Smartphone Forensics

Twenty-nine years ago when I entered the forensic field of study as an audio and video engineer. All recordings were created on analog tape. There were many different types of formats, such as Beta and VHS. Then along came digital tape that started to complicate things a bit. Then came tapeless video recording on digital video recorders. This is when the field of video forensics got even more complicated. By complicated I mean that continuing education for the video forensic expert became more important so the expert could keep up with the various formats and technologies that were starting to enter the marketplace. One of the classes that I took to better understand closed-circuit television systems (CCTV) was at a leader in global closed-circuit television systems called Pelco. Pelco, based out of Indianapolis, Indiana, facilitated learning processes to help installers, end-users, and law enforcement better understand how to operate their software and digital storage hardware. I remember learning, back then, that many cities were installing digital closed-circuit television systems into their downtown areas to help law enforcement personnel better supervise and keep their streets safe. I was thinking at the time how this was going to cause more demand for video forensic experts because more video footage was going to surface that would need to be examined, clarified, subjects in the videos would need to be identified, and processes were going to have to be established. By processes I mean the chain of custody, exporting for admittance into court and preservation and storage, which, at the time, was a costly endeavor. Hard-drive space was very expensive. Today, hard drive space costs very little in comparison to the value of preserving all of your digital footage for an extended period of time. Now there is another form of digital video that has surfaced and that is smartphone video. The need has developed for smartphone video experts to be able to authenticate, clarify, identify portions of the video and be able to testify on the authenticity of cell phone video that is used in litigation. Within the last several months, previous to the writing of this post, more than half of the video that I have received as a video forensic expert to authenticate, identify and clarify has been recorded in a smartphone. One of the reasons is that a smartphone is very convenient, and when a person feels threatened or an altercation occurs it has become human nature for one if not both of the people involved to turn on their video recorder on their smartphone and capture the events as they occur. That video can later be used to help support testimony in the courtroom. Just like any other digital video recorder a smartphone creates a video recording and saves the video on the hard drive of the phone. The video forensic expert retrieves that video recording from the phone that created it in order to create a solid chain of custody and authenticity of that video recording. One of the biggest problems that I am encountering today is that before I am retained, the criminal or civil proceedings have already removed the video recording from their smartphone, loaded it into a laptop, imported it into a video editing program, and burned the file to a disk. Sometimes that filename has been preserved, meaning the same name the phone gave it is transferred onto the disk sometimes it's been renamed. I've even seen times when the file formats have changed. iPhones record .mov files, droids record 3gp files, as a rule of thumb. There are exceptions and some of the different software updates may modify these file formats. It's important that any video evidence that has been created on a smartphone and is going to be used in litigation have the same chain of custody as any other video recording created on a digital video recorder. And that is to preserve the original on the original device that created the recording until the video expert has had the opportunity to remove the video from that device giving it the integrity to use as evidence in the litigation. If the video file is copied from the phone so that it can be viewed on a larger screen, that's fine. It's extremely important not to delete the original file on the phone until a forensic expert has the opportunity to examine it. The easiest way for a forensic expert to authenticate that file is on the device that created it. Many times I encounter digital video files that were created on a smartphone and the phone is either no longer available or the file has been deleted. To me, as a video forensic expert, that is a red flag because there is no need for anyone to delete a file from an original recorder, especially today when storage space has become inexpensive as well as readily available. Most of the integrity that can be established for that digital video recording comes in the process of the forensic investigation that starts with the digital file on that smartphone. The same is true for tablet video recording. The tablet has a hard drive just like a smartphone, just like any digital video recorder. It creates a video file and automatically assigns it a name and that filename is part of the integrity of that video recording on that device. So today the amount of video evidence that is appearing in court has grown dramatically as the result of the different devices that are readily available to create video and capture altercations, crime and other activity people want to document in order to use in the courtroom. It is very important to preserve the original recording, rather than delete it, to maintain the integrity and authenticity of that video file for the legal proceeding.

Tag Archives: Smartphone Forensics

Smartphone Forensics and the Future of Forensic Analysis