Tuesday, September 5, 2017
September 5, 2017
Cellular GPS Evidence: Waze + Cellebrite + CellHawk
It’s becoming common knowledge that location evidence on cellular devices can provide a wealth of evidence in any number of civil, criminal and investigative matters. Law enforcement agencies use cellular location evidence from service providers to help place a criminal suspect at or near a crime scene in a given time frame. Search and rescue analysts can use cellular call detail records to help locate missing persons as well. And as we’ve detailed in previous articles, this type of evidence can be useful in any number of other matters, from divorce to alimony to fraud investigations and beyond.
So where does all of this evidence come from and how can we best utilize it? It can come from a variety of different places, but the two main areas are the mobile device itself and the records from the cellular provider. Proper legal authority needs to be in place to obtain the data from either source as well, but with the right training and experience, an investigator or consultant can help with obtaining those items. Once the data is in-hand, any number of tools and approaches can help parse out the relevant data and map locations that may be of interest in the case.
In the example cited in this article, the data was extracted from an Apple iPhone 7 through an advanced logical extraction using Cellebrite Universal Forensic Extraction Device (UFED) Physical Analyzer. Because I’ve been doing a lot of traveling lately and using the Waze app to find my way around various US-based locations, I decided to use Waze as a case study in location information. Cellebrite UFED does natively parse this data (see fig. 1), but does not natively map the locations.
Fig. 1: Waze Data parsed in Cellebrite PA
As you can see, Cellebrite adequately pulled GPS locations, dates, times and even addresses that were stored in Waze. The list is longer, but figure 1 gives us a sample of a few months of Waze usage throughout various locations.
But again, Cellebrite does not natively map this data. So how can we see this graphically and perhaps even create a demonstrative for use in court? Enter the cellular record analysis and location mapping tool, CellHawk from Hawk Analytics. CellHawk is an online tool that will natively read, parse and map location data from any of the major cellular providers as obtained through a search warrant or court order. However, as I learned recently by attending the CellHawk training, it can also map anything with a date, time and GPS coordinates. The tool just takes a little manual configuration once the data is exported in Cellebrite.
For this demonstration, I simply had to export the Waze Data into an Excel spreadsheet, which is natively supported in Cellebrite. From there, the spreadsheet is uploaded into CellHawk, which natively reads the file column headers and asks for some direction about where the pertinent data (date/time/GPS location) is located within the spreadsheet. Here’s an example of what we get when CellHawk reads and maps the data:
Fig. 2: Northeast Waze Locations
Our office is located in Richmond, VA, which is listed as the starting point for many of these trips. But this map details all of the client visits in/around Virginia, Maryland and DC as well as locations where training was delivered in the Philadelphia and Boston areas over a period of more than a year.
When a map location is clicked, CellHawk natively tries to associate a phone number with that data point. Because the CellHawk generic location finder was used, the identifier of "Waze" was entered instead of a phone number, but this is user-defined in CellHawk. Interestingly, the dates and times of the data points are listed and viewable when clicked in CellHawk. The figure below details a recent trip to Kansas City, KS for the Cellular Analysis and CellHawk training:
Fig. 3: Date, time & location detail in CellHawk
What’s even more interesting about the dataset in general is the historical nature of some of these locations. Figure 3 also illustrates several locations in and around Chicago and Milwaukee. I used Waze to navigate in/around the Chicago area and to the Harley Davidson museum in Milwaukee in August, 2012. Since then, while the Waze user account hasn’t changed, the device has been upgraded through 3 or more different iPhone models.
This historical data was not a one-off or isolated to this trip only. Fig. 4 below shows map locations from a trip to and around the ALERRT Center in San Marcos, TX where I attended a conference in 2011:
Fig. 4: Waze historical data from 2011 mapped in CellHawk
That’s Great. Now what?
The data gathered by Cellebrite and mapped by CellHawk is useful to help prove or disprove someone may have been to and navigated around a particular area during a specified time frame. Further, if a subject of an investigation or litigation claims they cannot drive, Waze can help disprove that claim. When we factor in dates, times and historical data that is maintained over years and across multiple devices, the potential weight of that data becomes apparent.
There are other ways (no pun intended) to parse and map this data, but both Cellebrite and CellHawk make it fairly easy and intuitive. In the ever-present questions of who, what, where when, how and perhaps why of any incident, the ability to find, export and analyze this data simply and effectively is a fantastic investigative advantage!
P.S. If you think this was a cool illustration, I highly recommend checking out CellHawk for you cellular call detail record and cell site mapping. It’s a fantastic tool for mapping that particular set of data and that’s primarily what it was designed to do. Be looking for a future blog diving into CellHawk for that purpose.
Patrick J. Siewert
Professional Digital Forensic Consulting, LLC
Virginia DCJS #11-14869
Based in Richmond, Virginia
Available Wherever You Need Us!
We Find the Truth for a Living!