Source: http://www.centrallaw.com/tag/cell-phone/
Timestamp: 2018-04-25 00:50:13
Document Index: 132841714

Matched Legal Cases: ['§ 2510', '§ 2701', '§ 2705', '§ 2510', '§ 2701', '§ 2510', '§ 2701', '§ 2510']

cell phone Archives - Law Office of W.F. ''Casey'' Ebsary Jr
Home » Criminal Defense News » cell phone
Posted in Computers	Tagged cell phone, iPhone, Password, search warrant
Computer Crimes Experts, Mobile Phones, Devices, and SD Card Storage
Posted on January 20, 2016 by W.F. Casey Ebsary
Computer Crimes Experts, Cell Phones and SD cards
Recently I reviewed a computer crime case where the dates on files on an SD card seized by the police, examined by the police computer forensic laboratory, and by a defense expert in computer forensics showed some unusual patterns in the dates of files that allegedly contained contraband. Those files on the SD-card were later the basis of criminal charges and an arrest. There were claims of evidence spoliation. “Spoliation” is a fancy word for tampering. Sometimes a Computer Crimes Experts can come in handy. During a lengthy interrogation by the Prosecutor there were some answers given that may apply to virtually any cases involving data stored on a mobile phone SD card.
Questions and Answers from Computer Crimes Expert testimony on SD Storage Devices in Mobile Devices
What are hash values in SD cards and stored files?
“These are the hash values of that. That is a method that I use to be able to correlate that picture with the picture on the SD cards, things like that; but it’s a fingerprint. Every file has a unique fingerprint.”
What is the creation date on a file stored on an SD card?
“I have seen instances where if a file was moved to another system, the creation date is what the current date is of that system. Because, as far as that system’s concerned, hey, it was created on my system today.”
What about iPhone, where there are no SD storage devices?
“For example, with iPhone being a proprietary system, you’re — you’re talking about something that’s an encrypted system and we constantly stay abreast . . . . “-
Do both police and forensic examiners use Cellebrite?
“[W]e — as a company, in general, stay abreast of that, the changes there, as I’m sure your group has the same — same challenges. With that, we’re — we ‘ re always challenging our vendors. There’s three primary vendors we use, including Cellebrite, which you guys use, as well. But challenging them to stay abreast of it.”
What is the job of a computer forensic examiner in case involving cell phone data and SD storage devices?
“To look at it with the eyes of a computer forensic expert to determine whether the evidence being portrayed was accurate or if there was evidence being omitted or not looked at from a different way and we all know that when you’re looking at it from a prosecution point of view, you look at evidence from that angle. If you’re looking at it from a defense point of view, since I work both sides, I know I’m going to look at the evidence differently in cases because in one you’re trying to find underlying causes one way or another. So I felt my job in this was to look at the evidence to determine whether or not everything was being described accurately and completely.”
Are there different types of files stored on mobile device SD cards?
“When you talk about system files, it’s a little bit more complex. The system does many, many things to make your life work better on a computer. And storage locations could be temporary areas; the system just uses and works with. That’s very beneficial to us in a forensic area because that can be very telling as far as how the system was used, what the system is doing, who’s doing what and what’s automatic, what’s not, what’s user initiated, what’s system initiated, all that is good. You can tell that from the temporary areas. There’s also caching areas.”
What are Cache files on an SD card?
“Caching areas are when the computer does something and then it goes and does something else, it caches it out, caches something back in; that’s very telling of what’s going on in the system to us. Who initiated, whether it’s automatic, whether it’s deliberate, stuff like that. There is allocated resources, unallocated resources, deleted areas; there’s just a — just a plethora of stuff that the system does and there’s a lot of different storage locations. Now the ones that I’m focusing in on, for this particular case and this particular report, are the ones that, you know, give us telltale sign of something. And I would have to read it real quick here to know what we’re getting at. I was hoping you were going to ask something specific in here, but that’s basically an overview of what storage locations are.”
What is the significance of where files are stored on an SD Card?
“So storage locations, I gave you an example to help you understand how storage locations work, the difference between pictures and documents, stuff like that. The system is the same way. It does certain things, it will store them in different places. The other key point here then, also is that in — when you’re talking about the system storage locations, they’re not accessible by the user. These are areas that obviously if the user could access those, you could — you could destroy your system. But these are typically areas that are not accessible by the user. By us, yes, from a forensic point of view.”
Why are system storage files important?
“Because, depending on how the device acquired a particular piece of information, whether it be media or text or whatever, how it was — how it came to exist on the phone matters. And system storage can help us to determine that.”
Can date meta data on an SD storage device used on a phone be altered?
“I’ve seen people fool that and they’ll put a cell phone in a shield bag in which case it doesn’t make connection; and there is an app, I think, that can change the date. So there’s people that could do things like that but in these particular cases, these were active and that’s really not the issue that I want to get into. The problem is that depending on the software use or how things come about — and it’s called a feature. And there’s a feature that when you take a file and you put it onto a system, that it maintains the original creation date that that particular, let’s say photograph you made, was maintained. And it’s a feature because you want to know that the Christmas of 2004 occurred on December of 2004, not when you happened to move it over there. So it is a feature of something. But then there are some operations when you move things over, and I’ve seen it before because I’ll see stuff come to be on a system, and they’re milliseconds apart, the creation date. And I know that those were — that was a copy operation performed.”
“You plug in the SD card and the metadata is put on the SD card. Last access date in — in doing the correlation was — would be updated on the phone, as well. But let’s say, for instance, if you put
an image, a brand new image on there, and the creation date was last year and you put another image on there, maybe you copied three images and the way you copied it it happened to pick up the date of the computer which was, you know, maybe you changed the date of the computer and you wanted to show it to be last month. Then when you take that SD card and you plug it in the phone, you’re going to see one image with that date from last year as a create date and then you’re going to see three images, milliseconds apart, that are from last month. What I’m saying is that the phone becomes slave to the SD card as far as the metadata –“
Can computer crimes experts discover data files placed on a mobile device without the user’s knowledge?
“[J]ust realize that when I’m talking about the push, that the technology is there, that the . . . potential is there for stuff to be pushed on your computer. And of course, the user is oblivious to all this going on. And that’s why you could actually go to a website that had unfortunate information on it and your computer now is a recipient of that information and you, the user, are none the wiser.”
“Sometimes the user doesn’t even know they went somewhere. Sometimes in — in this world of malware and viral attacks and exploitation of compu — of people’s identities, there’s a lot of times — like, and I use the term unfortunate, is if you do a search, one thing these search engines do not do is assess where it’s going to take you and you could click on something and then it could actually take you to a site that doesn’t display anything but it certainly puts stuff on your computer and then redirects you to something else to show you what you think you wanted to see. There’s a lot of smoke and mirrors going on behind the scenes that the user’s not aware of. That’s the push technology I’m
talking about . . . .”
“Whether or not you saw it, whether or not you meant to go there, that’s — that does not — those two statements don’t come into play when it comes to push. . . . Push includes whatever the — and I’ll call it malicious in some cases, but whatever the site, or whatever the originating prospect that might be. It could be a server, it could be a site, it could be almost anything. Whatever it is, it will push on there
and I can’t tell you what that will be. In — I can tell you in general what it is. In general it’s thumbnails.’
“The fact that Windows does that, is a feature to allow you to operate better. But how many times have we heard about there being a hole, an exploited hole in Windows that Microsoft had to go in
and patch with a new release or with — with a new update they patched this hole or they discovered this — this whatever was open and they come in. You take a feature on something and you get a
website that exploits that feature, I think you kind of then answered your question because then okay, well whose fault is it? Well, it’s a feature of Windows to do this. But they’re — the reason it was written was to optimize web browsing, that’s it. Now to push big stuff on there, and push other stuff on there, when people are taking it to its limit and exploiting it and doing the wrong thing, then I’d say it’s the fault of the site.”
Posted in Computers	Tagged cell phone
Spend 600 Months In Prison When Police Search Lost Cell Phone
Posted on December 3, 2015 by W.F. Casey Ebsary
Search of Lost Cell Phone
What Happens When Police Search Your Lost Cell Phone That Has Illegal Material On It?
The story begins in a Walmart in Florida. The owner lost their phone at Walmart. After he left the phone, it was found, and the owner agreed to pick it up from the store. The owner of the phone failed to pick the phone up from the store. The store manager looked at the phone in an effort to find a photo of the owner. When the manager found contraband on the phone, she called the cops – police search lost cell phone.
Search Warrant for an Abandoned Cell Phone
Police search lost cell phone – The cops waited 23 days to get a search warrant. A Florida Court ruled that this did not constitute an unreasonable delay to obtain a search warrant. First, the court found that the defendants had hoped the store manager would not report the materials found on the phone to the police. Second, the phone owner had filed an insurance claim and replaced the phone with the exact same model. The decision to not retrieve the phone from the store, coupled with the filing of an insurance claim, and replacing the phone with the same model constituted an abandonment of ownership of the phone. Search and seizure law requires that those who challenge a search and seizure must have standing to challenge the search. In this case, the phone owner had no standing to challenge the search, the phone and any rights the owner had to challenge the search and seizure were gone. The court also addressed the Private Search Doctrine that supports searches by citizens, that otherwise might be illegal if performed by the police or the government.
Sentenced to 600 Months in Federal Prison
By the way, the court found that a 600 month sentence for the materials found on the phone was just fine. The phone owner entered a written plea agreement and the sentence was a possible outcome that while it was as harsh as the judge could impose, it was within the terms of the plea agreement.
“When Vo [store manager] failed to meet Sparks [phone owner] with the phone as the two had previously agreed, Defendants knew how to find Vo to get their phone back. But Defendants did not return to their Walmart store and look for Vo. Nor did they ask for Walmart’s assistance in obtaining their phone, found in its store, by its employee. They also did not file a report with Walmart or the police complaining that Vo would not return their phone, despite their requests. Instead, they made a conscious decision to stop pursuing the phone, even though they knew how to get it back with reasonable effort. That decision—whether because Defendants hoped that Vo would not report them if they did not continue to seek the phone or because Defendants simply thought recovery of the phone was not worth their reasonable effort—can be viewed only as a deliberate decision to abandon the phone. Because Defendants abandoned their phone within three days of having lost it, they lack standing to challenge law enforcement’s 23-day delay between recovering the phone and obtaining a search warrant to search it.”
The Private-Search Doctrine
“The Fourth Amendment provides that the “right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated.” U.S. Const. amend. IV. The protection the Fourth Amendment affords, however, extends to governmental action only; “it is wholly inapplicable ‘to a search or seizure, even an unreasonable one, effected by a private individual not acting as an agent of the Government or with the participation or knowledge of any governmental official.’” United States v. Jacobsen, 466 U.S. 109, 113, 104 S. Ct. 1652, 1656 (1984) (quoting Walter v. United States, 447 U.S. 649, 662, 100 S. Ct. 2395, 2404 (1980) (Blackmun, J., dissenting)). So once an individual’s expectation of privacy in particular information has been frustrated by a private individual, the Fourth Amendment does not prohibit law enforcement’s subsequent use of that information, even if obtained without a warrant. Id. at 116, 104 S. Ct. at 1656; see id. at 117, 104 S. Ct. at 1658-59.”
Read Complete Opinion Here: http://media.ca11.uscourts.gov/opinions/pub/files/201412143.pdf
Read More About Search And Seizure of A Cell Phone Here.
Read Even More About Search And Seizure of A CellPhone Here.
Posted in Computers	Tagged cell phone, cellphone, search warrant
“electronic devices will be removed from all members of a jury panel before jury deliberations begin”
“After you are called to the courtroom, the judge will give you specific instructions about these matters. The / A judge will tell you when you are released from this instruction. Remember, these rules are designed to guarantee a fair trial. It is important that you understand the rules as well as the impact on our system of justice if you fail to follow them. If it is determined that any one of you has violated this rule, and conducted any type of independent research or investigation, it may result in a mistrial. A mistrial would require the case to be tried again at great expense to the parties and the judicial system. The judge may also impose a penalty upon any juror who violates this instruction. All of us are depending on you to follow these rules, so that there will be a fair and lawful resolution of every case. “
Jury Instructions on Cell Phones and Electronic Devices
Posted in News	Tagged cell phone, Electronic Devices, jurors
Tampa Computer Trial Attorney – Lawyer on Computers in Court
Posted on August 15, 2014 by W.F. Casey Ebsary
Tampa Computer Trial Attorney on Computers in Court
Law Enforcement and attorneys for the other side have a team working against you. Why not have your own Forensics Team working for you? More than ninety percent (90%) of documents are now created electronically, and less than thirty percent (30%) of those electronic documents are ever converted to paper. Rules on preserving electronically stored information and strategies to recover that data make having a Forensic eDiscovery team more important than ever before.
Police have specialized equipment analyzing original digital media such as hard drives, disks, and flash drives, and optical disk drives in the computer forensics lab. There is special hardware and software that retrieves evidence from cell phones, including text messages (SMS) and pictures. For computers, specialized software is used to examine the computers and extract the evidence. We can too.
We use a team of attorney(s) and forensics expert(s) to help sort through data used in prosecution of federal indictments and state charges, fraud, hacking, theft of trade secrets, and other forms of cybercrimes.
With surge in popularity of mobile devices we can now forensically retrieve Information from mobile devices. We also provide help in searching corporate e-mail, personal e-mail, Short Message Service (SMS) text messages, personal notes, calendar entries, photographs, address books, and inbound and outbound call logs. This type of information can be invaluable to prove certain facts for a case.
Remember – an expert can help preserve the chain of custody and this data can then be used in litigation.
Computer in Court? Tell Me Your Story 813-222-2220 .
Posted in Computers	Tagged cell phone, cyber, cybercrime, flash drive, hard drive, sms
Cell Phone Searches – Supreme Court to Rule on Warrant Requirement
Posted on January 21, 2014 by W.F. Casey Ebsary
Cell Phone, Cell Phone Search
Cell Phone Searches – Supreme Court
Update: “Chief Justice John Roberts delivered the opinion of the Court, concluding that a warrant is required to search a mobile phone.[8] Roberts wrote that it fails the warrantless search test established in Chimel v. California.”
“The Supreme Court granted certiorari review in two similar cases, both used with evidence obtained by means of a warrantless search of a cell phone during a lawful arrest.
One friend has said, “Wow, the Supremes are taking a serious look at cell phone searches! There’s been talk for a while now about the problems courts have applying old standard to modern technology. We may get a sea change in S&S law. Of course, we may not, too, but it’s really worth watching. If you have a cell phone search case now, for goodness sake make your 4th Am motion and/or objections (track the language in these 2 cases).” Thanks DE for your thoughts on this issue.
In Riley v. California, No. 13-132, a state case, the question presented is:
Whether evidence admitted at petitioner’s trial was obtained in a search of petitioner’s cell phone violated petitioner’s Fourth Amendment rights.
In United States v. Wurie,No. 13-212, the Feds appealed, the question presented is:
The cases are Riley v. California, No. 13-132, and United States v. Wurie,No. 13-212.
Posted in Computers, Criminal Defense	Tagged cell phone, Cell Phone Search
Posted in Computers	Tagged cell phone, search, Warrant, Wurie
Cell Phone Surveillance | Cell Tower Data | Judge’s Opinion
Author’s Comment: Your cell phone tells police a lot about you. A Judge recently provided written testimony about about the impact of the ECPA (Electronic Communications Privacy Act — that is a law that appears to be about anything but ensuring privacy of electronic communications). Title I of the ECPA 18 U.S.C.A. § 2510 allegedly protects wire, oral, and electronic communications while in transit. It was enacted to set down requirements for search warrants that are more stringent than in other settings. If you have issues or questions about this sweeping federal law, call me toll free at 1-877-793-9290.
Excerpts from the written testimony are below. We will be posting the complete testimony and will link to that for our readers.
“ECPA was passed in 1986 as a laudable attempt to balance the privacy rights of citizens and the legitimate interests of law enforcement, given the communications technology of that day.”
Author’s Comment: The ECPA provides that many of the requests and records are to remain secret. Title II of the ECPA, the Stored Communications Act (SCA) 18 U.S.C. §§ 2701 to 2712 protects communication held in electronic storage, most notably messages stored on computers.
“By contrast, the SCA does not require $ 2703(d) orders to be sealed, and allows for “preclusion of notice” to others only if there is reason to believe the investigation would be jeopardized or other adverse consequences would result. 18 U.S.C. §§ 2705(b)(l)-(5).”
“There are over 500 federal magistrate judges serving in district courts around the country. In addition to civil matters, our responsibilities on the criminal side generally include almost everything except conducting felony trials.”
“One of our chief functions is to issue search warrants and other orders in aid of criminal investigations. These include electronic surveillance orders for pen registers, trap and trace devices, tracking devices, 2703(d) orders for telephone and e-mail account records and activity.”
“With rare exceptions, ECPA orders pertain to ordinary crimes and criminals, not national security or terrorism cases.”
“The process is exparte, meaning only one party – law enforcement – appears before the magistrate judge. Since this is at the criminal investigation stage, no defendant has yet been charged so no defense counsel is there to challenge the government’s request. Likewise, no representative of the electronic service provider or the target phone’s subscriber is present. In fact, the orders routinely contain gag orders precluding the service provider from advising their customers that the government is accessing their cell phone or e-mail account records. The public rarely learns about these orders, even long after issuance, because they are routinely placed under indefinite (i.e., permanent) seal.”
“A reasonable estimate is that the total number of electronic surveillance orders issued at the federal level each year substantially exceeds 10,000”
“The application sought “the location of cell site sector (physical address) at call origination (for outbound calling), call termination (for incoming calls) and, if reasonably available, during the progress of a call,” in addition to “the strength, angle, and timing of the caller’s signal measured at two or more cell sites, as well as other system information such as a listing of all cell towers in the market area, switching technology, protocols, and network architecture.” 390 F. Supp. 2d at 749. “
“Under ECPA, secrecy is achieved in two-ways: (1) gag orders preventing service providers from informing customers about law enforcement monitoring of their cell phone and e-mail usage; and (2) sealing orders denying public access to judicial orders. Typically, electronic surveillance orders contain both types of provisions, but rarely impose an expiration period; instead, those orders remain in place “until further order of the court.”29 The catch is that there is no mechanism in place for the judge to revisit the sealing order. She does not retain jurisdiction over the case, which is not a “case” at all but an investigation that may or may not ripen into a real case.”
“The brunt of such secrecy is not necessarily borne by the surveillance targets who are ultimately charged with a crime. After all, they are entitled to discover the nature and source of the prosecution’s evidence, including electronic surveillance orders leading to arrest. Suppression motions are available in the event of a constitutional violation. But not everyone caught up in the web of electronic surveillance is ultimately charged with a crime. Any target is likely to call or be called by family, friends, associates, or even total strangers who have no connection to a criminal enterprise. Yet by the fortuity of a single call, these by-standers may be swept up in a criminal investigation, their cell phone use monitored and their location tracked in real time. Unlike criminal defendants, however, these presumably law abiding citizens will never find out. The phone company cannot tell them, and courthouse records will disclose nothing. Ordinarily, a citizen whose house or office is searched is provided a warrant duly signed by a judicial officer, giving notice of the particulars of the search.33 When a citizen wishes to challenge the legitimacy of a law enforcement search of his home pursuant to a warrant, the law affords due process for that purpose. But when searches are shrouded in permanent secrecy, as in most cases of electronic surveillance, due process becomes a dead letter. Such secrecy also has a pernicious impact on the judicial process . . . .”
Author’s Comment: There are proposals to restrict the scope of this federal law, but as of today, November 22, 2010, the law and its ability to gather a diverse array of data about your cell phone usage remains a frequently used tool of federal law enforcement, including DHS (Department of Homeland Security) , DEA (Drug Enforcement Administration), FBI (Federal Bureau of Investigation), State, and Local Law Enforcement.
Cell Phone, Surveillance , SCA, Stored Communications Act , ECPA , 18 U.S.C. § 2510, 18 U.S.C. § 2701, , Electronic Communications Privacy Act
Cell Phone Surveillance | Cell Tower Data
Posted in Computers, Criminal Defense, Federal Court	Tagged 18 U.S.C. § 2510, 18 U.S.C. § 2701, 18 U.S.C.A. § 2510, cell phone, ECPA, Electronic Communications Privacy Act, SCA, Stored Communications Act