How Oakland County Sheriff’s Office Head Start in Digital Forensics Gave the Agency the Upper Edge

With the rapid proliferation of digital devices and the growing reliance on technology, even prosecutors are getting on board—and increasingly demanding digital evidence from law enforcement agencies. Prosecutors are now routinely requesting access to emails, text messages, social media posts, and other electronic records as part of their investigations.

A sentiment backed up by Detectives Jeremy Bois and Edward Wagrowski of Oakland County Sheriff’s Office (OCSO). “Prosecutors are definitely demanding more from law enforcement, they want an overwhelming detail before they even write up a warrant for arrest,” said Detective Bois.

This demand for digital evidence shines the limelight on digital forensics and its increasingly important role in modern investigations—and not without 

merit. For Detective Bois, it’s the speed advantage, “The ability to get all that information at a faster pace compared to fingerprints and DNA matching that takes weeks or even months, I think is beneficial to speed cases along and get better success rate.”

Early Bird Gets the Worm

A staunch supporter of digital forensics, the Oakland County Sheriff’s Office itself is more poised than most when it came to keeping in step with the proliferation of digital evidence and the accompanying demands.

They had a stake in the digital forensics game way before other law enforcement agencies, starting with computer crimes in 1999. “Back then it was just dead box forensics, you know towers and stuff like that,” Det. Wagrowski mentioned.

However, as technology advanced and smartphones became ubiquitous, the agency quickly pivoted towards mobile devices. “Now, the workflow for computers is just slowly ticking down.

Maybe twice a month, somebody will bring in a computer, but on the other hand, we’re seeing at least two or three phones a day!” he added.

In fact, “In the past year alone, we access more than 900 devices and that’s just between three examiners,” Detective Bois chimed in. A testament to the sheer scale of the OCSO’s digital forensics efforts and their commitment to staying ahead of the curve. To date, they have invested in Premium, UFED, and Physical Analyzer—the last of which is used 100% of the time by the two detectives for CSAM cases.  

With their comprehensive arsenal of digital forensics solutions, the Oakland County Sheriff’s Office has seen numerous successes in several high-profile cases that relied heavily on digital evidence that are valid and admissible—two of which the detectives were quick to highlight.

Dealt the Wrong Cards

The detectives discussed a case involving a professional poker player, whose body was found badly burned near a recreational area, northwest of Detroit.The victim was reported to have met with the assailant at a motel the night before. Law enforcement was able to identify and pin a person as an immediate suspect through the victim’s phone records.

To solidify evidence against the assailant and build a stronger case, OCSO dove deep into the suspect’s phone using Physical Analyzer and found footprints in the most unexpected of places. “We were able to use data from his phone, it was an iPhone, so it tracked his steps, and it showed him meeting the victim at the motel, how they went back and forth out of their rooms,” Det. Wagrowski said.

It was this activity data combined with other myriad of information including geolocation, call records, cell tower data, and surveillance video evidence that led to the quick arrest of the assailant. With digital evidence stacked against him, the jury took less than an hour to convict the assailant on one count each of felony murder and second-degree criminal sexual conduct. He is currently serving mandatory life imprisonment.

The Shooting

“Never in a million years that this would happen within our jurisdiction. We were already at work and our division Captain came into our office and said “all hands on deck” and to respond to the school. We thought it was some knucklehead with a rifle near the property but when we got there it was absolute chaos.” Det. Wagrowski reflected. “The first thought we had was, we needed to get the shooter’s phone before it shuts off.”

As the shooter was apprehended along with the parents who went on the run, they got their hands on the three phones. It was at that point crucial to prosecutors and the jury that they had all available data that were on the phones. “That’s when Premium really came in clutch.” he said, which at the time was the only solution that supported the model the shooter was using.

The Detroit Field Office of the US secret Service (USSS) was instrumental and immediately made themselves available to assist and our partnership with them is very important to us.

The OSCO and USSS team was able to gain access to the phones and extracted all incriminating data that would otherwise be locked away due to compatibility and support limitations.

“It was crucial and very important to the cause, and without Cellebrite Premium we wouldn’t have had that information.”

On implementing digital forensics and embracing digital transformation as a whole, both detectives cite the crucial components below.

Organizational buy-in

The first step to success in any form of digital transformation including digital forensics is always the support of the entire organization. Benefits need to be apparent, and it takes time. Detective Wagrowski provides an apt analogy of in-car cameras. “When we first had those cameras put in our patrol cars, deputies lost their collective mind! But now, zero chance a deputy would ever take a car without a camera because we saw what it could do for us. It’s all just about getting used to the change.”

Keep on training

Beyond the mainstay training which involves onboarding detectives and getting them accustomed to not turning off digital devices found at crime scenes, training for the examiners is also an important component. “Even if you had your training done 2 years ago, technology changes a lot in two years,” said Detective Bois. “You need to show that you are constantly up-to-date and to prove to the judge and jury that you are credible.”

Keeping evidence admissible

Digital evidence may have the speed and preservation advantage, but it still must be admissible in court. “That’s the one thing I like about Premium. Minimal manipulation is needed. All I do is plug in a phone and voila. Previously, I had to manipulate the phone to access information and I had to explain that to the court and jury which can impact the success rate,” Detective Wagrowski said. This also speaks to the investment in comprehensive and reliable digital forensics solutions.

Conclusion

As a wrap-up, Detective Wagrowski’s parting remarks hone in on the spirit of collaboration and how it can fuel investigations beyond just digital forensics. “I love being able to tell someone who’s hit a roadblock to come to us and we’ll get you your next steps, next arrest, or next charge. It’s great knowing that our office is leaned on by so many different agencies and people. It makes me excited to come to work—it does.”