Law enforcement officials and forensics experts said cell phones are the latest in a long line of new technologies to which they have adapted
By David Chanen, Chao Xiong
Minneapolis Star Tribune
MINNEAPOLIS, Minn. — Dale Hanson patrolled Minneapolis’ North Side before his policing career took a major turn off the streets and he became the department’s first full-time computer forensic specialist in June 2005. The job quickly morphed into the relatively unknown territory of cell phone investigation.
Last week, Hanson’s well-honed skills created big news when deleted video of an alleged rape retrieved from the cell phone of a Gophers football player landed a star teammate, cornerback Dominic Jones, in jail. Among a 400-page police investigation file and more than 40 interviews, prosecutors said nothing was more crucial to the case than that hidden video clip.
Because of the wealth of information they hold, cell phones are now part of almost every large forensic examination or criminal or civil case. Even so, Hanson estimated that Minnesota has less than a dozen full-time computer and cell phone forensic experts.
Law enforcement officials and forensics experts said cell phones are simply the latest in a long line of new technologies to which they have adapted, from land-line phones to camcorders to pagers to computers.
But they also agree that the cell phone’s ubiquity is unrivaled.
“As more and more people are having cell phones as part of their daily lives, cell phones are becoming part of investigations in general,” said Judy Regenscheid, information technology manager for Hennepin County and a board member of the Minnesota chapter of the High Tech Crime Investigation Association.
What they reveal, Hanson admits, baffles investigators. A convicted felon on probation taking a picture of himself holding a gun. Robbers filming their crimes. Last month, Jermaine Mack-Lynch was sentenced to 30 years in prison in the killing of a young pizza delivery man in Minneapolis. Key to his conviction was cell-phone video showing Mack-Lynch dancing around with the murder weapon, a shiny .357 Magnum.
“We have people telling us they are done being gang members and don’t want their name in our database,” said Ron Ryan, commander of the Metro Gang Strike Force. “Then we come up with cell phones showing them throwing up gang signs and holding a gun in their hand.”
Phone changed investigation
Hanson, 34, has examined more than 150 cell phones in the past two years.
When the Gophers player’s cell phone landed in Hanson’s crime lab, the investigator had no clue what he might discover. He rarely comes across deleted video files, especially “one critical to a case as this one,” he said.
In April, Gophers football player Alex Daniels videotaped Jones having sex with an 18-year-old woman who had passed out after drinking vodka, authorities said. Michael Colich, Daniels’ attorney, said he hasn’t seen the video, and he wouldn’t comment if Daniels deleted the file.
Daniels and football teammates E.J. Jones and Keith Massey were all arrested shortly after the woman reported the rape, but none has been charged with a crime. Dominic Jones, no relation to E.J., was charged last Monday with third-degree criminal sexual conduct.
The discovery of the video took the investigation in an unexpected direction, said Hennepin County Attorney Mike Freeman.
Even though users can’t see a deleted text message, cell phone picture or video, they can remain stored in a number of places: on the phone’s flash card, on the phone provider’s network, or on the customer’s personal computer if the phone or a device such as a BlackBerry is set up to route messages there, said Paul Luehr, a former federal prosecutor and now managing director and deputy general counsel for Stroz Friedberg, a national forensics and technical consulting company.
Computers store deleted information on their hard drives.
“To the average person, [deleting information is] like the kid who throws something in the wastebasket but doesn’t empty the wastebasket,” he said.
Getting to the data
To retrieve deleted data, a cell phone is connected via cable to a blank hard drive and computer with specialized software that captures all data stored on the phone, he said. That information can be saved onto a hard drive, disk or CD. Investigators can then conduct a key-word search, looking for files with a person’s name or a specific phrase. Besides video and pictures, a forensic investigator would look for call contacts, history and text messages.
The process isn’t foolproof though. Deleted information in cell phones can disappear after a couple of days or weeks while computers can retain deleted information for several months to a couple of years, said Luehr. Because cell phones have less storage and are more heavily used, old files can be deleted spontaneously to make room for new data. Luehr said he has seen numerous photos retrieved from cell phones that were half-erased because new data was entered.
It keeps changing
Cell phones also vary more than computers in their models, systems and layouts, he said.
And with each new cell phone model comes new challenges, Hanson said. He and other experts network with one another to solve investigative problems. He can’t wait until somebody gets to work on Apple’s highly popular iPhone.
Defense attorney Joe Friedberg knows firsthand how cell phone technology can affect criminal cases - and it doesn’t always favor prosecutors.
Last summer he defended St. Cloud bouncer Paul Buboltz, who was charged with killing Justin Smiley outside a popular nightclub.
An eyewitness snapped a cell phone photo of Buboltz with his arm around Smiley’s head; the photo was not deleted and was used in court. Friedberg said it was of “tremendous value” in his client’s acquittal because it showed Bulbotz’s arm was not on Smiley’s windpipe, disproving the prosecution’s assertion that Bulbotz cut off Smiley’s air supply.
“The knowledge that you can go and pull stuff back from never-never land is of great importance to law enforcement,” Friedberg said.
Copyright 2007 Star Tribune
All Rights Reserved