Kidnapping, Epic Date, or Insurance Fraud? How Cell Phone Forensics and Health Data Cracked the Case

The Initial Call: A Typical Consultation

The consultation call for this case started as it typically does. The attorney told us how an employee allegedly jeopardized their company’s reputation. I expected the mundane, perhaps a problematic email sent to a customer or a social media rant that touched upon a third rail.

However, when we got down to the details of this case, it raised my eyebrows, and with over a decade of working civil and criminal cases, my eyebrows rarely leave their designated location.

The Employee’s Story: An Unusual Business Trip

The employee’s story goes like this: He is on an international business trip and, after working hard all week, decides to let off some steam by exploring the city. By the next morning, he is boarding a plane and returning to the States.

After about a week, accounting noticed that the employee had racked up a five-figure charge on his corporate credit card, with almost all of that accrued on a single night.

The Shocking Claim: “I Was Kidnapped!”

The employee had never mentioned anything to his boss, accounting, or anyone else. When questioned, the employee recounts a harrowing experience. He claims that he was kidnapped and held the night in question for over six hours, all while the kidnappers kept him detained against his will, charging his corporate card on “extracurricular activities.”

The company’s leadership was suspicious, and they had every right to be. It seemed unusual that the card was not stolen, only compromised. First, according to the employee, the kidnappers returned it to him once they were partied out. Second, the employee never reported the attack to the international authorities, authorities stateside, or his own company.

The Forensic Examination: Enter Envista’s Experts

At this juncture, Envista’s digital forensics experts join the story. The company’s representatives contacted Envista to perform a forensic examination of the employee’s iPhone. We performed the forensic extraction, or copy, of the data from the mobile phone and began the data analysis, which included recovered deleted data.

Our team immediately noticed that applications were deleted shortly before the employee provided us with the iPhone for extraction, but we’ll come back to that in a moment.

The Apple Watch Evidence

An Apple Watch was connected to the phone, and the user had permitted it to record health data. Miles of walking were recorded on the night in question, contradicting the employee’s claim that he was detained in a single location all night. Unless the kidnappers truly enjoyed watching someone walk in circles from sunset to sunrise, the kidnapping story is losing credibility by the moment, but the motive has yet to be established.

The Deleted Applications: More Red Flags

Here, we come back to those deleted applications. One of the applications was a text message application. Although the user deleted the application, we were able to recover the data from it. Also deleted was the Google Translate application.

After forensically stitching together the data artifacts, we recovered a message from the employee’s phone. The message was written in English, translated to the local language, and subsequently sent to an international number when the employee was catching a flight back home.

The Message: Evidence of a Different Story

The message read as follows:

“Last night was amazing and I can’t believe you can’t find a man. Someday someone will find you and it will all end up perfectly. Find someone who has the same passions as you do. I want you to know how special you are, you are so beautiful, perfect by American standards. Words can’t express how much I will miss you.”

An Unraveled Tale

From the sent message, we were left with two options. One, the employee had a rare and severe case of Stockholm Syndrome. Two, this story had more holes than Swiss cheese. As you have surely deduced, our examination assisted in a good outcome for the company.

I don’t know what happened to the employee. Perhaps he got a fresh start at a new company or a really fun nickname at his current one.