Admissibility of Forensic Cell Phone Evidence in United States

I. Introduction

As according to the article analyzed herein, Forensics in context of the cell phones typically refers to “extracting information from cell phones using repeatable and verifiable processes.”² The branch of cell-phone forensics is still not completely developed by the researchers, academicians and professionals. Usually the same investigative methods are used for computers as well as the mobile phones since both contain electronic evidences and cell-phones are simply low-powered version of the computers. The most important rule of evidence collection is “Change Nothing” i.e. no alteration is to be caused to the information stored in the device. Even, moving the cursor or switching off the device could cause significant alterations like removal of data from RAM which stores current status or activity in the computer. However, to ensure legitimacy to the data collected, investigators in case of computers have developed repeatable and verifiable methods of extracting data from the device. One of which is “hash” method where the investigator works on the copy of the extracted information instead of making changes to the original hard-drive. An alpha-numerical code is generated before and after making copy of the extracted information, if the data in any of the file changes even a little bit, the code substantially changes. But this method cannot be used on cell-phones.

The difference between cell phone and computer forensics arise mainly while retrieving the data from the device. Since cell phones have exponentially large number of varieties and storage specifications is different in different models of cell phones as compared to computers with limited number of operating systems (mostly Windows), there is no single forensic tool like ‘hash’ which can make an exact copy of the information stored in the mobile phone.

II. Cell Phone Forensics

(A) Evidence Extraction Techniques

The article which is analysed in this paper briefly describes about three level sophistication technique of extraction of information from cell-phones. The most basic level of sophistication is scrolling through the phone and taking pictures of the content stored in the mobile. At second level, the examiners use such forensic tools so as to recover objects like call logs, pictures, folders and files but deleted files are not recovered through this technique. The third level sophistication is complicated and technical requiring trained forensic examiner who would use the physical recovery process (chip off method).

A more elaborative forensic investigative techniques and methods (National Institute of Standards and Technology, 2013 Report) are explained through a hierarchy given below³:

Fig: 1

Each stage present in the above figure (Fig: 1) requires a different skill set and equipment to yield different evidence at all stages. The most basic stage of initiation of retrieval of data is Manual Extraction. At this stage, specialized tools are not required. The forensic tool used is the ‘thumb’ to scroll through the touch screen or keypad while clicking pictures of the data stored. However, this stage may require knowledge of operating system suitable for such cell-phone.

The next stage i.e. Logical Extraction would require a technical knowledge and will incorporate external computer equipments so that commands could be provided to the targeted device which would register the extracted information in the examiner’s computer.

The third stage of Physical Extraction would involve a technique called ‘Flashing’. Through this process, even the deleted content can also be restored. Every cell-phone has flash memory where history of actions taken to read or write information is stored. Since, this stored data is for internal working of the phone rather than human observation, extraction of such data would require more technical knowledge and tools.

Chip off and Micro read are the final processing tools representing advanced digital evidence extraction from highly technical tools and knowledge. So, a micro chip from the device is removed and examined and data stored is extracted through a chip programmer and then stored in the examiner’s computer. This step is often used as a last resort and only accessed when the cell phone is damaged to an extent that it would not be possible to use other processes.

(B) Issues with Reliability and Authentication for these Extraction Techniques

The most basic level sophistication i.e. Manual Extraction is widely disfavored by the mobile forensic community since scrolling through the phone results in altering the data and can also lead to tampering of evidence. However in a case of Dickens v. State⁴, a girl was murdered and while her mother was scrolling through her phone before initiation of the investigation, she found out few incriminating messages in her phone. She instantly reported this to the police who admitted this as evidence. There was an objection by the opposing counsel as to its authentication; however, the court accepted it as valid evidence.

Logical Extraction methodology using phone extraction commands has its own shortcomings. There is no single software that would work with all cell-phones. Since, manufacturers release so many different phones, each new phone has to be cracked in a different manner through generation of different commands for every model of mobile phones. But this might result in alterations in the data as only the command and the output is known to the examiner and not the process which resulted in generation of this output.

These problems can be well-illustrated with the example of Sony Ericsson f500i. The command sent to retrieve information from the mobile phone to the examiner’s computer is “AT+CMGR=10, /r.”97. When this command is being sent from the examiner’s computer, the result of such command is “+CMGR; 0,,35, /r/n,” after which a text message is received. In the return message, the 0 (zero) indicated that the message is unread but when this code will be generated again by 2^nd command, the zero will convert into 1 (one) which means that the message is read. The problem with this example is two-fold: the change of status from ‘un-read’ to ‘read’ and only the command and output is known and not how such information is processed or whether such information is complete and reliable.⁵

However, this command based acquisition of evidence is then followed by the technique called ‘Flashing’ (Physical Extraction). But this software is not developed for forensics but for bypassing manufacturer restrictions. This tool was originally developed by the hacker community so that they could break into phones and re-program them. Its reliability is not tested or proved.

(C) Application of Daubert Factors for Analysing Cell Phone Forensics

Daubert Standard is the standard used by the trial judge to assess whether the scientific testimony of an expert witness is based on scientifically valid reasoning that which can be properly applied to the facts of the case. This standard was developed in a US Supreme Court Case of Daubert v. Merrell Dow Pharmaceuticals Inc⁶. To determine whether the methodology used by the scientists or technicians is valid and reliable, certain factors are considered, which are⁷:

Whether The Theory Or Technique In Question Can Be And Has Been Tested

1) Tools used for data extraction from mobile phones have never been tested fully and its error rates are also not published anywhere. The National Institute of Standards and Technology in 2005 tested various forensic tools on 17 different mobile phones to derive and demonstrate its capabilities but this research did not in any way proved the accuracy of these processes and tools.

2) One of the reasons for failure in deriving a uniform testing method is that the cell phone manufacturers release their new models too fast and these techniques fail to keep pace with them.

3) In People v. Young⁸, the court stated that the tools of cell phone forensics have yet to undergo legally sufficient testing and therefore, fail the testing prong of Daubert.

Whether the theory of technique is subjected to publication and peer review

1) There are many articles which talk about cell phone forensics but none of them expressly analyze whether these methods are reliable. One of the Articles states: “The only argument which could be used to confirm the correct operation of these methods is that they are in common use, and are regularly relied upon to acquire data, forensically or otherwise. This argument is insufficient for these methods to be scientifically acceptable, however.”⁹

Error Rate

1) These forensic tools are prone to errors as in NIST analysis, the tools failed to take into account e-mails, contacts, web content etc which is problematic in the sense that while the investigator uses these tools in an actual case, it will not be known whether the program excluded results like web content or there weren’t any available in the phone.

2) Other technical limitations are that important data may be omitted, there may be difference in the data generated and the data available in the phone or some data present in the cell phone which is relevant to the case but won’t be accessible etc.

Whether the standards controlling its operation exist or can be availed

1) There are various standards available which are to be followed while extracting digital evidence. Some of which are, PIRL List for Windows Computer Forensics¹⁰ (Also applicable on mobile phones), Guidelines on cell phone Forensics by NIST¹¹, Best Practices for Mobile Phone Examination by The Scientific Working Group on Digital Evidence (SWGDE)¹². However, these standards only provide different ways of acquisition of data but none of the above is successful in actual acquisition as it provides very less information. Hence, it does not satisfy the Daubert test.

WIDESPREAD ACCEPTANCE WITHIN A RELEVANT SCIENTIFIC COMMUNITY¹³

1) This acceptance would depend upon how the courts construe that who all are to be included into the ambit of ‘relevant scientific community’. In People v. Brown,¹⁴ the court while citing the reasons for rejecting the claim of general acceptance of few forensic practitioners stated that their career interests are hidden in acceptance of such tests and also that they are part of the law enforcement agency which conducted the tests.

2) It is not a pre-requisite while defining relevant scientific community that the forensic expert or examiner has a strong scientific background. But for inclusion of mobile forensic experts in the ambit of relevant scientific community, they must possess uniform scientific approaches towards investigation and significant amount of information with regard to the usage of forensic tools which is currently lacking. Hence, mobile forensic experts do not fulfill the requirements of Daubert test yet.¹⁵

Mobile Forensics does not qualify the Daubert factors, hence their admissibility may be challenged and mobile forensic evidence may not always be admitted by the courts.

(D) Relevant Cell Phone Evidence when Found outside the Phone

Another area which the article analyzed here covers is when investigative teams collect evidence from outside the cell phone to fill in the gaps created by deleted information in the phone. A person may sometimes use certain third party services like Google which when synchronized with the mobile phones can store data like text messages, historical location, voice messages, emails etc outside the cell phones. Below are some of the mechanisms through which data stored outside the cell phone could be traced.

HISTORICAL LOCATION INFORMATION- This illustrates how cell phone information can also be found outside the phones. When any phone call is made, these cell phones communicate through cell towers which show approximate location of the cell phone user (20 sq. miles in rural areas). If the user is travelling from one place to another, the call will be channeled through different cell towers showing the approximate direction in which the user is travelling.

ENHANCED 911- E911 is a service initiated by Federal Communications Commission which pinpoints the location of the person who is calling in a crisis. Things used to find out the location of the user are GPS, network connection signal strength and Network Assisted GPS Location.

APPLICATIONS- Some application providers also have location information of the user. For e.g., Applications for ordering food from any restaurant use GPS location so as to look for proximate restaurant choices. This information is stored in the internet history of the phone which can be accessed outside.

III. Evidentiary issues in Admissibility of Cell Phone Evidence

Admissibility of cell phone information in the court can cause major challenges as a lot of evidentiary issues arise while the government presents the digital evidence before the court like the authenticity of the evidence is required to be proved, the evidence must not contain hearsay since assertions are not admissible in court etc. Chapter 5 of the Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations Manual¹⁶ is relied upon for search and seizure of computer information. However, this manual can be successfully applied to mobile phones as well because of two reasons:

1) Information stored in computer as well as mobile phones have similar evidentiary requirements; and

2) Third party service providers accessed through computers play a major role in obtaining information from mobile phones.

(A) Hearsay

Rule 801(c)¹⁷ defines Hearsay as a statement which “the declarant does not make while testifying at the current trial or hearing; and a party offers in evidence to prove the truth of the matter asserted in the statement.” According to Rule 801(a)¹⁸, a statement is an oral or written assertion or non verbal conduct of a person. Assertion as has been defined in many cases including the case of United States v. Briscoe¹⁹ is given a connotation of a positive declaration.

The information with regard to the mobile phones can be divided into three main categories i.e. Hearsay (assertions made by humans, e.g. memo, letter, bookkeeping records etc.), Non-hearsay (created by a process, hence, does not involve assertions. E.g. GPS, call records, cell tower info., information from Applications etc.) And Partial or Mixed Hearsay (contains hearsay as well as non-hearsay, e.g. chats which contain personal messages as well as automatically generated last seen and time and date of receipt of messages).

The U.S. courts while analyzing Rule 803(6)²⁰ of the Federal Rules of Evidence has stated that computer evidence is admissible as it falls under the hearsay exception of ‘business records’. U.S. courts time and again have validated the admissibility of digital evidence through various case laws. The courts have stated that computer or cell phone evidence are generated through process and are not statements of persons so as to fall into the ambit of Hearsay. In United States v. Washington,²¹ it was held that telephone call records generated automatically are not hearsay because it does not qualify Rule 801(a) of Federal Rules of Evidence. In Bullcoming v. New Mexico,²² the court stated that computers follow mechanical process due to which records are created and hence such information generated automatically cannot be a lie.

(B) Confrontation Clause

The Sixth amendment to the Constitution of United States provides for the confrontation clause. This clause states that the accused has a right to confront a witness who is giving testimonial evidence against him. The word testimonial has been defined by the court in the case of Davis v. Washington.²³ It was stated by the court that a statement is testimonial when it establishes or in some way proves the past events that are relevant to the criminal prosecution. The court also stated that the statements which are testimonial can be implicated under the confrontation clause.

When certain records are generated through computer it cannot be implicated under the confrontation clause because these are not statements given by a person. In the case of United States v. Washington²⁴, the blood report of accused was generated through computer and the lab results prove that the defendant had been driving under the influence of alcohol. It was argued by the opposing counsel that these lab results are testimonial hearsay and hence the accused has the right to invoke the confrontation clause. The court while negativing the contention held that the evidence was generated by the computer through a process and is not a statement made by the lab technician. The sixth amendment guarantees the right only with regard to the person and not machines. In conclusion, the court held that the data generated by the computer is statement of a machine and not the statement of the operator of the machine.

However, information created by a cell phone is not for the purpose of primary investigation and hence is not testimonial in nature. In the case of Bullcoming v. New Mexico²⁵ the court held that the defendant has the right to confront the person who has extracted the information from the cell phone or any digital device.

(C) Authentication

Rule 901(a)²⁶ of the Federal Rules of Evidence talks about authenticating or identifying evidence. According to this rule, for any evidence to fulfill the requirement of authentication, the person proving its authenticity must produce the evidence which is sufficient to support the fact that the item is what the person is claiming to be. However, non-authentication can result in exclusion of the digital evidence which can prove to be fatal to the prosecution’s case.²⁷

According to the case of U.S. v. Salcido,²⁸ the authenticity of the evidence must be proved in accordance with rule 901(a) of Federal rules of Evidence. A further reasoning was given in the case of U.S. v Gagliardi²⁹ that the proponent need not prove the evidence beyond reasonable doubt.

Various authentication methods have been specified through a non-exhaustive list under rule 901(b)³⁰ of Federal Rules of Evidence. In the case of U.S. v. ³¹Kassimu, the court held that the computer records are authenticated because they match the description of the procedure which was given by the postal inspector.

Rule 901(b)(3)³² states that an item is authenticated when an expert or the trier of fact compares it with other specimen which is already authenticated. Rule 901(b)(4)³³ states that an evidence can have various distinctive characteristics like substance, content, appearance or internal pattern etc. which can authenticate the evidence. The case of U.S. v. Siddiqui³⁴ perfectly elaborates upon the above rule through its facts. It was held in the case that an email can be authenticated through the presence of personal information of the defendant just like in this case the dependent’s work email address and also the defendant's nick name was present in the email which authenticated the evidence.

Under rule 901(b)(9)³⁵, in order to prove that the evidence generated through an automated process in a cell phone is authentic or not, the prosecutor must describe the process as to how such evidence is recovered and that the process followed generates the accurate result. This in turn will help establish the trustworthiness and the reliability of the evidence. The extent of the details provided by the prosecutor would depend upon the circumstances of each case and also the complexity of the information.

A checklist adapted from the article “Thinking Outside the Business Records Box: Evidentiary Foundations for Computer Record”³⁶ authored by Timothy M O'Shea will facilitate the preparation for presentation of evidence at the trial.

1. The first step is to check whether the information or data collected has not been substantively altered, the points to be kept in mind are:

a. The Chain of Custody of the evidence;

b. Whether any information has been substantively changed while information was recorded from the cell phone to any third party service provider;

c. Whether ‘Hash’ can be used to verify that data;

d. How the information was collected;

e. What tools were utilized in collection of evidence;

f. Whether those tools are tested and have a known error rate.

2. Whether the record of evidence collection is complete:

a. Procedure used for collection and storage of information;

b. Method of retrieval of data from the cell phone to the examiner’s computer or any third person service provider.

3. Authenticity of the tools and techniques used:

a. Whether such technique or program is recognized for collection of digital evidence;

b. Whether there exists any prior problems with the tool;

c. Error rate of such tool;

d. Whether such tool fulfils the Daubert test;

4. The training and experience possessed by the examiner in dealing with forensic tools:

a. An experience in computer forensic training documented in his Curriculum Vitae;

b. Any competency tests passed by the examiner;

c. Numbers of examinations conducted;

d. Whether he possess any publication in this specialization;

e. Whether he follows a Standard Operating Procedure during examinations.

(D) PRESENTATION

The presentation phase begins after the evidence has been collected from the investigation which is corroborated with external evidence to fill in the gap in the evidence collected from the mobile phone and such evidence is then summarized in the forensic expert's report to be presented before the Court and is also well-established through admissibility theories under the Federal Rules of Evidence. Certain electronic evidence can be so technical that it may be difficult for the prosecutor to present this evidence at trial because the jury may not be able to understand and follow the evidence. Graphics can be used as an effective tool to make jury understand better the information through visual senses. Below are few methods of presentation of evidence at the trial³⁷:

COMPUTER DIAGRAMS- The key evidence can easily be explained through presenting a computer diagram which would help providing an overview to the jury. For example, a computer directory can be used to show the different locations so that evidence can be understood in consonance with the sequence of events.

AVOIDING COMPLEX MATTERS- If a tutorial for better understanding of the exhibit could be given to the jury, so that if the output contains the line of computer codes, it would be easier for the prosecutor to make jury understand such codes.

TIMELINE - A timeline is an effective way to focus on key electronic evidence records. There can be several benefits of using timeline at the trial one of which is that the witness can testify about the events in the timeline itself instead of testifying about each entry individually.

The prosecutor can follow any method suitable for presentation of the evidence but special care should be taken to present such evidence and it must be presented in the manner that it is understandable to the jury.

IV. Conclusion

The area of cell phone forensics is new and rapidly expanding. It offers the prosecutors more convictions through recording and presenting vast digital evidence. Electronic evidence can be present in or outside the cell phones in many forms including emails, text messages, historical locations, photos, contacts, call logs etc. Extracting this information can be a tiresome task for the digital forensic examiners because of limited availability of cell phone data extraction tools. However, the courts in U.S. have taken a liberal view in accepting this digital evidence provided it satisfies the provisions of Federal Rules of Evidence. However, the major problem that arise with regard to cell phone forensics is that it’s not well-understood by the judges and hence, sometimes, even the reliable and authenticated evidence important for fair determination of a case is often rejected by the judges. It is important for the prosecutors to spend enough time with examiners to understand the process employed in generation of this evidence. It is important for the prosecutor to help jury and judges to genuinely understand the evidence rather than presenting technical jargon to impress the judges.

*****

Footnotes

1. Author is a student at Rajiv Gandhi National University of Law, Patiala, Punjab, India.

2. Id. At 42. ↩

3. Sean E. Goodison, Robert C. Davis, and Brian A. Jackson, Digital Evidence and the U.S. Criminal Justice System: Identifying Technology and Other Needs to More Effectively Acquire and Utilize Digital Evidence, RAND Corporation, 2015, (10 Sept. 2020, 3:31 p.m.), https://www.rand.org/pubs/research_reports/RR890.html. ↩

4. A.2d 32, 36 (Md. Ct. Spec. App. 2007). ↩

5. Andrew McQuilkin, Sleeping Gate Keepers: Challenging The Admissibility of Cell Phone Forensic Evidence under Daubert, J. High Tech. L. 365, (2011). ↩

6. U.S. 579 (1993). ↩

7. Daubert Standard, Legal Information Institute, (6 Sept. 2020, 6:48p.m.) https://www.law.cornell.edu/wex/ daubert _standard. ↩

8. N.W.2d 283 (1986). ↩

9. Paul McCarthy, Forensic Analysis of Mobile Phones, University of South Australia, (7 Sept, 2020, 5:45p.m.) https://www.8051projects.net/files/public/1236046309_9698_FT19075_forensic_analysis_of_mobile_phones.pdf. ↩

10. PIRL Cell Phone Guide, (11 Sept 2020, 6:23p.m.) https://www.cwagweb.org/wp-content/uploads/2018/07/ Prosecutors-Initial-Reference-List-for-Windows-Computer-Forensics.pdf. ↩

11. Wayne Janson & Rick Ayers, Guidelines on Cell Phone Forensics, NIST, 2007. ↩

12. Best Practices for Mobile Phone Examinations, SWGDE, (11 Sept. 2020, 6:28 p.m.) https://www.webcitation .org/5lgBUfACZ. ↩

13. John B. Meixner & Shari Seidman Diamond, The Hidden Daubert Factor: How Judges Use Error Rates in Assessing Scientific Evidence, Wis. L. Rev. 1063, 1065, (2014). ↩

14. Cal.3d 512, 533 (1985) ↩

15. Supra. Note 4. ↩

16. H Marshall Jarret, Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigation, OLE Exec. Off. U.S. Att’y 1, 191 (2009). ↩

17. Fed. R. Ev., R. 801(c). ↩

18. Id. At R. 801(a) ↩

19. F.2d 1476, 1494 (7th Cir. 1990). ↩

20. Fed. R. Ev., R. 803(6). ↩

21. F.3d 225, 230-31 (4th Cir. 2007). ↩

22. S. Ct. 2705, 2711 (2011). ↩

23. U.S. 813, 822 (2006). ↩

24. F.3d 225 (4th Cir. 2007). ↩

25. S. Ct. 2705, 2711 (2011). ↩

26. Fed. R. Ev., R. 901(a). ↩

27. United States v. Baker, 538 F.3d 324, 332-33 (5th Cir. 2008). ↩

28. F.3d 729, 733 (9th Cir. 2007) ↩

29. F.3d 140, 151 (2d Cir. 2007). ↩

30. Fed. R. Ev., R. 901(b) ↩

31. WL 1880335, (5th Cir. Jul. 7, 2006) ↩

32. Fed. R. Ev., R. 901(b)(3). ↩

33. Id. At R. 901(b)(4). ↩

34. F.3d 1318, 1322-23 (11th Cir. 2000) ↩

35. Fed. R. Ev., R. 901(b)(9). ↩

36. Timothy M. O’Shea, Thinking Outside the “Business Record” Box: Evidentiary Foundations for Computer Records, Wis. St. B.J. (2008). ↩

37. Mark L. Krotoski, Effectively Using Electronic Evidence Before and At Trial, US Att’ys Bull. 1, 69, (2011). ↩