I have seen firsthand the immense stress and helplessness that families experience when a loved one is missing. I also know the unfortunate reality that most law enforcement agencies lack full-time missing persons units and these cases quickly get buried between in progress crimes and felony investigations that take priority.
One thing I have learned is the trail of digital breadcrumbs people leave behind as they move around is significant and it often takes an expert to know where to look for breadcrumbs, how to obtain the data, and then how to interpret the acquired data.
Digital forensics can be an important tool to find missing people. Examining the contents of a person’s phone or computer, looking at their habits as recorded on their FitBit, or social media updates are all examples of how a forensic analyst may help identify where a person currently is, who they have been with, where they have been, or where they are headed.
Unfortunately, law enforcement laboratories are backlogged with serious criminal investigations, sometimes with wait times greater than 24 months between digital evidence being submitted and an analysis report being completed. Because of this, most law enforcement labs cannot act quickly to forensically examine digital evidence in missing persons cases, especially if there is no reason to believe the person is endangered.
In fact, most law enforcement agencies will not even submit digital evidence to a laboratory for analysis unless they believe a crime has been or is about to be committed.
I have experience working on various missing person cases and have developed information from digital evidence that has led to successful recoveries. In one case involving a missing hiker, I obtained a picture taken by a missing person and analyzed that picture for Exchangeable Image File Format (Exif) data. The Exif data revealed the exact date, time, and GPS coordinates of where the picture was taken, leading search and rescue straight to the person.
examples of how digital forensics can help find missing persons
While it is rare someone leaves home without their cell phone, if a device is available it can prove invaluable. By reviewing Internet searches, recently viewed maps, voice mail, saved favorite places on a navigation app, emails, text messages, phone call logs, and other data, clues can be uncovered as to where the person was headed and who they may be traveling with. In many cases, digital forensic analysts can recover deleted content on phones and tablets just like on computers and removable media.
With the increased use of synchronizing between mobile devices and computers, even if a cell phone can’t be found, there is a possibility that backups of the phone exist on a computer. Internet history, emails, calendar entries, and documents may also be reviewed for any evidence of plans or communications about the person’s whereabouts or destination.
I investigated one case where a male subject was traveling to meet an underage girl to engage in criminal activity. The subject claimed he just happened to come across this girl in a parking lot, but a forensic examination of the GPS unit proved that he had actually planned his route and even saved his destination. GPS units may show previous directions of travel, saved routes, or destinations.
Through forensically analyzing devices and doing open source intelligence (OSINT), a forensic analyst can determine what online accounts are used by a person. Once these accounts are identified, they can be monitored for activity. Additionally, logs can be obtained through legal process from Internet Service Providers (ISPs) to find the Internet Protocol (IP) address used anytime the service was accessed. IP addresses are used constantly to trace activity back to a physical location.
Smart watches, fitness trackers, and USB thumb drives can also be a wealth of information. All of these should be collected and submitted for analysis just in case they either have data on them that is relevant, or leads in the direction of something else that may provide more information.
