The Orange County Sheriff’s Office Digital Forensic Squad processes approximately 1,300 devices per year across cases ranging from theft to homicide to crimes against children. After replacing a manual thumb-drive workflow with Cellebrite Guardian for cloud-based digital evidence sharing, the squad enabled real-time collaboration between lab examiners and detectives in the field. In the 2024 Madeline Soto missing persons and homicide investigation, Cellebrite Inseyets extracted critical evidence from a phone the suspect had wiped twice, while Guardian enabled detectives to review and act on that evidence in real time — contributing to a case that resulted in 21 life sentences. The squad also uses AI-powered media classification within both platforms to manage high caseloads.

Orange County, Florida is home to approximately 1.5 million residents and receives between 200,000-300,000 daily visitors, drawn by its renowned theme parks and numerous regional attractions.

“The community is very tourist-oriented and keeping them and the residents here safe is very important to the Orange County Sheriff’s Office,” said Darko Stamenic, Sergeant of the Digital Forensic Squad, which has five full time professionals who examine about 1,300 devices a year, primarily mobile phones from theft to homicide to crimes against children.

Stamenic has worked at the Sheriff’s Office since 2013 and joined the Digital Forensics Squad in 2022. They are improving their workflow with a new lab and updated technology.

“Even in the three years I’ve been here, it’s evolved. We used to use hard drives to distribute the extractions. Now we get to distribute them over the cloud with Cellebrite Guardian, which is very nice. So just trying to modernize the lab,” Stamenic explained. “We’re getting a Faraday room, which will be helpful as well.”

How Cellebrite Inseyets Streamlines Digital Forensic Processing

Stamenic said that adding Cellebrite Inseyets to their lab enables Streamline to process several phones simultaneously, and UFDRs are generated automatically to speed up workflow.

Stamenic said, “Just being able to generate the UFED reader report without sitting there and pressing the buttons because if you started it before we go home, then you come in the morning

and it’s done. With Streamline, we’re able to save, I’d say, hours. Just being able to have that automated as opposed to you having to click the button.”

Sgt. Stamenic reports that, as an affiliate of the Central Florida ICAC Task Force, they handle thousands of annual tips. Fast case processing is key to arresting suspected predators quickly.

Why Cloud-Based Evidence Sharing Replaced Thumb Drives

Sergeant Stamenic remembers the days when they had to manually copy reports onto thumb drives, which slowed down investigations.

“I mean it could take hours to transfer onto another thumb drive and then the detective needs a copy, the state attorney needs a copy and then the defense attorney needs a copy. It’s just a logistical nightmare,” Stamenic recalled.

A cloud solution was urgently required, and they now operate within Cellebrite Guardian.

“Just this morning I had a state attorney reach out to me and say, hey, we need to share this for discovery with the defense. And I was like, ‘All right, there you go. It’s shared. Have at it,’” Stamenic said. “So, something that would take a few hours can take five seconds now, so it’s very helpful.”

It goes a long way for collaboration and keeping the team on task.

“With the examiners and the detectives who are on the receiving end, not having to waste all that time driving around coming to see us. We’re able to collaborate. They’re able to be out in a field. We’ve had homicides where the detectives are out in a field, and I’m sharing the information live. We’re able to look over all that together, and I think that that definitely works into helping with morale as well,” Stamenic shared.

Real-Time Evidence Sharing in a Missing Persons Investigation

Guardian proved essential when 13-year-old Madeline “Maddy” Soto went missing from her hometown of Kissimmee, Florida in the spring of 2024. Police lawfully accessed her phone, which was left at home, along with her mother and stepfather’s phone to look for clues on where she may have gone.

“Detectives were out interviewing the parents, interviewing witnesses. And we’re able to share the data on the fly with them,” Stamenic said. “So, they’re able to look through these text messages and generate questions and leads based off of the phones.”

The stepfather’s phone stood out immediately.

“The stepfather wiped his phone shortly after she went missing. Not only once, but he wiped it twice,” Stamenic explained. “Detectives were able to talk about that with him, where he claimed he accidentally wiped it – twice.”

How Digital Forensics Recovered Evidence from a Wiped Phone

Naturally, investigators focused on the stepfather, Stephen Sterns, and feared something was terribly wrong. Unfortunately, their hunch was correct. A few days after the girl was reported missing, her body was found in nearby Osceola County. Maddy had been strangled.

“The huge part of the puzzle was when he reset his phone, some of the information from his cloud repopulated on his phone, which included a lot of videos of him sexually abusing her over the years,” Stamenic said, and added they were able to get a full file system extraction of his phone which led them to key evidence that made a strong court case.

“We had some pretrial hearings and the prosecutor had me walk the judge through the steps you would need to take to wipe a phone. There’s no way you’re going to accidentally do that and do it twice,” Stamenic said.

The collaborative digital forensics and investigative work through traditional methods led to a solid case. Sterns pleaded no contest to first-degree premediated murder of his stepdaughter, which means he did not admit guilt. In July of 2025, he was sentenced to 21 life sentences.

Cellebrite Certification and Courtroom Credibility

In the Soto case, as well as numerous other proceedings, Stamenic and fellow examiners are questioned regarding their professional qualifications while testifying.

“Every time I’ve had any kind of court hearing or deposition related to digital forensics, they always ask about what training I’ve had and specifically, CCO (Cellebrite Certified Operator) and CCPA (Cellebrite Certified Physical Analyst) is important. Most of the evidence that the attorneys are using are from Cellebrite Reader reports. Generating reports to show the jury and being able to say that I’m certified in the Cellebrite products is convincing for a jury,” Stamenic said.

How AI-Powered Media Classification Saves Investigative Time

With so much data and so many cases, Stamenic and the team of digital forensic examiners at the Orange County Sheriff’s Office are employing AI-powered features within both Cellebrite Inseyets and Guardian.

“Where I’ve seen it save the most time is both going through media and just being able to classify media and narrowing down 500,000 pictures to 100 pictures,” Stamenic said.

Guardian’s text summarization helps investigators by directing them to relevant information, always verified by a person. In one homicide case, Stamenic demonstrated the feature to a detective, resulting in a breakthrough.

“I showed the detective what buttons to click to use the AI, and the conversation ended up being the conversation that was related to the homicide,” Stamenic shared. “The AI picked that out of thousands of messages. It summarized that these two talked about one inviting the other to the house and violence between them.”

It’s those kinds of moments that keep Stamenic coming to work every day – no matter how difficult the case is.

“The job is very, very rewarding. You do have to see some things that most people will never see, or want to see, ever,” Stamenic said. “Being able to gather that evidence to help at least bring closure to the victims or victims’ families.”

See how Cellebrite Guardian can modernize digital evidence sharing at your agency. Talk to an expert.