I was wondering if someone could tell me if the properties of a pic in a cell phone can be viewed the same as in a computer? In a computer I can check created, modified and accessed dates. Can these dates be checked for a pic in a cellular device? Does it make a difference what type of operating system the phone is based on? Is it specific to the file extension or does it have something to do with the software used to do the exam?
Thanks!
Yes you can see all these properties in a picture file taken by a phone including the make and model of the phone that took the picture (in case it was sent by MMS) and sometimes also geotags of the location the picture was taken
RonS,
Thanks for the reply. I am wondering if it makes a difference if the geotagging is off and the pic was not shared with anyone. My question is directed at using the phone as evidence.
Under "most" circumstances we teach our officers to turn the phones off once they seize them and get a search warrant. If a phone was seized at 600 PM then when it is examined it should not show activity past that time.
If an officer decided to search the pic or even text content prior to turning the phone off to see if there was anything of evidence value would a forensic examination be able to determine this?
If I understood you correctly most forensic tools will record the time and date of when the extraction took place, so the examiner will see it happened before the warrant.
Does this answer your question?
Does this answer your question?
Not really, but I may not be explaining myself well.
A phone is seized at 600 PM. Right after the seizure and prior to being placed in property an officer allows curiosity to get the best of him and decides to look through the photos in the phone to see if their might be anything of evidentiary value.
The phone has 100 pics. While scrolling through he finds that 99 of them contain nothing of value. Pic 100 contains an image of CP, a bloody knife believed to be a murder weapon or a body.
Now I totally understand the whole fruit of the poisonous tree thing. Now since this individual has scrolled through all 100 images could a forensic examination of the cellular device show this by looking at the accessed dates and times on the photos?
In a nutshell If I look at a photo on a computer I will change the accessed date. If I look at a photo on a cell phone do I change the accessed date? If so what program would tell you that and does it have anything to do with the operating system of the phone.
Thanks!
hcso1510
RonS responses are probably the same as others would give to you. His, like others, can only be a general response because you haven't actually identified the make/model of handset.
If you are looking to identify a 'rule of thumb' that can be applied to all makes/models then I doubt you will achieve that goal unless your investigation seeks to consider majority, if not all, past/present handsets. You could categorise your investigation based upon a crude criteria selection choice so that your results show applicability to
a) Mobile Phone
b) Feature Phone
c) Smart Phone
and/or then categorise a mixture of different makes/OSs etc
i) Blackberry
ii) Windows Mobile
iii) Android
iv)Java
v) Symbian
vi) Nokia Proprietory
etc
HCSO
The CA High Court ruled today that a cell can be searched incident to arrest without a warrant
http//
I'm sure there will be challenges to it….
I guess the update of the accessed date/time would depend on the phone. Some of them probably don't even track last accessed date/time.
-=A=-
As trewmte mentioned, this is very much phone dependent and in many of the cases will only be accessible by using a physical extraction (beside the smartphones).