by Jeffrey Lehn, Senior Digital Forensics Consultant at Page One
The Dual Traps of Modern Forensic Toolsets
Modern digital forensics is fundamentally an amalgamation of hardware, software, problem solving, and interpretation. Just as a historian argues a thesis based on primary sources and verified outcomes, a forensic examiner cuts through ones and zeros to reconstruct events, recover truth, establish the factual timeline, and articulate data through comprehensive documentation. This reliance has created a dual trap for modern digital units: the false negative and the false positive.
Every seasoned examiner is familiar with the experience of a false negative. An investigator or detective approaches, evidence in hand, ready for analysis. You document and review the hardware, attempt to verify system compatibility, potentially even make the necessary connections, and discover the device is unsupported. Initial incompatibility results in a dead end, potentially for the entire case. Automated parsers to decipher the data do not exist; however, incompatibility does not equate to a lack of information, or an investigative dead end.
The possibly more sinister trap is the illusion of a false positive. Same scenario as above, but the forensic tool lists a device as compatible. The forensic examiner follows the procedure to access and acquire the data, analyzes it, and provides a report of findings to an investigator. Unbeknownst to the investigator or the forensic examiner, and although a status of “success” was returned by the tool, the parsed report was not based on a comprehensive data set. The report may be accurate for what it parsed and still be incomplete. More information is potentially recoverable, but it is up to the examiner to go past the standard protocol. Being vendor, tool, and technique agnostic is essential to methodological soundness. The risks of these two traps and the necessity to understand low level forensics and data is illustrated by the case People of the State of New York v. Christopher Seabrook.
People of the State of New York v. Christopher Seabrook
On Monday, January 8, 2024, at approximately 0045 hours, a 2011 Silver Toyota Yaris with four occupants paused at a stop sign in Brooklyn, New York. When the Toyota proceeded forward, it was struck by a 2023 White Kia Sportage. The Kia was traveling at a high rate of speed and impacted the Toyota across the front and rear driver’s side doors, spinning the small Toyota into a parked car, where it came to rest. The Kia continued approximately 30 to 40 feet past the intersection before halting with heavy front-end damage.
Emergency personnel transported all four Toyota occupants to Elmhurst Hospital, where it was determined the driver and passengers had all sustained severe head and body trauma. Two passengers were listed in critical condition and the third passenger was pronounced deceased. The occupants of the Kia fled the scene on foot.
A thorough video canvass was conducted. It captured a male driver and two females exiting the vehicle. Security cameras allowed investigators to track the driver for almost two miles until he walked inside a store in Brooklyn, where he removed his mask, allowing ID quality video to be recovered from the security cameras inside the premises.
The Kia was taken into custody at the scene. DNA was recovered from the driver’s side airbag, but cross-contaminated genetic material from the decedent constituted 45.9% of the sample. The DNA contamination likely occurred when emergency responders attempted to help the victims and manipulate the Kia. That contamination made the digital forensic evidence critical to determine the identity of the driver and decisively close the case.
Limitations: The False Negative
An NYPD Highway Collision Investigation Squad Detective accessed the Event Data Recorder (EDR) via GIT America tools. The EDR data confirmed that the Kia was traveling 56 miles per hour ½ second before the collision and 100% engine throttle, 1-second before the impact on a street with a 25 mile per hour speed limit. While EDR data describes in detail moments of the impact, investigators were no closer to identifying the driver, leaving the infotainment system as the last hope.
The Kia was equipped with a Kia Connect Gen 2 DAV2NT infotainment system without embedded telematics. This infotainment system was recovered and delivered to me for analysis in my role as a Detective in the NYPD Auto Crime Unit. At the time, Berla iVe, the industry standard hardware/software ecosystem for performing vehicle forensics, did not support the infotainment system. Berla’s product allows examiners to access and parse vast datasets from vehicles, often relating to connected devices, contacts, call logs, locations, GPS tracklogs, vehicle data, and more. Unfortunately, when this was an active investigation, Berla iVe was unable to connect, access, or parse any data from this vehicle. This is the trap of the false negative. An examiner dependent on a vendor, tool, or technique stops here, but there is more to glean from the infotainment system. A 2023 Kia Sportage is a modern vehicle with modern connectivity and is effectively a giant cellphone on wheels, with similar potential for solving crimes.
Acquisition Methodology
Unwilling to concede a dead end at this impasse, I bypassed the standard automotive forensic tools entirely and began a hardware extraction by performing a Chip Off. A Chip Off is a mechanical, hands-on forensic technique that involves physically removing a chip from a printed circuit board (PCB) in order to access and analyze the data it contains.
First, disassembly of the DAV2NT infotainment system revealed the PCB, which I examined under magnification. After identifying the non-volatile memory, a SanDisk SDINBDG4-8G eMMC BGA 153 chip, I secured the board in a PCB holder. Using a Quick 862DW+ hot air rework station and solder flux, I directed uniform heat at the board surface liquefying the connecting solder joints and allowing me to cleanly remove the eMMC chip with tweezers. Positioning the chip upside down under magnification, I applied solder flux and used a JBC Soldering Iron to clean the BGA contacts.
Next, 99.9% Isopropyl Alcohol ensured the chip was clean of any residue or extraneous material. After confirming under magnification suitable contact point condition, I placed the SanDisk chip into a Teel Technologies eMMC SD Adapter (11.5×13, 153 BGA). Connecting the adapter to a forensic computer enabled AccessData FTK Imager (version 4.7.1.2) to image the chip as a raw, uncompressed mass storage device. Finally, acquisition metadata confirmed the integrity of the physical extraction and FTK Imager verified the data by producing matching hash values.
File System Analysis
Many modern automotive infotainment systems run Unix-, Linux-, or Android-based operating systems, and many standard forensic tools can map, index, and analyze their file systems. The image created from FTK Imager was ingested directly into Autopsy Forensic Browser, which mapped out 22 logical volumes.
Within the file structure, I then identified unencrypted at-rest user data related to connected Bluetooth devices in volume 13 at the /vol_vol13/bluetooth/DB_BMS directory path. Infotainment systems commonly store user data, such as paired devices, call logs, and address books, in SQLite databases. Through my analysis, I discovered several databases. The most relevant to this investigation was MC_201a94846625.db.
Inside the database, I found a table titled “bluetooth_contacts” that included contact names and phone numbers. The .db file is named after the paired device’s MAC address, which is queryable through countless MAC lookup websites and tools. In this case, it resolves to an Apple device, which was later determined to be an iPhone. Tool compatibility was the issue, not the data content.
Correlation and Resolution
The contact named “My Number” gave a full cellphone number. The defendant was arrested in a completely unrelated offense for Driving While Intoxicated (DWI). During arrest processing, the defendant gave a phone number and stated that it was his “grandfather’s” number. When investigators subpoenaed subscriber information for the phone number I recovered from the infotainment system, the name returned matched the grandfather’s name the defendant had provided.
A search warrant was drafted and signed for historical cell site records for the cellphone number. The records returned by the warrant place the phone at a hotel in midtown Manhattan and an additional Facebook search warrant showed photo and video posts matching the cell site location in the hotel. These photos and videos included high resolution selfie images of the defendant, matching the video from inside a store in Brooklyn. Additionally, at the time/place/occurrence of the crime, cell sites of the cellphone number were mapped and consistently follow the video canvass to the incident, and leaving the incident, to the store.
Information gathered by this digital forensic investigation, when undeterred by the incompatibility of Berla iVe, led to Seabrook’s arrest. In the case of People of the State of New York v. Christopher Seabrook, Seabrook pleaded mid-trial to the Court’s offer of Manslaughter 2 for 2-6 years, Assault 2 for 5 years, Leaving the Scene Causing a Death for 1 year; to be served concurrently 5-6 years. At the time of the incident, Seabrook was also awaiting trial on a Criminal Possession of a Weapon case.
Incomplete: The False Positive
Between the close of the active investigation and the trial, Berla released an update that included compatibility for this vehicle. This is the second trap: the false positive. Berla’s iVe, like most forensic suites, has a search function that lists datasets that may be recovered, accessed or parsed from a specific device or, in this case, vehicle. At the time of the trial, Berla iVe showed that it was able to obtain data relating to the navigation and system metadata. The only tool officially supporting this vehicle on the market did not support obtaining connected devices or contact data.
Due to cross-contamination, the DNA evidence was complicated, making this case reliant on the digital forensic investigation of the automobile. The false positive is poisonous to an investigation because the examiner and investigator believe they have everything. Leads go cold, data is missed, and crimes go unsolved.
Not Supported?
Berla all but created the field of vehicle forensics, and Berla iVe is a fantastic toolset. They set the standards in education, access, and reporting. It has become common shorthand in police departments to ask “Did you get the Berla?” meaning “Did you get the vehicle data?” Just because a tool is synonymous with the field does not make it the only solution. If I had relied solely on the version of Berla iVe current at the time of either the investigation or the trial, crucial connected device data would not have been recovered. As a forensic examiner, you are not just the tool that you use. You are the expert, responsible for examining artifacts and databases. Every dead end is an opportunity to attempt something different. Do not stop at “Not Supported.” Experiment, discover, and, most importantly, share what you learn in this ever-evolving field.
2023 Berla Investigator of the Year, Jeffrey Lehn is a Senior Digital Forensics Consultant at Page One, specializing in vehicle forensics and advanced data recovery. During his 20-year NYPD career, he established the department’s Vehicle Forensics Unit and qualified as an expert witness in U.S. District and New York State Supreme Courts. As Director of the NYPD Auto Crime School, he authored courses and trained more than 4,000 investigators worldwide. A former Teel Technologies instructor and training content contributor, Jeff works at the intersection of technology, investigation, and law, ensuring forensic findings are accurately interpreted and defensibly presented as evidence.
Media Coverage of the Incident/Case
https://brooklyneagle.com/386437/man-sentenced-for-fatal-hit-run-crash
https://www.amny.com/nyc-transit/brooklyn-hit-and-run-crash-january-8-2024/
