by Charles Adams

Legal professionals are fully aware of the importance of collecting, reviewing, and producing Gmail messages maintained by Google.  Undoubtedly, Gmail evidence has played a pivotal role in many legal actions but in some situations, it does not contain all the answers to key questions.

Gmail messages are just the tip of the iceberg in relation to all the data collected and maintained by Google.  Unfortunately, many lawyers are missing vital facts and key pieces of evidence, simply because they are unaware that Google has the evidence to support their contentions.  This oversight can make the difference between winning or losing a legal action or worse, place an innocent person in prison.

Sadly, this oversight and/or lack of knowledge is sometimes driven by the belief that only Google Gmail messages are important, and that all other data maintained by Google is irrelevant, especially in civil actions.  Many, lawyers just want to see email messages to help build a timeline of communications in support of contentions to prove their case.  However, this may not always paint the whole picture of who, what, where, when or why things occurred.  To comprehend the full scope of events, you may need to dig a little deeper beyond the surface of emails and uncover hidden truths by examining additional data collected and stored by Google.

For instance, you may want to know when and where a person was physically located at a given point in time.  As such, Google Timeline, launched in 2015, is a feature that contains location history and can establish a user’s precise location on a specific date and time.

Google collects location data from a user’s mobile device if they have a Google account and location services are enabled.  This data is captured even while the device is idle.  Android users are prompted to set up a Google account upon activation of their new mobile device and Apple iPhone users can also add a Gmail account to their device.  This location data could exist since the creation of the account.  Per Google, this information is derived from GPS data, cell site/cell tower information, and Wi-Fi access points.  Google collects this data whenever one of their services is activated and/or whenever there is an event on the mobile device such as a phone call, text messages, internet access, or email access. Google account information can also contain photos and videos, search history, browser history, Wifi connections, IP Address, activity logs, chats, passwords, tokens, contacts, applications, security logs, cell phone backups, documents, other connected devices, Google Voice, Google Wallet and much more.

Google’s Timeline feature allows attorneys and investigators to obtain detailed information about where someone has been – down to the longitude and latitude – over the course of YEARS.

Imagine a witness stating they cannot recall a phone call or reading an email message or denying they visited a specific location.  Armed with Google Timeline data, you would be able to jog the witness’s memory by telling them precisely where they were located at the time in question.  Again, this is only one small aspect of all the data collected by Google that is overlooked.

To fully appreciate and discover what evidence you have overlooked, you need to understand what services Google provides and which of these services were being used by the Custodian (person or company) being investigated.  In many cases, not even the user understands or knows what services are actually being used, so it should be investigated to confirm.

One method of confirming which Google services are being used and what data is saved is to visit the users Google Dashboard.  While this may not be considered a forensically sound methodology and may not reflect all available data, you will see a summary of some of the Google account data to get more details.  To access the information:

Step 1: See an overview of user data

1. Go to the users Google Account
2. On the left navigation panel, click Data & personalization
3. Scroll to the Things you can create and do panel
4. Click Go to Google Dashboard
5. You’ll see Google services you use and a summary of data

You’ll see data from Google services you used while signed in to the account.  Note: not all Google services show up here.

Step 2: Find out more

1. Select a Google service, like Gmail or YouTube
2. You’ll see a summary of available data
3. From here you can take a few actions. (Note: these options aren’t available for each service.)
   1. To see the data in more detail, select it.  You’ll go to the service and see it there.
   2. To go to settings: on the bottom right, select more ፧ > Settings.  If this option isn’t available, go to the service and change settings there.
   3. To save a copy of your data: On the bottom right, select More ፧ > Download data
   4. To see more options, like finding help articles, select More ፧

If you are planning to use this information for legal purposes or need to understand the full scope of data available, it is recommended that you retain an experienced professional forensics expert to properly collect and analyze the data.  This will also help you with authenticating evidence for use in legal proceedings and avoid any appearance of evidence tampering and spoliation issues.

The following is a list of personal, business and developer Google Account services that may contain data relevant to your case.

Google Personal Account Services

• Android
• Android OS
• Calendar
• Cardboard
• Chrome Book
• Chrome Web Store
• Chrome
• Chromecast
• Connected Home
• Contacts
• Daydream View
• Docs
• Drawings
• Drive
• Earth
• Finance
• Forms
• Gboard
• Gmail
• Google Alerts
• Google Cast
• Google Chat
• Google Classroom
• Google Cloud Print
• Google Duo
• Google Expeditions
• Google Fi
• Google Fit
• Google Flights
• Google Fonts
• Google Groups
• Google Hangouts
• Google Input Tools
• Google Meet
• Google One
• Google Pay
• Google Photos
• Google Play Books
• Google Play Games
• Google Play Movie & TV
• Google Play Music
• Google Play
• Google Shopping
• Google Store
• Google Street View
• Hangouts
• Keep
• Maps
• Messages
• Nest Wifi
• News
• Pixel
• Pixelbook Go
• Play Protect
• Scholar
• Search
• Sheets
• Sites
• Sliders
• Stadia
• Tilt Brush
• Translate
• Voice
• Waze
• Wear OS by Google
• YouTube Kids
• YouTube Music
• YouTube TV
• YouTube

Google Business Account Services

• AdMob
• AdSense
• Analytics
• Android
• Assistant
• Blogger
• Chrome
• Data Studio
• G-Suite
• Google Ads
• Google Cloud
• Google Digital Garage
• Google Domains
• Google Enterprise Search
• Google Manufacture Center
• Google Maps Platform
• Google Marketing Platform
• Google Merchant Center
• Google My Business
• Google Shopping Campaigns
• Google Trends
• Google Web Designer
• Optimizer
• Search Console
• Shopping Actions
• Surveys
• Tag Manager
• Waze Local

Google Developer Account Services

• App Testing
• Cloud Computing
• Devices
• Engagements
• Game Services
• Growth
• Maps + Location
• Messaging + Notifications
• Monetization
• Payments
• Sign In + Identity
• Storage + Sys