Time on the phone

[AJ]

In another thread, we were discussing the time on the phone and we decided the time couldn't be correct because of various factors. I'm not entirely sure of that now.

In this image we see that the battery was removed while stored in the evidence bag:

http://www.gzdocs.com/documents/discovery_12/screenpics/2012-10-15_0002.jpg

In this image we see the time on the phone as being 7:02PM (taken at 6:07AM on 10/16/12):

http://www.gzdocs.com/documents/discovery_12/screenpics/2012-10-16_0001.jpg

Along with the information we found out yesterday (the last text being unread at 7:08PM), I think it might be a fair assumption to say the phone died shortly before 7pm - giving a couple minutes to get the pattern lock mentioned in the second image above. Only question in regard to such an assumption is: did they charge the battery externally, are they using a different battery or was the battery not really dead but perhaps a connection that needed to be cleaned (or otherwise fixed) ?

[leftwig]

I am not sure I understand your conclusions.  Are you suggesting that when they put the battery back in place, the clock started up as if picking up where it last left off (the time in the photo is now 7:02, so you assume it had died a few minutes earlier)?   I wouldn't think something like the time would have stayed in place for 7 months (ie, not stored on a removable memory device, but was in the phones transient memory).  I am no expert so have no idea, just trying to understand where you were going with this.

[MikeB]

I returned from a vacation in Colorado this week. Two hour time difference. When I returned- and before I had cell service - my phone was "stuck" on Colorado time. I am willing to bet a cup of eCoffee that if the phone no longer had service, the time would be stuck on whatever it was when shut off.

[DebFrmHell]

I returned from a vacation in Colorado this week. Two hour time difference. When I returned- and before I had cell service - my phone was "stuck" on Colorado time. I am willing to bet a cup of eCoffee that if the phone no longer had service, the time would be stuck on whatever it was when shut off.

I powered up a phone that I don't have service on.  It came up with real time when I turned it on.  We don't know when that photo was taken.  We just know that the photo was taken at 7:02pm since there is no date listed.  It is showing too many password attempts.  It shows the emergency 911 that you can call on phones, service or not.  Since that is the only button that would work, IMO, Singleton used that one to get the phone number.

Where is NMNM?  I don't have a quick reference other than one report from Det. Kuhl in CA.  There are no dates or times listed on it.  I am looking for the evidence file where the phone was checked out.  Remember that Brenton and an SAO investigator (Gilbreath?) had that phone for around 6 wks- 2 months (IIRC) 

The phone got shipped to CA sometime in January... again from memory. 

And we know how that goes...    

[RickyJim]

If it is OK to publish the text messages found on the phone, wouldn't be OK to publish the GPS data?  Or are the text messages somehow less protected than what are referred to as "phone records".

[AJ]

We don't know when that photo was taken.  We just know that the photo was taken at 7:02pm since there is no date listed.

The date of the image, along with the time and various other information (device taking the image) is in the metadata for the image. For the image with the device powered on, the image was taken:

Date: 10/16/2012
Time: 6:07 AM
Camera Maker: IPEVO
Camera Model: P2V

[AJ]

I am not sure I understand your conclusions.  Are you suggesting that when they put the battery back in place, the clock started up as if picking up where it last left off (the time in the photo is now 7:02, so you assume it had died a few minutes earlier)?   I wouldn't think something like the time would have stayed in place for 7 months (ie, not stored on a removable memory device, but was in the phones transient memory).  I am no expert so have no idea, just trying to understand where you were going with this.

Under this theory, you'd have to set the time on your phone every time you take out the battery - even if only for a moment. While it may be true that the phone may try to contact an ntpd (of some type) once a battery is re-inserted, that doesn't mean the last known time for the device isn't stored in non-volatile memory somewhere. While I agree that phones lack a CMOS battery so they can't continue to update the time without power like a computer would, I don't think they completely lose time either.

I don't have an Android phone to test with (or a phone that has easy battery access) .. but if someone does, a simple test would be to set the phone to not update through an ntpd (or whatever) and remove the battery. After a few hours, plug the battery back in and see what time it says.

[DebFrmHell]

The date of the image, along with the time and various other information (device taking the image) is in the metadata for the image. For the image with the device powered on, the image was taken:

Date: 10/16/2012
Time: 6:07 AM
Camera Maker: IPEVO
Camera Model: P2V

I freely admit it.  I don't get why the times are different.  6:07 AM v 7:08 PM

http://www.gzdocs.com/documents/discovery_12/screenpics/2012-10-15_0002.jpg

That is the picture from Detective Kuhl.  The one thing I noticed that I hadn't noticed before is the seizure date on that phone.  It is reported seized on 3/22/12.  Was the phone released to anyone that wasn't LE?  I find it a little odd that the date of seizure is the same date that Corey was assigned as special prosecutor.

Sorry if it has been mentioned before and I don't remember it.  There are the texts that were deleted.  W8 reported that some of hers didn't show.  If Tracy had the phone, if he had the access code, could he have been the one that deleted the texts, not from his home computer but through the actual phone?

I never thought Tracy had control over that phone.

[AJ]

I freely admit it.  I don't get why the times are different.  6:07 AM v 7:08 PM

http://www.gzdocs.com/documents/discovery_12/screenpics/2012-10-15_0002.jpg

There are a number of times to talk about. The phone displays 7:02PM and 7:04PM in two pictures taken of it. The text message log shows an unread message at 7:08PM. The image of the phone showing 7:02PM was taken at 6:07AM, and the image showing the time at 7:04PM was taken at either 11PM or 3PM (I remember it being 4 hours off the time on the phone).

What I figured people would talk about is that the phone shows a time previous to the time of the last text and would be confused by that, but it's explainable. When an SMS message is received it's stored in a database file (on iPhones it's called sms.db - it's an sqlite database). Along with the message, various other information is stored, such as the time it was received on the phone, and the time that the carrier (T-Mobile in this case) received it. I think the 7:08PM time would be the time the carrier received it, which would explain why the SMS was received after the time shown on the phone itself.

That is the picture from Detective Kuhl.  The one thing I noticed that I hadn't noticed before is the seizure date on that phone.  It is reported seized on 3/22/12.  Was the phone released to anyone that wasn't LE?  I find it a little odd that the date of seizure is the same date that Corey was assigned as special prosecutor.

I think that's why the seizure date is the same - that's the date the SAO took it from SPD. Just my theory. The only gap I recall in the chain of custody was somewhere between September and January 2013.

[RickyJim]

Sorry if it has been mentioned before and I don't remember it.  There are the texts that were deleted.  W8 reported that some of hers didn't show.  If Tracy had the phone, if he had the access code, could he have been the one that deleted the texts, not from his home computer but through the actual phone?

I never thought Tracy had control over that phone.

Where did you get the idea that Tracy was given the phone after it was collected by the police as evidence?  That would certainly be incredible.

[MikeB]

Wouldn't the logs of others TM was apparently in touch with have corroborating texts? Time stamps, deletions, etc?

[DebFrmHell]

Where did you get the idea that Tracy was given the phone after it was collected by the police as evidence?  That would certainly be incredible.

I got it from the SEIZURE DATE of 3/22/12.  There were lots of rumors about it going back to Tracy around that time and I thought it was all bunk and not worth discussing.  The date just screamed at me.  AJ got me back on path with his sensible explanation.

    Sometimes it pays to have someone dig me out of the conspiracy theories.  I have a tendency to run wild on occasion.


I would like to see the property report on that phone again, however.  I know I have seen it but didn't bookmark it for reference.  I could kick myself for that one.

[AJ]

I would like to see the property report on that phone again, however.  I know I have seen it but didn't bookmark it for reference.  I could kick myself for that one.

http://gzdocs.com/documents/0213/response_motion_discovery_cell.pdf

Thank Nettles next time you see her, she had to help me find it

[RickyJim]

The report says that at some not specified time the phone was handed over from SPD to FDLE.  I find no reason to believe Tracy had it after SPD collected it.

[DebFrmHell]

http://gzdocs.com/documents/0213/response_motion_discovery_cell.pdf

Thank Nettles next time you see her, she had to help me find it

I LOVE YOU AND NETTLES! 

 ummm.  But I am looking for the one that has where Singleton and Serino checked that phone out of evidence.  IIRC, it was around March 3rd.  It was a handwritten list but I can't remember if it was on the evidence bag or if it was a Log for DMS-7.