Making Mobile Data Work Harder, Solve Cases Faster
Written by Sheila Gil   

Today, most bad guys don’t commit crimes using computers. They’ve all gone mobile. Smarter, more powerful mobile devices yield a potential treasure trove of evidence for investigators and prosecutors alike. Critical details from browser history searches, messaging apps, call logs, and social media posts often reveal what suspects and victims were doing before, during and after a crime was committed. It has never been more important to have the right mobile forensics tools at the ready.

See this article in its original format in the Digital Edition!


This article highlights the critical forensics needs of forensics examiners and investigators in the Boulder (Colo.) Police Department and Hartford (Conn.) Police Department. These real cases illustrate critical needs and compelling outcomes with access to advanced mobile forensics tools.

Mining Leads from Mobile Minded Criminals in Boulder

During the first few hours or days of an investigation, the ability to mine leads quickly matters. Finding additional witnesses, placing people in the same place at the same time, and revealing communications between suspects and victims or corroborating statements can mean the difference between an investigation moving forward—and not.

“Mobile device evidence plays a critical role in almost every investigation we conduct, helping us solve the simplest to the most complex criminal cases,” said Det. Chuck Heidel with the Boulder Police Department.

Within mobile device data lies the connections that can reveal the intent and motivation behind many crimes.

“Up until a year ago, the process to uncover them involved hours and days of tedious and manual analysis, and even then they could go undiscovered,” he said. “Today, thanks to investing in the industry’s leading link analysis tool, we have the ability to visualize and cross-reference data quickly and effectively.”

In just six months after its implementation, the 25-detective department saved tens if not hundreds of hours in investigative time by integrating the tool into their forensics workflow.

Speeding Investigations

In one investigation involving a burglary that ended in homicide, linked data didn’t break the case, but the two suspects involved pled out when the data revealed the strength of the links between them, as well as corroborated statements from witnesses placing the subjects together the night before, potentially planning the crime.

While the impact of this capability has certainly expedited time-sensitive cases in Boulder, it has also proved useful in longer-term investigations. In late 2014, the city experienced a rash of unattended deaths attributed to heroin overdoses. After obtaining extraction reports from the forensics lab on each of the victim’s mobile devices, investigators imported the data into a link analysis tool and quickly discovered mutual connections to the heroin supplier – and the supplier’s supplier – which led to their arrest and charges for manslaughter and negligent homicide.

“As a detective in a very busy agency division, I’m always looking for ways to improve our collective productivity without adding time or effort to already considerable workloads,” said Heidel. “Having access to the right mobile forensics tools translates directly to better law enforcement outcomes: cases closed in a timely manner, public safety restored, and justice served.”

Making Mobile Device Evidence Count in Hartford

One of the Hartford Police Department’s biggest mobile device data challenges involves accessing constantly changing mobile messaging applications. Sgt. Andrew Weaver credits the department’s mobile-forensics vendor with keeping up with these changes, so they don’t become a stumbling block in investigations.

“When we run across a phone that’s difficult to unlock, or an application we can’t parse, they are there—often well beyond normal office hours—to walk me through the steps required to get to the data effectively and securely,” he said. “There’s not many challenges we haven’t been able to solve together, whether I had issues getting around a device lock or recover data from a specific application.”

Maximizing Forensic Investments

In public safety, budget dollars are thin, according to Sgt. Weaver. “While we compete with others to add to our forensics toolbox, having proven solutions and ongoing support makes it easier to justify,” he said. “At the end of the day, we need one or two excellent solutions to get the mobile data investigators need to speed their investigations.”

Time is the enemy of criminal investigations. Getting potential evidence out of mobile devices can shave weeks off of the investigative process and often lead to suspects pleading out to avoid more severe sentences in court.

“We had a case recently where a guy came in with his tablet, saying his roommate was using it to access child pornography and was worried he could get in trouble for it,” said Sgt. Weaver. “With his consent, we dumped the tablet data and confronted the roommate with the evidence and he pled no contest to the charges within three weeks. That’s the kind of force multiplier advanced forensics capabilities can have on a case. It simply changes the game.”

Navigating a New Normal

The clock on criminal investigations is always ticking. Every minute, mobile device generated data gets bigger and more complex, yet the demand to solve crimes quickly stays the same. Investigative teams at agencies everywhere need actionable leads, faster.

About the Author

Sheila Gil serves as the senior director of Global Forensics Product Marketing at Cellebrite. Sheila has deep industry experience and has been working in public safety marketing and product management for more than 15 years.

< Prev   Next >

Interview with an Expert

One of the more specialized areas of crime-scene investigation has to do with searching for evidence of arson. To get some background in this area, we spoke with an individual who has had more than 46 years in fire service, 24 of which have focused specifically on fire/arson investigation.