There are situations where prosecutor asks for all SMS messages in a mobile phone. And you find out that the phone is not supported by Cellebrite, Xact and other devices. So you have to make a manual examination and write down all SMS, where there are hundreds of them.
What would you do in a situation like this if you were a state-run lab? Would you sit and write each SMS manually for days and keep other examination reequests lie there and wait for days?
Or would you just say in your report that there are many messages in the mobile phone and that it was not supported by the examination device so it would take so much time to write each of them down, and that you can not do it at all.
Any comments appreciated.
I have been in a similar situation before, and our approach was to photograph each message on the phone. It is a bit of a time consuming way of doing it, but at least there wont be any transcription errors this way.
Quite a few people use ZRT from Fernico for this kind of examination.
Hope this helps.
thanks JDCoulthard
I have too been through that (slightly over a thousand SMSes) and what I did was to photograph all the SMSes including their details and type them out on a spreadsheet. it's painful but it gets the job done.
I have too been through that (slightly over a thousand SMSes) and what I did was to photograph all the SMSes including their details and type them out on a spreadsheet. it's painful but it gets the job done.
I presume that if the camera is placed correctly and good lighting/resolution/whatever is given, the pictures can be scanned through an OCR Software.
Recent ones have an amazing accuracy, and if properly set, exepcially in the case of a single font and not that much of "accented characters", they can be tweaked as to reach nearly or all the way up to 100% accuracy.
jaclaz
The ZRT is ok, but when I played with it, it was a little slow to focus.
What worked best for me was to use a Canon IXUS camera, with the digital macro enabled. I was then able to use a small desktop tripod with the phone underneath.
I think my record was around 4000 photographs from a single phone. My finger will never be the same after that one 😉
http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=5638
Yunus
Try videoing the handset examination and screens (texts, phonebook etc).
1) Make sure when videoing you have appropriate light (no light bulbs shining on the handset screen), the video camera has good zoom for close ups and that the video is on a tripod set down on a firm base (nothing worse than seeing video performed by shaking hands - causes nausea).
2) Ensure the video has integrity levels to demonstrate the video has not been contaminated in anyway. Make two working DVD copies and place the Master recording in secure holding.
3) Send a working DVD copy to the prosecutor and ask which texts required to be printed out as single screen shots.
4) As you have an identical working DVD copy when you receive your instructions from the prosecutor you can then set to work.
Reasoning
a) If you don't give the prosecutor options then it is no surprise when asked for hand-written evidence.
b) You provide this service where on rare occasions due to the limitations of a particular handset not being supported by other tools, it is part of your best practice methodology.
c) Hand-written evidence could be subject to errors due to your human-intervention, as can typed evidence.
d) Text messages can contain symbols and images (*emoticons) that are not easily translated into written evidence. As these symbols and images can add influence to the textual content, an error in the hand-written evidence that withholds the symbols or image from the text may translate to a serious or harmful threat. Moreover, even if you were to produce a typed version on your computer, it doesn't necessarily mean you wont make mistakes. Consequently, such errors (that need not occur) could import a false understanding of the defendant's behaviour in relation to the data.
*An emoticon is a textual expression representing the face of a writer's mood or facial expression - http//
en.wikipedia.org/wiki/Emoticon
Ouch !
I think my record was around 4000 photographs from a single phone. My finger will never be the same after that one.
So maybe videoing the evidence is the way forward?
I think my record was around 4000 photographs from a single phone. My finger will never be the same after that one
Resorting to old school forensics here… Was each SMS message relevant for the investigation? If its for a drug matter, messages like "Hey, about that deal, you owe me xxx OK" would be relevant, but when it comes to messages like "hey bro, wake up" probably not.
In our lab, and in scenarios where XRY or Cellebrite does not support the phone, we utilise ZRT as well, give some instructions to show the investigating officer how to use ZRT and leave it up to them to take photos of the relevant messages.
We are using video also as it helps with messages that are longer than the screen size will permit without scrolling the message. In addition, coming from one of the most sued departments in the world, I would hesitate selectively imaging messages because the suspect will invariably say that you did not get the exculpitory(sp?) messages that would clear him of all charges.
Just a couple of thoughts,
Eric
Video recordings are great and so are photographing the exhibit. Both can give you screenshots and where necessary, images can be tendered as an annex so we need not type everything out, especially if its only 1 or 2 text messages out of 500.
using OCR will be great too.. saves a hell lot of time.
D