Digital Forensic Case Study

Case solved by Northwest Ohio Technology Crimes Unit (NOTCU) using Mobile Phone Examiner Plus (MPE+)

Smartphones, mobile phones with more advanced computing capabilities and connectivity than regular mobile phones, came onto the consumer market in the late 90s, but only gained mainstream popularity with the introduction of Apple’s iPhone in 2007. Today,their are around 6.4 billion smartphone sold till date and growing!!!!!

Such alarming smartphone sales also comes with increase in mobile device Crimes.Nowadays we have dosens of smartphone makers having their own custom operating systems.This is good for consumers but it’s huuuuuuuuge problem for Mobile Forensic Teams worldwide.

It becomes difficult for Mobile Forensic Teams to cope up with such situation. Not because of workload, but due to the multitude of mobile forensic solutions on the market today coupled with the inability to keep up with advances in mobile device technology .

“You cannot put dollars and cents on cases we process. The ability to take these criminals off the street for us is priceless.”–Sgt. Terry Sneary Digital Investigator, Northwest Ohio Technology Crimes Unit (NOTCU)

Child Predator Case solved using MPE+

In a one criminal case involving sexual exploitation of minor. Sgt. Sneary was tasked with processing a suspect’s iPhone® 4. Suspect used this phone to communicate with victims in this case, as well as to store sexually explicit images of victims.

1. collection

   • To recover data from victim’s iphone Sgt.Sneary used Cellebrite UFED® along with MPE+

2. Examination

   • As per NIST framework Data obtained from one tool should be validated by other similar tool. In this Case data obtained by Cellebrite UFED® should be validated by MPE+®

3. Analysis

   • Sgt.seneary determined the suspect utilized the application textPlus to communicate with suspect.He was able to retrive messages sent via the textplus application using MPE+ SQLBuiler.He was able to access application’s SQL database. Additionally, in processing the suspect’s iPhone 4 with the Cellebrite UFED, Sgt. Sneary utilized MPE+ iLogical support for iOS® devices to validate the Cellebrite findings.

4. Reporting

   • Using MPE+ he was able to present the textPlus messages in a readable format for the jury to see.
   • Sgt. Sneary recovered a deleted picture the suspect took of one of the minor victims. In the picture, the suspect’s face was visible in the background of the image as a reflection in a mirror. This recovered picture as well as the textPlus messages recovered with MPE+ SQLBuilder would later be the key evidence presented at the suspect’s trial.

References

access data