Episode 7: Conversation with Benjamin Bierce on Cell Phone Data Collection

Benjamin Bierce:

With my forensic equipment, I can make a copy, a forensic image, which is basically a copy of what’s on the phone. This can make a huge difference in the case. It’s because, using a phone is so dangerous. Like we said before, it’s as dangerous as drinking and driving. The courts want to know this. Sometimes it’s just as important to prove that someone was not on the phone, as it is to prove that someone was on the phone.

David Craig – Host:

Today, After the Crash is proud to have Benjamin Bierce as our guest. Benjamin is a trained, certified and experienced digital forensic telephone examiner. He trained in digital forensic from the United States Army, United States Secret Service, the National Computer Forensics Institute, and the Federal Law Enforcement Training Center. He currently works for ESI or Engineering Systems Inc, where he is a senior staff consultant. This is, After the Crash.

David Craig – Host:

I’m attorney Dave Craig, managing partner and one of the founders of the law firm of Craig, Kelly & Faultless. I’ve represented people who have been seriously injured or who have had a family member killed and semi-rather big truck wreck for over 30 years. Following the wreck, their lives are chaos. Often they don’t even know enough about the process to ask the right questions. It is my goal to empower you by providing you with the information you need to protect yourself and your family, and each and every episode, I will interview top experts and professionals that are involved in truck wreck cases. This is, After the Crash.

David Craig – Host:

Welcome, Benjamin.

Benjamin Bierce:

Thank you. It’s a pleasure to be here, and thank you for this opportunity.

David Craig – Host:

Tell us a little bit, and also I’d like to thank you for your service in the United States Army. I appreciate that. You obviously have a lot of background and training with a variety of different folks. Tell me a little bit how that has helped create your expertise. What was most important? How did that help you?

Benjamin Bierce’s Background and Experience

Benjamin Bierce:

I was a robbery detective with Indianapolis Metro Police Department back in 2010, and I was also in the Army Reserve as a special agent. We had our annual training, and that particular one was the National White Collar Crime Center, and they trained us on analyzing cell phone records. At that point, I had no idea, no interest, it wasn’t something that was on my radar, it was just the mandatory training that was required that year by the army.

Benjamin Bierce:

So, I came back as a police officer in Indianapolis, and I started using it and I was amazed at how effective it was at that time, in helping identify and convict robbery suspects. We took that to the next step, and I started using it in homicide investigations when I moved up to homicide and we found it so valuable that I relinquished my homicide duties and started doing the phone records full-time for the homicide and robbery unit, and then from there, they moved me over to the… Or the police department moved me over to the computer and digital forensics unit so that I could do it for the entire department.

Benjamin Bierce:

Well, it wasn’t long after that, that I said, hey, this may be valuable in several cases as well. So, I started my own business at the time, part time while I was a police officer working with attorneys in mostly motor vehicle crashes, because identifying if somebody was on the phone was incredibly valuable. One of the interesting things on the police side, it’s all or nothing, it’s either a conviction or it isn’t a conviction, or it’s a conviction or it’s an acquittal.

Benjamin Bierce:

But on the civil side, it can have varying degrees of value. Instead of just focusing on winning or losing, we can introduce things into the case that can move the needle, and even quite significantly hundreds of thousands of dollars by showing that someone was using their device and was distracted at the time of the crash.

David Craig – Host:

I think of all the guests I’ve had, when I’ve told people who’s going to be on my podcast, people have been the most excited about this discussion. Cell phone use, it fascinates them. It fascinates them, and they see it and obviously, your expertise can be used, and is abused in criminal cases like you talked about. We see them as being used in divorce cases. We see it being used in other types of civil cases, as well as automobile cases.

David Craig – Host:

It’s one of those things that, everybody knows that there’s information there, but nobody knows for sure how much information, and they’ll be shocked, I think after they listen today, they’ll find out what all is available on these cell phones.

Benjamin Bierce:

It is absolutely amazing. We live our lives on our phones right now, and I’m finding… Because I do computer forensics, as well, and I’m working on cases… One of the types of cases that I’ve had a lot of interest in lately is business disputes, and non-compete agreements, things of that nature. When I’m getting the computers in, and I examine the computers, and then examine the cell phones, I’m finding almost everything on the cell phone that I’m finding on the computer, plus so much more.

Benjamin Bierce:

When someone has the intent to do something nefarious, they’re not likely to communicate their intents with their co-conspirators over a company owned device or computer or something of that nature. However, they feel perfectly free to be able to text each other, what their intentions are. But then at the same time, most of us have, if we’re involved with even a decent sized organization, we probably have our Outlook and our One Note and our One Drive and all these things on our phones as well. That’s almost mirroring what’s on the computer.

David Craig – Host:

With us, we started using it, and we’re using it more and more all the time, your expertise, because what we have found is there’s so many wrecks that are being caused by folks that are distracted. That’s one time when I use them, is that if I have a semi tractor trailer, that even though the rules require that they use a Bluetooth, we find that some drivers are still using them. They’re texting, they’re looking at pictures or pulling up social media. There’s all kinds of things that we’re seeing.

David Craig – Host:

We see distracted drivers that are injuring or killing people, when they’re using their phone. Actually, in my experience, I’ve been doing this for over 35 years, I’m seeing more wrecks caused by distracted driving than I am by drunk driving.

Benjamin Bierce:

Absolutely. Before I became a detective on the Indianapolis Police Department, I was a DUI enforcement officer, and I’ve also read studies that show that cell phone use can be as detrimental to a person’s ability to drive as being over the legal limit of alcohol. It’s absolutely a factor, and we need to get a handle on this. I think we’re moving in the right direction with legislation that prevents people from being able to text and drive.

Benjamin Bierce:

Sometimes the laws are written poorly to begin with, and then they’re revised. I remember the first law that came out in Indiana, I think, only covered the texting app, but later they picked that up to cover email and other such things. Then also in Indiana, I think it was last year, that they said you cannot hold the device up to your head anymore. You have to be using some kind of hands free device.

Benjamin Bierce:

While at the same time, technology is catching up, because our vehicles have hands free capabilities within them and the devices are getting better and you can dial without touching anything by voice command. Those are all good, but even so, it does add a level of distraction in especially those that don’t use that type of aids, the hands free aids are really putting those around them at risk.

David Craig – Host:

Then two points, even though they have legislation, sometimes the police are still hesitant to enforce it. Then cell phone use, it’s just one of those things that they see and they’re so familiar with it, that they’re a little less likely to enforce it. I have some clients who lost their legs, I have several clients who have lost loved ones due to fact that the other driver was using their cell phone. Yet, the police were hesitant or did not at all file any type of charges. I think we’ve got to get better at the enforcement aspect of it, but it will take time.

Benjamin Bierce:

Absolutely, and that’s probably a training issue for the police. Having been the guy that was out there writing the traffic crash reports, it’s not always a police officer’s favorite thing to do. They tend to get through them as quickly as they can. That being said, Just as well, I was a police officer, as a detective I specialized in the cell phone record analysis and digital forensics. There are police officers that are very, very good at crash reports, and that’s what they really focus on that.

Benjamin Bierce:

It’s almost as if you can see, when the crash report is being read, if it was one of these professionals, or if it was the patrol officer that doesn’t do it all the time, that had to do it. We don’t get to pick the officer that takes the crash report, we can only deal with it after the fact.

David Craig – Host:

The other problem, I do semi truck crashes all over the country, and in the different levels of police departments, obviously vary in the amount of resources they have available to them, varies from county to county, city to city, state to state.

Benjamin Bierce:

Absolutely, and that’s one of the benefits. I was very blessed to work for the Indianapolis Metro Police Department that had resources that allowed me to be able to specialize in what I did. I’ve worked with many other law enforcement agencies across the state and across the nation, and it depends on the resources of the department.

Benjamin Bierce:

A small Sheriff’s Department in a smaller state is not going to have the resources that, let’s just say, the Chicago Police Department has, and they don’t have the manpower to allow someone to specialize. The police officer that they send… I trained with many of these guys, but the police officer that they send to the training, because they need someone, it’s becoming more and more necessary for law enforcement to have some kind of digital forensics capability.

Benjamin Bierce:

They pick out one of their officers, or one of their deputies, that has a knack for it and send them to training. Well, when he gets back, most of the time, he’s writing traffic tickets or traffic control or patrol and responding to calls for service, things like that. Then maybe once or twice a year, they have a case that requires that skill.

Benjamin Bierce:

So, they get on it then but they, of course, have to reach out for some assistance usually from the state police in those instances. That’s true for the accident reconstructionists as well. They may send them to training, but they just don’t get the experience if their department covers a rural area that doesn’t have that many crashes.

David Craig – Host:

I’ve seen and I’ve actually talked to a lot of police officers who some actually left the police department, because of their frustration at the level or lack of level of equipment and technology. That police just can’t keep up on it, they can’t afford it in some of these smaller police departments, and they want to be able to prove, they’ve got to prove in court that somebody was actually using a cell phone, and they’re hesitant to do that, and they don’t have the technology or the expertise to do it.

David Craig – Host:

I’ve had many police officers, they’re not going to hire somebody like you typically in a smaller area. I’ve had a lot of them talk to me and same thing goes for reconstructionists, they don’t always have the 3D capability of scanning, they don’t have all the equipment that the private folks have. So, it just doesn’t get done, which I understand, but as a lawyer who my job is to protect the victims of serious wrecks with semi truck or trailers or other vehicles, my job is to protect them, and that’s why it’s important for my clients and folks that are looking at this to understand, you cannot count on the police necessarily to do a phone download, or to do a reconstruction or a 3D scan. If you hire somebody privately that knows what they’re doing, they’re going to know who to hire.

Benjamin Bierce:

Absolutely. With regards to the police departments in the smaller jurisdictions, they do have the resources of the state police in most states to go to, to get this kind of assistance. But the problem is, I remember when I was still working with Indianapolis Metro Police, the state police had about a six month backlog, and to tell you the truth, we did too.

Benjamin Bierce:

There were so many… Even an apartment that is well-funded and well-equipped as the Indianapolis Metro Police Department, we still had a significant backlog. I don’t know what the back… This was five years ago that I left the police department, so I don’t know what their capabilities are, or their backlog is right now. But back then, there was a significant backlog. But even if the police are able to get the downloads of the phone, things of that nature, they’re generally not going to be the ones that would testify in a civil case.

David Craig – Host:

Lawyers like me that are experienced, we look at it, and we’re doing more downloads all the time, not only of the folks who caused the wrecks, but also of our own clients. We want to preserve the phones and make sure that our clients aren’t on the phone at the time of the wrecks. I think it’s the standard of care in my industry now, that your lawyer should be looking out for your interest by preserving the evidence, and also then securing the evidence that’s available from the other side.

Benjamin Bierce:

Absolutely. Sometimes it’s just as important to prove that someone was not on the phone, as it is to prove that someone was on the phone.

What Kind of Evidence Can Be Found in a Cell Phone?

David Craig – Host:

Well, I’m excited, I know people are excited to learn about this. I’m going to let you educate us a little bit today on how it works. I guess, why don’t we start off by just telling us, what is in a cell phone, what kind of evidence is there?

Benjamin Bierce:

Well, let’s talk about the two major types of evidence that we can get related to cell phones, and the places that we can go to get evidence. The first one is the device itself. With my forensic equipment, I can make a copy, a forensic image, which is basically a copy of what’s on the phone. We can go in and we can take a look, and there are different levels of intrusion that we can go into the phone, that are able to collect more information, and a lot of times that’s dependent upon what type of phone it is.

Benjamin Bierce:

To give you an example, let’s say we have an rooted Android phone. What I mean by rooted is that’s something that some users can do to gain access to the higher levels in the operating system of the phone. Most of us never even think about that kind of stuff. But some people enjoy, it’s a hobby for them to be able to change what their phone can do, and to do that, they need to get root access.

Benjamin Bierce:

Once a phone’s been rooted, however, it is extremely vulnerable, and we can extract almost a bit for bit image, every one and zero that’s on the memory of the phone. Then it goes down in other levels, and I would say like the newest iPhones, we get the least information from, because of the way Apple locks down their operating system.

Benjamin Bierce:

We can still get quite a bit of information, quite a bit of valuable information, but it’s not even close to a bit for bit copy of the memory of the phone. Then once we take a look at what we can get from the phone, we call them the native apps. The applications that come on the phone, if we’re talking about the Android, then we’re talking about the Google environment, and if we’re talking about an iPhone, we’re talking about the Apple environment.

Benjamin Bierce:

With Apple, it would be Safari or the iMessage app, things like that, we’re going to be able to get pretty comprehensive data from those applications. Whereas we get some other applications that are not native, like Snapchat, which prides itself on deleting its images. Well, for one thing, many people as soon as they get a snap, they take a screenshot of it, and then it goes into their photos, and of course that’s preserved for us to recover. But it’s a little bit more difficult with things like Snapchat, we can recover some information, but we have to dig down into the database, and actually, rather than relying on our forensic equipment to bring these things to the surface, we have to manually go down and look at the code and look at the databases and convert times to something that’s legible that a human would understand, but it can be done, takes a lot more time, but it can be done.

Benjamin Bierce:

But think about what we have on our phones. Most of us use our phones for email as well, email messages are there. Many of the phones can download voicemail messages to the phone, and it makes it much more convenient for us because we don’t have to dial in like we used to have to do, we don’t have to dial in to our service provider and enter a code to be able to check our voicemail, it just automatically downloads to our phone.

Benjamin Bierce:

Well, when it does that, we have a little audio file on there. There’s so many things that we can get into. I was doing some experimentation with my own phone, and I found that… I have a habit when I… One of my family’s favorite meals is a tilapia meal that I make for them, and I have to make sure that I time how long I let them sit in the pan before I flip them over. Because I’ve got the grease all over my hands and things like that, I don’t want to touch the timer. So, I just say, “Hey, Siri, set a timer for three minutes.”

Benjamin Bierce:

Well, I was actually able to recover that audio file that my iPhone had recorded, of me asking it to set a timer. Sometimes, even when we try and use Siri, and it’s not always available, it’s not always preserved, and it doesn’t preserve, especially if it’s a longer command, it wouldn’t preserve the whole thing, but it was enough for, Hey, Siri, set timer for three minutes.” I was able to get that audio file.

Benjamin Bierce:

Pictures, videos, things of that nature are pretty easily recoverable from the phone. Then we can go to greater lengths on some things that are more difficult to recover.

David Craig – Host:

That’s-

Benjamin Bierce:

I’m sorry, go ahead.

David Craig – Host:

Our call history, is that something you’re able to recover?

Benjamin Bierce:

Yes, it would. Where that comes into play… Well, there are two ways that we can recover the call history and one is from the phone itself, and the other method of obtaining evidence, and that’s getting the records from the cell phone company.

David Craig – Host:

But a little bit more related.

Benjamin Bierce:

Right.

David Craig – Host:

But as far as just what you’re getting out the phones, I think people… You can get your call history, how about my contacts, people I have on my phone, you can get that?

Benjamin Bierce:

Absolutely. The nice thing about that is that when we look at the text messages, or the call logs, the forensic software that I use will automatically go into the contacts and if there’s a name associated there, it’ll come up in our report, and it makes it really easy to identify who we’re speaking with.

David Craig – Host:

Text messages, you’re going to be able to get those?

Benjamin Bierce:

Yes, and the interesting thing about that is the device itself is the best way to recover the text messages because the cell phone companies don’t record, with the exception of Verizon and only for seven days, but the companies don’t record the content of the message. So, we don’t know what the message says. If we get the phone records, we can see that a message occurred, but can’t see what it said. So, going into the phone and recovering that is the best way to recover the text message.

Benjamin Bierce:

Other interesting point is that iPhone to iPhone messages using the iMessage go through Apple servers and they don’t go through the phone company servers. Our phone records that we get will not show iMessage messages. No log, no evidence at all that it occurred. So, the only way to recover the iPhone to iPhone messages or iPhone to any Apple device messages using iMessage is through the phone itself or the iPad or the MacBook or any devices running iMessage.

David Craig – Host:

Photos and videos, would you be able to recover those by downloading the cellphones?

Benjamin Bierce:

Absolutely. As with photos, and with all artifacts or all evidence that we record from the phone, if the evidence, let’s say it’s a photograph, if the user deletes the photograph, and then I get the phone to do an examination of the phone, I may be able to recover that deleted message. As long as we can get it before the memory space that holds that deleted message, even though it’s deleted, as long as it hasn’t been overwritten with new data or cleared or erased, then we can recover that photograph or whatever the evidence may be.

David Craig – Host:

I know in my cell phone I use it for work. So, I have my Outlook, my calendar on there. Where I’m supposed to be, what time I’m supposed to be there written with reminders. Would you be able to extract that?

Benjamin Bierce:

Oh, absolutely. Absolutely. Not just Outlook, but also the native calendar app that comes on the phone, along with any memos, voice memos, calendar appointments, notes, things of that nature.

David Craig – Host:

What about Facebook? I have Facebook on my cell phone, are you going to be able to look at my Facebook account, if you are able to get the phone?

Benjamin Bierce:

That’s a little bit more difficult. The Facebook page that it comes from, probably not, not from the device that’s not connected to the internet, because Facebook, the application requires an internet connection. However, Facebook Messenger is recoverable. Now, it brings us to an interesting point with that, and it depends on the scope of the examination, and it also takes an additional either consent, subpoena, or court order. But many times we can download… The forensic software that I use is able to download a copy of the Cloud account.

Benjamin Bierce:

If we’re Facebook, Twitter, could be One Drive, Dropbox, things like that, that are on the cloud, as long as I have the username, the password and the appropriate authority, I can get copies of those cloud accounts.

How is the Information Gathered or Extracted From Cell Phones?

David Craig – Host:

Obviously, it’s a lot of information that you can obtain from someone’s cell phone. Tell us a little bit, I guess, people how do you do that? What’s involved in… If somebody is listening to this, and they’re a potential client out there, and they’re thinking, I think this other driver was on their cell phone, and they’re denying it to the police at the scene, but you’re looking in your mirror and you see them on their cell phone, and they say, “No, I wasn’t.” Now, the police aren’t probably going to check it. What steps need to be taken for us to find out whether that person was on their phone or not?

Benjamin Bierce:

Well, first point is we need to identify the need. But it’s getting to the point where it’s almost accepted that we need to look at the phone. Once we have established the need to look at the phone, then it becomes a discussion between the two attorneys, and once it’s agreed upon that the phones need to be examined, then the attorneys can develop a protocol, which is an agreement as to how we’re going to go into the phone, what we can look at. When we produce the report about the phone, do we want to go minutes, hours days around the time of the crash? What’s appropriate in this case?

Benjamin Bierce:

That’s going to depend on the case. With a traffic crash, it’s pretty easy. It’s, we’ve got one particular point in time that we want to take a look at. But if we’re talking about something like a business dispute, that may take years, so, our protocols will look very different. Now, in the event that one party does not want to produce the phone and the other party believes that it’s justified to produce the phone, then they may have to go in front of the judge and obtain a court order to produce the phone.

Benjamin Bierce:

Once the phone is produced, then, under normal circumstances, I do need the passcode to get into the phone, and then possibly the username and the password for either the Google account or the Apple account that’s associated with that phone. If again, that’s not produced… Many times the court will order that the user produce those passwords, but if there’s still refusal to do so, it’s not the end of the road for us, and depending on the type of phone and how old the phone is, the older the phone, the better, in these cases, we can send it out to a vendor who can unlock the phone and get us an image of the phone and send it back to us, and then I can take that and run with that information.

Benjamin Bierce:

Once we’ve established the need, the protocol and I have the physical possession of the phone, and the username and password, I’ll plug it into my forensic software, then that forensic software will take an image of the phone. That image will then be stored on my hard drive, and I can go back to it and I can examine that image later.

Benjamin Bierce:

But at that point once we have the image and we confirm that the image is a good image, the phone can be returned to service without any problem. Now, again, it may depend on the circumstances of the case. Some cases, it’s more prudent to preserve the phone until the case is completely finished, and adjudicated, or we have the settlement or we have the decision, and the ink is all dry, then we can put the phone back in service. But in most cases, I can examine the phone, get the extraction and return the phone to the user. My average time is about two hours to examine a phone, and to get that forensic image that varies greatly, depending on the type of phone, how much memory the phone has, and how much memory of the phone is used, because I’ve seen it in one of your projects, it took 11 hours to get all the images and the videos and everything off of the phone.

Benjamin Bierce:

That’s unusual, that’s very unusual. As phones get larger and are used more, because many people don’t even have a computer anymore, they use their phones, and they might have an iPad or some type of tablet as their device that they use for their banking and their email and everything and they don’t have a traditional PC computer anymore.

Benjamin Bierce:

For people like that, their phone gets a lot of use. So, it’s going to have a lot of information on it. But as we go forward and phones get more and more memory, and people get more and more used to using their phones rather than their computers, the time to be able to extract those, it goes up and up and up. Now, that’s counterbalanced by the hardware that I use to retrieve that. Obviously, the faster the computer that I have, then the faster that I can get the image. But nonetheless, it’s getting to the point where it’s going to… Two hours now, but pretty soon it’s probably going to be three or four hours on average for each phone.

David Craig – Host:

I can address… When I first started practicing, 35 years ago, we didn’t have it. Now, these phones, like you said, they’re computers, people use them as their computers. It’s become more and more important to be aware that, that information is out there. Most of the time when I’m working with another lawyer after I have someone who’s been killed in a wreck, or seriously injured, I can reach out to the other side, and we can agree on a protocol.

David Craig – Host:

Sometimes, their expert shows up at the same time my expert shows up and they swap phones, my client’s phone and their client’s phone, and we do downloads right there and we work together with their experts. On other times, I have had cases where they have fought us. But I’ve never had a court not agree to intervene and have a court order those if you have a good reason for it. The courts, they want you to find out the information, whether it’s relevant or not, maybe it shows up and it’s helpful, maybe it doesn’t, but most courts will err on the side of allowing you to gather that information.

Benjamin Bierce:

Absolutely, and I believe that’s because the information is so significant. This can make a huge difference in the case. It’s because using a phone is so dangerous. Like we said before, it’s as dangerous as drinking and driving. The courts want to know this. But there’s no telltale evidence afterwards as there is with drinking and driving.

David Craig – Host:

I’ve also seen, this has been an interesting phenomena, that a lot of lawyers… There’ll be a wreck, my client will suspect that the person was on the cell phone, the defendant, the other person who caused the wreck will deny it. Then we will file a lawsuit and we’ll ask for their cell phone records. Lo and behold, the attorney then all of a sudden says, “Well, we’ll admit fault. We admit 100% fault.” And it doesn’t matter anymore.

David Craig – Host:

Now, sometimes then that resolves the issue, you don’t need the cell phone. Other times though, you still need the cell phone for a variety of different reasons. We still may gather it, but that is a phenomenon I’ve been seeing more recently, rather than us get the phones, they’ll say, “What can we give you? Can we agree to fault and those type of things?”

David Craig – Host:

I know I’ve used you before on cases where the other side did have their experts there. Is that common where you work with the other expert?

Benjamin Bierce:

It’s becoming more and more so. Earlier in my career working with civil cases, it was usually me by myself. We didn’t have the protocols in place, it was just more or less, here’s the phone and go ahead and take a look at it. Now that it’s being used so much more, and attorneys are getting more comfortable with it, they want to include their own expert, and we want to have a protocol in place before we even touch the phones.

Benjamin Bierce:

Yeah, absolutely, it’s more and more the case where we’ll have two experts present for the examination. I’ve had some where they’re even three. We may have one expert representing one party, one expert representing the other party, and then a third neutral party doing some type of examination for the phone. That’s usually the technical side of it, where we need to involve a lab that needs to deconstruct a phone, pull chips off the phone and attempt to recover.

Benjamin Bierce:

If a phone was so damaged by fire or water or something like that, that the phone’s not operational, we generally have to send it to a lab so that the lab can deconstruct the phone and pull chips and get information directly from the chips.

David Craig – Host:

Before we move on, is there… As far as I know, there’s a second way we grab information. Is there anything else you want to touch base on as far as extracting information from the physical phone itself?

Benjamin Bierce:

I think we can go on for a week about that, because I joke that I can make a career out of examining one phone, because there’s so much information. If you printed all the information that’s on a phone, double sided on pieces of paper, it would fill a semi truck. That’s how much information we’re looking at. But I think we can move on to the phone records now.

David Craig – Host:

I will also say that, I know you have some slides, anytime you feel like there’s something that’s helpful, pop it on the screen, and we’ll [inaudible 00:37:04]

Benjamin Bierce:

Sure, will do.

David Craig – Host:

Okay, let’s talk about the second way we gather information from cell phones.

Benjamin Bierce:

Right. The second way is to get the records from a cell phone company, and this has its advantages and disadvantages. An advantage is it can’t be lost, it can’t be deleted, the phone companies are going to have it. Each phone company has a little different protocol, but they have protocols as to how long they keep the information.

Benjamin Bierce:

Generally speaking, we can get three areas of information from the phone. The first is a call log, like we spoke about before. That’s the voice calls, we’ve got the time and data, the connection, the duration of the connection, and the part, the initiating party, and the receiving party. Then the next category would be SMS messages. I say that, that stands for short message service, and it’s limited to 160 characters.

Benjamin Bierce:

That is the traditional old texting that we did, even when we had flip phones, and we can still use that type of messaging on our smartphones. But most companies only maintain the SMS message log, they don’t have what the message said, they only have the date and time that it occurred, and the sending party and the receiving party.

Benjamin Bierce:

Then the third area would be data connections. Again, the data connections just show the bytes up and bytes down. So, how much data is flowing up and how much data is flowing down to the phone, and is not specific about what type of application is being used. It’ll give us the time and date, the duration for that data session. Then in addition to that, we can identify the cell sites that were used for a certain connection. What types of information it’s going to be available for depends on the phone company.

Benjamin Bierce:

Almost all the phone companies provide cell site locations for voice calls. But some provided for data and not for text messages and some provided for text messages and not for data, and some only have it for voice messages.

Benjamin Bierce:

The valuable part of that is that, we can identify the general location of the phone, not the exact location, but the general location of the phone because we know which cell site it would… We have a point on the ground that we know the tower was. We don’t know the point on the ground where the phone was, but we can say, it’s more than likely in a certain area based on which tower that it was connected with.

David Craig – Host:

I think that’s important. In the semi cases that I handled, I’ve used that information a lot, because sometimes the semi drivers will falsify their logs. If I can tell by the phone records, generally where their phone is, obviously, unless they give their phone to somebody else, I can establish in the deposition, did you hand your phone off to anybody? “No.” Did you have your phone with you at all times? “Yes, I did.” Okay, so it was either with you or in your house or within your close proximity, or in your truck? “Yes.”

David Craig – Host:

Then you nail that down, and then you find out that maybe they’re not where they said they were on their logs. You can do that with these towers, you can pinpoint locations generally, not exactly, but in general areas where this cell phone would have been.

Benjamin Bierce:

Absolutely, and that’s one of the services that’s been becoming more and more popular is reconstructing a driver’s logs over six months, or a year prior to the crash to see what the habits were, to see if the driver goes through a certain… Let’s say we’ve got a construction area, and the driver ends up getting a crash in the construction area. Well, can we go back and see how many times he passed through that construction area? Should he have known he was approaching a construction area?

Benjamin Bierce:

Most of these drivers, even the over the road guys run pretty regular routes. So, they pass through the same areas frequently. It may be once a day, once a month, once a week, something of that nature. But we can establish that pattern to say that, well, he should have known this. But let me throw another scenario, and imagine that we’ve got a truck driver that’s involved in a crash. Let’s say he perishes in the crash along with other people, and it’s a terrible incident, and the truck is destroyed, the phone is destroyed in the crash, maybe even on fire. Let’s say it’s a smaller trucking company, and he only keeps paper logs.

Benjamin Bierce:

If that’s the case, then the crash could destroy the paper logs as well, and we may not have the truck driver’s log for a week or a month prior to the crash. Going back and using the cell phone records to be able to reconstruct his log during that time period could be extremely valuable.

David Craig – Host:

To give you another example, I represented some folks that were severely injured down on I-65, around Louisville, Kentucky, where some sheet metal fell off the back of a flatbed, and my clients went over it, caused their car to ignite and blow up in flames. Luckily, there was a FedEx driver who saw basically, the color of the truck, thought he knew what type of truck it was. It was on the radio saying, “Hey, you dropped a piece of steel.”

David Craig – Host:

Now, this was earlier, so the truck driving, he drops a piece of steel, but he keeps going. Another truck radios and says, “Hey, you dropped something.” The guy doesn’t pull over, the guy keeps going. My client, it’s night, they’re coming back from Florida, doesn’t see it, runs over it, punctures it. The FedEx guy hears on the radio, oh my God, there’s been an explosion of it. He’s like, “Okay, let me see if I can find this trucker.” Trucker had gotten off the highway, obviously, because he was hiding, disappears.

David Craig – Host:

All we had was a general ID, this was this color, and I think it was this type of truck. That’s all, because that’s what they told the police. We contact that trucking company, and they say, “No, we don’t have a driver anywhere in Louisville, Kentucky area. Not anywhere. He’s sleeping in Shelbyville. The only driver, the closest driver we have is in Shelbyville and he was sleeping at that time.” The bad thing is with these cell phone, you can say there’s a difference between whether he’s in Shelbyville, Indiana, or Louisville, Kentucky, right?

Benjamin Bierce:

Oh, absolutely. Let’s throw it out there and say it’s a completely unknown, that you don’t even have the UPS driver. One of the things that we can do, it’s called a tower dump. We can go to the towers, the cell sites that cover that area, and we’d have to do this for all the companies, all the major phone companies, but we can see what phones were in that area, at that time.

Benjamin Bierce:

Now, depending on where it is, if it’s way out in the middle of nowhere, we may get 100 phone numbers. If it’s in Downtown Louisville, we will get tens of thousands of phone numbers and it becomes a needle in a haystack full of needles, and it’s almost impossible, but under the right circumstances, we might be able to identify a completely unknown person by their cell phone

David Craig – Host:

A case where you can say, okay, what was the closest driver you had? You find out, okay, well, they’re in Shelbyville. Well, then you can say, “Okay, give me their phone and we can find out. If you really were in Shelbyville, you got nothing to worry about.”

Benjamin Bierce:

Right, exactly.

David Craig – Host:

If not, you got problems. Also trucking nowadays, a lot of the newer trucks have GPS, and they have other ways that you can find people. But even with electronic logs and things, we’re still seeing people fudge. They’re disconnecting and then reconnecting, and they’re just doing a variety of things. Cell phone use definitely can be helpful in a truck case.

Benjamin Bierce:

Absolutely. To give an idea, we know… Here, let me share the screen real quick. Of course, we know what a cell phone looks like. Can you see the photo?

David Craig – Host:

Yes.

Benjamin Bierce:

This is a cell site. I tend to use the word cell site instead of tower, because they can put cell sites on top of buildings, water towers, or anything that stands up, and gets high enough above the ground, to provide a good signal. But this gives us an idea what the cell site looks like, the tower. Based on that, here’s what the head of that would look like. Let me see if I can enlarge that a little bit.

Benjamin Bierce:

There we go. This is what the top of that cell site looks like, and these are the antennas that our phones communicate with. If you look at it, there are three sides to it. Each side we would call a sector, and the particular sector that we’re looking at here has three antennas on it. Generally speaking, the antenna in the center, is a transmitter and these antennas on the side are receivers.

Benjamin Bierce:

The nice thing about a cell phone and why we can communicate over the cell phones the way we can, is because it usually uses two different frequencies, one to send and one to receive, unlike the walkie talkies we used as a kid are the ones that I used in the army, where you push down the button to talk and then you had to let off on the button to listen, we can talk and listen at the same time on cell phones because they use these two different frequencies for sending and receiving.

Benjamin Bierce:

If we take a look at the… Here’s an example of, if we were looking at the cell site from the top, we were looking, if we were looking at the cell site from the top, we can split it down into three sectors, it’s like we take a pizza, and then we cut it into three equal pieces. I say three equal pieces, the sectors are not always equal, but I’d say about half of them are, and we can break it down into sector one, two and three.

Benjamin Bierce:

When we get the cell phone records, for a particular call, it’s going to say that it came from a certain cell site. Then within that cell site, it came from a certain sector. That gives us the ability to narrow down the possible area that the cell phone was.

Benjamin Bierce:

If we’re looking at a crash, and we know the basic route that a person took to drive before they were involved in the crash, and we get the cell phone records and let’s say the phone call starts at a cell site in a sector that’s covering one’s house, and then we look at the end of the call and the last cell site that was being used for that particular call, maybe covering the crash scene.

Benjamin Bierce:

We can say that in more likely than not, that that person was engaged in a phone call at the time of the crash, because they would move through… If they were let’s say on an interstate, they would move through a sector so quickly, that the fact that the time of the crash and the end of the call seemed to coordinate, and the sector covering the crash scene, that’s an awful coincidence. If they’re trying to say that they were not on the phone at the time of the crash, that’s an awful coincidence that everything lines up to say that they were.

Benjamin Bierce:

Those are some of the things that help us break it down. Here’s an example of what it would look like on a map. This is over on the east side of Indianapolis, and we can say… Can you see my cursor okay, as I move it around?

David Craig – Host:

Yep.

Benjamin Bierce:

If we have reason to believe that the person was at Starbucks, let’s say, we could say that these records are consistent with the phone being at Starbucks. But let’s say that the user makes a statement that they were at the Hancock Wellness Center, which would be over in sector three, but the records say sector one, we can say that the cell phone records are inconsistent with their statement that they were at Hancock wellness.

Benjamin Bierce:

When it all boils down to it, we’re looking at consistencies, and inconsistencies. Is it consistent with the user being on the phone at the time of the crash? Yes or no? Is it consistent or inconsistent with a person being at a certain location? Does that make sense?

How Does The Information Extracted Help in a Truck Accident Case?

David Craig – Host:

Yeah, no, that’s fascinating. Another way that we’ve used this is in a truck case. First of all, if they’ve testified that they started their day at a certain terminal, and then we can figure out which tower that terminal would service, which tower services that area, and then we find out okay, then the time of the wreck happens. So, we know what tower that is, we can locate. But we can figure out time, sometimes drivers, we can show that a driver covered an area of the country a lot quicker than they should have.

Benjamin Bierce:

Oh, absolutely.

David Craig – Host:

By looking at where they were at, which towers they were at, how quickly did they get from here to there?

Benjamin Bierce:

That’s interesting. I had a criminal case where a murder suspect fled to Florida right after committing the murder. I tracked the phone records all the way down to Florida and I had one stretch of highway, where the slowest possible speed that the suspect was going was 87 miles an hour. It was an interesting exercise, and it didn’t really end up helping out in that case. But for a truck driver, it absolutely would.

Benjamin Bierce:

Now, we cannot dial down to giving the exact miles per hour that a vehicle is traveling at the time of impact, what we can look at is over large, large spans of time and space, we need hundreds of miles… The longer the sample that we have to work with, the more accurate that it’s going to be. Because if someone, let’s say stops for gas, and spends 10 minutes getting gas, that’s going to be figured into that time. If we can get something where we’ve got consistent movement, and large stretches of highway that were covered, then we’re going to get a more accurate reading on the speed.

Benjamin Bierce:

Many of these trucks have very sophisticated telematics systems that can track their speeds at any certain time, and that’s a much more accurate way of obtaining speed than a phone record. But the phone records also can be used to verify something like the telematics system from a truck.

David Craig – Host:

Another way we’ve seen it used is sometimes we see, especially in construction zones where a semi driver will either be distracted by the cell phone, or they will fall asleep. Guys and women who drive semi tractor trailers sometimes aren’t getting the proper sleep, they have sleep apnea, whatever it is, and when they’re doing fine on the highway until they come up and stopped or slowed vehicles. Then all of a sudden they don’t react quickly, and they kill people or they hurt people.

David Craig – Host:

One of the things that’s interesting, is if you have the driver’s cell phone is tracking a whole week of activity. Maybe someone said they were off duty, they weren’t driving, and they were sleeping. But yet their phone is all over the place.

Benjamin Bierce:

Absolutely. That’s one of the things that I’ve seen lately is truck drivers putting in their logs that they’re off duty when they should be on duty not driving. When their trailer is being unloaded and then reloaded, calling that off duty instead of on duty so that they make their requirements for sleep. But the cell phone information will help us out with that.

David Craig – Host:

Well, this is fascinating. I would assume that you’ve seen your business grow, as cell phone usage has grown, as the sophistication of the cell phones have grown. I would assume this as a growing area of law.

Benjamin Bierce:

Absolutely. It’s growing very quickly. I think, more than the sophistication of the devices, I think it’s the awareness of attorneys and plaintiffs and defendants and people in general that this capability is there. As that grows, that’s going to drive more business. But it’s also going to drive more involvement. As we spoke up before, it’s almost accepted now that we need to examine a phone for any kind of crash. Whereas when I started doing this, we had to have witness statements before a judge was willing to sign a court order or subpoena to get phone records or to examine a phone.

Benjamin Bierce:

But as it grows, and as people become more aware of the capability, and also, as we do more on our phones, the expectation from the court is that we need to turn this rock over, we can’t just pass by it, we need to take a look and see what was going on.

David Craig – Host:

I think that’s what’s important. People who are listening to this, that are not lawyers, that’s just ordinary folks, my goal with this podcast is to provide information to ordinary people, so they know a little bit more about what’s going on, and maybe what questions to ask their lawyers. I think information is power, and the more information they can have, the better off they are.

Benjamin Bierce:

Absolutely, absolutely. As I mentioned, I think when we started, this is not just… On the criminal side, it’s all or nothing, it’s a conviction or it’s an acquittal. With the civil case, it isn’t. It’s shifting responsibility a little bit in the more appropriate direction based on the information we have. It’s not an all or nothing, it’s, how can we move the needle, and how can we provide a better representation of what really happened? This is a very significant factor in what happened.

David Craig – Host:

I believe that folks should… I think the attorneys that are handling these type of cases, need to have a team of experts that they can call on quickly, and say, “Hey, I have a new case, and here’s the case.” And bring folks in, whether it’s a reconstructionist, whether someone to do an ECM download on a semi, or whether it’s a phone forensic expert to pull the data off the cell phones, you need that team already prepared to know who you’re going to call. Because, unfortunately, sometimes cell phones can be lost or destroyed, sometimes the police will take a cell phone on a fatality and hold it. But then they eventually release it back to the defendant. If your attorney is not moving quickly enough, I’ve seen phones disappear.

David Craig – Host:

Now, you still can get some information, as you talked here today, but it’s a lot easier if you actually have that physical phone.

Benjamin Bierce:

I think it’s a good thing if the police take the phone, from my point of view. Here’s why, because, as I said before, many things can be deleted, and they can be deleted by automatic processes within the system. There’s a limited amount of memory, of course our phones are getting bigger and bigger, but there is a limited amount of memory within the phone. So, the phones have processes running within the operating system to manage that.

Benjamin Bierce:

For example, an iPhone out of the box will come set to the leaked text Messages after one year. Well, these civil cases can drag on for many years. By the time that we get to the point where we can examine the phone, those text messages may be long gone and overwritten. If the police collect the phone, a couple of things happen that are good for me, and my ability to produce the best information to the court. One is the police will generally do an examination of the phone. They will get a forensic image of it, and with the proper paperwork, we can get a copy of that forensic image that the police took.

Benjamin Bierce:

The second thing is they preserve it. They turn it off, they make sure that it’s in an area where it’s not exposed to too much magnetic fields that can erase phones and cause damage to memory. The phone is off. So, it’s not being used, and it’s not going through cycles, it’s not constantly saying this information is old, so let’s get rid of it, and then overriding it.

Benjamin Bierce:

I like it when the police take the phone. Now, it may end up being a pain, but sometimes we can coordinate with the police department and say, okay, you got this phone, and it’s part of, let’s say, a fatal investigation, and we respect that you want to keep the phone in evidence, we are requesting the opportunity to examine the phone while it’s in your custody, we will come to your location, to your evidence room or to your facility, we’ll bring our equipment, we’ll examine the device, and then we’ll turn it right back over to you, and it’s back in evidence.

Benjamin Bierce:

Then also, I think, to make it a little bit sweeter for them, we offer to give them copies of the information that we’ve obtained, because we may have greater capabilities than they do. If we can offer that to them, that may make it more attractive. Now, I’m not saying that every police department is going to say yes to that. But there are chances that we could get in even if the phone is in police custody.

Benjamin Bierce:

Now, on the other side, if a phone is involved in a crash, and the user continues to use the phone, with no respect to… Because honestly, the best way to preserve the phone after a crash is to turn it off and not use it at all. Don’t take it to the phone company to get a new phone, just go there and tell him your phone number and they’ll give you a new phone and a new SIM card and all that, preserve everything. Best case would be the phone would go in the custody of the attorney until the protocol is set. But not everybody is going to do that, and people don’t think to do that.

Benjamin Bierce:

When a person continues to use a phone, and let’s say it’s a year later that the phone comes up to be examined, well much of the information that’s on there is going to be gone. Especially, when I was talking about the Snapchat database, many of the databases only hold the last activity. A year later, even 10 minutes later can be too late for some of those databases. Once it’s gone, we don’t know if it is valuable or not.

Benjamin Bierce:

Then another scenario that I’m sure you’re well aware of is that many plaintiffs may go through several attorneys during the course of the lifetime of the case, and they may not be satisfied with the first one that they get. Once they find an attorney that they have more confidence in, that’s the attorney that may say, “Okay, we need to get these phones, but it’s been two years since the incident.” By that time, many of the phone records are gone too.

Benjamin Bierce:

That’s one of the reasons that we need to work on preservation, but also is for people to be careful about who they select that’s going to represent them in the case, and to go forward with an attorney that has relationships with teams just as you spoke of.

Benjamin Bierce:

At ESI, we can cover it from the reconstruction, the ECM downloads, the digital scan of the scene, and we can do that. Then of course, any digital forensics aspect of it, and we can do that very quickly. It’s very important for a person that’s involved in something like this, that wants to pursue their case, to find a good, reputable attorney that has these kind of relationships from the start.

David Craig – Host:

I think that’s the saddest thing, and that’s part of the reason why I did this podcast. The people I hire in my firm or another firm, at least they need to know what to ask, and they need to know who is your team? I think this truck driver was on a cell phone, who are you going to hire? Do you have somebody that you use regularly?

David Craig – Host:

I get cases that are years old, that other lawyers did nothing, and they didn’t preserve any evidence. They did no ECM downloads, they didn’t check the brakes of the semi tractor trailer, the equipment’s gone, the cell phones are gone. It’s always frustrating, and it’s understandable somewhat, sometimes the clients are slow in hiring, because they’ve lost a loved one. So, they’re dealing with the devastation and the loss and they’re not thinking, what should I do about preserving my claim? But that’s why someone in their family needs to stick up for them and say, “No, you hired the right attorney, who knows, who has the experience, who has a team that they can go put together to preserve the evidence.”

Benjamin Bierce:

Absolutely.

David Craig – Host:

One of the things that’s important to me, is that I only use experts who are credible. I assume every case I’m going to do that I may end up in a courtroom, and if I’m going to end up in a courtroom, a jury is going to judge the people that I hire. So, I want to hire the best, and I want to hire people who are biased. I want to hire people who will give me the straight scoop, one way or the other, and I want people… Most of my experts work on both sides. Will work on the plaintiff side, the person who’s injured or on the defense side. Because I don’t want somebody who’s a hired gun, who just will tell me what I want to hear.

David Craig – Host:

I think it’s important for people to understand, Ben, that you do both sides, correct?

Benjamin Bierce:

Yeah. I’m about 50% on each side. I just had that question in a deposition recently, and I believe my client in that case was a plaintiff, but the defense attorney was asking me, “Well, what’s your percentage?” It’s 50-50. That’s a good split. I’ve gotten very good clients on both sides. In fact, a couple of years ago, I started getting calls from clients on both sides on the same case. It’s hard to tell a good client and a good friend, “I’m sorry, I can’t do this, because I have a conflict.” But at the same time, I’m helping a good client and a good friend on the other side of it, too.

Benjamin Bierce:

Ultimately, it doesn’t matter which side hires me, I’m going to say the same thing. It’s, I’m going to produce what evidence I see, and I’m going to present it. The way I try and do that is, would I say this, if I were working on the other side? If the answer is yes, then great, that’s what I want. If the answer is no, then I need to take a look at myself and say, am I being a little biased here? And I need to pull that back out.

Benjamin Bierce:

One of the nice things about ESI is that all my work is reviewed. I have a peer that goes through, that understands the kind of work that I do, takes a look at it, and can check me on that. Usually, whoever the peer reviewer is, is someone that’s not involved in the project at all. So, they’re coming in from a completely separate angle. If they identify something, then they call me on it and I fix it before it ever reaches your hands, or my client’s hands.

David Craig – Host:

Just so the listener knows, Ben, we’ve talked about a couple of times, ESI, and ESI has a group of experts in many different areas that have the technical knowledge and the hands on experience to help people figure out what happened. How did a wreck happen? What happened, what occurred? To gain the evidence, and then they also have a lot of experience presenting it in a courtroom, if they need to.

Benjamin Bierce:

Absolutely. It’s amazing to work with this company. We’ve got the reach from Seattle to Fort Myers, Florida, and many places in between. We’ve got an expert in just about everything. Most of the consultants with ESI are engineers, I’m not, but most are, and we have experts in truck crash or automotive reconstruction. We have aircraft, watercraft, building disasters, slip and falls. We have engineers that can recreate things. I just got an email that we were looking out that one of our offices was looking for a specific vehicle to do some experimentation with, and they promised that it wouldn’t be destroyed.

Benjamin Bierce:

But ESI does destroy vehicles. If we needed to reconstruct something, and the budget of the project allows it, we’ll get an exemplar vehicle of the same kind and go out and crash it, and see what happens.

David Craig – Host:

Well, Ben, thank you very much. I really appreciate you taking the time to share your knowledge on the cell phone forensics with our podcast.

Benjamin Bierce:

Well, it’s been absolutely my pleasure.

David Craig – Host:

This is David Craig, and you’ve been listening to After the Crash. If you’d like more information about me or my law firm, please go to our website, C-K-F-L-A-W.com. Or if you’d like to talk to me, you can call 1-800- ASK-DAVID. If you would like a guide on what to do after a truck wreck, then pick up my book, Semitruck Wreck: A Guide for Victims and Their Families. It’s available on Amazon or you can download it for free on our website ckflaw.com