspect, a victim or a witness? From there, investigators will need to determine what data they need to collect and the levels of authorization they’ll need to go through to get that information. Do they need to go through an executor, law enforcement, courts or family members?
Collecting Hard-to-Obtain Data
Many times, getting into a person’s data is not so easy. For example, they might have a passcode on their phone. When you need to collect locked data, Ellington recommended the following steps:
Before you get started, get the proper authorization to obtain any data.
Begin with the subject’s phone. Will you be able to break in? Do they have any saved passcodes in a browser or notes?
Then move on to their computer. Will you be able to break in? Can you find saved passwords in a browser such as Chrome or Safari?
Get their primary email account. It’s helpful if the subject has a recovery email for their primary email.
In the Event of a Death
So, how do you proceed with data when someone dies? According to Ellington, it’s best to access information as quickly as you can, but don’t force an account with incorrect passwords. If you can’t get into a phone, Ellington recommends transferring the number to a new phone to receive text messages. He also suggests that investigators start with the main email account and everything you can find from there.
It’s also important that investigators preserve as much data as possible and as many accounts as you can find. Take down accounts, disable email addresses and memorialize their social media accounts.
Preserving Your Own Digital Legacy
Ellington closed out the session by discussing how attendees could retain their own digital legacies. It’s not something that many people might consider when drawing up their wills and planning their estates, but the reality is so much of our personal history is digital, so Ellington implored attendees to preserve their own digital data and have a plan for how they’ll pass it on to family and friends. Indeed, Ellington told attendees they should have their own “digital death plan.”
He provided these tips to preserve your own digital legacy:
Share your credentials with a trusted friend so that your information is readily available if necessary.
Don’t encrypt your data or else it will be lost forever.
Use standard format drives such as FAT32 and use standard file formats such as JPGs.
Store data in dry, climate-controlled places.
Have multiple copies and account for your data in your will.
Scan old images and digitize VHS tapes.
