I agree too. The presence of images with geotags alone would not lead me to conclude that the laptop was in any particular location but one must look at the totality of the circumstances.
Pics of people in a bar geotagged near "Carlos and Charlies" + SSID's for "CandCFree" + cached intranet page for the Hilton across the street + so on and so forth = the laptop likes to drink at Carlos and Charlies.
Personally I see it as a probable "red herring".
Possible red herring, yes. It would be terrible advice to give a n00b who lacked the ability to separate the wheat from the chaff. On the other hand, there are almost always factors that narrow the relevant issues, and it's part of an investigator's job to exercise good judgment. For example, if the case concerns a narrow window of time, say a month, and image creation dates were during that time, it would be imprudent not to examine the EXIF data.
As such, I would think that it would be a benefit for everyone if more of this stuff was shared. If you look it and consider it, and then make a reasoned choice whether you can incorporate it or not, that's cool. Or maybe just ask for clarification. I think that we can all benefit from sharing our perspectives, whether we use the information or not.
Sure ) , and the good thing of a forum is the possibility to talk and provide and discuss opinions and ideas.
Possible red herring, yes. It would be terrible advice to give a n00b who lacked the ability to separate the wheat from the chaff. On the other hand, there are almost always factors that narrow the relevant issues, and it's part of an investigator's job to exercise good judgment. For example, if the case concerns a narrow window of time, say a month, and image creation dates were during that time, it would be imprudent not to examine the EXIF data.
Of course D , but here, in this thread and in this context it is the least probing piece of info one can find.
Let's hypotize that a set of three images with geotags of Miami are found on that laptop, NOT picturing the suspect (and of course NOT taken with the laptop on-board camera).
Please consider how if you find a picture of the suspect in Miami, that proves that the suspect was in Miami and not that the laptop was there. (unless in the picture the laptop was held in his/her hands and in such a way that you can read in the picture the serial or COA sticker, or the laptop cover has an identifiable crack/scratch, etc. wink )
Excluding beforehand that the pictures were downloaded or received as attachment to e-mail, etc. (which could anyway be a third possibility) there are two ways they could reach the laptop's hard disk
- they were copied to it from a Mass Storage device (say USB stick or SD card)
- they were copied from it from the camera/device that took the pictures directly
If #1, nothing connects the pictures (and the locations where they were made) to the movements of the laptop.
Two weeks ago my cousin came back from a trip in Egypt, took the SD card out of her camera and, since my wife's desktop has not a SD card reader, they used my laptop to see the pictures. A few photos were saved on my laptop's harddisk. The laptop has never been in Egypt.
Really.
If #2, is the same, at the most, if the camera that took those pictures is among OTHER items seized found in the possession of the suspect, then it means that the camera (and not necessarily the laptop) has been in Miami.
My cousin did download the same pictures to her laptop once back, but she didn't brought it with her on the trip, just the camera.
Really.
jaclaz