In the nighttime hours of Dec. 29, 2010, someone made a Google search from an Acer desktop computer in Baltimore, Maryland: “Can you track a cellphone GPS if it isn’t on?”

One day before the Google search, 16-year-old Phylicia Barnes, an honors student from North Carolina who was visiting relatives in Baltimore, went missing. A few months later, on April 20, 2011, her body was found in the Susquehanna River. Her death was ruled a homicide.

Prosecutors charged Michael Johnson, an ex-boyfriend of Barnes’ sister, with murder in April 2012. He had two trials between 2012 and 2015—a jury convicted him, and a judge later acquitted him, but both verdicts were overturned.

During Johnson’s third trial, an FBI digital forensics analyst told the court that the Google search on the night of Dec. 29 came from the Acer computer taken from Johnson’s residence, and that an administrator named “Mike” was logged in at the time, WBAL reported. Prosecutors said that Johnson had turned his phone off at certain points on the day of Barnes’ disappearance; they attempted to guide the judge to connect the dots between Johnson’s phone, the Google search and Barnes’ murder.

This digital tidbit was just one piece of many pieces of evidence presented at the trial, much of which was circumstantial. In the end, the judge was not convinced—he acquitted Johnson for a second time, and this time, the decision could not be appealed.

The Google search—and other digital evidence—presented at this recent trial was just one example of a digital artifact that investigators and prosecutors can use to build a picture for a jury or judge of what happened, or what a certain person did. In this case, the defense disputed the prosecution’s narrative, saying the computer was “always logged on” and that any one of the 12 people who used it could have made that search.

This week, I spoke with Brian Dykstra, president and CEO of Atlantic Data Forensics, who has worked in digital forensics for over 19 years and has analyzed this type of evidence firsthand in cases ranging from civil suits to murder trials. Dykstra stressed that just one Google search doesn’t represent the full picture of what happened on that computer on that day.

“There’s a lot of different data points. So as a forensic examiner in those situations, you have to make good use of all those other little forensic artifacts that can tell you what was going on at the computer at that time, to give you an idea of who was actually doing the activity,” he said.

Removing Doubt from Digital Questions

The prosecution argues that the defendant made an incriminating Google search—the defense counters that anyone could have walked up to the computer at that time and made that search, even from the defendant’s account. How can a judge or jury know who really made the search?

“Say I have a Google search that’s, ‘How do I hide bodies?” (…) As a forensic investigator you have to look at what else was going on at the computer at that time,” Dykstra explained. “So for example, if there’s multiple accounts, who was logged in at the time? Does that account have a password? Was there a Gmail account, a Yahoo account or anything else like that at the time being accessed?”

Perhaps one Google search from a multi-user computer could have come from anybody—but when the digital evidence unveils a swarm of other online activity, social media activity and communications that line up with a prosecutor’s assertion that the defendant was the one sitting in front of that computer on that day, the prosecution’s case can become much more convincing.

“There’s almost always four or five other activities that you can show that it was this individual specifically. It’s much harder for a defense attorney to go ‘Well, yeah we know he logged into his Gmail account but it was compromised. And yeah we know he logged into his Fitbit account but it was compromised,’” Dykstra continued. “It starts to sound suspicious. So you’re saying four different of your accounts were all compromised in between the time that you did this ‘where to hide a body’ search? That sounds shaky.”

Alternatively, a defense attorney could use this full picture of online activity to prove someone other than their client made the search. A thorough forensic examination will unveil the truth, no matter which side it favors.

Following the Path of Digital Footprints

The digital world is so intertwined with the real world that our digital lives create something of an imprint that can tell investigators what was going on in our real lives. They can learn about our hobbies and interests by seeing what sites we went to, learn about our relationships by looking at the connections on our social media profiles—and know at which times we were alive and safe based on the fact that we were actively logged in and posting.

In Phylicia Barnes’ case, prosecutors showed Facebook activity from Barnes’ laptop ongoing from 10 a.m. to 11:31 a.m. on the day of her disappearance, which then abruptly stopped until one last post was made 45 minutes later. The prosecution presented this evidence because it matched their proposed timeline of the crime—they suggested the halt in activity represented when she was harmed, and even suggested the later post was made by someone other than Barnes due to its use of a question mark, while most of her other posts did not include punctuation.

The defense however showed documents from Facebook proving that she had been using Facebook’s Messenger until 12:40 p.m.—data that hadn’t synced to the laptop’s hard drive but still existed in Facebook’s records. In this case, the fuller picture of activity worked in the defense’s favor. Dykstra said it’s usually prosecutors who have the upper hand, due to their ability to get a court order for websites like Facebook and Google to provide them with all of this information, but defendants can still have access to that evidence once it’s made available.

“(Prosecutors) can get a court order, and Facebook will dump out for them the entirety of the victim’s Facebook account, with all the dates and times and who posted what when, and IP addresses, so if they suspected that they posted from another location or something, all that data would be there and available to them,” he explained. “I’ve used it before in murder cases where the prosecution has requested that data. We’ve got it, we’ve looked at it and in that case I was actually able to show that my client hadn’t made certain posts that they claimed to be his, because we had the entirety of the Facebook dump—everything they’d ever written, edited (and) communicated.”

With a full set of digital footprints, it’s much easier to tell who stepped where than when you only have a partial picture. And following these footprints, investigators can trace a timeline, and hopefully find a path to the truth.

“That’s really what folks ask from forensics people,” Dykstra said. “’What happened here?’ And you have to tell them a story that you can validate.”