Digital Forensics

IX. The Digital Evidence Was Forensically Extracted — But the State Did Not Present the Actual Examiners

The defense should not inaccurately claim there was no forensic extraction. The record establishes that Twiggs’s phone was seized, transported to the Regional Computer Forensic Laboratory and downloaded using Cellebrite. Discord materials were also obtained through investigative process. Source: rev.com But that does not end the inquiry.

• he does not personally conduct Cellebrite extractions;
• he did not perform this extraction;
• and when asked whether he had spoken with those who performed it, his testimony did not establish meaningful firsthand involvement with the extraction personnel. Source: rev.com

• the extraction method;
• whether it was full-file-system, advanced logical or another extraction type;
• database integrity;
• message identifiers;
• account identifiers;
• deleted records;
• synchronization artifacts;
• whether messages originated locally or were restored from cloud data;
• whether the displayed conversation was complete;
• whether multiple devices accessed the account;
• or whether timestamps reflected device time, server time or another reference.

Instead, Agent Davis narrated selected messages. When asked how he knew gray messages came from Mr. Robinson, Davis explained the iPhone color convention and said Twiggs acknowledged who was saying what. Source: rev.com But gray means only that a message was received on that displayed device. It does not establish the physical identity of the human being typing on the sending device. The authorship foundation again runs through Twiggs. The State showed that messages existed on Twiggs’s phone. It did not establish through the extracting examiner or a corresponding extraction from Mr. Robinson’s device that Mr. Robinson physically authored every attributed message.

• Was Mr. Robinson’s phone recovered?
• Was it extracted?
• Did his native device contain the corresponding outgoing messages?
• Did Discord supply IP records?
• Were device identifiers established?
• Was the account logged into elsewhere?
• Did Twiggs know passwords or have access to Mr. Robinson’s devices?
• Were deleted or preceding messages recovered?
• Was the complete conversation introduced rather than selected passages?

Without those answers, the State has evidence of messages received by Twiggs — not conclusive proof of who physically authored them.