Cops love iPhone data trail, criminals who use device may be left without alibi

Chicago Sun Times ^ | 08/12/2010 | Chicago Sun Times

[The Magical Mischief Tour]

Detective Josh Fazio of the Will County Sheriff's Department loves it when an iPhone turns up as evidence in a criminal case.

The sophisticated cell phone and mobile computer is becoming as popular with police as it is with consumers because it can provide investigators with so much information that can help in solving crimes.

"When someone tells me they have an iPhone in a case, I say, 'Yeah!' I can do tons with an iPhone," said Fazio, who works in the sheriff's department high-tech crimes unit.

The iPhones generally store more data than other high-end phones -- and investigators such as Fazio frequently can tap in to that information for evidence.

And while some phone users routinely delete information from their devices, that step is seldom as final as it seems.

"When you hit the delete button, it's never really deleted," Fazio said.

The devices can help police learn where you've been, what you were doing there and whether you've got something to hide.

Former hacker Jonathan Zdziarski, author of iPhone Forensics (O'Reilly Media) for law enforcement, said the devices "are people's companions today. They organize people's lives."

And if you're doing something criminal, something about it is probably going to go through that phone:

• Every time an iPhone user closes out of the built-in mapping application, the phone snaps a screenshot and stores it. Savvy law-enforcement agents armed with search warrants can use those snapshots to see if a suspect is lying about whereabouts during a crime.

• iPhone photos are embedded with GEO tags and identifying information, meaning that photos posted online might not only include GPS coordinates of where the picture was taken, but also the serial number of the phone that took it.

• Even more information is stored by the applications themselves, including the user's browser history. That data is meant in part to direct custom-tailored advertisements to the user, but experts said some of it could be useful to police.

Clearing out user histories isn't enough to clean the device of that data, said John B. Minor, a member of the International Society of Forensic Computer Examiners.

Just as users can take and store a picture of their iPhone's screen, the phone itself automatically shoots and stores hundreds of such images as people close out one application to use another.

"Those screen snapshots can contain images of e-mails or proof of activities that might be inculpatory or exculpatory," Minor said.

• The keyboard cache logs everything that you type in to learn autocorrect so that it can correct a user's typing mistakes. Apple doesn't store that cache very securely, Zdziarski contended, so someone with know-how could recover months of typing in the order in which it was typed, even if the e-mail or text it was part of has long since been deleted.

Sometimes, the phones can help even if the case isn't a matter of life or death.

In Kane County, the sheriff's department used GPS information from one of the phones to help reunite a worried father with his runaway daughter, who was staying at a friend's house.

"His daughter felt comfortable at the house because she did not think her parents knew where she was, and she actually answered the door. She was a bit surprised as to the fact that [her] dad found her," said Lt. Pat Gengler, a spokesman for the sheriff's department.

[longtermmemmory]

wow, steve jobs was the face in the apple commercial.

[stripes1776]

Any sufficiently well-featured image metadata editor will allow you to alter or remove the GPS location. Metadata may also include your camera type, the exposure, resolution, date, time, a photo thumbnail, copyright info and much more.

Thanks for the information.

Even if the photo is legally releasable to a third-party, it might accidentally come with your metadata.

Not good.

[HiTech RedNeck]

App screen snapshots: Instant redisplay of app again, before it gets completely started, helps keep the impression of a fast, responsive UI (a fast UI is mostly subjective, and Apple puts a lot of effort into making UIs *feel* fast even if they aren't).

The illusion would be dispelled as a cynical ploy the moment I tried to type into, or menu navigate on, the "instant" app and found that I had to wait before it responded. Especially if it wasn't just one app that seemed to "freeze" upon appearing. Windows and most Linuxen do this the right way. What you see is what's ready.

[HiTech RedNeck]

So many place names are similar (is it Green Street or Greene Street?) that darn straight a cache is going to spy on your actual place name usage. Whom does it tattle to? The fuzz, if they get their hands on your phone.

[antiRepublicrat]

The illusion would be dispelled as a cynical ploy the moment I tried to type into, or menu navigate on, the "instant" app and found that I had to wait before it responded.

They wouldn't do it if it were noticeable. We're dealing with tenth of a second times or less, faster than you can start typing, but enough to give your mind the impression of a more responsive UI.

Perception matters more than fact, because perception is fact to a user. Look at the chart below describing user reactions to a progress bar in a scientific study:

Those were the perceptions of the users of how long those operations took, although they all took exactly the same amount of time. Simply changing the behavior of a progress bar can make a user THINK the computer is doing something faster or more slowly. Specifically to this article, people thought Vista copied files more slowly than XP (even though it actually copied them faster) because 1) the progress didn't start until 12 seconds into the copy, making people think it took longer, and 2) the progress bar slowed down at the end as cached data was written, which makes people think it took longer. The SP1 "fix" for slow Vista file copy was only a change to the progress bar behavior. It didn't speed up copies at all.

Apple has historically concentrated on the perception of UI performance, while Microsoft usually concentrated on clock performance. That's a main reason why Apple's UI is better. These aren't tricks or illusions, this is simply engineering that accounts for the fact that perceptive and clock time are not the same. Apple software is usually designed for the way our minds work, not how fast a clock ticks.

[HiTech RedNeck]

Kubuntu’s KDE does have a little “bouncer” which appears as soon as one clicks for a program which is going to take some time to appear.

[SunkenCiv]

Good to know, oops, I mean, this makes no difference in my everyday life. ;’)

[antiRepublicrat]

Kubuntu’s KDE does have a little “bouncer” which appears as soon as one clicks for a program which is going to take some time to appear.

That sounds like a copy of the OS X Dock behavior.

[Fire_on_High]

I’ve always suspected that was the case, just never formally tested it.

I’ve got multiple machines side by side and typically just used the one that was easiest to see to initiate network tasks, but every so often a certain picky game on the Vista box would hork its permissions and I needed to deal with something before I could take the time to reset them. Everyone banged on how slow Vista was, but seemed to me that without fail, the machines took within a second or so of the same time for the same file copies/moves.