Digital Footprints

Sypnosis

Police respond to a shooting outside a neighborhood convenience store and learn the shooter was lurking in the shadows prior to the incident. The investigation turned toward a man who lived two blocks away. Investigators believed the man walked from his second story apartment to the crime scene then returned to his apartment after the shooting. CDRs and the suspect’s cell phone were obtained by the investigators. As the case progressed, prosecutors sought a full review of the data.

Our Role

The prosecution retained Hawks Consulting to conduct an in depth analysis of all the digital evidence in the case. CDRs were not useful given the proximity of the suspect’s apartment to the crime scene. Our focus was on the Full File System extraction of the Apple iPhone.

Technology Involved

Apple iOS Full File System extraction

Wi-Fi logs

Apple Health

Device Logs

Key Findings

The Wi-Fi logs revealed disconnection from the home router shortly before the suspect was first seen on camera as well as reconnection to the router shortly after the shooting.

Full File System extraction provided valuable nuanced detail of the events leading up to and following the incident.

Apple Health data revealed steps that corroborated the video surveillance as well as the suspect climbing a flight of stars when he returned to his apartment after teh shooting.

There was no evidence that the man was at the location he claimed at the time of the alleged theft.

Outcome

Going beyond the question of “was the phone in the area” led to a granular understanding of the suspect’s movements prior to, during, and after the shooting.