Analytics software parsed 35 TB of data seized from an alleged child-exploitation suspect to find crucial evidence linking him directly to the abused child

When police in Glastonbury, Connecticut, received a report of a suspect allegedly sexually exploiting a child in their jurisdiction, they immediately reached out to federal authorities. After obtaining a warrant they raided the home of James Ripberger, the suspect in the case, retrieving some 50 devices that would eventually be determined to hold 35 TB of information.

Manually reviewing that much data to find critical evidence linking the suspect to the child in question might have taken months and valuable evidence could easily have been overlooked from what would eventually include thousands of pornographic pictures and some 20 videos. With the help of Cellebrite experts and advanced analytics tools, Glastonbury police were able to find key images that eventually lead to the suspect’s conviction.

“What was important was being able to visualize [all the evidence in] the case together as one.”

Lt. Corey Davis, Glastonbury Police Department.

“Gathering images from each device and uploading them into a single case file, then being able to immediately pick out which devices had images we were interested in [was crucial].”

Lt. Corey Davis, Glastonbury Police Department.

The Case

At the time of the investigation, Lt. Corey Davis of the Glastonbury Police Department, was the Digital Forensics and Investigations Supervisor for the Connecticut Center For Digital Investigations (CDI). His was responsible for overseeing the digital forensics portion of the case. When it was clear that a minor was involved, Lt. Davis immediately requested help from federal authorities. Over time, the case would involve assistance from a number of organizations including the Department of Homeland Security, the National Center for Missing and Exploited Children, and Cellebrite.

A sentencing memorandum filed by Ripberger’s lawyer, John D. Maxwell, and quoted in an online article by Alex Wood published by the Journal Inquirer said, “Ripberger met the victim around 2010 when she was living with her father in Glastonbury…

Her grandmother lived near Ripberger, and he [Ripberger] agreed to watch the girl at his house while she waited for her father to get out of work and pick her up.”

In another online article published by the Hartford Courant, author David Owens said that, “James Ripberger, who moved to Connecticut in 1998 from Louisiana for a job, accumulated about 20 videos of child pornography, more than 17,000 images of what the government described as ‘child erotica’ and multiple images and videos of a young female whom he watched after school and who Ripberger surreptitiously recorded in various stages of undress.”

The Challenges

As Lt. Davis described when interviewed, the challenge for his team was to come up with a way to efficiently sort through the 35 TB’s of data they discovered to “find just data on that victim.” Lt. Davis knew that facial-recognition software would be critical to narrowing down the data to more actionable intelligence. Since his department already used Cellebrite technologies, he contacted his Cellebrite representative who referred Lt. Davis to the National Center for Missing & Exploited Children (NCMEC).

NCMEC serves as the national clearinghouse and resource center for information about missing and exploited children. Their database provides a means for investigators to compare seized materials to determine whether an exploited victim has appeared in any other cases in the U.S. or internationally. NCMEC also works with a broad array of technology vendors, to provide assistance in missing and exploited children cases. Their partnership with Cellebrite provided the means for Lt. Davis’ team to work directly with Cellebrite’s digital intelligence experts on the case.

The Solution

By working with a team of Cellebrite experts who flew to Glastonbury to assist in the case, Lt. Davis’s team was able to utilize advanced Analytics tools and AI to narrow the number of relevant devices, which resulted in the team discovering images of child exploitation that weren’t in the standard hash sets Glastonbury PD normally uses to parse data.

“What was important was being able to visualize [all the evidence in] the case together as one,” Lt. Davis explained. “Gathering images from each device and uploading them into a single case file, then being able to immediately pick out which devices had images we were interested in [was crucial].”

The Tools Used

While the majority of the data was stored in computers and on hard drives, some mobile devices were also seized. The team used Cellebrite’s Physical Analyzer to search for evidence on the phones, but as Lt. Davis described, “For the most part we were uploading to Cellebrite Pathfinder to ID the images on the drives. We then utilized Griffeye to look for child-exploitation images, categorize them, and generate a report that would tell a prosecutor how many illegal images were found.”

At the end of the investigation, digital experts noted that leveraging nudity and face filters, and image-face matching, was critical to discovering a number of general media events tied to the victim. Ultimately, the team was able to identify a handful of images that were highly inappropriate. Some were child-exploitative and a few qualified as being Category 1 abuse.

The Results

James Ripberger was sentenced to 150 months (12 ½ years) in prison for receiving child pornography followed by 10 years of supervised release. A state case against him is still ongoing.

A number of valuable take-aways, which may help other agencies involved in similar investigations, can be gleaned from this case:

• Don’t be afraid to ask for help: Had Lt. Davis not reached out to his local tech rep., he would not have known how to seek assistance from NCMEC, which ultimately provided the means for his team to utilize the expertise of Cellebrite technicians and tools to solve the case.
• Look for efficiencies: Being able to quickly sort out which devices contained potential evidence then being able to dive deeper to find key evidence that might have otherwise gone unnoticed shows how valuable having the right digital intelligence tools and training can be. Without them, this case might not have been solved and the victim’s years of suffering put to an end.
• Staying current is key: As technology evolves, devices of all types are able to store larger and larger amounts of data. A recent survey of some 2000 global managers and law enforcement personnel revealed that 90% of cases involve smartphones as the main evidence source. An investigative team’s ability to parse data from multiple devices and ever-growing data sets will be critical to solving cases in the future.

To learn more about Cellebrite’s full suite of Digital Intelligence solutions, visit Cellebrite.com