Cracking Cases with Digital Forensics

What Is Digital Forensics :-

Digital forensics is the act of assisting an investigation by accumulating evidence from
digital artifacts. These digital artifacts include computers, network, cloud, hard drive,
server, phone, or any endpoint system connected to the infrastructure. The activity also
includes collecting information from emails, SMSs, images, deleted files, and much
more. In short, the responsibility of digital forensic investigator is a threefold process:

1. Preserving or recording the state of a digital device

2. Analyzing the state of digital device

3. Reporting retrieved information

In the case of a cybercrime, a digital forensic examiner analyzes digital devices and
digital data to gather enough evidence to help track the attacker. As data are abundant due
to digital dependencies, the role of a digital forensic investigator is gaining prominence
everywhere.

For example, a digital forensics investigator may dig into a device, such as a cell
phone, to determine whether data proves or disproves an alleged action

Digital Forensics Is More Important Now Than Ever

With 95% of the Americans owning mobile phones today, the existence of data is
staggering. [1] But it is not just mobile phones that forms a part of investigation, but other
devices like laptop, desktop, tab, juke box, play station, smart watches, and everything
under the Internet of Things family are responsible for exchange of data. The
advancement of technology adds more to the volume of data, and therefore, digital
forensics should be expanded to adapt to meet the needs of the users. The emergence of
higher sophisticated devices has stressed on the importance of digital forensics too.

Famous cases cracked with digital forensics

Digital footprint stands the amount of usage or accessing the data on various digital
devices. By following the digital footprints, the investigator would be able to retrieve the
data that are critical for solving the crime case.

Dr. Conrad Murray’s lethal prescriptions :-

Another recent case solved with digital forensics was that of Dr. Conrad Murray,
personal physician of Michael Jackson. Digital forensics played a crucial role in the
trial. After Jackson passed away unexpectedly in 2009, the autopsy found Jackson’s
death to be the result of prescription drugs. Investigators discovered documentation
on Dr. Murray's computer showing his authorization of lethal amounts of the drugs,
and he was convicted of involuntary manslaughter for Jackson’s death. He served
two years in prison and lost his medical license.
Doctor Is Guilty in Michael Jackson’s Death :-
Another recent case solved with digital forensics was that of Dr. Conrad Murray,
personal physician of Michael Jackson. Digital forensics played a crucial role in the
trial. After Jackson passed away unexpectedly in 2009, the autopsy found Jackson’s
death to be the result of prescription drugs. Investigators discovered documentation
on Dr. Murray's computer showing his authorization of lethal amounts of the drugs,
and he was convicted of involuntary manslaughter for Jackson’s death. He served
two years in prison and lost his medical license.

LOS ANGELES —

Michael Jackson, among the most famous performers in pop music history, spent his final
days in a sleep-deprived haze of medication and misery until finally succumbing to a fatal
dose of potent drugs provided by the private physician he had hired to act as his personal
pharmaceutical dispensary..

The physician, Dr. Conrad Murray, was found guilty of involuntary manslaughter nearly
two and a half years after Jackson’s shocking death at age 50. The verdict came after
nearly 50 witnesses, 22 days of testimony and less than two days of deliberation by a jury
of seven men and five women. The trial had focused primarily on whether Dr. Murray
was guilty of abdicating his duty or of acting with reckless criminal negligence, directly
causing his patient’s death.

Jackson, who had become a star as a child in Gary, Ind., singing with his siblings in the
Jackson 5, grew into one of the best-known performers in the world. Though increasingly
eccentric in his later years, often living on a secluded California estate he called
Neverland, Jackson always had a fervent core of fans and, despite scandals, his lavish
lifestyle and persistent money woes, always seemed just a comeback away from a return
to the top.

Hundreds of fans showed their devotion by gathering outside the downtown courthouse
throughout the trial — many of them sporting Jackson’s signature single white glove. On
Monday, they chanted “Justice, justice” and spent hours after the verdict dancing to his
hits, from “Beat It” to “I Want You Back.” Huge crowds had also gathered outside the
California court where Jackson was tried, and acquitted, on child molesting charges in
2005.

The singer’s parents, Joe and Katherine Jackson, and siblings La Toya, Jermaine and
Randy were in the courtroom for the verdict. The family left the courthouse without
speaking to the hordes of reporters gathered outside, simply saying they were “very
happy” with the verdict and flashing a thumb.

Dr. Murray, a Houston cardiologist, was paid $150,000 a month to work as Jackson’s
personal physician as he rehearsed in Los Angeles for “This Is It,” a series of 50 sold-out
concerts in London that he needed to pay off hundreds of millions of dollars in mounting
debts.

Testimony showed that Dr. Murray had stayed with Jackson at least six nights a week and
was regularly asked — and sometimes begged — by the insomniac singer to give him
drugs powerful enough to put him to sleep. Jackson, Dr. Murray told the authorities, was
especially eager to be administered propofol, a surgical anesthetic that put him to sleep
when other powerful sedatives could not. Testimony indicated that propofol, in
conjunction with other drugs in the singer’s system, had played the key role in his death
on June 25, 2009.

For its part, the defense tried to portray Jackson as a man so desperate to make his
comeback concerts a success that he was willing to take wild chances and grew terrified
that he would not be able to perform to his own exacting standards without more rest and
less stress.

The morning Jackson died, Dr. Murray told investigators during a recording played in
State Superior Court here, the singer told him, “Just make me sleep; it doesn’t matter
what happens.”

When Jackson died, he was more than $400 million in debt, but since his death, his estate
has prospered, generating more than $310 million and paying off most of his debts.

The estate has struck several lucrative deals, including a movie, video games, a new
recording contract and two productions by Cirque du Soleil.

Shortly after Jackson’s death, Dr. Murray told investigators that the pop star would
routinely plead with him to administer more propofol, calling it his “milk.” The defense
argued that Jackson gave himself the fatal dose of the drug. The Los Angeles County
coroner ruled that Jackson’s death was caused by “acute propofol intoxication,” in
combination with two other drugs in his system.

Murray’s iPhone offers snapshot of Jackson’s final weeks

The doctor came by night and left each morning. What went on in the second-floor
bedroom where Michael Jackson was treated by his personal physician night after night
was known only by the doctor and his famed patient.

On Wednesday, the private words of the feeble patient to the caretaker at his bedside rang
out in the Los Angeles courtroom where Dr. Conrad Murray is now on trial for Jackson’s
death. Barely comprehensible and slurring his words, the singer shared with Murray his
dreams about a children’s hospital he wanted to be remembered for.

The recording of the exchange six weeks before the singer’s death, prosecutors say,
is the clearest evidence the doctor knowingly continued to give his patient the
powerful anesthetic that ultimately killed him.

In its entirety, the recording was about four minutes long and personal, with Jackson
talking about his high hopes for his comeback concerts, his dreams about what kind of a
legacy he would leave, and his childhood.

Why and in what context Jackson was recorded may never be known. The recording was
recovered from the personal iPhone Murray turned over to police a month after the doctor
was interviewed by police. Stephen Marx, the forensic computer examiner who found it,
could only say in his testimony Wednesday that the recording was created at 9:05 a.m. on
May 10, 2009.

What is clear, prosecutors have said, is that two days after the recording was made,
Murray ordered an additional shipment of propofol, the surgical anesthetic that killed
Jackson. Murray told police he gave the singer the drug almost every night in the two
months leading up to Jackson’s death on June 25.
Jurors heard Jackson telling Murray what he had often said publicly — that he related to
children because his music career had interrupted his own youth.

“I love them because I didn’t have a childhood. I had no childhood. I feel their pain, I feel
their hurt,” he said.

The doctor was barely heard on the recording, intermittently replying “Mmm-mmm” as
Jackson spoke. After the singer suddenly grew silent, Murray asked, “You OK?”

After a pause, Jackson replied: “I am asleep.”

Jurors also heard a recording from five days before Jackson’s death — a voice mail
message from the singer’s manager, Frank DiLeo, to Murray.

“I’m sure you are aware he had an episode last night. He’s sick,” said DiLeo, who died
this year. “I think you need to get a blood test on him. We got to see what he’s doing.”.

Murray’s phone also offered jurors snapshots of what the doctor was doing in
Jackson’s last hours, during which Murray told police the singer was awake, unable
to sleep and begging for propofol. Marx, the computer examiner, said the doctor’s
phone automatically stored images of the phone screen at certain points in time.

At 7:03 a.m., his phone showed e-mails from two people who were hammering out the
contract under which Murray was to care for Jackson at $150,000 a month. At 9:45 a.m.,
the screen showed e-mails from his Las Vegas practice containing medical records for
“Omar Arnold” — an alias Jackson used — dating back to 2006.

At 11:17 a.m., about half an hour after the doctor said in police interviews that he gave
Jackson a dose of propofol, Murray sent an e-mail to a London insurance broker to say
that press reports about Jackson’s health were all “fallacious.

When a coroner’s investigator took the stand later in the day, jurors saw a photo of a
lifeless Jackson on a hospital gurney, his mouth agape and his skin paper-white.
Investigator Elissa Fleak testified that the photo, which prosecutors highlighted during
opening statements, was the first she took of the star in her death investigation at Ronald
Reagan UCLA Medical Center.
prosecutors used Dr. Murray’s iPhone to collect forensic
evidenc.

The evidence, which included a recording of Jackson speaking in a slurred manner, was
gathered by DEA computer forensics examiner Stephen Marx. It helped prosecutors
make the case that Murray veered significantly from acceptable medical practice.
Through the iPhone, Marx found digital medical charts thought to be non-existent, as
well as emails Murray sent hours before Jackson died on June 25, 2009.

And yet, according to several high-tech forensic experts, there is plenty of confusion
among those who work in law enforcement in terms of what smartphone and tablet data
can be captured and analyzed, how to do that correctly, and how reliable the information
is–particularly GPS location data.

Mark McLaughlin of Los Angeles-based Computer Forensics International, who has 14

years of experience as a computer forensics examiner, says few understand that “digital
evidence is very fragile.” During the past 18 months, while working on many criminal
defense cases, he has seen law enforcement use flawed procedures. “They are collecting
data in an invasive manner,” he says, “which means they’re changing the original piece of
evidence.” They don’t have extensive training or experience, according to McLaughlin,
“and they can just go out an buy software and call themselves ‘examiners.'” In court he
has proven that some have unwittingly altered data when copying it from a smartphone.
“It all starts with a good forensic copy,” he says, “and if you don’t have that, everything
you do after is suspect.”

A professor of math and computer science at the John Jay College of Criminal Justice at
the City University of New York, Ping Ji, says the state of the art of smartphone forensics
today is “in its infancy.” Evidence sometimes is hard to seize, and procedures for
acquiring it from smartphones are quite different from getting evidence from a computer,
she notes. For example? “[Investigators] shouldn’t shut down right away or remove
the battery, because [they] may lose some evidence.”

Surprisingly, John Jay’s Masters Program on Forensics Computing does not yet cover
smartphones and tablets. Because today’s mobile devices are smart enough to let users
access the Internet through network providers as well as wireless systems, like Wi-Fi, Ji
is considering proposing a course on wireless network forensics or wireless network
security, which would have a component on smartphone systems.

One difference between computer and smartphone forensics is that it is impossible to

copy data from smartphones that are turned off, whereas disc drives just sit there.
Examiners therefore isolate the phones in a Faraday Box (a.k.a. Faraday cage or shield),
which blocks network access and inhibits signals. Alternatively, examiners can remove
the portable memory chip known as the Subscriber Identity Module, or SIM card.

Reiber estimates that law enforcement professionals only acquire 10% of the data that’s
relevant and available on iPhones and iPads, and similar devices, but failing to harvest
other important, digital artifacts. He also acknowledges, sympathetically, that in this
economic climate, officers often have trouble getting funds for equipment, software, and
training.

There are federal and state grants and training programs available from the likes of the
National Computer Forensics Institute (NCFI) in Hoover, Ala., which is part of the U.S.
Secret Service, and the Federal Law Enforcement Training Center (FLETC) in
Brunswick, GA, which is part of Homeland Security. But they can be hard to obtain, and
the federal agencies that govern them must recommend the students.
A suspect’s past locations can be determined by downloading photos they took with their
iPhone onto mapping software, Reiber says. Coupled with geo-tags embedded in the
picture, this gives examiners the latitude and longitude to tell where the shot was taken,
he says. That’s a “fantastic piece of evidence,” Reiber says. But as a counterpoint, see last
April’s IEEE Spectrum piece by Purdue University Professor of Cyber Forensics Richard
Mislan. In it, he argues that iPhone location data are designed to improve location
identification, not to track it.

The iPhone “relies on multiple technologies to determine its location–satellites, Wi-Fi

hotspots, and cell towers combined depending on their availability,” Mislan wrote. “This
hybrid method is very inaccurate in rural areas, though is usually slightly better in urban
areas. And while someone analyzing the collected data can often identify a basic route,
it’s usually only accurate to within five to ten miles.” Mislan concluded that “Law
enforcement agencies will continue to use the iPhone location data and other related
intelligence for corroborating information about where phone users have been originally
obtained from other sources, but…relying on the iPhone data as evidence itself may be a
crime.”

Although Murray was sentenced in 2011 to four years in prison, he was

released two years early for good behavior.

“Some may feel this was a medical malpractice case. It wasn’t. It was and is a criminal
homicide case,” Pastor said. “Michael Jackson died not because of an isolated, one-off
occurrence or incident. He died because of a totality of circumstances which are directly
attributable to Dr. Murray.

“I will restart my life and, God willing, I will be a model to show the world that despite
adversity, and when bad things happen to good people, they can restart their life and
succeed,” Murray said.

Murray’s medical license was suspended; however, his attorneys have already filed
petitions in Texas to have it reinstated, ABC News reported.

The news prompted Brian Panish, the attorney for Jackson’s mother Katherine, to release
a statement to ABC News, saying, “We hope he can never practice medicine again and
will not violate his Hippocratic oath and hurt another patient.”