Real life digital evidence leads to conviction

A suspect in a murder and arson case in Hartlepool, UK, was convicted and sentenced to 33 years after digital forensics helped secure his conviction. The suspect in this case had used Facebook VoIP calls, direct messages and updates from his phone to discuss his financial and narcotics activities around the time of the crime. The digital evidence produced by his phone and social media activity helped build an accurate picture of his movements and motives at the time of the crime.

Additionally, a second mobile device was identified and located thanks to data retrieved from his Google Cloud account using the first device’s security tokens. Read the full case study here.

Retrieval of the phone records was pivotal in this conviction, along with the insights gained from the way the phone (and its user) communicated and interacted with the cloud.

Mobile technology becomes central to modern life

It is well known that phones increasingly play an integral role in our daily lives. Beyond being a communications device for multiple channels (SMS, Facebook Messenger, WhatsApp, phone calls), it has become the ‘go-to’ camera device, local storage, and geolocator. Many users don’t realize that a great deal of their personal data is pushed to the cloud by default for backup while real-time interactions with online services are recorded by service providers operating in the background.

What this means for investigations

Law enforcement around the world know that accessing a suspect’s mobile device means that crucial and indisputable evidence can be retrieved to help solve cases faster. There are literally hundreds of cases worldwide where success has relied solely on digital evidence retrieved from the cloud, often via a phone or tablet.

Access and retrieval of critical evidence

Gaining access to a phone’s data is the first digital forensics challenge to overcome, as encryption or damaged hardware can present unique obstacles. Once access is accomplished, the gathering of relevant evidence is paramount to ensure local and external data is accounted for. Tokens stored on the mobile device must be identified to access external cloud accounts as well. Without cutting-edge digital forensics tools this entire procedure is a time-consuming process for investigators.

A variety of devices and data formats

As crime scenes can involve multiple suspects, victims and devices, a single case often requires data from many dozens of accounts and devices. There are also other media and text files to correlate and integrate into a suspect’s timeline. These can come in the form of call detail records, CCTV footage or cell tower logs.

Every step of the forensics workflow must also preserve forensic soundness to stay within the confines of the permissions granted by the local legal framework. Undertaking this scale of forensic investigation can be time and resource consuming without the type of solution and services that Cellebrite delivers.

Digital intelligence solutions to speed up time-to-evidence

Cellebrite has developed a range of solutions to get results in hours that would have taken months using other methods.

After using Cellebrite’s solutions to gain legal access to a suspect’s phone, Cellebrite’s Cloud Analyzer can leverage security tokens stored on the device to access a suspects or victims cloud accounts. This includes the two-way communication records from the phone to the cloud and to other individuals.

Timeline Table View: Display and filter time-stamped events to quickly understand sequence of events.

Additional data from social media and apps like WhatsApp communications is often accessible as data is backed up to Google Cloud, or Apple’s iCloud. Deleted messages and images can, therefore, be available for retrieval via the token on the device for those secondary services.

AI-powered Analytics to Surface Actionable Insights

Retrieved and collected data can now be introduced into the multi-source data ingestion engine of the Cellebrite AI-powered Analytics solution. Analytics is designed to help investigators quickly know what to focus on first, identify persons of interest, pinpoint their actions across media, and map their locations. Watch the Analytics Webinar: Harness the Power of Digital Data, to learn more.

When the Text Analytics capability scans all communication records, it’s machine-learning algorithm identifies and categorizes patterns and anomalies in a suspect’s online behavior. Analytics organizes this data into chronological and map views to identify a suspect’s movements, communications, and contacts relevant to a crime.

Media Analytics automatically detects and categorizes images and video frames related to key categories, such as child exploitation, weapons, money, drugs, nudity, documents and more. Digital investigators can now quickly identify persons of interest with advanced facial recognition and image categorization capabilities within the platform.

Serving Law Enforcement around the world

For digital forensics cases that are above and beyond current capabilities of law enforcement, Cellebrite offers Advanced Services that give agencies direct access to a pool of Cellebrite digital forensics experts with labs around the world.

Cellebrite’s combined digital intelligence solutions and services assist law enforcement agencies all over the world and helps speed up the time-to-evidence. What used to be slow and fragmented processes are now digitally enhanced workflows powered by artificially intelligence to stay one step ahead of criminals. Now, less cases go cold and more convictions happen, based on digital evidence and insights gleaned by Cellebrite’s solutions.

Cellebrite’s commitment to solving technological challenges for law enforcement is part of our ongoing mission to create a safer world.

To learn more about Cellebrite’s offerings, get in touch with one of the company’s global sales agents.