Case study

Deleted text messages

betray a daughter’s killer

Cellebrite UFED 4PC unlocks the evidence

that puts victims husband behind bars.

At 10:45 am on June 19th, 2013, in the city of Fécamp, France, Régis Marin and
his wife Isabelle received a phone call that shattered their lives forever. Their
Agency daughter’s husband, Bruno Laffilay, told them that their daughter Harmonie,
David RAULIN, a 25-year old nurse, had taken her own life. In total shock and disbelief, Marin
Expert judiciaire hors liste, rushed over to their home and found his son-in-law and his brother smoking a
Cellebrite certified mobile cigarette in the garage. Laffilay had only called him, which seemed rather odd
examiner given the circumstances.

Solution
UFED Ultimate 4PC A troubling scene
The police were called to the house where Harmonie was found hanging from
an electric wire in a storage room. From the outset, the Investigation Director
from the Department of Seine-Maritime, France, immediately expressed his
reservations about the incident. He found it surprising that an electric wire
could bear the full weight of the victim. In addition, no stool or chair was found
near Harmonie’s lifeless body. The Investigation Director also found it unusual
that Bruno, upon finding his dead wife, chose first to call his brother, and then
Harmonie’s parents. The obvious question is why he didn’t immediately call the
emergency services.
 2 Cellebrite case study

“It is not standard Laffilay’s story

practice to use mobile The questioning began, and Laffilay quickly became defensive of his actions. He
forensic technology told the police he was a volunteer for the Red Cross and had tried to revive her
himself but was unsuccessful. He said that he felt it was unnecessary to call the
as part of the criminal emergency services. Throughout the investigation, Laffilay seemed completely
investigation process,” insensitive and devoid of any real emotion losing his wife.
said Raulin. “There are
Laffily told the investigator that prior to finding his wife, he left the house at
simply too many cases. around 8:00 pm that evening to walk the dog. While he was out, he claimed
However, for important, to have called his wife several times, but she didn’t answer. He returned at
high-visibility cases, I approximately 10:00 pm to find her dead. However, Harmonie’s parents never
believed him.
am often nominated
by the judge to make They said their daughter was a very happy person, had just bought a house, and
loved her nursing job. As a result of the Marin’s mounting concerns, the court
forensically sound opened an investigation to determine Harmonie’s cause of death.
extractions of mobile
data -- and for that I
rely on Cellebrite UFED The investigation begins
Ultimate 4PC technology.” An initial examination of the victim’s phone showed the husband’s alibi to be
solid, and messages between them appeared to reflect a loving, harmonious
relationship. However, numerous facts surfaced during the investigation
discrediting Laffilay’s story. A neighbor told the police that he heard screaming
coming from the victim’s house the night of her death – something Laffilay failed
to mention.

Additional details unfolded. The couple had fought that day, and Laffilay left the
house and walked along the beach with a friend, without telling his wife and
without returning any of her calls or text messages. When questioned about
the inconsistencies, Laffilay admitted he hadn’t disclosed the full story. He told
police that he was embarrassed and didn’t want his in-laws to be upset with him.
He was taken into custody, but released a few days after his wife’s suicide was
confirmed by the medical examiner. Harmonie’s death was estimated at 9:00 pm,
minutes after Laffilay received a final text from her. He continued to attribute her
death to depression over her inability to have children, and a fight with her twin
brother, with whom she was no longer in contact.
3 Cellebrite case study

A parents’ fight for the truth

Despite the outcome of the autopsy and investigation into their daughter’s
alleged suicide, the Marin’s simply did not agree with the conclusion of the
authorities, and conducted their own investigation. They questioned co-workers,
and discovered that Harmonie suspected of her husband cheating, which resulted
in many arguments. When her mother got her daughter’s possessions back,
she decided to go through them and read the thousands of messages on her
iPhone 4. In doing so, Isabelle discovered there was so much she didn’t know
about her daughter’s life. With each discovery, she painstakingly forwarded
each of her findings to the President of the Component Court.

Isabelle discovered numerous discussions with Laffilay’s brother, which

detailed an unsafe environment at home, and that Harmonie was threatened by
Bruno. But what was even more troubling, Isabelle found no message history
between Harmonie and Bruno, except on the day of her death. Then there was
also the nature of her last messages to him. The messages were written in a
young language style with many grammatical errors, the complete opposite of
Harmonie’s writing style.

After a long year of fighting and sharing evidence that validated their concerns,
the Marin’s won and were finally heard in court. Now with an overwhelming
amount of evidence, a judicial investigation for murder was opened by the
president of the court. The case was referred to the National Gendarmerie, since
the police force failed to revive the case. Digital forensic expert, David Raulin, was
appointed to conduct a full forensic examination and analysis of the phone.
4 Cellebrite case study

Raulin’s approach and Cellebrite-powered findings

“It is not standard practice to use mobile forensic technology as part of the
criminal investigation process,” said Raulin. “There are simply too many cases.
However, for important, high-visibility cases, I am often nominated by the judge
to make forensically sound extractions of mobile data -- and for that I rely on
Cellebrite’s UFED Ultimate technology on the 4PC platform.”

Upon receiving Harmonie’s phone, Raulin completed the following tasks:

• Determined if the device was intact

• Described precisely how the phone was received, and how it entered
the investigation
• Considered all information from the security investigators from the
city of Fécamp
• Extracted all messages, including deleted messages, to determine if there was
anything of a threatening nature
• Considered any observations, deductions and conclusions that could contribute
to the truth
Using the Cellebrite UFED solution, Raulin conducted a thorough extraction and
evaluation of all recovered data.

“The phone showed an overwhelming amount of deleted call logs and text
messages relating to the contact ‘Bruno Laffilay,’” noted Raulin. “Between June
1-19, the deceased wrote text messages in her normal manner as revealed by
numerous other messages found on the phone. Only her last message – which
was not deleted – used language not consistent with her usual style.”

Raulin also mentioned that the responses from Bruno were not deleted from
the date of her death. At the same time, there had been other messages with
phrases like “kisses” and “sweetie” not used in her previous messages. Despite
the deleted messages being recovered, and even with Cellebrite’s technical
assistance, it was impossible to determine when the text messages and call logs
were deleted from the phone.

Proof of a manufactured alibi

A free search (manual recovery of deleted data-encoding 7bit PDU) found the
desired phrase, confirming Laffilay’s threatening behavior. The encoding format
is used to allow the transmission of data in a compressed format during its
transit over the network of the mobile operator. However, it’s not readable by the
phone before it’s decoded. While the decoding is automatic, this message was not
present in the phone’s memory, proving that the message had been deleted.

“Since it took a year between my analysis and the data extraction, data might
have been permanently or partially deleted due to the automated memory
management systems which may have been active during the year,” said Raulin.
“However, the recovery of Bruno’s deleted messages and calls contradicted his
version of events and showed a high probability that he had written text messages
on Harmonie’s phone himself in order to create an alibi.”
5 Cellebrite case study

The Cellebrite Advantage

Flexible and convenient, UFED 4PC is a software-only platform that can be used
on virtually any hardware platform. It allows agencies of all sizes and missions
to harness the power of digital intelligence with tools designed to support unique
workflows and environments.

Whether conducting digital forensic examinations in the lab, investigating in the

field, reviewing findings in an office or managing your digital forensics tools in an
IT department, UFED 4PC offers easy deployment to a PC, laptop, server or other
hardware to meet an agency’s specific requirements.

The solution delivers market-leading access to digital devices and unsurpassed

capabilities to extract and decode all available data. Investigators can delve
deeper and thoroughly review logical, file system and physically extracted data to
discover and share critical evidence faster.

Key capabilities include:

Unlock devices faster

Easily bypass pattern, password or PIN locks and overcome encryption
challenges, powering faster time to extraction and analysis.

Access more data from more devices

Perform forensically sound advanced logical, file system and physical extractions
of live, deleted and hidden data from the most digital devices with exclusive
bootloaders, Advanced ADB and other recovery methods.

Decode data quickly and comprehensively

Dig deeper into device data and explore every segment of a device’s memory with
user-friendly, powerful tools like SQLite Wizard, Hex Viewer, integrated Python
Shell and others to locate and manually carve or parse hidden or unknown data
and reveal the greatest amount of evidence.

Find evidence efficiencies

Automate, consolidate and view disparate data in a single window to simplify
analysis. Identify and uncover connections between people, places and events
with maps and timelines. Tag and highlight information and images against watch
lists, Project VIC and other databases

At every stage of an investigation, Cellebrite solutions empower investigative

teams to access actionable insights, advance cases and work together more
collaboratively. Raulin concurred the importance of having access to proven
extraction, decoding and analysis capabilities that deliver the whole case picture
in detail.

“Cellebrite’s solution provides technological proof – you cannot deny that it’s
there – which ultimately carries huge weight in court,” said Raulin.
 6 Cellebrite case study

“Cellebrite’s solution Finally…closure

provides technological
proof – you cannot deny
that it’s there – which
ultimately carries huge
weight in court,” said
Raulin.
Faced with the detailed forensic findings, the judge ordered to exhume
Harmonie’s body. A new autopsy took place and a new forensic expert was
appointed. He discovered markings that could not have been self-inflicted.
A homicide specialist reported that the wire used to hang her could not have
supported her body weight if she attempted to end her life. The medical
examiner’s final report showed that she had been strangled and did not
commit suicide.
Confronted with all the new findings, Laffilay finally admitted to murdering his
wife and was sentenced to 25 years in prison.

For his part in the case, Raulin indicated the biggest challenge was the public
stage it played out on dealing with the family’s grief.

“There was so much determination by the victim’s family that personally touched
me. When I finished the analysis, I realized just how much of the truth would be
revealed. I used Cellebrite technology, and was proud to help the law enforcement
of my country uncover the truth which was greatly desired by the family.”

For more information on how Cellebrite’s solutions can help you,

visit www.cellebrite.com.

Digital intelligence for a safer world

Digital data plays an increasingly important role in
investigations and operations of all kinds. Making data
accessible, collaborative and actionable is what Cellebrite
does best. As the global leader in digital intelligence with
more than 60,000 licenses deployed in 150 countries, we
provide law enforcement, military and intelligence, and
enterprise customers with the most complete, industry-
proven range of solutions for digital forensics, triage
and analytics.
By enabling access, sharing and analysis of digital data
from mobile devices, social media, cloud, computer and
other sources, Cellebrite products, solutions, services and
training help customers build the strongest cases quickly,
even in the most complex situations. As a result, Cellebrite is
the preferred one-stop shop for digital intelligence solutions
that make a safer world more possible every day.
To learn more, visit www.cellebrite.com

© 2018 Cellebrite Inc. All rights reserved.

v20180124