Mobile Forensics · Cloud & Account Evidence · Lesson 5 of 5

Challenge: The Missing Messages

Work a harassment case across a victim's export and a suspect's cloud accounts.

The case brief

Detective Morgan Ellis, in the United States, is investigating a harassment complaint. The victim, Jamie, has been receiving threatening emails at a Gmail address. Jamie wants to help and has agreed in writing to share the emails, sign-in records and account activity from the past three months.

The suspect, Casey, has an iPhone and an iCloud account. Casey's phone was factory reset last week, before it could be seized. Casey also used an older Android phone, which has been sitting unused in a drawer for about ten weeks.

Morgan has two very different sources to work with. Jamie's account can be reviewed with consent. Casey's accounts can only be reached through legal process, and Casey isn't cooperating. Morgan wants to move quickly but stay within the law at every step.

Start with Jamie. Morgan wants the emails and sign-in records in a form that can be checked later.

Before it's gone

Casey's iPhone was reset, so its local data is likely gone. But the reset doesn't delete Casey's iCloud account, and the account may still hold synced data and backups. Morgan is drafting a warrant for the account, which will take several days. Morgan worries that Casey might sign in and delete things in the meantime.

Jamie also mentions that Casey once bragged about clearing out old messages. Morgan knows backups get replaced and expire over time.

The encryption wall

Apple responds to the warrant, but notes that Casey had turned on Advanced Data Protection. Casey's iCloud Backup, Photos and iCloud Drive come back as data Apple can't decrypt. Morgan's sergeant asks whether anything useful could still be in Apple's hands.

Morgan also has the timeline from Jamie's export, which shows when the threatening emails arrived. That could be lined up with any account records Apple can still read.

The phone in the drawer

Last, Morgan considers Casey's old Android phone. It was backed up with Google One, and its photos were saved to Google Photos. Nobody has used it for about ten weeks. Morgan wonders what's still in Google's hands for that device.

Casey never turned off backup on the phone. It simply stopped being used. Morgan wants to know before drafting another warrant, so the request asks only for data Google is likely to have.