The Waldrep Company LLC.

The Waldrep Company LLC. Court-Ready Digital Forensics & Expert Witness Services for Legal Teams | Forensic Training

Two federal courts. Two plate-reader queries. Opposite answers.On September 10, a federal court in California held that ...
10/13/2026

Two federal courts. Two plate-reader queries. Opposite answers.

On September 10, a federal court in California held that police queries of license plate reader (ALPR) databases were not a Fourth Amendment search. The queries turned up a few photos of each of two cars. That data, the court said, "could not create 'an all-encompassing record'" of the defendant's whereabouts.

On October 1, a federal court in Oklahoma went the other way. A deputy's warrantless search of plate-reader systems, including Flock, had returned "more than 50 individual records" of a driver's whereabouts "across the country for an entire month." The court called it "a type of indiscriminate mass surveillance" and suppressed the evidence. It also found the traffic stop had been unlawfully extended, a separate ground.

The Oklahoma court acknowledged that, by its own research, "nearly every court examining the issue to date has determined that ALPR technology use is not a search."

Neither ruling binds other courts. Read side by side, though, both put real weight on the query itself: what was asked, and how much history came back.

So the query record matters. If a plate-reader hit is in your case file, someone should be able to say:

Who ran the query, and the reason given.
The plate, the date range, and the networks searched.
How many records came back, and over what period?
Which results were used. Which were set aside.

Investigators who write that down protect the hit. Attorneys who ask for it learn how much weight it can carry.

The newest objection to digital evidence is not "that recording was altered."It is "that recording is fake," even when i...
10/08/2026

The newest objection to digital evidence is not "that recording was altered."

It is "that recording is fake," even when it is real.

Researchers call this the liar's dividend. When anyone can produce a convincing synthetic voice, anyone can claim a real one was synthesized. Playing the clip for a jury does not answer that challenge, and neither does a confident expert who only listened to it.

Authenticity rests on provenance:

The original file, not a re-recorded or re-encoded copy
The source device, and how the file got from it to the exhibit
The metadata, read and checked for consistency
Corroboration from records that exist apart from the recording

Evidence rules committees are still debating how courts should handle AI-generated and AI-altered evidence. Litigation teams do not have to wait for that debate to end before preserving the original and documenting where it came from.

If a key recording in your case were called a deepfake tomorrow, could you show where it came from?

"Can't the client just export the chat and send it over?"They can. The real question is what that export will have to su...
10/07/2026

"Can't the client just export the chat and send it over?"

They can. The real question is what that export will have to survive later.

A self-collected export shows the parts of a conversation one person chose to capture, in the format the app chose to produce. What usually stays behind:

Edit and deletion records
Original attachments and their full metadata
Account and device identifiers
Time zone and clock settings
The app database and logs that tie everything together

Once opposing counsel asks how the evidence was gathered, the testimony shifts from what the messages say to who collected them, with what tool, and what they left out.

A defensible collection does not have to be a full device image every time. It needs to be scoped to the case, done with a documented method, and repeatable by someone else.

Collect it once, and collect it in a way you can defend.

The hold letter went out on Monday. The messages were set to disappear after 24 hours.Disappearing messages do not pause...
10/06/2026

The hold letter went out on Monday. The messages were set to disappear after 24 hours.

Disappearing messages do not pause for a litigation hold. The setting keeps running until someone turns it off, in every relevant thread and on every device that holds the conversation.

When the duty to preserve begins, courts tend to ask three practical questions:

Did anyone know auto-delete was turned on?
When was it turned off, and who did it?
What was lost in between, and can any of it be found somewhere else?

Sometimes copies survive on another participant's phone, in a backup, or in notification records. Sometimes nothing survives, and the gap becomes the story.

For counsel: add ephemeral messaging settings to your hold notice and custodian interviews. Do it on day one, not at the first deposition.

Does your hold template mention disappearing messages yet?

Plug a drive into a computer and the computer may write to it.Nobody has to click anything. Operating systems can update...
10/02/2026

Plug a drive into a computer and the computer may write to it.

Nobody has to click anything. Operating systems can update small records on a connected drive on their own. On a normal day, that does not matter. On evidence, it matters a great deal.

A write blocker sits between the evidence drive and the examiner's computer. Think of it as a one-way valve. Data flows out so the examiner can copy and read it. Nothing flows back in.

That is how an examiner can say, under oath, that the examination did not change the drive. A hash comparison then shows the copy matches the original.

If a juror can picture a valve, they can follow the rest of the testimony.

Share this with someone who has to explain it in court.

The log that shows who opened that file may already be gone.In Microsoft 365, Audit (Standard) keeps activity records fo...
10/01/2026

The log that shows who opened that file may already be gone.

In Microsoft 365, Audit (Standard) keeps activity records for 180 days by default. Audit (Premium) keeps some of them (Exchange, SharePoint, OneDrive and Entra ID) for one year. Longer retention can be set up, but it cannot bring back a record that has already aged out.

Disputes rarely start on the day of the event. A forwarding rule on a mailbox, a folder shared with the wrong person, a sign-in nobody recognized. By the time anyone asks about it, months can pass.

If a matter could turn on activity inside a Microsoft 365 account, ask early whether the audit log has been exported. Not whether it exists. When.

Our free eDiscovery primer for attorneys is on the resources page. Link in bio.

A seized iPhone does not wait for the lab.Since iOS 18, an iPhone that stays locked for 72 hours restarts itself. After ...
09/30/2026

A seized iPhone does not wait for the lab.

Since iOS 18, an iPhone that stays locked for 72 hours restarts itself. After that restart, the phone is in a Before First Unlock state, and most of the data on it stays encrypted until someone enters the passcode.

A Faraday bag blocks the signal. It does not stop the timer.

That makes two details worth writing down at the moment of seizure: the time, and the condition of the device. Was it powered on? Was it locked? Does anyone know when it was last unlocked?

Those notes shape what the examiner can do. They also answer a question every report gets asked later: how do you know what condition the phone was in?

Save this for your next device seizure.

09/30/2026

Digital Forensics Training with The Waldrep Company.

Link in the comments.

09/30/2026

Cases built on digital evidence are decided long before trial.

Those cases turn on what got preserved, how it was collected, and which questions somebody thought to ask the examiner. One habit helps with the last of those: put the questions in writing before the device goes out, since they set the scope of the work.

Our new online course, Digital Evidence for Legal Professionals, covers that ground for attorneys, paralegals, and legal assistants. It is taught by Eric L. Waldrep, MCFE, court-qualified digital forensics examiner. Five modules and 22 lessons, all built on one fictional case, Northwind Logistics, Inc. v. Dana Reyes. Each seat includes 18 downloadable references, a CLE self-application packet, five module quizzes, a 25-question final, and a Certificate of Completion.

The course is not accredited CLE and claims no credit. Where a state allows attorneys to self-apply, it supplies materials to support that application. Credit is not guaranteed and varies by state.

We teach the evidence and the forensics. You bring the lawyering.

Founders price: $497 through Wednesday, October 14, 11:59 PM Central. $697 from October 15.

https://thewaldrepcompany.com/courses/delp/?utm_source=linkedin&utm_medium=social&utm_campaign=delp-launch

Drive makers count in decimal: 1 TB is 1,000,000,000,000 bytes.Windows counts in binary, so the same drive shows as abou...
09/27/2026

Drive makers count in decimal: 1 TB is 1,000,000,000,000 bytes.

Windows counts in binary, so the same drive shows as about 931 GB.

Nothing is missing.

When two reports list different sizes for one device, check the units before questioning the evidence. DFIR Toolkit's storage calculator converts between them offline.

Download DFIR Toolkit on the App Store.

https://apps.apple.com/us/app/dfir-toolkit/id6793640596
DFIR Toolkit
or the Windows version here: https://toolkit.thewaldrepcompany.com/

Address

118 Margaret Street
Addison, AL
35540

Alerts

Be the first to know and let us send you an email when The Waldrep Company LLC. posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Contact The Business

Send a message to The Waldrep Company LLC.:

Shortcuts

Share