Cary Police Destroy Evidence Part 3

Summary

In this transcript, a forensic examiner discusses the procedures and findings related to the examination of a Motorola V551 and a BlackBerry device. Despite lacking formal training in mobile forensics, the examiner utilized a data pilot tool but failed to adequately document the process or check for various data types on the phones. The interaction reveals critical issues surrounding data erasure following incorrect PIN entries and highlights discrepancies in a detective's account of the procedures. Ultimately, the examiner disputes the accuracy of the documentation and emphasizes the importance of following protocols in forensic investigations.

Takeaways

• 🔍 The investigator has limited training in cellular phone forensics, which may affect the reliability of their findings.
• 📱 The Data Pilot tool was used to access the Blackberry phone, but it did not yield any useful data regarding contacts or messages.
• 📝 The investigator failed to document the forensic examination adequately, lacking notes and photographs of the process.
• 🔑 The unlocking process involved multiple failed attempts, ultimately leading to data erasure, which raises concerns about protocol adherence.
• 📊 The investigator acknowledges the importance of SIM cards but did not check the SIM card data separately from the phone itself.
• 🚫 The investigator disagreed with Detective Young's assertion that the phone's data was intentionally deleted, indicating inaccuracies in the description.
• ⏳ The process of erasing data from the phone and SIM card requires distinct steps and cannot be done simultaneously.
• 📅 The investigator could not recall the date of the second examination or whether the Blackberry was locked at that time.
• 💻 Proper forensic procedures typically require thorough documentation and validation of tools used, which were not followed here.
• ⚠️ Overall, the lack of detailed documentation and thorough examination raises significant questions about the integrity of the evidence and the investigation.

Q & A

What training does the witness have regarding cellular phones?

The witness does not have expert training in forensic examinations of phones.

What tool did the witness use to examine the phone?

The witness used a device called a Data Pilot to access the phone.

Was the phone turned on during the examination?

Yes, the phone had to be turned on for the examination.

Did the witness take notes during the forensic examination?

The witness stated that they did not take notes during the examination, except for an initial exam.

What information did the witness find on the phone during their examinations?

The witness found no data or information on the phone during their examinations.

Did the witness check the SIM card separately?

No, the witness did not check the data on the SIM card separately from the phone itself.

What does the witness understand about the process of locking a SIM card?

The witness understands that the SIM card can be locked by entering the wrong PIN a specified number of times.

What did Detective Young attempt to do with the phone?

Detective Young attempted to unlock the phone by entering a PIN unlock code and, after multiple failed attempts, the phone's data was erased.

What is the procedure for erasing data from both the SIM card and the phone?

The procedure involves locking the SIM card and the phone separately, requiring distinct steps to erase data from each.

Did the witness agree with Detective Young's explanation of what happened to the phone?

No, the witness stated that Detective Young's explanation was not accurate and did not reflect what had happened to the phone.