20 CHAPTER 3 Digital Forensics: The Subdisciplines examining the data available in GPS units, it is possible to estimate how fast someone was driving, and if they made any stops and for how long. If a person is suspected of a crime, GPS records can be helpful in determining if that person went to the location where the incident happened, whether they were ever near it in the vehicle, or if the timeframe even allows for the possibility of that person being a suspect. For instance, assume that a suspected person is accused of committing a murder at one location, and then dumping the body at another within a one-hour timeframe. If it takes an hour and a half to drive the distance from the scene of the incident to the location of the body, the plausibility of that argument based on GPS records takes a serious hit. However, it is also important to note that GPS units and GPS tracking are not perfect. There are situations where the recorded data can be highly suspect and have no correlation to the actual location of the GPS device. This can happen when a GPS unit's information is being collected by a third party and errors creep in due to data errors in the transmission of the GPS unit's locations, faulty GPS devices, and areas where the GPS unit may not have a clear view of the sky. 3.2.4 Media device forensics Digital music players, digital audio recorders, personal data assistants, USB thumb drives, portable hard drives--these are media devices. The examination of media devices can provide useful data, including the files that exist on them and the recov- ery of deleted files from these devices. When they are plugged into a computer, these devices also leave information about themselves, such as the files that have been transferred to or from them and the time and date when these transfers took place. There are many possibilities of finding data of evidentiary value on media devices. For instance, on a digital audio recorder, deleted audio recordings can be recovered. A music player, like an iPod, can be used like a portable hard drive to steal or hide data. Just because these devices might be designed with the intention to play music or keep up with your calendar, at their base level they are still storage devices, and most function exactly like a normal hard drive when connected to a computer. 3.2.5 Social media forensics The past decade has seen an explosion of interest in the number and popularity of social media websites and programs. Programs like MySpace, Facebook, Twitter, and LinkedIn are commonly used social media outlets. It is common for people to have accounts with multiple social media outlets. For instance, someone might have a Facebook account to communicate with their friends and family, and a LinkedIn account to keep up with their business associates and other profession- als. Social media has become the preferred method of communication for many,