Best Practices for Collecting Mobile Data in the Field

Written by Steve Lin

July 27, 2020

Picture it: you’re interviewing a suspect in a major case. You’re certain their smartphone has crucial data you could use to get them to confess—but you don’t have the hours you know it’ll take the forensic lab to get your data back to you. They’ve already told you how backlogged they are.

You can get the suspect to unlock their phone so you can navigate to the content you need, but you worry their defense attorney could argue that you changed or deleted evidence somehow. At the same time, you worry if you release the suspect, they’ll do it again—and releasing them will come back on you, too.

Now picture this happening across more than one case, not just your own, but your colleagues’ as well. As you’ve undoubtedly discovered yourself, the more important mobile device data is to investigations, the more devices are seized for analysis—and the less time forensic lab examiners have to commit.

That can leave you without the actionable information that social media, messaging, contact, location, browser, picture and video, and other data can provide you with to make fast decisions.

Our new e-book describes five investigative scenarios that can benefit the most from field collections:

  • The Missing Child. Few teens go anywhere without their mobile devices, though a child who doesn’t want to be found may leave theirs behind. Time is of the essence in these cases, and field personnel need information—fast.
  • The “Traveler” Child Abuse Suspect. Whether it’s a proactive operation, or a tip investigators received about a child on their way to meet a suspected child predator, the eventual encounter with the suspect will undoubtedly lead to their mobile device.
  • The Domestic Offender. One person’s word against the other can sound equally convincing. Each party’s mobile device can shed light on the dispute.
  • The Probation/Parole Check-In. Whether a convict is on probation or parole for sex offenses, gang-related crime, organized crime, trafficking, or some other offense, the data on their mobile device(s) can reveal whether they’re complying with the terms of their release.
  • The Trafficking Case. Trafficking in drugs, guns, or humans can involve multiple mobile devices and the need to gather intelligence that could lead to higher level leadership. It can also mean distinguishing trafficking victims from criminals.

Investigators can use mobile device data to correlate data and devices together to make the following decisions:

  • Identify leads: where to go, and whom to talk to next. Who else was your suspect messaging or talking to around the time of the incident? What wifi hotspots did their device see on their path of travel? What hotspots did they actually connect to and use—and could they help identify additional witnesses?
  • Interview suspects and witnesses. The more information you have about who they associated with and where they were, the better questions you can ask during interviews, and the more informed your charging (or release) decisions will be.
  • Discuss charging options with prosecutors. The content of messages can reveal their intent—or lack thereof. By the same token, the absence of content can show whether someone was simply in the wrong place at the wrong time.
  • Rescue victims, including finding victim support services. Messaging, picture, and video content could show whether a subject is a victim of domestic violence or human trafficking—and help you to get them to a safe place for the support they need to leave.
  • Share intelligence with task forces. The same connections to people and places that help you identify leads, can also be valuable to gang, drug, and human trafficking task forces conducting ongoing operations.

Field collections additionally help forensic examiners by maintaining chain of evidence from the outset—and saving them the time they need to focus on bigger, tougher cases.

To learn more, download our e-book today!

Join Our Newsletter

Don’t miss our blog posts or new releases.  Sign up to receive updates in digital forensics.