Time deviation can become a pivotal concern when analyzing cell phone evidence, especially in motor vehicle accidents. The timestamps on phone records may not align with those on 911 center records. In this post, we’ll delve into the following:
- Example Scenario
- Determining the Deviation
- Test Calls
- Conclusion
To illustrate the complexities of time deviation in cell phone evidence, let’s dive into a hypothetical scenario. Imagine a case involving a collision between a car and a semi-truck just outside a bustling metropolitan area. The official crash report states that the incident occurred at 3:58 PM on January 27, 2018. Upon obtaining the phone records for the driver of the car, a puzzling timeline emerges. The records indicate a call that commenced at 3:34:15 PM, lasting 24 minutes and 40 seconds, and concluding at 3:56:55 PM. At first glance, it seems the crash took place just over a minute after the call, but we’re about to uncover a deeper layer of intricacy.
The timestamp on a crash report typically mirrors the initiation time of the Computer Aided Dispatch (CAD) report. As someone who once patrolled the streets and completed crash reports, I recall setting the crash time to coincide with the CAD run’s initiation. That’s the best time a police officer on scene has for the time of the crash.
In most jurisdictions, when a distress call reaches the 911 dispatcher, a series of steps take place. The dispatcher assesses the nature of the emergency and then initiates a CAD run. There’s often a brief delay between the call’s arrival and the initiation of the CAD run. The CAD run is human initiated. To obtain a more precise crash time, we’d ideally need access to the first 911 call audio, complete with a date and time stamp. Audio recordings are system initiated instead of human initiated. For our hypothetical scenario, the time stamp on the initial 911 call reveals 3:57:33 PM.
Yet again, we find ourselves a little over 30 seconds away from the crash time. So, it’s clear that establishing the deviation is crucial.
With our scenario in mind, we now embark on the task of deciphering the time deviation between Sprint records and 911 center logs. Are the clocks of Sprint and the 911 center perfectly synchronized? It’s highly improbable. The first step is identifying the carrier for the phone number that initiated the first 911 call. In our hypothetical case, if this call came from a Sprint network phone, we’d scrutinize Sprint’s records. If the end time of this call aligns with the start time of the first 911 call, we’re on the right track.
However, if the first 911 call originated from a different carrier, say Verizon, the puzzle grows more complex. Are Sprint and Verizon clocks perfectly aligned? Again, it’s doubtful. Despite this, we can still utilize the first 911 call to pinpoint the closest time to the crash on the 911 center’s timeline. Let’s say we find a Sprint phone that dialed 911, and the recording’s timestamp reads 3:58:33 PM. Upon examining the Sprint records for this call, we note a time of 3:57:31 PM.
The deviation between the 911 center’s time (3:58:33 PM) and Sprint’s time (3:57:31 PM) amounts to minus one minute and two seconds.
By applying this deviation to the first 911 call’s time (3:57:33 PM), we arrive at a Sprint time of 3:56:31 PM.
The call in question, with a start time of 3:34:15 PM and an end time of 3:56:55 PM, occurred well before the first 911 call at 3:56:31 PM and ended after the first 911 call on the Sprint timeline. This analysis conclusively indicates that the person driving the car was engaged in a phone call at the time of the crash.
In scenarios where we can’t find a phone on the same network as the target phone that reported the crash to 911, we resort to examining phones on the same network making unrelated 911 calls. These times are set by the switch, not the cell site. Given that most calls in a region go through the same switch, any calls made via a different cell site would bear timestamps set by the same switch. This ensures we’re comparing apples to apples.
Consider a case involving a late-night collision on a remote two-lane road. Given the limited traffic, 911 calls might be scarce. If luck favors us, both drivers’ phones would operate on the same network. However, we can’t always count on that. To secure the necessary data, we might resort to making test calls to the 911 center. Although identifying the exact network used by the target phone can be a challenge, we can obtain prepaid phones for all networks in the area and conduct test calls with each. Subsequently, we preserve the records for our test phones until we establish the target phone’s network. This information is then subpoenaed.
In the United States, four major carriers—AT&T, Sprint, T-Mobile, and Verizon—dominate the landscape. Well, three because T-Mobile and Sprint have merged, but at this time Sprint still seems to be operating its own network. Conducting test calls across these networks in an area like Indianapolis would provide comprehensive data.
Executing test calls is a time-sensitive endeavor. The closer we conduct them to the incident, the more robust our argument about the consistency of deviations. As time elapses, our argument weakens. Ideally, test calls should transpire within 24 hours of the incident, with a one-month limit being the upper threshold.
In summary, the times recorded on crash reports and 911 center logs do not perfectly align with the times indicated in phone records. While they may be close, they’re not identical. However, with diligent effort, we can uncover the deviation between the 911 center’s time and the phone record time. This process extends beyond call logs; it’s equally applicable to text messages, internet activity, or application usage data retrieved from the device. The key is identifying a common event that links both timelines.
In the presented scenario, the deviation favored the party demonstrating that the other party was on the phone at the time of the crash. Yet, it’s crucial to acknowledge that the deviation can sometimes swing the other way, indicating a call that seemed to end post-crash actually terminated before the incident.
When scrutinizing phone records for calls around the time of a crash, pay special attention to carriers like AT&T and T-Mobile, which employ Universal Time Coordinated (UTC) or Greenwich Mean Time (GMT). These time standards differ from Eastern Daylight Time (EDT) and Eastern Standard Time (EST). For Sprint and Verizon records, particularly in regions close to time zone borders, timestamps can potentially straddle two different time zones. Consulting an expert for a thorough analysis is strongly recommended.
Ultimately, definitively establishing whether a person was using their phone at the time of a crash might entail a bit of complexity. However, with meticulous investigation, this evidence can wield substantial influence over a case.
If you have any inquiries regarding the time issue or any other questions related to cell phone evidence, please feel free to reach out to me via my website braveinvestigations.com.
Unraveling the intricacies of time deviation in cell phone evidence can be akin to solving a puzzle. In this journey, we’ve explored the critical role that time plays in such investigations, particularly in the context of motor vehicle crashes. We delved into example scenarios, established the concept of deviation, and even discussed the possibility of making test calls to solidify our findings.
Remember, in the world of digital forensics, attention to detail and a methodical approach are our strongest allies. By following the breadcrumb trail of timestamps and meticulously cross-referencing different records, we can unlock vital insights that can make our break a case.
As we conclude this investigation into time deviation, always keep in mind that each case is unique, and the intricacies may vary. But armed with a solid understanding of the principles we’ve discussed; we’ll be better equipped to navigate the complex terrain of cell phone evidence analysis.
If you found this information valuable, consider subscribing to this channel for more in-depth insights into digital forensics and investigative techniques. And, as always, don’t hesitate to leave your questions or comments below.
Stay curious, stay vigilant, and keep seeking the truth.