Mobile Forensics · Timelines & Analysis · Lesson 5 of 5

Challenge: The Late Night Message

Decode, convert and weigh the evidence in an after-hours break-in.

The case brief

A small shop in a New York suburb was broken into one night in mid July 2025. You're a digital forensics examiner at the county lab. A detective has a warrant for a suspect's iPhone, covering messages and app usage for July 14 and 15, and a separate warrant for the carrier's records for the same two days.

The suspect says he was at home all evening, a few blocks from the shop.

Here's what you have so far:

• A message in an iPhone database with a raw timestamp of 774238200. Your converter shows three readings: 1994-07-15 02:10 UTC as Unix seconds, 1970-01-09 23:03 UTC as Unix milliseconds, and 2025-07-15 02:10 UTC as Apple Cocoa time.
• A carrier record of a call that used a cell sector covering both the shop and the suspect's street.
• When the phone was seized, its clock matched the lab's reference clock, and automatic time was on.

Local time for the report

The detective's report will be read by people who think in New York local time. The shop's alarm went off at 10:05 PM local time on July 14.

You need to give the message's time in local time too, clearly labeled, so readers can compare it with the alarm. Remember the date, and which offset New York uses at that time of year.

What the cell record shows

The carrier's record shows a call from the suspect's phone at 22:20 local time, ten minutes after the message. It used a sector whose coverage includes both the shop and the suspect's home street.

The detective is keen to write that the record proves the suspect was at the shop. The suspect's lawyer will argue the opposite, that it proves he was at home. Your report has to say only what the record supports.

Asking for more

The detective now wants the suspect's historical cell site records for the whole previous month, to see whether the phone visited the area around the shop on other nights.

A colleague suggests saving time by asking for a court order under the lower reasonable grounds standard instead. You remember the 2018 US Supreme Court case on this exact kind of record.