With the rise in digital evidence, using the right solutions to handle all that data is more important than ever. And few know this better than Corporal Mark Moy from the Flagler County Sheriff’s Office (FCSO).

When FCSO used to rely more on neighboring agencies to process its digital evidence, Cpl. Moy said, “We were waiting a month or two for what would take us a couple of days or a week to resolve on our own if we had our own tools.” The time wasted waiting for evidence to be processed and driving back and forth to retrieve the data solidified the need for FCSO to have its own digital forensics solutions.

Bringing Flagler County Sheriff’s Office into the Digital Investigative Age

Cpl. Moy has 21 years of experience in law enforcement, including three years with the Broward Sheriff’s Office before moving to FCSO, where he’s served for the last 18 years. Having worked in the property crimes unit, Cpl. Moy has seen first-hand how digital footprints are becoming more prevalent in each case, which is what drove him into digital forensics.

He explains, “I started to see many more cases where the phones started to play a huge role as evidence, and that sparked my interest.” After returning from a homicide conference around 2016, where he learned about digital forensics solutions, he pitched it to FCSO management to help the agency be more self-sufficient in handling digital evidence.

FCSO’s digital forensics lab also has support from Sheriff Rick Staly, a big proponent of digital forensics. With that support, Cpl. Moy channeled his passion for digital forensics into evolving the agency’s digital investigative capabilities.

The Need for Efficient Digital Evidence Management

FCSO recently started using Cellebrite Inseyets to enhance its digital forensics lab. However, collaborating with different parties made it clear that Cpl. Moy and the agency needed a better evidence workflow management system, which led to them to purchase Cellebrite Guardian through a grant.

Cpl. Moy explained how cumbersome it was to share UFDRs with detectives and prosecutors in the conventional way. A major limiting factor is that other stakeholders may not have a work machine powerful enough to handle the reports. He also needed to make copies and share them with different parties separately.

Upon searching for a better alternative, Cpl. Moy explained that Cellebrite Guardian checked all the boxes. “As an examiner, you can load it, get your extraction and make your reports. You then tell your detective it’s completed, and they can log on to see the progress and even tag the items they’re looking for.” The ease of collaboration with Guardian also extends to prosecutors. Furthermore, using a cloud-based evidence workflow management system, as Cpl. Moy puts it, “Is a no-brainer in this era, as storage requirements just keep growing.”

Digital Evidence: The Undeniable Smoking Gun

Despite the undeniable facts that digital evidence provides, Cpl. Moy said defendants still don’t seem to take plea agreements. Often, it’s with digital evidence that he shows how rock-solid the case is. He explained, “Once I go on the stand and go over all the evidence, there’s no doubt in their mind these individuals committed those crimes.”

A Community Terrorized by School Swattings

In the spring of 2024, the Flagler County Sheriff’s Office began receiving 911 calls reporting threats on local schools. The incidents, known as “swatting,” involved fake reports that triggered massive law enforcement responses and fear in the community. “Parents weren’t letting their kids go to school, kids didn’t want to go to school,” said Sheriff Rick Staley.

Cpl. Moy, along with the Criminal Intelligence Unit, began their investigation to find out where the calls were being placed. When they began looking at the IP address associated with the call, the pieces started coming together. “Even though the suspect was using a VPN at times, there were times where the VPN was not connected and linked him back to his residence,” Cpl. Moy said. The digital footprint of the calls led investigators more than 600 miles away from Flagler County, to an 11-year-old boy in Virgina.

After retrieving the suspect’s phone, it was analyzed by Cellebrite Inseyets. Cpl. Moy said this solution played a significant role in piecing together information and evidence that ultimately led to the suspect being extradited to Florida to face trial. The boy ended up being sentenced to more than a year in a Florida detention facility and the community regained its peace.

Sheriff Staley credits the department’s training and advanced digital forensics solutions with ultimately pinpointing the suspect, “this kid truly terrorized this community,” he said.

How Digital Evidence Helped Solve Vehicle Burglaries

When a vehicle burglar responsible for a chain of burglaries across multiple jurisdictions came to Florida, digital evidence played a major role in catching him. After the suspect broke into several cars in Flagler and a neighbouring county, police say the suspect used his victim’s credit card for several purchases. The flagged transactions led to the Florida Real Time Crime Center tracking his vehicle through traffic cameras.

He then got into a pursuit with law enforcement and was stopped at a drawbridge, where he tried to dispose of evidence. Law enforcement recovered a stolen gun and his mobile phone, among other things. FCSO’s examiners lawfully accessed the phone and obtained incriminating location data that, coupled with traffic camera footage, tied the suspect to the crimes in the area.

As the suspect was a convicted felon, a judge sentenced him to life in prison for several offenses, including burglary while armed with a firearm and grand theft with a firearm.

Catching a Child Predator with Deleted Files

In a case involving CSAM (child sexual abuse material), a man who was a custodial figure had secretly recorded videos of a young teenage girl in the shower. When the victim found out, and her mother reported the incident to law enforcement, they knew digital evidence would be important.  

Although the suspect deleted the files from his mobile phone, examiners managed to recover deleted cached images. This critical evidence was instrumental in securing his conviction and sentence.

While digital evidence is valuable in combating all types of crimes, Cpl. Moy is especially driven to solve cases involving ICAC (internet crimes against children) and CSAM. He said, “You get those cases, and you become a voice for those victims. You can help them move forward and get justice, when a lot of times, they feel like no one hears them.”

Protecting Digital Evidence as a Collective Effort

The growing importance of digital evidence in securing justice means that all parties are responsible for preserving it. As patrol officers are often the first on a crime scene, Cpl. Moy provides FCSO officers with training material on digital devices.

Simple training is often the most effective, and his brief training slide deck serves as an excellent manual. He highlights that good training material can help officers visualize the steps they should take when dealing with digital devices. Some of what officers learn from his manual include:

  • Keeping the device in the state that it was found in, whether it’s switched on or off
  • How to isolate a device from the network, if possible
  • The required forms when submitting devices for examination

In the ever-evolving field of digital investigations, Cpl. Moy is enthusiastic and determined to face the challenges of gathering and analyzing evidence. He believes that DNA evidence still plays a vital role in solving crime. However, the abundance of digital evidence means data is often the puzzle piece that completes a strong case, driving it toward justice.