iPhone question

[speirbhean]

Hi there. If an iphone is smashed to pieces, and the SIM card was cut up, could you figure out what internet sites had been accessed on it? IE could the internet provider give you that information? And how long roughly would it take?
thanks!

[Medievalist]

Yes. It takes a court order for the service provider to roll over, usually.

But the sim card isn't really interesting; it's the storage media on the phone itself, the data in the user's cloud account, and then the service provider's data.

Data is immortal. Media isn't.

[jclarkdawe]

See:

• Pre-paid cell phones
• Capabilities of digital forensics
• text bomb for a telephone?
• Phone call tracing setup
• cell phone questions
• Vehicle accident - cell phone

Best of luck,


Jim Clark-Dawe

[Buffysquirrel]

Provided the user account can be identified, all the sites visited will be on the ISP's server. Even with the phone smashed, its data might still be retrievable. Best bet: microwave.

[cbenoi1]

> could the internet provider give you that information?

No. ISPs are just switches and routers that connect small wires to bigger wires. Too much data going through the wires and not enough time to analyze it. And in many jurisdictions, snooping on data packet contents is considered illegal.



Google search history can be kept on both the terminal and the server, provided you have logged onto your google account. Facebook, Twitter and other social-type web sites keep a record of activity on their respective web sites. Same with banks and utility companies, for obvious reasons. But anyjoeblow.com web site won't.

As for any other general web site, the URL history is kept on the terminal itself. If the terminal is destroyed or the URL history cleared upon leaving the browser (there is a setting for that), then it's impossible to determine which web sites a user has visited.

In other words, say goodbye to the browsing history if you fubar an iPhone. Unless you happened to have visited specific sites which do record activity on their sites only. It's a matter for police to query the Facebook / Twitter / Google / Amazon /... of this world for user data; this is akin to a fishing expedition.


-cb

[anthony draco]

Originally Posted by cbenoi1

> could the internet provider give you that information?

No. ISPs are just switches and routers that connect small wires to bigger wires. Too much data going through the wires and not enough time to analyze it. And in many jurisdictions, snooping on data packet contents is considered illegal.



Google search history can be kept on both the terminal and the server, provided you have logged onto your google account. Facebook, Twitter and other social-type web sites keep a record of activity on their respective web sites. Same with banks and utility companies, for obvious reasons. But anyjoeblow.com web site won't.

As for any other general web site, the URL history is kept on the terminal itself. If the terminal is destroyed or the URL history cleared upon leaving the browser (there is a setting for that), then it's impossible to determine which web sites a user has visited.

In other words, say goodbye to the browsing history if you fubar an iPhone. Unless you happened to have visited specific sites which do record activity on their sites only. It's a matter for police to query the Facebook / Twitter / Google / Amazon /... of this world for user data; this is akin to a fishing expedition.


-cb

And if you crush the phone into irreparable bits, how much chance can they gain info on you from Facebook, Twitter, Google, Amazon, banks, etc? I assume not much unless they know your account/user name and what to look for in the first place? If you go anonymous, and they don't know what to look, is it possible for them to find you?

[jclarkdawe]

Smart phones present an interesting problem and the iPhone has another level of complexity as well. Smart phones use two alternative systems for connecting to the internet. One is the data plan that comes from the phone company. The second is any wireless that you come in contact with.

For example, if I go into Panera Bread, I use their wireless. When I'm at home, I use the house's wireless. And when I'm driving down the road, I use the phone company's. So the first is going to be hard to guess, the second and third fairly easy.

For a couple of reasons, including billing and government requests for tracking, each address that shows up on the iPhone is recorded, using each device's unique code. (If you're on a limited data plan, which is especially the case with mobile systems, and you go over your plan, you can request the company show you your exact usage. If the company is billing you for more, they've got to be able to proof it.)

If the iPhone is set up to locate the phone, it's location is broadcast constantly to Apple. Siri also requires a connection to Apple. There's other information going to Apple as well. So Apple could have this information as well.

Realize that this stuff is rarely seen by humans, as it is massive. And a lot of what is seen is sanitized by the provider to protect privacy.

To get the material, you have to obtain a search warrant that the provider accepts. (There's a bunch of reasons why they don't accept warrants.) Time range is anywhere from a day or so to enough frustration on the police department that they're ready to scream.

Best of luck,

Jim Clark-Dawe

[cbenoi1]

Originally Posted by anthony draco

And if you crush the phone into irreparable bits, how much chance can they gain info on you from Facebook, Twitter, Google, Amazon, banks, etc?

Yep. Hence the fishing expedition. They'd have to get it from the home computer somehow. More legal & technical hassles.


> There's other information going to Apple as well. So
> Apple could have this information as well.

I forgot about Apple's snooping on its users (silly me). But I recall this can be turned off.

-cb

[Medievalist]

A court order has an amazing effect on an ISP or SP.

They likely will turn over aggregate data for the account or an IP dump but then the interested parties will hire someone like me to sort it, parse it, analyze it, and make it pretty.

I've had court orders result in 25 or 30 gigs of text data, but that can be mined.

You need to have someone with technical savvy provide the data request for the court order.

[anthony draco]

OK, so, there are soooooooo many pitfalls and such for criminals. But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me? A totally new phone? New number, without my name on it when I bought it? No fingerprints, of course.

And then when I'm done. I assume it's a good idea to grind the phone into 1000+ shards? What other loose ends do I have to take care of, or what can I do to disguise/cover my track regarding the information recorded on those third party?

Originally Posted by cbenoi1

Yep. Hence the fishing expedition. They'd have to get it from the home computer somehow. More legal & technical hassles.


> There's other information going to Apple as well. So
> Apple could have this information as well.

I forgot about Apple's snooping on its users (silly me). But I recall this can be turned off.

-cb

What's fishing expedition? Sorry, I'm not familiar with your legal/investigation process. You mean you try to physically access the comp I have? So is it safe if I don't store that information in my PC?

Aside from that, provided that I can turn off Apple Snooping, is there anything else stored on Apple I have to cover?

Originally Posted by Medievalist

A court order has an amazing effect on an ISP or SP.

They likely will turn over aggregate data for the account or an IP dump but then the interested parties will hire someone like me to sort it, parse it, analyze it, and make it pretty.

I've had court orders result in 25 or 30 gigs of text data, but that can be mined.

You need to have someone with technical savvy provide the data request for the court order.

And what are the odds of discovering it? What type of info can be found? And any ideas on how I can cover those?

[onesecondglance]

Step 1: don't use an iPhone.
Step 2: get a cheap, disposable pre-paid phone.
Step 3: chuck said phone into a river when you're done.

Repeat as necessary.

[cbenoi1]

Originally Posted by onesecondglance

Step 1: don't use an iPhone.
Step 2: get a cheap, disposable pre-paid phone.
Step 3: chuck said phone into a river when you're done.

Repeat as necessary.

That. Criminals buy cheap prepaid phones by the truckload. They load them up with prepaid credit cards you can find at any corner store, if long-distance calls are needed. Everything is paid in cash. Phone numbers are memorized and not stored on the phone. No trace left behind for the police. Once a phone has lived its useful life (usually a few hours to a few days), it's chucked in a river and another one takes its place. New phone, new phone number.

-cb

[Buffysquirrel]

In tv show The Wire, one season had a lot of stuff about the criminals using prepaid disposable phones because the cops had been bugging the payphones they had been using. In the end, the cops found out where they'd been buying the phones, got the serial numbers and the CCTV, and were able to connect them to the phones that way.

Also, if you sync your iPhone to your computer, that immediately strips out unique identifying information. So don't do that.

[jclarkdawe]

Originally Posted by anthony draco

OK, so, there are soooooooo many pitfalls and such for criminals. But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me? A totally new phone? New number, without my name on it when I bought it? No fingerprints, of course. You buy a burn phone from Wal-Mart or other store. You make sure you don't call a known landline that would connect back to you. You throw it out every month, although better practice is one call and gone. Internet use is harder, and probably requires a new computer every month and using public web access. I'm not sure how confident I'd be even with that approach. Once they snag one trace of you on the internet, if it's worth it, they can do a lot of back tracking and public internet access frequently has video connected to it.

And then when I'm done. I assume it's a good idea to grind the phone into 1000+ shards? What other loose ends do I have to take care of, or what can I do to disguise/cover my track regarding the information recorded on those third party? Better solution is to let it be stolen, or place it on a truck and enable the GPS tracking.

What's fishing expedition? Sorry, I'm not familiar with your legal/investigation process. You mean you try to physically access the comp I have? So is it safe if I don't store that information in my PC? Your computer stores stuff whether you want it to or not, including keystrokes. Whenever your phone or computer connects to a network, it records it. And when you show up at websites, like AW, it records it. And removing all traces from your computer requires a bit of ability.

Aside from that, provided that I can turn off Apple Snooping, is there anything else stored on Apple I have to cover? No one is quite sure what Apple gets. (And this may include Apple.)

And what are the odds of discovering it? What type of info can be found? And any ideas on how I can cover those? Depends upon what you're doing. If you're going to the wrong websites, your computer is being searched. People see pictures that shouldn't be there, and your computer is searched. Big areas are child pornography/pedophiles and terrorism. These searches are expensive, time consuming, and require some serious technical expertise.

Best of luck,

Jim Clark-Dawe

[Medievalist]

Steal a phone that belongs to someone else, use it.

[speirbhean]

Thank you all! I should have explained my plot. Ms M has been murdered, her phone is found smashed to a million pieces behind her. The last bit of surfing she did on the web is key to why she was killed, I'm trying to find out if the cops could access that info without the physical phone. The scene I'm writing takes place a week after the death so I'm guessing they wouldn't have had time yet. I'm hoping it's NOT do-able btw as my main cop character ends up getting the info thru old fashioned detection!

[Medievalist]

Originally Posted by speirbhean

Thank you all! I should have explained my plot. Ms M has been murdered, her phone is found smashed to a million pieces behind her. The last bit of surfing she did on the web is key to why she was killed, I'm trying to find out if the cops could access that info without the physical phone. The scene I'm writing takes place a week after the death so I'm guessing they wouldn't have had time yet. I'm hoping it's NOT do-able btw as my main cop character ends up getting the info thru old fashioned detection!

If she's fairly savvy, there are ways she can hide her footprints. She doesn't have to be an über geek, but she needs to know how to Google, and follow directions.

So if you establish that she's been careful to obscure her activity, that would help.

That said, forensic data analysis is good old-fashioned detection.

[jclarkdawe]

Time consuming but easy to solve. If the phone is smashed, the police ask her family and friends for her cell number. (Asking for your cell number is one of the first things asked these days if you go missing. There are too many cool ways of tracking people through their cell phones.) The second set of three digit numbers in your phone number used to tell people what town you were from. Now it tells people in the know what phone company issued the number. That's assuming when they call it, they can't figure out who owns the number from that.

But it's easy to tell the original carrier that issued the number. Then it's a matter of tracing back through any changes. (I've changed companies a couple of times while keeping the same phone number.) As I said, time consuming but easy. Any decent detective can trace this.

Once you find the company, then you find the records.

Take a look at Report: Blood Found In Missing Mother’s Car. If I remember right, the police didn't have her cell phone and needed to find her number and then contacted the cell company to go through the records. I believe the nimrods who killed her were found through her phone records. There's a lot more on this case on the internet. And this one isn't that unusual.

Best of luck,

Jim Clark-Dawe

[jclarkdawe]

If you want her search to be real hard to find, have her set up her iPhone so that it connects for internet to any free wireless in preference to using Verizon or AT&T. Go to Panera Bread, or other free hotspot to conduct the search. That way the surfing won't show up on her phone company's records. You'd have to search Panera's or whatever's records, which means you've got to show that she was there and that there is a need to search the records.

Best of luck,

Jim Clark-Dawe

[speirbhean]

Hmm. She wasn't trying to hide her activity as she didn't know it would get her killed! The killer is anxious that no one finds out about her Internet activity as that will lead the cops to him. But it all has to happen v quickly as the killer is going to strike again with a week unless some one stops him, so I'm guessing it's ok to say that the tech people are working on it while my hero cop is getting on with his solid door to door enquiries. Thanks again!!

[Buffysquirrel]

The killer would be better off taking the phone. The minute the cops see it's been smashed, they're going to start wondering why. If it's just gone, ie stolen, they might not prioritize it as much.

[WeaselFire]

Originally Posted by anthony draco

But say... if I'm the Ghostface killer from Scream 4 who uses iPhone to call and taunt his victims, what steps do I have to take to make it untracable back to me?

That's the easiest thing to do. Simply use someone else's phone.

Jeff