Old Wine in New Wineskins: How Remnant Data Challenges Forensics and the Law

Imagine buying a new storage device—a USB drive or maybe even a cheap SSD. The user connects it to their system and suddenly finds themselves having access to data that is left on the seemingly blank slate of the new drive. Farfetched? Not at all, as research has shown. Through recycling and refurbishing devices and especially storage chips, the phenomenon of remnant or reconstructable data on seemingly new devices has made its way to the general public. This begs the question of whom this data is attributed to: The new possessor of the device or rather a possibly unknown third party? This paper examines the possibilities forensic professionals have to recover and reconstruct data from remnants and fragments and what evidentiary value temporary and deleted files may hold. In a complementing legal discussion, the effects of a—possibly limited—evidentiary value are discussed. Special consideration is given to the following leading questions: First, how does one possess data? Second, how do cases like remnant data or file fragments influence the evidentiary value of forensic findings? And third, which conclusions can be drawn for forensic professionals, as well as the legal prosecution and defense?