FRLLC - A Digital Forensics Blog

YouTube is a video-sharing platform which allows users to easily and quickly upload videos taken on their phones.  An attorney or investigator might see a video on YouTube relevant to their case or subject, which they want to download and preserve before YouTube or the video's author removes it.  This article demonstrates a tool which is free and easy to use to preserve YouTube videos and content from hundreds of other sites. Background As a digital forensic consultant, I've been asked by attorneys numerous times to preserve a video that is on YouTube.  While anyone can screen capture a video or install any number of browser extensions that can make a copy of an online video, these methods do not provide logging or metadata that is sufficient for litigation.  Years ago, I discovered a tool which is easy to use and provides logging and metadata capture.  While some may not consider it to be a "forensic tool", I consider that testing and validating this tool on a ...

In criminal cases involving Child Sexual Abuse Material (CSAM), the prosecution rarely produces forensic reports or source data to the defense due to the timely redaction process required to exclude CSAM media from the production.  Software applications, commonly used by digital forensic analysts to process and examine sources of digital evidence, have started to include methods for generating reports with the contraband redacted or to export data in a format which excludes all image or video files completely.  While this may not replace the need for an on-site forensic examination by a defense expert, it can save time and expenses for both sides during the discovery phase, and subsequently, the examination phase.  This article provides one technique using Magnet Axiom software, an application commonly used by law enforcement, for accomplishing such an export.   Background Discovery is the legal process of one party turning over evidentiary material it has in it...

This article presents an issue in the discovery process relating to Call Detail Records and Historical Cell Site Location Information in criminal cases. Provider search warrant returns almost never include the cell site database, even when the language in the search warrant requests it. I suspect the reason is because the providers regularly upload cell site lists to law enforcement-only portals, and thus, they assume law enforcement has access to them. A combination of a disclaimer and misunderstanding causes issues for the defense in its analysis of the records.   UPDATED: 2/8/2026 Cell site lists not provided with discovery The use of historical cell site location information (CSLI) is commonly used in criminal cases and increasingly more in civil cases. CSLI is information provided by Mobile Network Operators (MNO) (e.g. T-Mobile, AT&T, Verizon) and Mobile Virtual Network Operators (MVNO) (e.g. Boost Mobile, Cricket Wireless, Tracfone).  I'll refer to them collect...