MSAB XAMN Pro – Discover evidence: time, place and people

Not everyone who commits a crime plans it carefully. In most crimes, suspects usually have a couple of devices, such as a mobile phone and a tablet, and communicate under an alias using common applications.

This can make it difficult to link a suspect to the crime scene, but it becomes easier when using XAMN Pro, which quickly and efficiently filters conversations, images, and videos of suspects. And because this type of data has a built-in timestamp, analyzing it can provide a better understanding of when the crime was committed, even if the data volumes are large.

Establish provenance of time-stamped digital evidence
Given the critical role of timestamps in digital investigations, this blog post seeks to highlight how analyzing these key pieces of information can yield potentially game-changing insights for your case.

Here are three vital areas that researchers should keep an eye on:

1. Timestamps must be found

Most artifacts (i.e., pieces of digital evidence) extracted from a mobile device are timestamped with information indicating when the artifact was created, updated, and sometimes deleted. This includes everything from calls, messages, images, and web history to generic files and when a particular app was installed.

The timestamps presented in XAMN Pro for a given artifact depend on multiple factors, such as what was originally recorded by the source device, what was possible to recover during extraction, and the category of the artifact in question.

Being able to link a piece of digital evidence to a specific moment in time can be of great importance to any investigation.

Below is an example of how to effectively limit a search in XAMN Pro based on time:

Case:You are working on a grooming case and want to limit your search to only see messages and calls from the last year.

Solution- An easy way to do this is to use the Timeline view. Simply select the year that is of interest to you. The “Timeline” filter will now allow you to search the data more effectively. You can filter by year, month, day, hour, minute, or even second to identify the busiest periods on a device and create a picture of sequences of events.

In this episode of #MSABMonday, take a closer look at the Timeline filter in XAMN Pro, which allows you to quickly narrow your search for artifacts based on specific time periods. This streamlined approach simplifies the examination of large amounts of data, speeds up data analysis, and improves investigations.

3 tips you need to know about “Time” in XAMN Pro:

A time-based search will match all time-related properties of the case artifacts. This means that a single file appearing on a device can show activity in multiple places on the timeline, both when it was created and later (potentially) updated and deleted.

Time searches can be saved in Quick Views. If, for example, your standard procedure is to limit your search to the last 24 months, you can save it in a custom Quick View called “Last 2 Years.” This allows you to get started immediately with this filter without having to make a manual selection.

The time filter is automatically linked to all other filters in XAMN. If you add a time filter selection, you'll see how, for example, the Artifact Categories section updates instantly. If a category, for example Calls, is grayed out after you apply the filter, it means there are no calls from that period.

Additional tip:
Using the timeline can be a quick and convenient way to exclude a device from further investigation. If, for example, several devices have been seized, it is possible that some of them are old and the suspect no longer uses them. If, after quickly looking at the timeline, the device shows no activity after 2016, you can probably ignore it (assuming you're investigating a recent crime).

Also, make sure to always validate your data. XAMN Pro makes this process easy for you. In this #MASBMonday tutorial, learn how to validate important data, such as times and dates associated with calls or messages, to ensure the reliability of your findings in court.

2. Cross data to find exact location
Determining where the crime has been committed also involves processing large amounts of data. Some digital artifacts retrieved from a mobile device have location information associated with them. This may include images or information pulled from health and fitness apps, for example. Of course, being able to link an individual to a physical location based on digital traces on a removed device can be of great interest and importance to any investigation.

Previously, one was forced to spend hours and sometimes days sorting through vital data to determine the time, place and person. With XAMN Pro, it takes seconds. Once you master the tools, the program will quickly determine geographic location by crossing data from cell towers, web history, images and, for example, fitness apps.

This is an example of how you can effectively limit a search in XAMN based on location:

Case:An individual suspected of preparing to commit armed robbery is being investigated. He is interested in the general whereabouts of the individual.

Solution- Use the “Maps” view. This allows you to analyze location artifacts more easily and effectively. This view presents all artifacts with associated location data. The artifacts are grouped into groups and split into individual artifacts as you get closer. This gives you a convenient overview and the ability to zoom in and locate an individual artifact.

3 tips you need to know about “Location” in XAMN Pro:

You can combine the new Filter views, Maps, and improved Timeline with any view in XAMN Pro.
If you use offline maps, you can also use the search box to search for places by street name, city, or area name. For an even more complete view of locations linked to a particular device and person, XAMN Pro allows you to import call data logs from mobile network operators. These typically include the location of cell towers that a device has connected to. If you have access to CDR (call detail records) as part of your research, it is recommended to import them before you start digging into the data.

Bonus Tip: The Areas of Interest filter in XAMN Pro is a powerful feature that allows you to define a specific area you are interested in for more refined analysis. In this episode of #MSABMonday, learn how to take advantage of this functionality to quickly view artifacts within your chosen area, streamlining your investigations and saving you valuable time.

3. The roles of everyone involved are specified
Depending on its scope, there may be many individuals involved in the planning and execution of a crime. Being able to determine who has been in contact with whom and the ability to link digital artifacts to an individual person is of great importance to most investigations. Given the enormous amounts of information that needs to be processed and the added complexity when people communicate using more than one device or multiple applications, this can be complicated and time-consuming. XAMN Pro has a unique ability to simplify this process; We call it People.

XAMN Pro not only allows you to immediately filter the people relevant to you and see the relationships between them, but you can also select specific identities and view their communication. This includes identifiers such as names, phone numbers, messaging nicknames and email addresses and will, for example, display an identified phone number in both a native device phone call and a WhatsApp voice call.

You can manually match relevant identities into Common People. However, this should only be done if you have corroborating evidence, e.g. two specific email addresses belong to the same Person.

3 tips you need to know about “Personas” in XAMN:

Personas are always created from identities identified in the extracted data.
People never alter source extraction data. The People directory is maintained in your Case file and can be rebuilt and managed without affecting the source data.
An image is automatically assigned to a Persona if it is supported by the source data. You can also assign an image manually.
Watch this episode of #MSABMonday for a quick tour of the powerful “People” feature.

Final thoughts
XAMN Pro unlocks a whole new level of analysis in mobile forensics. It combines efficiency with ease of use and powerful search capabilities, making it an excellent choice for digital investigators who need to quickly and securely discover, analyze, package and share digital crime scene evidence and artifacts.

To get the most out of the tool, sign up for our comprehensive training courses. With the extensive list of analytical capabilities included with XAMN Pro, becoming certified ensures that you are aware of all the time-saving capabilities within the platform and can make the most of your valuable time. Our courses will allow you to work with speed and precision in the most powerful digital forensic analytical tool. It will ensure you are well prepared to solve cases more intelligently, organize results, and complete powerful reports and visuals to convey information.

read it inmsab.com