special timeline ne...
 
Notifications
Clear all

special timeline needed

7 Posts
5 Users
0 Likes
571 Views
(@pinin113)
Posts: 47
Eminent Member
Topic starter
 

hello everybody
this is the case i'm working on
car accident,2 dead people.
one car in highway,straight,no fog, nothing strange,hits a car in front
with ufed we found that the driver received a message on 2 phones he owns, about 30 seconds befor the hit(we have time from in car gps and highway cameras).
i need to know if the driver readed the message in the moment of the crash.
how can i see the exact second the message has been read?i think that could be useful to find a log of the proximity sensor of the phones,but i don't know where to search…
thanks

 
Posted : 12/12/2015 2:02 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

What was the device you read with UFED?
What is the OS version?
What messaging app data did you read?
What is the messaging app version?

 
Posted : 14/12/2015 8:46 am
(@davepawlak)
Posts: 29
Eminent Member
 

Don't let the details cause you to over analyze the data at hand. There is going to be a degree of uncertainty because human nature and unpredictability is involved.

The "exact" moment a text message is read will not be recorded by the phone. However, the exact moment the text message is displayed on the phone in a manner likely to which the user would read is marked. In that the message is opened and exposed. Though, it does not mean the user was viewing the message.

For instance, a text message appears on the lock screen and the user swipes the screen to cancel the message preview. However, the message opens causing the DB to believe the message was "read". The user never looked at the phone past swiping the screen to cancel the preview, yet the phone thinks the user was looking at the phone reading a message.

User created artifacts would be a better indicator if present. An outgoing call, third party app usage, sent MMS/SMS, etc. These would be more reliable with a person using their device at an exact time and a short amount of time prior to be completely reasonable.

Also, JHUP's questions are very important to the mix.

 
Posted : 14/12/2015 10:45 am
(@pinin113)
Posts: 47
Eminent Member
Topic starter
 

thanks for the replies.
he has 2 devices
iphone 6 ios 8.4.1
lg e610 4.4(if i well remember)
there is an incoming phone call on the iphone, about 3 minutes before the crash.
the man is not collaborative at all, at the beginning he said that the phones were of someone else, than the carrier told us that he was the owner.there are two messages in the 10 minutes before on the iphone(not imessage and not whatsapp), incoming
on the android there is one whatsapp, incoming

 
Posted : 14/12/2015 9:23 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

Hello,

Please recover all MP3 files from the phone and listen to them.

I was shocked to discover that Google Maps stores the "oral" directions one hears when using Google Maps on one's phone as temporary MP3 audio files.

In other words, when the Google Maps' female voice is providing directions through my phone's speaker, the content of those directions are being stored as MP3 audio files. Previously I had mistakenly assumed that Google Maps was sending me the audio directions as a "radio" broadcast.

So, if one listens to these Google Maps related MP3 audio files in order, one can determine the location(s) a person was travelling.

This information may (or may not) prove informative to your case.

Regards,

Larry

 
Posted : 15/12/2015 1:44 am
(@zergling)
Posts: 38
Eminent Member
 

There is a chance that your whatsapp logfiles at least detect the "screen on" event.

I can only confirm this for android devices on which it looks like this (inside whatsap logfiles)

YYYY-DD-MM HHMMSS LL_I W [1main] app/screen/on < - On android its local time (not utc+0)

This is caused by simply turning the screen on and unlocking the device (the whatsapp app was not opened at this point but was still running in background)

At least on android the whatsapp application subscribes the screen on event of the operation system.

So give it a try and let us know )

 
Posted : 11/01/2016 7:19 pm
(@pinin113)
Posts: 47
Eminent Member
Topic starter
 

ok, i will take out the case this week and try.thank you for the information

 
Posted : 11/01/2016 9:11 pm
Share: