Issue link: http://lawandordermag.epubxp.com/i/139048
SPECIAL REPORT The Value of Mobile Data in Criminal Investigations The Cellebrite UFED Touch ing Python scripting; regular expressions; and searches for strings, dates, codes, numbers, ICCID and SMS formats—to locate other user data missed and validate everything for a successful conclusion to the case. Nation's First Texting Homicide Conviction In Madison, Wisc., Detective Cindy Murphy, also a mobile forensics expert, testifed in the case of a young female driver accused of striking and killing a pedestrian while text-messaging her boyfriend. During this trial, the detective was able to refute the conclusion of a defense witness, who was untrained and inexperienced in the feld of mobile forensics. That witness had erroneously concluded that the defendant's mobile phone was not a reliable indicator of the order of text messages sent and received from the device. Fortunately, the jury had already heard Murphy testify how she had used the UFED Physical Analyzer to determine how deleted messages on that phone model could affect the text entries' order—resulting in a conviction for the driver. "In my experience as a criminal investigator, password protections and deleted text messages, pictures and call logs once proved to be major obstacles in relying on mobile data as a feasible source of evidence," Murphy commented. "Now, for crimes ranging from pedophilia to gang violence to human traffcking, we are able to use mobile data with a high degree of accuracy and integrity for convictions in criminal investigations. The impact has been signifcant for case clearance rates." These cases demonstrate the increasingly important role of mobile forensics in empowering investigators to gather and analyze cell phone data. As mobile phone usage increases, there is no doubt that stories like the ones above will become more common. Education, Training and Technology As Detective Murphy's story illustrates, the thorough investigations overviewed above would not have been possible if the experts behind them did not have the proper training. In order for law enforcement to adapt to the proliferation of mobile evi- 38 LAW and ORDER I June 2013 dence and prepare to testify about their processes in court, it's critical for organizations to invest in both technology and training as part of best practices. Two types of training support this. First, mobile-forensics technology vendors use tool certifcations to ensure that their solutions are implemented properly in the feld and support standard procedures for gathering and submitting evidence. Second, vendor-neutral training provides a well-rounded approach to the scientifc methods of mobile forensic evidence preservation, collection and analysis, including the validation emphasized by Detective Elder above. Either way, a strong training program should include a number of areas. First, hands-on technology demonstration, i.e., using technology solutions to connect to mobile phones and extract information without compromising the phones' integrity. Second, best practices for collecting and preserving digital evidence, both in real time from the feld and as part of the ongoing investigation processes. Third, processes for recovering hidden and deleted data: to retrieve information that may not be visible on the device, i.e., hidden within mobile applications or fle metadata. Fourth, instruction on analyzing extracted data: to ensure that forensic examiners properly validate and interpret the outcomes such that they can be entered as valid evidence in court. Powerful mobile forensics technology combined with consistent and up-to-date education and training for law enforcement will ensure that mobile data, and the methods used to obtain it, adhere to the Constitution's search, seizure, and due process requirements. Mobile Forensics in the Justice System "Lawmakers and judges are looking at cell phones much more critically than they did computers," said Gary Kessler, associate professor, Embry-Riddle Aeronautical University and a member of the ICAC North Florida Task Force. "However, because few understand the nature of the technology, they are erring greatly on the side of caution. This speaks to the need for greater education regarding the scope and possibilities of mobile forensics and what it means for privacy and pre-trial discovery." The case studies outlined here only scratch the surface on the important and growing role of mobile forensics in the modern justice system. As the usage of mobile data in criminal cases increases and more cell phones are submitted as evidence in court, it's clear that law enforcement must adequately prepare to handle mobile forensics and the technology that powers it. Christa M. Miller is currently the Director of Mobile Forensics Marketing for Cellebrite USA. LaO Post your comments on this story by visiting www.lawandordermag.com