How To Solve A Violent Home Invasion With A United Force

Transcription

1 Use Case SOLVING VIOLENT CRIMES WITH A UNIFIED WORKFLOW In a Violent Home Invasion Investigation, the UFED Series Seamlessly Unifies Workflows from Field to Lab A series of violent home invasions has everyone in a community, police included, on the edge. The investigators know they need to tie these crimes to an underlying motive, which experience has led them to suspect involves narcotics, gang or other organized criminal activity. Under pressure from the mayor, city council, media, and residents themselves, the investigators are prepared to deploy the right tools to identify key evidence from social media, mobile device data, detailed call records and other sources and to put a stop to the crimes. 1

2 In progress: Home invasion with assault Patrol officers respond to the scene of a Saturday night home invasion robbery with assault in progress. They apprehend two suspects fleeing the home on foot. As officers take them into custody, one of the suspects manages to throw his smartphone to the ground and crush it with his foot. Officers seize the other suspect s smartphone without incident as they are taking both individuals into custody, and they separately bag and tag each device as evidence. In the field: Background investigation Statements from the two victims, in which both independently confirm the suspects talking to each other about someone named Jiggy, lead officers to believe that the suspects were not acting on their own. Officers think this incident is another in the series of home invasions they ve been responding to. 2

3 At the station: The initial search Officers obtain a search warrant for the undamaged device and use a UFED Camera to photograph both devices as part of their evidence intake process. Based on collected statements, the officers warrant empowers them to bypass the device s password and search for all communications data, including call logs, text messages, and app data from the past week. Developing the first leads After bypassing the suspect s password, the UFED InField search reveals: A set of messages, which appear out of context or out of sequence, using a popular messaging app to communicate with Jiggy. Officers believe some messages have been deleted. Photos of the victims home from various angles. A series of call logs showing both sent and received calls from four other numbers. Officers compile their extraction report in UFDR format and submit it, together with the victims statements, their reports, both devices and the photographs, to their digital forensic lab. 3

4 At the lab: The follow-up search The forensic examiners validate the officers UFDR report using UFED Ultimate. They then obtain additional search warrants for each mobile device to extract deleted data and geolocation metadata from the same time frame, one week previously, as the original search warrant. From the undamaged device, examiners recover deleted message fragments from the messaging app and geolocation data consistent with not only the images of the home, but also with prior incidents. 4

5 Overcoming the challenge of a damaged device Examiners are able to extract data from the damaged device using JTAG methods. Decoding the data in UFED Physical Analyzer, they find: A clear link between the two suspects in the planning of the home invasion. Examiners notice that the address number is transposed in several of the messages sent by the second suspect. Additional fragments of messages with Jiggy via a different social media app. The messages include drug dealers lingo, but they are incomplete, and the provider is known to be hostile to law enforcement legal process. The examiners warn investigators that there is a risk the provider will not supply the messages at all, leaving the case without critical evidence. Developing the first leads Now believing this to be a case of mistaken identity, the officers obtain a new search warrant to use social media account credentials on both devices. UFED Cloud Analyzer shows that the social media messages with Jiggy explicitly refer to drug deals. They provide probable cause to arrest that individual, who investigators learn is a dealer in a neighboring community. Search warrants on his devices provide the final context for the case. 5

6 Building the case Using UFED Link Analysis, investigators are able to show how the three suspects are tied together in the coordination and execution of six armed robbery/home invasions. Clear patterns of communication show Jiggy, an alias for the mastermind, giving orders to the two subordinates to hit particular houses. Mapping the subordinates geolocation data shows them casing the homes in the days leading up to the robberies. In addition, Jiggy s private social media posts show his paranoia and motivation to dominate the drug market in the region. 6

7 Taking criminals off the street The investigators are able to build a solid case against all of the suspects for the armed robberies, assaults, and drug distribution. Leveraging UFED Reader, they present the entire case to their prosecutor, detailing a timeline of robbery-related events over a period of three months. In turn, the prosecutor charges all three suspects with multiple felony counts. This takes them off the street and puts an end to their criminal activities. The UFED Series delivers the most comprehensive mobile forensics extraction, decoding and analysis capabilities on the market, empowering investigators to unlock critical mobile device evidence and focus their investigations on the leads that matter. By leveraging the UFED Field Series and UFED Pro Series together as part of an end-to-end solution, law enforcement agencies can simplify complex analytical tasks, cultivate more leads in less time, and present evidence they can stand behind in court. About Cellebrite Cellebrite is the world leader in delivering cutting-edge mobile forensic solutions. Cellebrite provides flexible, field proven and innovative cross platform solutions for lab and field via its UFED Pro and UFED Field Series. The company s comprehensive Universal Forensic Extraction Device (UFED) is designed to meet the challenges of unveiling the massive amount of data stored in the modern mobile device. The UFED Series is able to extract, decode, analyze and report data from thousands of mobile devices, including, smartphones, legacy and feature phones, portable GPS devices, tablets, memory cards and phones manufactured with Chinese chipsets. With more than 30,000 units deployed across 100 countries, UFED Series is the primary choice for forensic specialists in law enforcement, military, intelligence, corporate security and ediscovery. Founded in 1999, Cellebrite is a subsidiary of the Sun Corporation, a publicly traded Japanese company (6736/JQ) To learn more, visit For more information contact sales 2015 Cellebrite Mobile Synchronization LTD. All rights reserved. 7