Getting the cell phone

As we see frequently, texts and messages on cellphones can be important evidence in a case.  Most of the time the MCIO’s merely got the CW to provide a screenshot and otherwise cherry-pick what they want to take as evidence in the beginning.  Of course the cherry-picking is in favor of the CW and they ignore what might be Brady-plus material.  True, I’m starting to see more MCIO’s do a Cellbrite extraction, which is good.

United States v. Pham from the NMCCA teaches us that we need to be precise in what we ask for when we are seeking the CW’s phone.

Here, the CW “voluntarily provided her cell phone, a Samsung Galaxy S-IV, to NCIS for forensic examination. NCIS investigators performed a logical extraction of the phone and returned it to PI the same day. In response to a January 2016 defense discovery request for a copy of the physical extraction” the defense got “a logical extraction performed 11 months earlier.”

A defense expert consultant confirmed this disclosure.  So the defense moved to compel a physical extraction of the CW’s “Samsung Galaxy S-IV” cell phone. “The defense asserted that the report derived from the logical extraction did not include deleted data, hidden data, or mobile applications data.”

The NCIS expert explained that he could not perform a physical extraction because a “Galaxy S-IV” was not a “rooted” phone.  The evidence provided in support of the defense expert conclusion that a physical extraction could be performed was a “screenshot,” of an apparently earlier version of the phone, a “Galaxy SIII, Alfa,” and the screenshot indicated it was a “rooted” phone.  Based upon this limited and contradictory evidence, we agree with the military judge that the appellant failed to sustain his burden of persuasion. Furthermore, there was no evidence submitted at trial or to date that in February 2015, when NCIS had control of PI’s cell phone, the technology existed to conduct a physical extraction of a Galaxy S-IV cell phone.

Cellebrite can now unlock iPhone 6 and 6+, also extract data from array of popular apps, according to cyberscoop.com.

What Happens When You Press that Button?  — according to Cellbrite.