Digital Forensics: The Kris and Lisanne Case in Panama
NFI Report-Based Analysis of iPhone and Samsung Forensics
“Still Lost in Panama” on Amazon Case LexiconThe Mysterious Disappearance Case of Kris Kremers & Lisanne Froon
On April 1st, 2014, Dutch students Kris Kremers (21) and Lisanne Froon (22) vanished without a trace during a hike on the Pianista Trail in Boquete, Panama. What began as a relaxed hike to a scenic viewpoint evolved into one of the most puzzling missing person cases of recent years.
Ten weeks after their disappearance, their backpacks containing iPhone 4, Samsung Galaxy S3, Canon PowerShot SX270, and personal belongings were discovered. The digital devices held a treasure trove of forensic data: 100 mysterious night photos, desperate emergency calls with no network coverage, and a complex timeline of digital activities that raises more questions than it answers.
This digital forensic analysis is based on exclusive original data from the Netherlands Forensic Institute (NFI) and provides the first detailed technical evaluation of iPhone and Samsung forensics in the Kris and Lisanne case.
Digital Evidence Timeline: Kris and Lisanne Case
Normal Activity
Battery level recorded
Battery: 16%Charging
Device charging (until 10:45 AM)
Turned On
Power On – Boot-Time 1:47 (unusually long)
Battery: 70%Photo Taken
Photo taken (20140331_134832.jpg) & (20140331_134837.jpg)
WhatsApp Usage
WhatsApp message (going hiking)
Battery: 70%WiFi Activity
WiFi connection SbtR
Battery: 70%WhatsApp Usage
Last WhatsApp message sent
WhatsApp Usage
Last WhatsApp activity
Battery: 70%WiFi Activity
Last Wi-Fi connection registered
Normal Activity
Last documented activity before April 1
Battery: 65%Normal Activity
Battery level recorded
Battery: 64%System Activity
System activity
Battery: 51%WhatsApp Usage
Last WhatsApp message received
WiFi Activity
Last Wi-Fi connection registered
Battery: 51%Normal Activity
First use on April 1 – Contact with GSM network
Battery: 51% Signal: -82 dBm, bars=5Photo Taken
First photo series begins
Normal Activity
Contact with GSM network
Battery: 51% Signal: -85 dBm, bars=4Weak/Lost Signal
Dead Zone reached – No contact with GSM network
Battery: 51% Signal: -82 dBm, bars=1Weak/Lost Signal
Contact with GSM network again
Battery: 51% Signal: -82 dBm, bars=1Photo Taken
IMG_0502.JPG
Normal Activity
Fluctuating signal
Battery: 51% Signal: bars=3,4,3,5,4Photo Taken
Photos taken (20140401_131420.jpg – 131513.jpg)
Normal Activity
Google Maps closed
Photo Taken
Creation of photo files IMG_2125.JPG to IMG_2127.JPG
Battery: 51% Signal: -87 dBm, bars=4Photo Taken
Creation of photo file IMG_2128.JPG (last at Mirador)
Battery: 51% Signal: -89 dBm, bars=4Weak/Lost Signal
Probable GSM contact loss
Critical Event
Final signal loss + ~800 Powerlogs – No contact with GSM network
Battery: 51% Signal: -94 dBm, bars=1Photo Taken
Last daylight photo
Emergency Call
First emergency call 112 (failed)
Battery: 42.18% Signal: -94 dBm, bars=1Emergency Call
Call to emergency number 112 (failed)
Battery: 22%Turned Off
Probably manually turned off (OS activity ends)
Turned Off
Power Off – No further filesystem activity
Battery: 40% Signal: Dead ZoneEmergency Call
Turned on, call to emergency number 112 & turned off again
Battery: 19%Turned On
Phone turned on – Boot-Time 1:38
Battery: 42.98% Signal: -113 dBm, bars=1Settings Changed Screenshot
Control Center screenshot – 2G/3G mode switched
Battery: 42.98% Signal: -113 dBm, bars=1Emergency Call
Call to emergency number 112 (failed)
Battery: 42.98% Signal: -113 dBm, bars=1Emergency Call
Turned on, call to emergency numbers 112 & 911 & turned off again
Battery: 19%Turned On
Turned on & turned off again (no calls)
Battery: 18%Turned On
Turned on and left on overnight
Battery: 18%Normal Activity
Weather app and Android OS apps used (until 2:47 AM)
Battery: 4%Turned Off
Battery at 1%, probably shut down
Battery: 1%Turned On
Phone turned on
Battery: 41.62% Signal: -113 dBm, bars=1Emergency Call
Call to emergency number 911 (failed)
Battery: 41.62% Signal: -113 dBm, bars=1Emergency Call Screenshot
Call to emergency number 911 (second, failed) + Dialer screenshot
Battery: 41.62% Signal: -113 dBm, bars=1Turned On
Phone turned on
Contact Opened
Phone turned on, contact ‘Mytiam’ opened in address book
Battery: 39% Signal: -113 dBm, bars=1Turned On
Turned on and turned off again
System Shutdown
Last boot attempt (battery 0%), shutdown activity
Battery: 0%Turned On
Phone turned on
Signal: no powerlogsTurned On
Phone turned on
Signal: no powerlogsTurned On
Phone turned on. SIM-Pin entered correctly.
Signal: no powerlogsInactive
Log file created (boot attempt, but not fully started)
Critical Event
Phone turned on. SIM-Pin not entered. Last PIN attempt. SIM locked
Signal: no powerlogsTurned On
Phone turned on. SIM-Pin not entered.
Signal: no powerlogsApp Usage Screenshot
World Clock app screenshot (last app screenshot)
Signal: no powerlogsTurned On
Phone turned on. SIM-Pin not entered.
Signal: no powerlogsInactive
No activity registered
Signal: unknownInactive
No activity registered
Signal: unknownCritical Event
100 night photos begin + deleted IMG_0509.JPG
Photo Taken
Last camera activity
Inactive
Log file created (boot attempt, but not fully started)
Turned On
Phone turned on. Files created/deleted/modified. App usage not recognizable. Estimated battery >10%.
Signal: unknownTurned Off
Last activity before manual shutdown.
Signal: unknownBattery Analysis: Phone Power Levels in the Kris and Lisanne Case
iPhone 4 (Kris Kremers) Data Analysis
Start: 70% → End: >10%
Active Period: March 31 – April 11, 2014
Events: 35
Boot-Time Anomaly: 1:47 Min (unusual)
Critical Point: April 5, 1:37 PM – SIM-PIN failed
Samsung Galaxy S3 Mini (Lisanne Froon) Data
Start: 68% → End: 0%
Active Period: March 31 – April 10, 2014
Events: 24
Critical Point: April 4, 5:00 AM – Total shutdown
Canon PowerShot SX270 (Lisanne Froon) Camera Photos
Active Period: April 1 + April 8, 2014
Phase 1: 33 photos (11:18 AM-1:54 PM)
Phase 2: 100 night photos (1:29 AM-4:10 AM)
Critical Point: Deleted IMG_0509.JPG
Device Comparison: Digital Evidence from Kris Kremers and Lisanne Froon
iPhone 4 – Digital Analysis
Samsung Galaxy S3 Mini – Forensics
Canon PowerShot SX270 – Photos
Emergency Call Chronology: Distress Calls in the Panama Case
Emergency Call 112
No connection
Battery: 42% | Signal: -94 dBm | First emergency
Emergency Call 112
No connection
12 minutes after iPhone attempt
Emergency Call 112
No connection
Phone off for over 13 hours
Emergency Call Troubleshooting
Control Center screenshot
2G/3G mode manually switched
Emergency Call 112
No connection
Battery: 43% | Signal: -113 dBm
Emergency Call 112 & 911
No connection
Strategy change from 112 to 911
Emergency Call 911 (2x)
No connection
Battery: 42% | Within 4 seconds + screenshot
Emergency Call Contact
Mytiam opened
Seeking help through saved local contact
Critical Turning Points in the Digital Trail of Kris and Lisanne Case
Boot-Time Anomaly (1:47 Min)
Unusually long boot process suggests jailbreak, spy apps, or memory issues.
No contact with GSM network & weak signal
First critical signal loss under poor conditions, shortly before Mirador. Battery 51% at 11:40 AM.
5 photos in 53 seconds (1:14:20 PM – 1:15:13 PM)
Short photo session, probably just before descent from Mirador on wrong side. GPS data for these photos missing.
Final GSM contact loss of both phones
Both devices lose network connection simultaneously. ~800 Powerlogs until first emergency call suggest intensive activity.
Last camera daylight photo at Quebrada 1
Beginning of 7-day photo gap. Suggests problem preventing camera access.
First coordinated emergency calls
12 minutes gap between devices – possibly systematic trying or joint operation.
Both phones turned off simultaneously
OS activity ends. Both phones turned off simultaneously, suggests conscious battery conservation or coercion.
Turned on & emergency call 112 & turned off again
Repeated distress call. Phone off for over 13 hours. Immediate turn-off after emergency attempt.
Screenshot / 2G-3G switch
Evidence of active network troubleshooting attempts immediately before another emergency call.
Strategy change 112 → 911 + immediate shutdown
Conscious adaptation to American emergency number. Screenshot documents two 911 calls within 4 seconds.
Apps (including AccuWeather) started (battery 4%)
Brief reactivation, possibly searching for signal or information despite low battery.
Battery at 1%, probably shut down
Samsung phone becomes non-functional – important turning point for Lisanne’s communication ability.
2x emergency call 911 (failed) + Dialer screenshot
Only 911 is called now. Immediate hang-up afterwards. Screenshot documents the attempts.
Contact Mytiam opened
Targeted opening of an entry suggests seeking help through saved contact.
Last boot attempt (battery 0%) & shutdown
Lisanne’s phone completely non-functional – final loss of Samsung digital trail.
SIM-PIN failed for first time
First wrong PIN attempt after correct entry until then. Possible indication of device change or motor problems.
Last screenshot (World Clock app)
Last documented conscious app usage on iPhone. After this only automatic powerlogs.
Phone turned on & off. SIM-PIN not entered.
Very short turn-on time without SIM-PIN entry. Time wasn’t enough to capture a signal.
Beginning of 100 night photos
After 7-day break sudden intensive photo activity. All photos show only darkness with occasional light reflections.
Deleted photo IMG_0509.JPG
Only consciously deleted photo in entire sequence. What was removed here and why?
Last iPhone turn-on (64 minutes on)
Longest turn-on time without recognizable app usage or log creation. Estimated battery over 10%. Manual shutdown.
Technical Anomalies & Forensic Details
Boot-Time Anomaly
Signal Forensics
RAM/NAND Bug
Screenshot Analysis
Temperature Profiles
Powerlogs Analysis
Jan B.
Professional evaluation of NFI phone data with detailed analysis of iPhone and Samsung forensics, boot-time anomalies, signal forensics, powerlog analysis, and critical turning points in the Kris Kremers and Lisanne Froon case.
Read Full Analysis in BookOriginal NFI Report: iPhone & Samsung Forensic Analysis
Detailed technical evaluation by Jan B. (iPhone Specialist)
The complete 11-page forensic report contains the comprehensive technical analysis of NFI phone data with detailed explanations of boot-time anomalies, signal forensics, powerlog analysis, and critical turning points in the Kris Kremers and Lisanne Froon case.
The authors thank iPhone specialist Jan B. (certified cloud and network expert) for the professional evaluation of NFI data and detailed forensic analysis of the iPhone and Samsung timeline.
More Information & Discussion
