It was a dark and stormy night. In a narrow alley on the west side of Chicago, a dead woman is slumped inside her Mercedes, clutching her mobile phone to her head, as if she were still in conversation. Rain pours through the broken car window, blown out by the bullet that went through the woman’s temple. A small crowd is standing around the car as Chicago PD detective Nick Fasano arrives on the scene, responding to a 911 call made by a witness waiting in a restaurant line. Fasano knows he’s looking at a homicide. For one thing, there’s that bullet in her head. He immediately realizes that another sort of witness to this crime might be on the other end of that phone connection.
He reaches through the open car window to grab the phone and thumb through its recent call history. Then he stops himself. He knows better than to disturb a crime scene. And he’s never seen that particular model of phone—he could potentially push the wrong buttons and destroy evidence. He needs to get that device to a forensic lab, where the information can be extracted properly, in a way that preserves not only the contacts, call histories, text messages, e-mail, images, and videos but also their admissibility in court.
If the fictitious Fasano were a television detective, forensic examiners would arrive in moments with high-tech tools and search the phone on the spot. Fasano would have the information he needed in 15 minutes and he’d solve the entire case within the hour. Here’s the reality: Detectives don’t carry forensic tool kits that let them search mobile devices. Instead, they photograph the scene and then remove the phone. But this procedure is riddled with pitfalls.
A detective who finds a mobile phone at a crime scene immediately has a decision to make—whether to turn the phone off or leave it on. If he turns it off, the investigator in the lab may have to deal with a password prompt when the phone restarts (60 percent of people password-protect their phones, according to a 2009 study by Credant Technologies). If the detective leaves it on, the phone could receive calls and text messages during the drive to the lab, which could force the device to overwrite information inadvertently. It’s even possible that someone connected to the crime may hit the phone with a text or e-mail ”bomb” that floods the phone’s memory with messages that crowd out all other previous calls from the log.
To prevent that, the detective could leave the phone on and place it in a metal-mesh shielding bag to block all signals. Indeed, such products are readily available. But even that tactic would cause problems. Placing the phone in such a bag would erase vital location information stored by certain kinds of phones—after searching for a signal for a while, the phone would give up and zero out the register that holds location data. Bagging the phone would also drain the battery faster, because the phone, trying in vain to lock on to a tower, would boost its transmitting power to the maximum. And these preservation bags aren’t completely impervious to wireless signals. Drive within a few dozen meters of a cellphone tower and all bets are off.
Back to Fasano (who, along with the others named in this article, is a fictional character based on actual cases I’ve come across in my work consulting for federal, state, and local law enforcement agencies). Fasano photographs the scene and takes the cellphone. Because the phone is already on and at least 75 percent charged, he leaves it on, without a shielding bag, taking the risk that incoming calls may overwrite evidence. He races to the forensic lab.
At the lab, Fasano tells the forensic examiner, Marla McKenna, about the phone and its relationship to the crime scene. McKenna tells Fasano the exam will take several hours. Then she photographs the front and back of the phone and takes a close-up of the screen. She notes the name of the manufacturer—HTC—and the carrier branded on the phone’s case. She looks through her selection of nearly 100 different data cables, hunting for one that will fit. She’ll need a charging cable soon as well.
She’s not sure of the model number; that’s usually stamped under the battery, and she’s not ready to remove the battery and kill the power. She goes online to look at phones by HTC, trying to home in on the model by matching its styling with the pictures on the screen. She decides it’s an HTC Magic—an Android-powered touch phone. Only now can she determine what hardware and software tools to use to examine this phone.