iPhone question

Yes. It takes a court order for the service provider to roll over, usually.

But the sim card isn't really interesting; it's the storage media on the phone itself, the data in the user's cloud account, and then the service provider's data.

Data is immortal. Media isn't.

See:

• Pre-paid cell phones
• Capabilities of digital forensics
• text bomb for a telephone?
• Phone call tracing setup
• cell phone questions
• Vehicle accident - cell phone

Best of luck,


Jim Clark-Dawe

Provided the user account can be identified, all the sites visited will be on the ISP's server. Even with the phone smashed, its data might still be retrievable. Best bet: microwave.

> could the internet provider give you that information?

No. ISPs are just switches and routers that connect small wires to bigger wires. Too much data going through the wires and not enough time to analyze it. And in many jurisdictions, snooping on data packet contents is considered illegal.



Google search history can be kept on both the terminal and the server, provided you have logged onto your google account. Facebook, Twitter and other social-type web sites keep a record of activity on their respective web sites. Same with banks and utility companies, for obvious reasons. But anyjoeblow.com web site won't.

As for any other general web site, the URL history is kept on the terminal itself. If the terminal is destroyed or the URL history cleared upon leaving the browser (there is a setting for that), then it's impossible to determine which web sites a user has visited.

In other words, say goodbye to the browsing history if you fubar an iPhone. Unless you happened to have visited specific sites which do record activity on their sites only. It's a matter for police to query the Facebook / Twitter / Google / Amazon /... of this world for user data; this is akin to a fishing expedition.


-cb

cbenoi1 said:

> could the internet provider give you that information?

No. ISPs are just switches and routers that connect small wires to bigger wires. Too much data going through the wires and not enough time to analyze it. And in many jurisdictions, snooping on data packet contents is considered illegal.



Google search history can be kept on both the terminal and the server, provided you have logged onto your google account. Facebook, Twitter and other social-type web sites keep a record of activity on their respective web sites. Same with banks and utility companies, for obvious reasons. But anyjoeblow.com web site won't.

As for any other general web site, the URL history is kept on the terminal itself. If the terminal is destroyed or the URL history cleared upon leaving the browser (there is a setting for that), then it's impossible to determine which web sites a user has visited.

In other words, say goodbye to the browsing history if you fubar an iPhone. Unless you happened to have visited specific sites which do record activity on their sites only. It's a matter for police to query the Facebook / Twitter / Google / Amazon /... of this world for user data; this is akin to a fishing expedition.


-cb

Click to expand...

And if you crush the phone into irreparable bits, how much chance can they gain info on you from Facebook, Twitter, Google, Amazon, banks, etc? I assume not much unless they know your account/user name and what to look for in the first place? If you go anonymous, and they don't know what to look, is it possible for them to find you?

Smart phones present an interesting problem and the iPhone has another level of complexity as well. Smart phones use two alternative systems for connecting to the internet. One is the data plan that comes from the phone company. The second is any wireless that you come in contact with.

For example, if I go into Panera Bread, I use their wireless. When I'm at home, I use the house's wireless. And when I'm driving down the road, I use the phone company's. So the first is going to be hard to guess, the second and third fairly easy.

For a couple of reasons, including billing and government requests for tracking, each address that shows up on the iPhone is recorded, using each device's unique code. (If you're on a limited data plan, which is especially the case with mobile systems, and you go over your plan, you can request the company show you your exact usage. If the company is billing you for more, they've got to be able to proof it.)

If the iPhone is set up to locate the phone, it's location is broadcast constantly to Apple. Siri also requires a connection to Apple. There's other information going to Apple as well. So Apple could have this information as well.

Realize that this stuff is rarely seen by humans, as it is massive. And a lot of what is seen is sanitized by the provider to protect privacy.

To get the material, you have to obtain a search warrant that the provider accepts. (There's a bunch of reasons why they don't accept warrants.) Time range is anywhere from a day or so to enough frustration on the police department that they're ready to scream.

Best of luck,

Jim Clark-Dawe

anthony draco said:

And if you crush the phone into irreparable bits, how much chance can they gain info on you from Facebook, Twitter, Google, Amazon, banks, etc?

Click to expand...

Yep. Hence the fishing expedition. They'd have to get it from the home computer somehow. More legal & technical hassles.


> There's other information going to Apple as well. So
> Apple could have this information as well.

I forgot about Apple's snooping on its users (silly me). But I recall this can be turned off.

-cb

A court order has an amazing effect on an ISP or SP.

They likely will turn over aggregate data for the account or an IP dump but then the interested parties will hire someone like me to sort it, parse it, analyze it, and make it pretty.

I've had court orders result in 25 or 30 gigs of text data, but that can be mined.

You need to have someone with technical savvy provide the data request for the court order.

OK, so, there are soooooooo many pitfalls and such for criminals. But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me? A totally new phone? New number, without my name on it when I bought it? No fingerprints, of course.

And then when I'm done. I assume it's a good idea to grind the phone into 1000+ shards? What other loose ends do I have to take care of, or what can I do to disguise/cover my track regarding the information recorded on those third party?

cbenoi1 said:

Yep. Hence the fishing expedition. They'd have to get it from the home computer somehow. More legal & technical hassles.


> There's other information going to Apple as well. So
> Apple could have this information as well.

I forgot about Apple's snooping on its users (silly me). But I recall this can be turned off.

-cb

Click to expand...

What's fishing expedition? Sorry, I'm not familiar with your legal/investigation process. You mean you try to physically access the comp I have? So is it safe if I don't store that information in my PC?

Aside from that, provided that I can turn off Apple Snooping, is there anything else stored on Apple I have to cover?

Medievalist said:

A court order has an amazing effect on an ISP or SP.

They likely will turn over aggregate data for the account or an IP dump but then the interested parties will hire someone like me to sort it, parse it, analyze it, and make it pretty.

I've had court orders result in 25 or 30 gigs of text data, but that can be mined.

You need to have someone with technical savvy provide the data request for the court order.

Click to expand...

And what are the odds of discovering it? What type of info can be found? And any ideas on how I can cover those?

Step 1: don't use an iPhone.
Step 2: get a cheap, disposable pre-paid phone.
Step 3: chuck said phone into a river when you're done.

Repeat as necessary.

onesecondglance said:

Step 1: don't use an iPhone.
Step 2: get a cheap, disposable pre-paid phone.
Step 3: chuck said phone into a river when you're done.

Repeat as necessary.

Click to expand...

That. Criminals buy cheap prepaid phones by the truckload. They load them up with prepaid credit cards you can find at any corner store, if long-distance calls are needed. Everything is paid in cash. Phone numbers are memorized and not stored on the phone. No trace left behind for the police. Once a phone has lived its useful life (usually a few hours to a few days), it's chucked in a river and another one takes its place. New phone, new phone number.

-cb

In tv show The Wire, one season had a lot of stuff about the criminals using prepaid disposable phones because the cops had been bugging the payphones they had been using. In the end, the cops found out where they'd been buying the phones, got the serial numbers and the CCTV, and were able to connect them to the phones that way.

Also, if you sync your iPhone to your computer, that immediately strips out unique identifying information. So don't do that.

anthony draco said:

OK, so, there are soooooooo many pitfalls and such for criminals. But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me? A totally new phone? New number, without my name on it when I bought it? No fingerprints, of course. You buy a burn phone from Wal-Mart or other store. You make sure you don't call a known landline that would connect back to you. You throw it out every month, although better practice is one call and gone. Internet use is harder, and probably requires a new computer every month and using public web access. I'm not sure how confident I'd be even with that approach. Once they snag one trace of you on the internet, if it's worth it, they can do a lot of back tracking and public internet access frequently has video connected to it.

And then when I'm done. I assume it's a good idea to grind the phone into 1000+ shards? What other loose ends do I have to take care of, or what can I do to disguise/cover my track regarding the information recorded on those third party? Better solution is to let it be stolen, or place it on a truck and enable the GPS tracking.

What's fishing expedition? Sorry, I'm not familiar with your legal/investigation process. You mean you try to physically access the comp I have? So is it safe if I don't store that information in my PC? Your computer stores stuff whether you want it to or not, including keystrokes. Whenever your phone or computer connects to a network, it records it. And when you show up at websites, like AW, it records it. And removing all traces from your computer requires a bit of ability.

Aside from that, provided that I can turn off Apple Snooping, is there anything else stored on Apple I have to cover? No one is quite sure what Apple gets. (And this may include Apple.)

And what are the odds of discovering it? What type of info can be found? And any ideas on how I can cover those? Depends upon what you're doing. If you're going to the wrong websites, your computer is being searched. People see pictures that shouldn't be there, and your computer is searched. Big areas are child pornography/pedophiles and terrorism. These searches are expensive, time consuming, and require some serious technical expertise.

Click to expand...

Best of luck,

Jim Clark-Dawe

Steal a phone that belongs to someone else, use it.

speirbhean said:

Thank you all! I should have explained my plot. Ms M has been murdered, her phone is found smashed to a million pieces behind her. The last bit of surfing she did on the web is key to why she was killed, I'm trying to find out if the cops could access that info without the physical phone. The scene I'm writing takes place a week after the death so I'm guessing they wouldn't have had time yet. I'm hoping it's NOT do-able btw as my main cop character ends up getting the info thru old fashioned detection!

Click to expand...

If she's fairly savvy, there are ways she can hide her footprints. She doesn't have to be an über geek, but she needs to know how to Google, and follow directions.

So if you establish that she's been careful to obscure her activity, that would help.

That said, forensic data analysis is good old-fashioned detection.

Time consuming but easy to solve. If the phone is smashed, the police ask her family and friends for her cell number. (Asking for your cell number is one of the first things asked these days if you go missing. There are too many cool ways of tracking people through their cell phones.) The second set of three digit numbers in your phone number used to tell people what town you were from. Now it tells people in the know what phone company issued the number. That's assuming when they call it, they can't figure out who owns the number from that.

But it's easy to tell the original carrier that issued the number. Then it's a matter of tracing back through any changes. (I've changed companies a couple of times while keeping the same phone number.) As I said, time consuming but easy. Any decent detective can trace this.

Once you find the company, then you find the records.

Take a look at Report: Blood Found In Missing Mother’s Car. If I remember right, the police didn't have her cell phone and needed to find her number and then contacted the cell company to go through the records. I believe the nimrods who killed her were found through her phone records. There's a lot more on this case on the internet. And this one isn't that unusual.

Best of luck,

Jim Clark-Dawe

If you want her search to be real hard to find, have her set up her iPhone so that it connects for internet to any free wireless in preference to using Verizon or AT&T. Go to Panera Bread, or other free hotspot to conduct the search. That way the surfing won't show up on her phone company's records. You'd have to search Panera's or whatever's records, which means you've got to show that she was there and that there is a need to search the records.

Best of luck,

Jim Clark-Dawe

The killer would be better off taking the phone. The minute the cops see it's been smashed, they're going to start wondering why. If it's just gone, ie stolen, they might not prioritize it as much.

anthony draco said:

But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me?

Click to expand...

That's the easiest thing to do. Simply use someone else's phone.

Jeff