Insurance claims depend on documentation. Photographs of the damage. Videos of the incident. Invoices, medical records, repair estimates, and communications between the claimant and third parties. Many of those documents retain metadata or structural artifacts that can help evaluate creation, modification, source, and whether changes occurred before submission.
Cyber Agents, Inc. works primarily with insurance defense counsel and carriers who need to know whether the documentation submitted by a claimant is what it appears to be. We have handled more than 100 insurance-related matters across Kentucky, Ohio, Tennessee, North Carolina, South Carolina, Michigan, New Jersey, Wisconsin, and beyond — insurance investigations, collision matters, wrongful death disputes, and commercial vehicle cases.
The metadata is the case
Most digital files or their surrounding systems retain some metadata, but the available fields and their reliability vary by format, source, and handling history. A smartphone photograph may contain capture time, location, device, and camera metadata, but fields can be missing, altered, stripped, or supplemented by editing and platform history. A document created in Word or a PDF generated from a native file contains timestamps for creation, modification, and printing — along with author information, edit history, and version records.
That metadata is often more informative than the file itself. A photograph submitted as evidence of storm damage, taken weeks after the storm at a different property and edited the night before submission, carries that history in its metadata regardless of what the image shows. A repair estimate backdated to fall within a policy window still carries the timestamp of when it was actually created.
We examine the metadata of every document and media file submitted in a claim. Dates that do not match the claimed timeline. GPS coordinates that place a photograph at a different location than represented. Edit histories that show a file was modified before submission. In one matter, a document submitted as a PDF was structurally inconsistent in ways that indicated it was not generated natively — the file format did not match what the claimed source would produce. In another, we examined a lease where geometric analysis of the document showed that edits had been added to a scanned original after the fact — the edited elements were square to the page in a way that original scanned content is not. In another, a set of submitted invoices appeared to be copies or scans of originals rather than native documents — itself a finding in a matter where document authenticity was at issue.
Metadata that has been stripped entirely is also a finding. Intact files retain their metadata. Its absence requires explanation.
How claimants should submit documentation
The single most common reason metadata is unavailable for examination is that it was stripped before the files reached the attorney.
When a claimant takes photographs on their phone and texts them, emails them, or shares them through most social media platforms, the platform strips the location data and often other metadata fields before delivery. The attorney receives a photograph with no GPS coordinates, no device information, and frequently an altered timestamp. There is nothing left to examine — not because the evidence was fabricated, but because the transmission method removed it.
The correct way to receive photographic and video evidence from a claimant is through iCloud or Google Photos. When a claimant shares media directly from their iCloud library or Google Photos account — through a shared album or a direct export — the metadata is preserved. The GPS coordinates survive. The original capture timestamp survives. The edit history survives. The file that arrives for examination is the file the device produced.
If you are an insurance defense attorney with a claimant producing photographs, instruct them to share via iCloud Photos or Google Photos and export the originals — not screenshots, not texted images. That single instruction determines whether metadata examination is possible at all. We are happy to advise on the correct collection procedure before the claimant produces anything.
Collision and accident matters
In collision and accident cases, device location in the window around the incident is often the most contested factual question.
We reconstruct device location and activity in the period immediately before and after a collision. Where was the device? Was it in motion? Was it being actively used? Was the claimant on a call at the time of impact? We generate location reports covering specified time windows — commonly one to two hours around the crash time — drawing from the device’s GPS logs, carrier records, and Call Detail Records. That reconstruction either corroborates the claimant’s account or it does not. Like a metadata timestamp, the data tells the truth whether anyone wants to hear it or not — either way, the record is established.
In commercial vehicle matters, we have reviewed driver log data alongside device data — identifying discrepancies between what the logs reflect and what the device shows about location and activity during the same period. Driver logs that do not match the device record are among the most significant findings an insurance defense attorney can bring to a deposition.
See also: Cell Record Analysis for CDR and carrier record methodology.
Wrongful death and wearable device data
In wrongful death and serious injury matters, wearable device data — Fitbit, Apple Watch, Garmin, and other health tracking devices — provides a baseline of the claimant’s physical condition before and after the event. We have accessed and analyzed wearable device data in civil matters to establish activity levels, sleep patterns, heart rate history, and movement in the period surrounding the alleged injury or death.
That data frequently changes the damages picture. A claimant whose wearable records show activity inconsistent with the claimed injury timeline, or whose device data places them in a different location at a relevant time, presents differently in litigation than what the complaint describes. We find those discrepancies and document them in a form usable in deposition preparation and trial.
Document authenticity examination
Beyond photographs and video, claims regularly involve documents whose authenticity is at issue. Repair estimates. Medical records. Contractor invoices. Incident reports. Correspondence with third parties.
We examine document metadata as a standard part of insurance litigation support. A document whose metadata places creation after the event it purports to document is not what it appears to be. A file submitted in one format that exhibits structural characteristics of a different format was not generated the way the claimant represents. Amendments or additions to scanned documents that are geometrically inconsistent with the surrounding content were not part of the original.
We also examine documents for signs of image manipulation. Photographs can be altered to show damage that was not there, to add objects to a scene, or to remove evidence of pre-existing conditions. The forensic signatures of image editing are readable by an examiner with the right tools — and those signatures survive in the file even when the visual result appears convincing.
Audio transcription
Insurance claims frequently involve recorded statements — claimant interviews, recorded phone calls with adjusters, recorded statements from witnesses, and law enforcement body camera audio related to the incident.
We transcribe audio for insurance litigation matters. Recorded statements that have never been reviewed in full become searchable, quotable, and comparable against the claimant’s written submissions. A recorded statement from the day after the incident that differs materially from what was submitted months later in the formal claim is evidence. We make that comparison possible.
Transcripts are produced in a format usable for deposition preparation, expert reports, and trial.
On-site device acquisition
Not every claimant can bring a device to our office. For matters where on-site examination is necessary — a claimant who is unavailable, a device that cannot leave the jurisdiction, or a carrier that requires inspection at a specified location — we travel to acquire device extractions in the field.
We have conducted on-site acquisitions at claimant residences, law offices, and third-party evidence facilities across multiple states. The extraction methodology is the same regardless of location. The chain of custody is documented from acquisition through analysis.
eDiscovery for large claim matters
Some insurance matters involve large volumes of electronic data — internal communications at a claimant company, years of email related to an ongoing business dispute, multi-party records in a major loss event. When the volume of documents at issue exceeds what can be managed through traditional review, we host and search the data in Relativity.
We apply the same cost-control methodology used in business litigation: filtering and culling the dataset before it enters the platform, validating keyword searches before committing to full review, and producing results in the format the attorney needs.
See also: eDiscovery Hosting for platform details and cost management approach.
What we examine in insurance matters
- Photograph and video metadata — capture timestamps, GPS coordinates, device information, and edit history
- Document authenticity — creation and modification timestamps, file format integrity, edit history, and structural consistency in submitted claims documents
- Image manipulation detection — forensic signatures of digital editing in photographs and documents submitted as evidence
- Collision and accident device data — location, activity, and communication records in the window around an incident
- Driver logs cross-referenced against device location data in commercial vehicle matters
- Wearable device data — activity, location, and health records in wrongful death and serious injury claims
- Audio transcription — recorded statements, adjuster calls, witness recordings, and body camera audio
- eDiscovery hosting and keyword search for high-volume commercial and subrogation matters
Starting an engagement
Most insurance litigation engagements begin with a specific document or set of photographs that the attorney suspects has been altered or does not match the claimed timeline. We can typically provide an initial assessment quickly.
If you want to ensure the documentation you receive from a claimant is preserved correctly for examination, contact us before the production deadline. The instructions we give for how to share media files take five minutes and determine what is examinable.
Related services and litigation support
Contact Cyber Agents to discuss digital forensic litigation support for your matter.