Methodology

Google History Forensics

by Craig Ball

In my last Forensic Focus column, I touched on migration to handhelds and the cloud, mushrooming drive capacities and encryption-by-default as just some of the factors auguring the eventual extinction of conventional digital forensics. But an end to old school digital forensics is no threat to examiners who evolve. There will be plenty to do for those adapting their skills and tools to new sources and forms of information. We will learn to read new tea leaves.

Happily, for every source of forensically-rich information that fades away, others emerge. For every MacBook configured to wipe deleted data, there’s an iPhone storing screenshots and typed text. When webmail shooed away some of our ability to locate messaging artifacts, social networking and geolocation wandered in with stories to tell.

Now and then, the emergent sources just seem too good to be true.

Case in point: Google History.

Certainly, forensic analysts routinely look at Google searches locally; parsing Internet activity to assess what the user searched and surfed: “Nude children.” “How to make chloroform.” “Wipe a hard drive.” It’s compelling evidence.

But, as users grow savvy about covering their tracks, we see more cache deletion and deployment of antiforensic “privacy” tools designed to deprive us of the low-lying fruit. It’s potentially “spoliation” on the civil side and “obstruction of justice” on the criminal side. On both sides, proving it helps justice be done.

Then again, data can disappear innocently, too. Oliver Wendell Holmes, Jr., observed that, “Even a dog distinguishes between being stumbled over and being kicked.” Discerning evil intent—mens rea in the law—is crucial to deciding whether and how much to punish actions that result in lost evidence. One way we demonstrate intent is by showing the planning that preceded an act. We reasonably infer intent to destroy evidence from web searches seeking ways to make evidence disappear.

But what do you do when the data destroyed is the evidence of intent in its destruction?

Imagine my astonishment and excitement at discovering that, for many of its users, Google remotely stores and readily displays an extensive history of searches. When I checked mine, Google displayed a list of 22,151 Google searches I’d done going back to March of 2006! For my wife, Google stored more than twice as many searches in the same timeframe. Neither of us recalled activating a search archival feature beyond whatever was entailed in creating our Gmail accounts.

Getting to a search history is easy, but it requires authentication. Go to www.google.com/history and enter your user ID and password. You may see nothing, or you may see tens of thousands of searches over years of use. The history is searchable and can be organized by type of search (e.g., web, images, maps, etc.).

Accessing a user’s Google History is immediate and cost-free, but requires both a user’s credentials and a legal right to access the data for the investigation. In the face of a spoliation claim, an opponent may be willing to voluntarily grant access. Else, the court can order a party in a civil suit to disgorge credentials and authorize access with appropriate deference given to issues of confidentiality and privilege. While a subpoena served on Google is technically an option, those who’ve gone that route in civil cases are often frustrated, finding they must secure a court order.

Again, your ability to access another person’s information is not the same as the right to do so.

Because Google History allows a user to delete and alter their history, counsel in the case should consider if it’s a source of data to be encompassed in a preservation demand or order requiring a party not to delete or alter the data. If a preservation demand or order speaks only to “social networking” or “online storage,” Google History is something else altogether.

If you’ve used Google History to a fruitful end in an investigation, I’d like to hear from you, either in a comment below, or by e-mail (craig@ball.net).

 
Click here to discuss this article or leave a comment below.

Read Craig’s previous columns

Craig Ball is a globetrotting Texas lawyer who limits his practice to service as a court-appointed special master and consultant in computer forensics and electronic discovery. Notwithstanding formal training and multiple certifications in computer forensics, Craig credits a lifelong passion to understand how things work and be able to explain it to others as his most cherished credential. Craig writes the award-winning Ball in Your Court column on electronic discovery for Law Technology News and is the author of numerous articles on e-discovery and computer forensics, many available at www.craigball.com

Discussion

4 thoughts on “Google History Forensics

  1. Craig–

    Scary post. Now the question is… is a user HAPPENS to access this website on their own, then the box is imaged, do any of the pages show up in cache? I sense an experiment….

    FYI I was able to go all the way back to August 2008, when I was in Hawaii and did some Google Mapping… they must save these for statistical/commercial purposes (ie how many of our users frequently search for x…where are they located, etc).. thoughts?

    Posted by Melissa A | September 8, 2011, 5:59 pm
  2. Hello Craig, my name is Antonio and I live in Basque Country Spain Zarautz, a very interesting article, unaware of the option in Google search history, certainly a good tool when you can not access the Internet browser history.

    a greeting

    Antonio Dominguez
    ADF Information

    Posted by Antonio Dominguez | November 24, 2011, 8:40 am

Trackbacks/Pingbacks

  1. Pingback: Weekly Top Story Digest - September 21, 2011 | @ComplexD - September 21, 2011

  2. Pingback: The September 24th weekend edition of the “Top 20 … plus more” – a compendium of e-discovery articles/vendor news/upcoming events | The Electronic Discovery Reading Room - September 24, 2011

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 959 other followers

%d bloggers like this: