Publicly available Facebook messages are almost too simple a source of information. It’s harder – but possible – for attorneys to find ways to get copies of chats and instant messages Facebook users engage in, and which typically are not kept in permanent form.

But computer forensic experts have found Facebook instant chats are saved in deleted form on a person’s computer.

“People who use instant messaging in Facebook assume those conversations are gone,” said Josiah Roloff, a vice president and investigator with Spokane computer forensics company Global CompuSearch.

“Those conversations are there on the hard drive in what’s called unallocated file space,” Roloff said. To find them, investigators use software tools, such as EnCase, a product that finds and restores deleted computer data. As long as the deleted files sit on parts of the hard drive that are not overwritten with new data, EnCase can retrieve messages and chats.

EnCase is also used, among other tools, to dig through deleted messages on smartphones, including the popular Apple iPhone.

Not long ago Global CompuSearch was asked by a Spokane man to look through his wife’s iPhone to determine if she was having an affair.

Using EnCase, Global CompuSearch investigators sifted through the wife’s iPhone data. Even though many of the recorded voice messages were deleted, EnCase was able to recover roughly 1,000 of them, and the husband learned she was seeing another man, Roloff said.

As a result, his attorney was able to negotiate a divorce settlement in the man’s favor, Roloff said.

“The iPhone is one of the most insecure phones you can have” if you’re trying to hide or protect personal information, Roloff said.

That opinion has nothing to do with the recently divulged feature of many iPhones, which can keep a location history going back many months. Apple has modified that feature and told users how to disable that option.

“What makes an iPhone so insecure is that it can hold so much information, including photos that may be deleted but can also be recovered,” he said. Older or plain-feature phones don’t hold that volume of personal information, he added.

At other times attorneys try to determine not what’s on a computer, but how it got there.

Roloff’s boss, Global CompuSearch CEO Marcus Lawson, was involved in a major child-custody case in Connecticut that involved allegations that a husband was downloading child pornography.

The wife said she found the porn on one of the couple’s home computers. She cited that as the reason she deserved sole custody of their three children.

The husband’s attorneys asked Lawson to examine a number of computers the couple used. The husband insisted he had nothing to do with them.

Lawson discovered he couldn’t establish who downloaded the porn, but he made a strong case it wasn’t the husband.

Using time-stamp information associated with browser files on the computer, Lawson showed that whoever visited the porn sites did so when the husband was far from home on business trips.

via Software helps lawyers mine data users thought they’d deleted – Spokesman.com – May 8, 2011.