Investigation of Mobile Devices for

Distracted Driving Cases:

Case Study and Best Practices

John J. Carney, Esq.

Carney Forensics
Criminal Vehicular Homicide and Injury
• State accuses Sarah of overshooting her
planned exit by 80 miles, texting all the way.
• When she makes a left turn on a small
highway to turn around and head back, she
drives in front of two motorcyclists.
• The first motorcyclist collides with her car
and the second collides with the first
motorcyclist.
• One dies and one is permanently disabled.
Criminal Vehicular Homicide and Injury
• State's expert opines that after an
accident, most people get out and check
on others before calling 911.

• Since Sarah made her 911 call at

11:59AM, and she received her last text at
11:57AM, he opines she was very likely
texting during or just before the accident.
Feature Phone Evidence
GPS Evidence
Feature Phone Evidence
Feature Phone Evidence
Feature Phone Message Evidence
Feature Phone Message Evidence
Verizon Wireless Text Message Log
GPS Evidence
GPS Evidence
GPS Evidence
Correlated Message & GPS Evidence
GPS Evidence for Validation
Visualizing Message & GPS Evidence
Visualizing Message & GPS Evidence
Visualizing Message & GPS Evidence
Google Earth
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Google Earth Flyover Video Preview
Touring Set Up for Flyover Video
Collect Relevant, Material Evidence
• Consider ALL Evidence Related to Collision
• Mobile Devices
• Cellular Services
• Subpoena or Obtain Search Warrants
• Seizure
• Search
• Move to Compel Production of Mobile
Devices for Digital Forensics Examination
• Expert Testimony May Be Needed
Consider All Transportation Modalities
• Pedestrian

• Bicycle

• Motorcycle

• Automobile

• Truck or Semi-Tractor Trailer

Examine All Relevant Mobile Devices
• Defendant’s Smart Phone
• SMS, MMS, iMessages
• Mobile Messaging Apps
• Navigation Apps
• GPS Unit and Watch
• Track Points
• Date and Time Stamps

• Victim’s Smart Phone and GPS Device

• Correspondents’ Mobile Devices
Examine Immediately for Best Recovery
• Evidence can be deleted, overwritten, and
lost forever when recovery delayed
• Messages
• Calls
• GPS Locations

• Continued use of mobile device after collision

results in deleted and overwritten evidence
• Beware lost opportunity to seize / preserve at
accident scene and to isolate and protect
Examine Immediately for Best Recovery
Examine with Multiple, Upgraded Tools
• Cross validate mobile evidence with several
mobile device forensic tools
“There is wisdom in the multitude of counselors”
- Proverbs
• Re-examine mobile device with upgraded
tools unavailable months or years earlier
• New mobile apps supported
• New, better algorithms for recovering evidence
• Bugs fixed in mobile device forensic tools
Examine with Multiple, Upgraded Tools
Text Messages Marked as “Open”
• Role of “read” or “unread” status flag
• Role of “read” receipt
• Neither proves automobile driver actually
read text message
• Messaging app behavior when conversation
or thread is already open on device
• Complex behavior of messaging app in use
on lock screen
• Use of other apps on lock screen at same time
• Multiple phone settings control messaging app
behavior on lock screen
Spoliation of Mobile Device Evidence
• Consider the possibility of intentional
destruction of evidence
• Spoliation by resetting phone to factory
conditions
• Spoliation by wiping phone remotely
• Spoliation by using third party “cleaner” apps
Examine Cloud for GPS Locations
• Apple iCloud Photos and Photo Stream
• GPS locations in photo EXIF data
• Google Location History Tracked from Mobile
Device
• Passive GPS locations tracked every few
minutes for past few years
• More GPS locations are sampled when tracked
mobile device is moving
• GPS location time stamps are precise to second
• Google shows compelling GPS location maps
Examine Cloud for GPS Locations
Obtain Phone Service Provider Biz Records
• Request and Persist to Retrieve Defendant’s
and Victim’s Business Records
• Request Call Detail Records for Voice Calls
• Date and time stamps to the second are critical
• Request Text Message Logs (SMS Logs)
• Date and time stamps to the second are critical
• Message content is not available
• Request 3G/4G Data Recs for Mobile Apps
• Can Request Cell Tower Sites for Locations
• Switch and Tower IDs
• Sector (usually three antennas per tower)
Obtain Phone Service Provider Biz Records
Request E-911 Call Center Records
• Must Determine Outside Time Limit of
Collision
• Request from Local E-911 Call Center
• Request ALL E-911 Calls Placed to Center
• Defendant
• Eye Witnesses
• Others
• Date and Time Stamps to the Second are
Critical
Request E-911 Call Center Records
Consider Vehicle Forensics Examination
• Recoverable User Evidence
• Contact Lists (Phone Books)
• Text Messages
• Call Logs
• E-mails
• Photographs
• Movies / Videos
• Music / Audio
• Games
• Social Media Feeds
• Installed Apps
Consider Vehicle Forensics Examination
• Recoverable Navigation Evidence
• Tracklogs or Navigation History
• Trackpoints or GPS locations
• Recent Destinations
• Favorite Locations or Waypoints
• Recoverable Device Evidence
• Mobile Devices Connected to Vehicle
• Bluetooth Connections
• Wi-Fi Connections
• USB Connections
• SD Card Connections
Consider Vehicle Forensics Examination
• Recoverable Vehicle Evidence
• Serial Number
• Original VIN Number
• Recoverable Vehicle Event Evidence
• Headlights On and Off
• Doors Identified for Open and Close
• Gear Changes for Park and Drive
• Odometer Readings
• Velocity Logs
• GPS Time Synchs
• System Reboots
 Expert Witness Narrative Reports
• Use Pictorial Demonstrative Exhibits
• Make your report come alive
• Let the demonstrative exhibits tell the story
• Use detailed captions for foundation
• Show Your Work
• Show your tools and your evidence in detail
• Show your analysis and how you found proof
• Don’t skip steps
• Think about your best geometry proof in H.S.
• Authenticate with Forensic Tools Reports
Expert Witness Best Practices for Trial
• Use Pictorial Demonstrative Exhibits
• Ease jury comprehension of complex, scientific
forensic evidence
• Let the demonstrative exhibits tell the story
• Make court testimony a show and tell session
• Show relevant, integrated evidence
• Mobile Devices
• Cloud Accounts
• Cell Services
• Correlate and integrate to get the true picture
• Synchronize evidence using time stamps
Expert Witness Best Practices for Trial
 GPS Demonstrations
• Mobile Devices
• Photo
• Video
• Wi-Fi
• Texting Apps

• Google Cloud
• Google Location History
Google Location History: Ireland 2015
Google Location History: Ireland 2015
Google Location History: Ireland 2015
Google Location History: Ireland 2015
Questions & Answers
Carney Forensics
“Digital Evidence is Everywhere”

Cell Phones / Smart Phones

Smart Tablets
Computer Forensics
GPS Devices
Social Media / Email

Sign up for our Newsletter!!

www.carneyforensics.com
Carney Forensics