Last week we made the trip across the pond to Olympia, UK for the Forensics Europe Expo. This was a new conference for the Magnet Forensics team, and I was excited to present on how Geolocation Artifacts and Timeline Analysis can help solve digital forensics investigations.
During the session, I used a fictional case study (involving child luring that led to murder) to demonstrate how different tools and techniques can be used to analyze evidence recovered from computers and smartphones at different stages of an investigation; including tips on how to start a search for a missing person, and find evidence needed to support criminal charges.
If you’re interested, you can see my presentation slides here:
The presentation seemed to spark a conversation among IEF users at the Expo about how they have used IEF Timeline (one of our visualization tools built into our software) in their own cases and investigations.
One gentleman told me about a case where he had used our timeline tool to prove a particular person was, in fact, the user on a system. As we all know, it’s often easy to determine what was done on a computer, but when you have to tie the actions to an actual person in the real world, things become much more difficult.
In this particular case, the suspect’s defense was that someone else had been behind the keyboard when the actions in question occurred. But with IEF Timeline, the investigator was able to identify a number of key events in the order they occurred, confirming that the computer user was in fact the suspect they had in custody.
If you’re interested in learning more about IEF Timeline, and how it can benefit your cases and investigations, here are some good resources:
- IEF Timeline Blog Post by our CTO, Jad Saliba
- Webinar: Using Geolocation Artifacts & Timeline Analysis to Solve the Case: A Digital Forensics Case Study
Cheers!
Jamie McQuaid
Forensics Consultant, Magnet Forensics
