Did Law Enforcement Give You All The Data From the Mobile Phone?

It is important to have a competent forensic expert advise you on whether or not you need to ask for a forensic image that contains more data. Additionally, if law enforcement did not create the right type of forensic image of the defendant’s phone, it may be necessary to ask for the device to be shipped to another law enforcement center with the capabilities to create a physical image of the phone. Cell phone data is often used as evidence in criminal cases, and prosecutors often rely on forensic images of the defendant’s phone to make their case. However, the way in which a forensic image is created can affect the amount and type of data that is captured. For example, a forensic image may only capture text messages, leaving out other important data such as WhatsApp, Snapchat, Instagram, or Facebook Messenger messages. Often times we are faced with cell phone data being used by the prosecutor.   The typical scenario presents itself where the defendant’s phone is in police custody and a forensic image was created and then a subsequent report generated that is most likely created by a tool called Cellebrite UFED.   What most don’t know is the forensic image created can be made in a way that only captures part of the data and that depends on many things such as the selection made by the person creating the forensic image, the licensing available to the technician or the need within the case. In order to explain, let me introduce to you a common scenario.   The defendant is charged with sexual assault and the alleged victim gave a statement that she received a text message from the defendant.   Law enforcement may capture only text messages when creating the forensic image and then create a Cellebrite Reader Report of only the text messages between the alleged victim and the defendant.    This leaves you in the position of defending your client without all the facts (exculpatory information).   What if there are messages between the alleged victim and the defendant on Whatsapp a popular messaging program, Snapchat, Instagram or Facebook Messenger?    Would you not want to look at that data as well?  Of course you would, but that is not given to you because it was not captured during the imaging process and subsequently it was not produced to you in a report.  

CALL GARRETT DISCOVERY 888.822.5077

  Let’s take a minute to explore what the options are for law enforcement when creating a forensic image (extraction) of a cell phone. Below is a chart that shows the differences between each extraction type.