The mobile phone is used daily to send and receive videos, photographs and messages, these types of devices have become an essential element in the lives of many people and what is stored there can say a large part of each individual. Smartphones have been a key test in police investigations for yearsMurders to cases such as the current trial against the state prosecutor general, Álvaro García Ortiz, whose messages deleted continue to recover the civil guard.
Technology has evolved to strengthen the confidentiality of communications, more in a world threatened by cybercrime and digital espionage. This has complicated the work of researchers who need very advanced technologies to carry out IT expertise. The case of García Ortiz has shown the importance of this technical process.
In Spanish-Microno, we visited the installations of Lazarus, a company with more than 20 years of experience in Europe in recovery devices, from mobile to servers. “”People are increasingly aware that in a judicial situation the electronic imprint This can help resolve a case, “said Manuel Huertas, CEO of Lazarus.
Manuel Huertas, CEO of Lazarus Technology
Murderer
“Today, there is so much interaction between devices, services, clouds, files and applications, which is practically impossible to disappear proof without any trace.” Huertas explains that a small percentage of criminals have learned to do it difficult work, while the vast majority still do not know how to erase their “” “imprintsIn the end, what they do is demonstrate intentionality“, How it ended up revealing itself on the phone of García Ortiz.
Digital evidence
Mobiles arrive at the laboratory in a Faraday bag, to ensure tests. In this case which shows orchards, the telephone is automatically without signal, it cannot even issue or receive signals, they are sure that no one will interact remotely during the investigation. When he arrives at Lazarus, Technicians transform the device into digital evidence.
The contents of the phone are completely obtained, the medico-legal image of everything it stores, to be able to save the mobile in the safe. Until the sentence is issued or the file is submitted, the phone remains kept there.
Faraday bag to protect the phone
Murderer
The phone begins to be digital evidence when A code or atmosphere is obtained, the equivalent of human DNA. “In the case of human DNA, whenever you analyze, you consume part of this biological sample, which can end.” In digital medico-legal research, tests can be repeated a thousand times.
The hash technology is also used to catalog illegal or pedophile internet content. Each photograph, document or file becomes a unique number that describes its contentLike a fingerprint or digital DNA sequence, without opening or visualizing it. Hash is impossible to understand anyone with the naked eye, but identifies this digital element.
Haches report in a digital medical-legal survey
Murderer
No matter what you do with proofs or the times you analyze it. “As you take the image and check that it is good, you know that the image keeps its three precepts: Integrity, conservation and guarantee of repeatability“Explains Huertas. Repeatability is the most important thing, in order to provide that digital evidence to other criminalists in the event of conclusions of your report would be questioned.
From these evidence, new hunts of any file or element on the phone is extracted, everything has its own hash. “”You remove a chopping from other atmosphere And you realize the integrity of each of these tests, “he says. From this in-depth research, not only are documents or messages, but also a certain activity, that is to say the movements of information who were.
Reconstruction of digital activity
“If you fly information with a pendrive, we can discover that when you connected a skewer, which the serial number A, what model, what capacity and what information movements there was,” they explain to Lazarus. Thus details one of the reports of the central operating unit (UCO) On October 16, 2024 at 3:00 p.m., Garcia Ortíz Mobile's messages were erasedJust when the high court had met a matter against him. “Delete all the conversations on October 16, he removes them twice, that is to say that he erases them again,” explains Huertas who studied the reports.
Also A factory phone restoration is carried out October 23 and a reintegration of certain applications such as WhatsApp is made. “You must have a SIM card to receive the SMS and that SMS arrives on the 24th to recover part of the WhatsApp recordings,” he explains. All this activity takes place a few days before the registration of the prosecutor general's office was carried out on October 30.
The central exploitation unit (UCO) delivered a report in which he indicated that he had found “zero messages belonging to any type of instant messaging request” between March 8 and 14, 2024, the key dates of the case . The report has not been suggested by the intentional elimination of messages, but since 2019, there are recommendations in the institution for the periodic deletion of electronic devices for security reasons.
These recordings are a bit the logbook of what happened on the mobile. It is more difficult to obtain the exact content of these deleted messages.
Encrypted messages
The recovery of a simple deleted message could be easy, but there is a way to eliminate this information more massively: rewriting or modifying encryption keys with factory reset. This expert explains during the visit to Lazarus, that when using a phone, the keys that open these documents or messages such as WhatsApp, translate information into readable messages, understandable to people, in the phone.
Whatsapp cats are encrypted from start to finish
Murderer
By resetting the factory, you write new keys, therefore, for everything that is below, the keys to open it were lost. “As we know that the phone has made seven backups, backups, if we access the Gmail account, and we have access to backup, we can restore on a phone, in this or another, the content of this copy”, explains Manuel Huerta. This is one of the possibilities considered.
The UCO has published a letter addressed to the judge in which he underlines that he could find these missing messages with the Udef Ullebite tool. However, they indicate that They need WhatsApp support, already asked by the judgeTo access deleted messages from local telephone storage.
El Androide Libre
Para Huertas es importante conservar el cifrado de extremo a extremo que aplicaciones como WhatsApp o Apple Messages ofrecen. “Creo que es un ataque a la privacidad bastante importante”, indica, “ha nivel forense, ya se ha demostrado que es posible extraer lo que se busca, añade una capa de complejidad al proceso, pero no es problemático”.
La empresa Lazarus colabora con la justicia en casos similares, en sus 21 años de trayectoria ha trabajado en investigaciones tan mediáticas como el asesinato de Diana Quer. Para Huertas uno de los más complicados fue la recuperación de los datos del F-18 estrellado el año pasado en Zaragoza, “la tarjeta estaba muy destruida y tenía una serie de requisitos bastante complejos”.
También ha sido una de las empresas en recuperar equipos dañados por la DANA en Valencia y otras regiones de España. Las mesas de su laboratorio están llenas de móviles destrozados por accidentes y cuyos dueños necesitan recuperar la información, o servidores que sirven de prueba en la investigación de un ciberataque. Trabajan con cualquier equipo informático capaz de almacenar datos, hasta con un pendrive.
