Data recovery is gaining a greater role in solving crimes. The practice has grown tremendously from the early days of finding evidence on floppy disks to today’s investigations of tablets and mobile phones. If criminals think that they can just erase incriminating data and thus appear innocent, that idea probably will not work anymore.
For instance, law enforcement may have an interest in a few people who may be participating in an illicit drug ring. During a surveillance episode, law enforcement will wait until they have witnessed a transaction to move in and make the arrest. At that time, one or more of the perpetrators could run, jettisoning drugs, guns, phones, and anything else that may be incriminating. Collecting the phone means that forensics can analyse calls and texts, as well as any photos and use any or all of them as evidence.
Whilst it is still in the research phase, it is now possible to analyse a smartphone’s RAM, even if the phone has been shut down. Forensics teams will soon be able to see what was displayed on the last several screens before the phone was shut down, and this research is applicable to tablets as well. Not only is this research going to provide more information, it will be able to provide law enforcement with the most recent evidence of wrongdoing, and may provide evidence of other crimes as well.
As an example, let’s say that someone was arrested for possession of a controlled substance. Even if his phone was turned off at the time of his arrest, turning it back on would still yield important information – was he looking at child pornography or selling illegal firearms as well as dealing drugs? That information can now be discovered as well. And let’s not forget how valuable email can be to an investigator, even seemingly obscure ones, as in the case of one victim whose murderer was found through the clues left in emails sent by the victim to various family members, friends, and her eventual murderer.
Remember we mentioned floppy disks earlier? A serial killer eluded capture for 16 years until 2004, when he attempted to taunt police with a Word document he sent them on a floppy disk. What had taken years of investigative work was reduced to a few hours when computer forensics experts found metadata on the disk that revealed the killer’s first name and location.
It may still be easy for criminals to run, but data recovery is rapidly crushing their ability to hide!