The Importance of Digital Forensics Experts: The Case of the Distracted Pedestrian
Introduction: Recently CyForce had been contracted by a law firm representing the estate of a deceased individual. This person was a well-known resident of a mid-sized city, and they were struck by a motor vehicle while crossing the road. The question in dispute was whether this individual was “distracted” by their mobile phone while crossing the street. The local police department had examined the victim’s phone and “officially determined” that they were actively using a video chat program at the time of the collision. Thus, they were partially at fault for the collision that occurred. This question is so important because, like most states, the state where the collision occurred happens to be a “comparative fault” state, specifically a modified comparative negligence state. Contributory and Comparative Negligence States have a couple of approaches when determining and apportioning fault in negligence cases, especially in civil litigation. They can employ a contributory negligence model or a comparative negligence model. Generally speaking, if a state employs a contributory negligence model and you are found to be at fault, even just one percent at fault, you cannot recover damages in a civil suit. On the other hand, if you are in a comparative negligence state, the percentage that each party was at fault will be used to assign damages. For example, if you are found to be 20% at fault, then at most, you can recover 80% of the damages. There are two types of comparative negligence, either pure comparative negligence or modified comparative negligence; the significant difference between the two is that in a modified comparative negligence model, there is a threshold of fault that you must be below before you can be awarded damages. This threshold usually is around 50%. Case Background The collision occurred in the late afternoon, on a winter day, with temperatures near 50°F and clear visibility, light wind, and no rain. The victim had just parked their car and was walking to meet friends for dinner. After walking a short distance down the road from their vehicle, the victim decided to cross the street, at which point they were struck by a truck. A bystander used the victim’s phone to call an individual listed in the victim’s most recent call history. Police Investigation As with all fatal automobile collisions, the local police investigated the circumstances surrounding the collision to ascertain the facts of the case. Since a bystander could utilize the victim’s phone, the police theorized that the phone was unlocked and being used by the victim at the time of the collision. For this reason, the phone was analyzed by the police department, which included a full file system (FFS) extraction of the phone’s internal memory. After locating the data pertaining to the date and time in question, the police department’s digital forensic investigator saw indicators that a particular video messaging application was running on the phone at the time of the collision. This led them to conclude that the victim was utilizing a video messaging application when they were struck by the truck. Civil Case The victim’s estate filed a civil case against the driver of the truck. The driver’s attorney relied heavily on the police department’s report that stated the victim was actively utilizing their phone at the time of the collision. They argued that the victim was primarily at fault for the collision because they were distracted by their phone and stepped out in front of the truck, and the driver did not have time to stop before striking the victim. As you can imagine, having this critical piece of evidence from the police department’s expert “showing” that the victim was actively using a video messaging application at the time of the collision was a major “plus” for the defense in trying to show that the victim was at least 50% at fault for the collision. If the defense was successful in proving this to the court, and since the state where the collision happened was a modified comparative negligence state, the driver would not have to pay damages to the victim’s estate. CyForce’s Critical Involvement The attorney for the victim’s estate contacted CyForce and asked us to perform a second examination of the data from the victim’s phone and try to determine if the police’s conclusions were correct. Though CyForce was not provided with the actual phone, they did receive a copy of the FFS extraction and determined that there were no indicators of compromise to the data. The phone in question was determined to be an iPhone 8 plus running iOS 13.3. Utilizing state-of-the-art technology, CyForce established the “pattern of life” for the iPhone, including detailed usage history covering the collision’s time. While examining the data, one curious fact stood out to Dr. Lewis, CyForce’s Chief Forensic Officer: the iPhone’s microphone, camera, and speaker were never activated during the time of the collision. The detailed logs and databases that make up the pattern of life on an iPhone shows in immense detail what is being utilized on an iPhone and when. For example, it logs when the microphone is activated, where the output audio is sent (speaker, Bluetooth, headphone jack, etc.), and when the camera is turned on. Yes, these logs did show that the video messaging application was running, but it didn’t show that any of the usual hardware was being utilized while it was running. Dr. Lewis thought it was rather suspect that a video application would be actively utilized, but the audio wasn’t playing or being recorded, and the camera wasn’t being used. Of course, in forensic sciences, a hunch isn’t considered evidence. After a thorough search of the literature, it was determined that research on this application was non-existent. Still, similar applications did show the camera, microphone, and speaker activation when used to play or record video messages. This led CyForce to conduct a scientific experiment utilizing the same model of iPhone and the same version of iOS to determine with scientific certainty if the activation of
