Location Carving—A Key Driver For Solving Crimes

 

 

By: Or Begam – Team Leader, Forensic Research Group and Natanel Alkalai – Research Technical Leader

Whether you are identifying multinational frauduncovering criminal networks, or investigating a homicide, location information is vital to solving crimes. Here’s how investigative teams can put location carving to work to expedite case closures.

How Location Data is Stored

The process for gathering location information is relatively straightforward. A pair of coordinates can be digitally stored as text or as binary numbers on a device’s memory. When this data is associated with a timestamp and cross-referenced with activities performed during a specific timeframe on a mobile device, key digital evidence can be uncovered.

The location-carving feature in UFED Physical Analyzer searches all the data in an extraction for latitude and longitude patterns to identify places in the mobile device memory that recorded this information. Once it finds the coordinate data, the location carver then identifies related timestamps, which can pinpoint a suspect’s location in both time and place.

Narrowing Down the Search with Customizable Filters

The custom-radius function in UFED is useful for investigators to narrow the scope of the location carving to find coordinates in relative proximity to a crime scene. The carved results, coupled with the timestamp, are then plotted on the timeline and map in UFED Physical Analyzer to pinpoint the location. UFED also presents a “confidence score” for each location based on the data distance between the latitude and longitude.

The Real Power of the Location Carver

The beauty of using the location carver is that investigators don’t need to understand how specific apps or file structures work in order to find locations. The carver searches for familiar patterns of coordinate information inside the binary data for you.

Key Case Studies

Here are three case studies where location data helped bring major cases to a close:

Learn more about UFED Physical Analyzer here.

Digital Forensic Community