Case Study 2: Fabricated or Deleted Evidence
| Background | In a family law matter paper print-outs of Facebook pages was introduced by the applicant as evidence of conversations on Facebook. The respondent disputed the authenticity of the statements and sought to demonstrate these were manufactured and had never been posted to her Facebook Profile. The respondent alleged that the material was a deliberate attempt to mislead the court to her detriment. |
| Collection | All Electronically Stored Information (“ESI”) from several relevant accounts was collected programmatically across a specified date range including attendant metadata to compare with the material introduced by the applicant that was claimed to be authentic. |
| Collation | ESI was downloaded into a case-based logical evidence container, preserved and organised to compare with the material in question. |
| Analysis | Comparative analysis of paper court exhibits with downloaded ESI. Initially a simple visual inspection to ascertain whether the contested posts were visible from the respondent’s account (Facebook Profile) or from the perspectives of related parties that allegedly included comments and which were Facebook friends of both parties. We carefully reviewed changes in friend’s collections and account privacy settings to identify potential changes in the visibility of material with the credentials that we used to collect material for the case. For corroboration and to confirm our analysis of metadata, we also obtained sworn statements from “Facebook Friends” as witnesses – all of these supported our analysis all in their assertions that they had not seen the post alleged to have been fabricated in the live Facebook environment. Our experienced investigators also reviewed material looking to content analysis; language / tone / fonts/ appearance / layout. Also we used techniques such as gap analysis of metadata sequence and integrity to determine possible existence of any data missing from conversation threads and posts on wall. |
| Product | Report specifying findings in metadata integrity and showing any gaps that could have corresponded to the allegedly fabricated posts / component of evidence. Recommendations that statements be taken from related parties to confirm that the alleged posts did or did not exist. Recommendation for investigation of possible perjury to escalate matter to be able to obtain data from social site law enforcement liaison process. A detailed report allowing law enforcement liaison processes to be very focused and efficient in data requests to the relevant online social network. |
| Outcome | Our report was submitted to the court. We understand additional questions regarding provenance of the Facebook posts were asked of the applicant. |