#556: Hidden Data: What Lawyers Need to Know About Digital Forensics, with Cole Popkin

Episode Notes

Transcript

ack Glaser:

Hi, I’m Zack, and this is episode 5 56 of the Lawyerist Podcast, part of the Legal Talk Network. Today’s episode is a little different than usual. It was recorded live at a tech show, 2025, where I have the chance to speak with a wide range of experts and innovators in the legal tech space. You’ll notice the format is a bit more on the ground and conversational, and that’s intentional. We wanted to capture the energy of the event and bring you into some of those real time conversations as they were happening. Now my guest today is Cole Popkin, a digital forensics senior analyst at Proven Data. Now, if you hear digital forensics and immediately think not my area, I encourage you to stick with this one. Cole typically works with attorneys in personal injury and family law cases where recovering deleted text messages. Analyzing metadata or examining timelines of digital activity can be critical, but what he shares in this conversation applies much more broadly than that.

So whether you’re in litigation, transactional work, or running a small firm with a growing tech stack, understanding the basics of digital forensics can help you better protect your clients and yourself. We talk about the kinds of information that can still be pulled from devices even after it’s been deleted. Why encryption isn’t always a safety net, and how surprisingly easy it can be to leak client data without realizing it. Cole also shares some simple practical steps you can take to secure your devices and digital communications. Now, this isn’t a doom and gloom security talk. It’s a realistic, lawyer friendly look at how to be smarter about the tech we already use every day. As lawyers, we have an ethical obligation to safeguard client information, but many of us don’t know what’s really happening under the hood of our devices. This episode is an opportunity to learn from someone who does. You don’t need to become a forensics expert, but understanding what’s possible and what’s at risk can help you be a better steward of the trust your clients place in you. Now here’s my conversation with Cole Popkin.

Cole Popkin:

I’m Cole, and I work as the team senior digital forensic Analyst at Proven Data.

Zack Glaser:

Cole, thanks for being with me. So proven data forensics analysis. What is this? What are we talking about here?

Cole Popkin:

Yeah, great question. So my montage that contains data, it can be analyzed, it can be analyzed, it can be used for you against you in court. Let me use it for you. So we will analyze anything from phones and computers to video files. Audio files are kind of the main four, but then even we’ll do more niche types of things such as email, forensics, PDF forensics, Excel forensics, even getting into some vehicle forensics, so anything that contains data, which is pretty much everything these days.

Zack Glaser:

Yeah, absolutely. So I think a lot of litigators, a lot of people in the family law area would understand what that forensics really is, but can you give us an example of what we’re talking about, why we would need our digital data forensically analyzed?

Cole Popkin:

Yeah, absolutely. So I mean, bottom line is, especially in the criminal defense field, everything contains data. So if law enforcement is prosecuting something, there’s a good chance the phone is going to be a part of that evidence. Oftentimes, it goes so underutilized for what it can actually be accomplished with analysis. So for example, I’m actually working a case right now where someone’s accused of an armed robbery and we’re able to build out a timeline, and then I think the incident happened at X time, but we’re able to get location data that he was, I think an hour and a half away, 30 minutes before that. So there’s no logical way that he could be there. But I mean, it’s not clear to people who don’t know how to interpret the data that’s with it, and unfortunately, law enforcement is so backed up with every case, not able give each one the attention it needs. So that’s kind of where third party companies like us come in and fill in those gaps.

Zack Glaser:

So you are able to take information from the person’s phone and determine where at the very least that phone was located?

Cole Popkin:

Yeah, I mean, there’s a couple of different ways you can do it. We’ll do stuff from, we’ll also utilize cell phone towers, wifi logs that are with a business or a home or something like that, and kind of build up that timeline.

Zack Glaser:

Okay. Okay. We’re talking about phones, we’re talking about computers, we’re talking about email. You said something about cars.

Cole Popkin:

Yeah,

Zack Glaser:

This is fascinating to me because I get into rental cars and I see it and it says, do you want to connect your phone to this thing? And I’m like, hell no. Right?

Cole Popkin:

Yes. You never know what’s going to happen with

Zack Glaser:

That. So talk to me about that. What kind of information can you get out of a car?

Cole Popkin:

So this kind of comes more involved with our personal injury lawsuits that we’ll work with. It’s kind of the predominant area of these come into play. I mean, super old ones, they don’t contain as much electronic data, but people don’t realize how much is actually being stored in a car. So not just location data, but speed even. We will do a few stolen vehicle cases, and then we’re able to determine the Bluetooth address of the phone that you were talking about a second ago and show, well, the phone was connected to the car at this point in time and it was stolen that exact same day. We need to look for where is this Bluetooth address from? So it’s all types of things you can get. Burla is kind of the main tool that we’ll use for that. And then as well as we kind of do some of our own custom scripting to interpret the data.

Zack Glaser:

So what is burla?

Cole Popkin:

Yeah, Burla is kind of the leading tool for vehicle forensics right now.

Zack Glaser:

So kind of plugs in, I assume, and this is just for me, changing the oil in my car plugs into the computer. Does it plug into the same area? Exactly.

Cole Popkin:

It’s a pretty lengthy process of, I mean, there are some that you can just plug it in and download and there you go. Other ones you kind have to take out the head unit and then sync all the data from that.

Zack Glaser:

That feels a lot more professional as opposed to me just kind of getting up underneath.

Cole Popkin:

You can’t really use Chris Fixit for this type of thing. He’s a great YouTuber for if you need a car fix, but you need to have a little more specialized training with your breaking down a vehicle with

Zack Glaser:

That. Yeah, okay. So we can kind of tell where somebody is time sort of entries the speed and things like that. So I can see this being in PI cases pretty nicely, but we’re also talking about the information on your phone. So I’d like to dig into this a little bit more, please. About what kind of information, when I think about, oh, we quote search somebody’s phone, let’s say, I think text messages. So yeah, that’s going to be there, but what other information, what other kind of information can we get out of the

Cole Popkin:

Phone? That’s a good question. I remember I was doing, this is when I was with state police doing contract work. There was one case where someone was accused of violating their probation, and so we were able to go through the text messages and we saw a bunch of text messages that were received, but none that were actually sent. So technically the person was trying to get him to violate the parole order. And then around that same time, I’m looking through the search history and it’s the person that I have a restraining order against is texting me, what do I do? And it’s like 3:00 AM So I mean, it could be a ploy, but he’s probably really stressed. So there’s this other types of evidence that you can take into account with that. So browser history, call logs, I mean even social media apps, Fitness Trackers, all of that contains more data that you can parse out and organize to create a case.

Zack Glaser:

Okay. So I’m, man, the mind reels with this. The

Cole Popkin:

Possibilities are endless. It’s Incredible.

Zack Glaser:

Yeah, they really are. Because I wear a Garmin watch a lot, and that’s connected to my Phone. And that is connected to some app online. And I actually tell, I tell my kids that I coach cross country, I tell them to make their Strava account

Cole Popkin:

Private,

Zack Glaser:

But then I challenge them to go find my house based on my Strava account because I want to scare them into this. And so here, right now, I want to kind of scare attorneys into being thoughtful about the security of their phones. So what are some ways that we can protect ourselves as an attorney? Let’s flip this around from, I can get a ton of data to how can I make sure that my data is safe in that area?

Cole Popkin:

I think probably one of the biggest things you can do is have a personal phone and have a work phone that’s going to limit a lot of liability. That’s going to be your way if your personal device is breached, going to be open to a worldwide type of things. Whereas if your work phone is breached, then you have something else. I mean, it’s not entirely on them at that point.

Zack Glaser:

Yeah, no, this makes sense to me because my father always told me when I was writing things as an attorney, he’s like, right as if this was being brought up in court, as if this was evidence in court. And so I think about our things as attorneys as it could potentially be subpoenaed. And if my personal phone is my work phone, then we’re not even talking about a breach. We’re talking about I had to hand this over to somebody and now we have forensic analysis on my personal phone. And so separating those two things into work and personal phone sounds like a really good idea.

Cole Popkin:

It is a good idea. We’re in the middle of a lawsuit right now where the client that we’re representing, her attorney actually got breached attorney in New York, a mid-size law firm, really competent attorney as well. Part of the job is to go through the attorney, see if they seem competent. And then every case that I’m reading about her, she seems like she knows what she’s doing, but there was a cybersecurity issue. They didn’t have the best, what seems like email hosting service, and then it allowed for her actual email to be breached. And even another type of scam that I’m seeing more frequently is, so for example, our company name is Proven Data. So my email is Cole at Proven data. There could be a scammer out there that has Cole at PROV dash NDA t.com. Always make sure you’re checking the email domain as well. That’s where, I mean, so many of the scams come from is from that false domain.

Zack Glaser:

Yeah. Okay. And that potentially lets somebody get in and now

Cole Popkin:

They didn’t have to be into the network at that point. At that point, they’re then speaking with the client, and then they’re able to basically route all communications to them, especially if they’re avoiding phone calls type of thing. They’d have no way. The client has no way of knowing. So you got to make sure you’re checking the email domains at least regularly, even just having, I know it’s a pain, but having longer email threads is a good practical way to determine as just the same person that I’ve been emailing with back and forth

Zack Glaser:

I see. As opposed to creating a new thread and saying, I’m going to go email Zack.

Cole Popkin:

I’m not saying don’t create a new thread, because sometimes you have to, but when possible,

Zack Glaser:

And just as a tangent, I like taking those conversations off onto teams or something like that.

Cole Popkin:

Absolutely.

Zack Glaser:

Right. Okay. What is your favorite thing that you can kind of grab from this digital data that you think, oh, people don’t know that this is being tracked?

Cole Popkin:

That is an awesome question. So I’ll tell you about a case that we just trapped up last year. So it was an armed robbery case at a gas station. I think it was like 2001, the person who was convicted of the crime, and this comes into play in a second. His height is five six.

Zack Glaser:

Okay.

Cole Popkin:

Now that we analyze the video, we’re actually able to, through a lot of math and calculations and forensics work, we’re actually able to determine the height of the person in the video. So in this case, the person in the video holding the gun, holding up the gas station was actually, it was a range of five one to six one. So there’s no plausible way unless he had some really high heels on, which is pretty impractical. So people don’t realize the 3D measurements that is available. I mean, bottom line is video forensics has come a long ways, but there’s still just so many cheap options for security cameras. There’s very little a video forensic analyst can do, but there’s almost always an opportunity to do expert measurements in the video. So that’s where I think it’s, especially in the criminal defense field of someone says, that’s definitely not me in the video, but facial reconstruction isn’t going to be super practical in a video. So height is a huge way to determine if it is someone from a law enforcement perspective, but even if it isn’t someone from that defense attorney perspective,

Zack Glaser:

That makes a lot of sense. Because I think of CSI, New York or whatever, and everybody’s sitting at the computer and they’re saying, enhance, enhanced,

Cole Popkin:

And I’m like, bullshit. I wish that that could be it, but it’s actually scroll, fix this pixel, fix that pixel, and then fast forward five or six hours.

Zack Glaser:

But we can still get some practical things. Yeah, we’re not going to enhance. And then it’s like, oh my God, that person has a mole on their left cheek. But we can say that person is either six one

Cole Popkin:

Absolutely

Zack Glaser:

A range,

Cole Popkin:

Like you say. Right? Or even brightness filters to determine race and license plates usually has one of the higher success rates with things. And even if you only get four or five characters, you can get the make and model of a car you’re usually able to pinpoint with a PI database or something like that. We use, I I core for those types of things, you can usually figure out who the vehicle kind of actually belongs to.

Zack Glaser:

Yeah. Okay. Man, this is, it’s a whole

Cole Popkin:

Opening, fascinating world of possibilities out there. I don’t even know all of them. And even practically speaking, forensics, this is more an opinion than a hard, fast fact, but has really only been around for maybe 25, 30 years.

Zack Glaser:

You mean this digital forensics? The digital, sorry. Digital forensics.

Cole Popkin:

So I mean, especially with the rampant rise of various types of, everything’s digital now, right? I mean, we’re still figuring out new ways to parse through data, and when I say parse, it means use it to analyze it for court.

Zack Glaser:

Okay. Awesome. Yeah. Awesome. Well, cool. Thank you. This has been, like I said, eye-opening. Fantastic. Thanks so much for having me. How do people get a hold of proven data?

Cole Popkin:

Yeah, absolutely. I mean, just feel free to go to our website. I’m sure you can link it somewhere. Feel free to reach out to me directly. My work phone is (616) 214-0540, and then feel free to email me at Cole at proven data as

Zack Glaser:

Well. Awesome. And that doesn’t have the weird hyphen in it.

Cole Popkin:

No, it doesn’t. Yes. That’s my authentic one. So if you see something that’s not that domain, it’s not me.

Zack Glaser:

Fantastic. Well, Cole, thank you for being with me. I appreciate it. Thanks

Cole Popkin:

So much for having me. I appreciate it.

Continue Reading