Lessons From the Forensic Examiners Behind the University of Idaho Murders Investigation

Key takeaways

• DNA identified the suspect; digital forensics showed the murders were planned, largely through what was missing from his devices
• An FBI examiner brought in two Cellebrite experts when data that should have been there was missing
• The core lesson: when a device shows nothing, find out why. There’s likely a good reason, so see how it plays into your case

At 2:54 a.m. on the night of the University of Idaho murders, Bryan Kohberger’s phone was manually powered off. Wi-Fi and cellular data were disabled, and the battery was 100% charged. On devices that otherwise gave investigators little to work with, that detail became what one examiner calls the most damning evidence that the murders were planned.

Kohberger pleaded guilty to killing four University of Idaho students in Moscow, Idaho, on Nov. 13, 2022: Madison Mogen, Kaylee Goncalves, Ethan Chapin and Xana Kernodle. DNA from a knife sheath left at the scene led investigators to him, but DNA couldn’t show whether he planned it. That question came down to a phone and a laptop and the data that was no longer there, or so it seemed.

Jeff Tanzola, then a supervisory special agent with the FBI’s Philadelphia field office, brought in Cellebrite forensic experts Heather and Jared Barnhart to work out why the data was missing and what it meant.

On stage at the Cellebrite C2C User Summit 2026, the three walked through how they did it. Here are five lessons from that conversation for anyone working a digital investigation.

1. Know When to Call for Help, and Who to Call

The lesson: a stalled review is a reason to bring in outside expertise, and the time to build those relationships is before the case lands on your desk.

Tanzola collected the devices 48 days after the murders. “A lot of times you get a phone, you get a computer, and there’s a lot of evidence that just jumps off the screen at you,” he says. “This was not the case.” A second examiner went through them, and every tool in the lab was used to examine them yet not much came back. Kohberger was a doctoral student in criminal justice, which gave him a ready explanation for anything that may have looked odd, and the pressure on the lab kept building. “Everyone’s looking at you,” Tanzola says. “You’re the digital forensic guy, you have the phone, you’re looking at it. Why is nothing there?” So he asked himself a different question:

“Who’s smarter than I am? I’m not the smartest examiner in the room by far, trust me. But I knew who to reach out for.”
Jeff Tanzola, former supervisory special agent, FBI

The answer was two people he had known for more than a decade through digital forensics instruction. He pitched the idea to the agencies running the case, and in March 2023 he called Heather, who brought in Jared, knowing another set of eyes would be a huge help. They worked the case on site at the Philadelphia Regional Computer Forensics Laboratory (RCFL), on evenings and weekends, around their regular jobs.

Heather thinks the call itself is the part people skip. “I think a lot of people don’t ask for help,” she says. Jared added that perhaps ego gets in the way more often than it should.

2. Separate What Time Deleted From What the Suspect Deleted

The lesson: some data disappears on its own and some of it gets removed, and telling the two apart is where intent starts to show.

When the tools came back with so little, the question became why. Some of it was time: by day 48, many of the phone’s most useful logs had rolled off on their own. The laptop was a different story. Someone had cleaned it, going back to October, and the cleanup went deep enough that even the record of the cleanup had been scrubbed.

“When you’re cleaning the file that tracks the cleaning, I was like, you got to be kidding me.”
Heather Barnhart, senior digital forensics expert, Cellebrite

To spot what was missing, they first had to establish Kohberger’s pattern of life, meaning what normal looked like for him, and his normal was strange. The FBI’s Cellular Analysis Survey Team (CAST) had found four stretches when his phone went as quiet as it did on the night of the murders. He had 16 to 18 contacts and no one he regularly chatted with outside of text messages and long calls with his parents. Against that baseline, a run of changes to his digital habits stands out in the weeks and hours around the crime.

The Pattern Around the Crime

Each shift in Kohberger’s digital activity carried meaning:

• Months before, he started using a VPN, a break from his usual habits
• On Nov. 11, two days before, he turned off Wi-Fi, so the phone stopped connecting to networks
• At 2:54 a.m. Nov. 13, the phone was manually powered off with the battery at 100%
• At 4:48 a.m., about two hours later, the phone came back on away from any known Wi-Fi, and CAST tower data placed it away from home
• Afterward, he dropped the VPN and incognito mode and went back to normal, which Heather calls the perfect bookend
• In the weeks after, he kept close tabs on the investigation, repeatedly downloading case updates, and late on Christmas night he searched for and downloaded files on more than a dozen serial killers
• On Dec. 29, he read a Moscow Police Department release confirming police were looking for a white Hyundai Elantra, then immediately looked up auto detailing shops and shopped online for new vehicles

Jared calls the power-off the most damning evidence because there was a deliberate decision to not have his phone traceable during the times of the murder, which suggests the planning aspect. Heather sums up the whole exercise as making sense of “the lack of data being the best data.”

3. Validate Phone Logs Before You Testify to Them

The lesson: a missing log only holds up in court if you can show what it should look like.

None of that matters in court unless you can show what a log should contain. When Jared found an unfamiliar log tied to the Wi-Fi change, he sent it to Josh Hickman, a Cellebrite Android expert who began testing it. Because Heather owned the same phone model on the same carrier, the team could repeat each action and compare the results. The point of that work is an explanation a jury can follow: press this button, and the log looks like this; turn off Wi-Fi, and it looks like that. Saying data is missing is one thing, but showing what should have been there is critical when talking to jurors.

That bar matters to prosecutors as much as examiners, because a finding you can’t explain is a finding you can’t use.

Heather also played defense attorney against her own work. Maybe the criminology research was only research. As for the eraser on the laptop, she couldn’t prove it hadn’t run alongside a virus scan. What she couldn’t explain away was how much had been wiped. “What are you hiding?” she says. The case ended in a plea deal, so none of it was ever tested in front of a jury.

4. Don’t Expect AI to Flag What Was Never There

The lesson: AI surfaces what exists in the data. Knowing what should be there still takes a trained examiner.

When the devices came up short, Heather’s first instinct was to doubt the tools. The team ran more than one, and she checked whether Cellebrite Physical Analyzer had missed something, but there was nothing there to parse. That experience shapes how she thinks about AI in digital forensics:

“As we introduce AI into digital forensics, we are going to train AI to tell us the artifacts that exist. What happens when they don’t? So you still have to learn what these logs mean, and you need test data, and you need to keep training yourself to understand if the evidence isn’t there. It’s the same situation that we were in: AI is essentially your junior analyst. So you’re bringing in some junior examiner and saying, hey, help me find the stuff. But we already couldn’t find it.”

Jared puts the risk more starkly. Without the knife sheath, investigators might have reached the suspect some other way and then stared at this same evidence, with a criminology excuse for every finding.

5. When the Case Goes Public, Protect the Evidence and Your Objectivity

The lesson: a public case brings pressure the lab never asked for. Stay away from the coverage (traditional and social media), and be ready to show exactly who touched the evidence.

When videos about the crime scene started showing up in Heather’s TikTok feed, Jared and Heather agreed not to watch them, so it didn’t influence the work. They stayed away from the news entirely, to the point that they didn’t know a national TV report on the case had aired until the prosecutor’s office contacted them about it. They wanted to speak only to the piece of the investigation they had worked.

That report brought its own pressure. After video of the suspect’s car leaked to the media, the judge wanted to know who had access to the forensic reports. Tanzola’s team answered quickly because the FBI keeps chain-of-custody logs and records of every login to its internal network. His advice: know how you would answer that question before a judge asks.

Continue the Conversation at Cellebrite C2C User Summit 2027

Tanzola’s call to Heather and Jared worked because the relationship behind it already existed, built over more than a decade through digital forensics instruction. Jared’s advice points the same way: “Surround yourself with smart people, challenge yourself, because you never know when something like this falls in your lap.”

The C2C User Summit is where many of those relationships start: three days of hands-on training and sessions like this one, with the examiners who worked the cases in the room.

Frequently Asked Questions

Did DNA or digital evidence identify Bryan Kohberger in the University of Idaho murders?

DNA helped identify Bryan Kohberger as the suspect in the University of Idaho murders. A knife sheath left at the crime scene led investigators to him, and digital forensics later helped show that the killings were planned.

What digital evidence showed Bryan Kohberger planned the Idaho student murders?

Bryan Kohberger's phone showed a pattern of preparation before the Idaho student murders. He started using a VPN months before and turned off Wi-Fi two days before, and the phone was manually powered off at 100% charge at 2:54 a.m. His laptop had also been cleaned going back to October.

How can investigators tell if a phone was turned off on purpose?

Phone logs can record when a device powered off and how much battery it had at the time, and a phone that shut down at 100% charge did not die on its own. In the University of Idaho murders case, examiners confirmed what Kohberger's phone logs meant by repeating the same actions on an identical phone model on the same carrier.

Was digital evidence presented at trial in the University of Idaho murders case?

No. The University of Idaho murders case ended in a plea deal, so the digital evidence was never presented at trial.