Digital forensics dossier · Panama 2014
Digital traces in the Kris Kremers and Lisanne Froon case
Two phones and a camera are the only witnesses to the days after 1 April 2014. We have sorted their data day by day: emergency call attempts, power-on and power-off events, battery levels, screenshots and the photographs from 1 and 8 April.
What the devices recorded
After the two students disappeared, Kris’s iPhone 4, Lisanne’s Samsung Galaxy S III Mini and her camera, a Canon PowerShot SX270, were examined. The phone data comes from the analysis by the Netherlands Forensic Institute (NFI); Jan B. went through it technically for us.
This page sorts the documented events by time and by device. At its centre are the eight emergency call attempts, the battery levels over time, the screenshots and the gap between the daylight photographs of 1 April and the night photographs of 8 April.
On method: we keep documented device events, technical interpretation and open questions apart. An anomaly in the data is not in itself proof of any particular course of events. Times are given exactly as they appear in the analysed data.
- 65
- Timeline entries
- 12
- Days (31 Mar–11 Apr)
- 3
- Devices
- 8
- Emergency call attempts
- 17
- Turning points
- 133
- Camera photos
Timeline of the digital traces
Every documented event from 31 March to 11 April 2014, sorted by day. Emergency call attempts and turning points are marked in red.
65 entries
Monday, 31 March 2014
- Samsung
Battery level recorded
Battery 16% - Samsung
Device is charging (until 10:45:26)
- iPhone
Powered on – boot time 1:47 minutes (unusually long)
Battery 70% - Samsung
Photo 20140331_134832.jpg
- Samsung
Photo 20140331_134837.jpg
- iPhone
WhatsApp message (“going hiking”)
Battery 70% - iPhone
Wi-Fi connection “SbtR”
Battery 70% - Samsung
Last WhatsApp message sent
- iPhone
Last WhatsApp activity
Battery 70% - Samsung
Last Wi-Fi connection on 31 March
- iPhone
Last documented activity before 1 April
Battery 65% - Samsung
Battery level recorded
Battery 64%
Tuesday, 1 April 2014
- iPhone
System activity
Battery 51% - Samsung
Last WhatsApp message received
- Samsung
Last Wi-Fi connection
Battery 51% - iPhone
First use on 1 April – contact with the GSM network (camped_rat=GSM)
Battery 51%−82 dBm, 5 bars - Camera
IMG_0475.JPG – first photo of the day
- iPhone
Contact with the GSM network (camped_rat=GSM)
Battery 51%−85 dBm, 4 bars - iPhone
Dead spot – no contact with the GSM network (camped_rat=Unknown)
Battery 51%−82 dBm, 1 bars - iPhone
Contact with the GSM network again (camped_rat=GSM)
Battery 51%−82 dBm, 1 bars - iPhone
Fluctuating signal (camped_rat=GSM)
Battery 51%bars 3, 4, 3, 5, 4 - iPhone
Photo files IMG_2125.JPG to IMG_2127.JPG are created
Battery 51%−87 dBm, 4 bars - Samsung
Photos 20140401_131420.jpg to 20140401_131513.jpg
- Samsung
Google Maps is closed
- Camera
IMG_0507.JPG – photo at the Mirador (viewpoint)
- iPhone
Photo file IMG_2128.JPG – last iPhone photo at the Mirador
Battery 51%−89 dBm, 4 bars - Camera
IMG_0508.JPG – last daylight photo
- iPhone
Final loss of GSM contact (camped_rat=Unknown), around 800 powerlog entries
Battery 51%−94 dBm, 1 bars - Samsung
Probable loss of GSM contact
- Camera
IMG_0509.JPG – this file is missing from the numbering between the day and night series
- iPhone
First emergency call attempt to 112 – no connection
Battery 42.18%−94 dBm, 1 Balken, camped_rat=Unknown - Samsung
Emergency call attempt to 112 – no connection
Battery 22% - Samsung
Probably switched off manually (system activity ends)
- iPhone
Powered off – no further file system activity until the next morning
Battery 40%no network
Wednesday, 2 April 2014
- Samsung
Powered on, emergency call to 112, powered off again
Battery 19% - iPhone
Powered on – boot time 1:38 minutes
Battery 42.98%−113 dBm, 1 bars - iPhone
Screenshot of the Control Centre, switching between 2G and 3G
Battery 42.98%−113 dBm, 1 bars - iPhone
Emergency call attempt to 112 – no connection
Battery 42.98%−113 dBm, 1 bars - Samsung
Powered on, emergency calls to 112 and 911, powered off again
Battery 19% - Samsung
Powered on and off again, no calls
Battery 18% - Samsung
Powered on and left on overnight
Battery 18%
Thursday, 3 April 2014
- Samsung
Weather app and Android system apps used (until 02:47)
Battery 4% - Samsung
Battery at 1 per cent, probably shut down
Battery 1% - iPhone
Powered on
Battery 41.62%−113 dBm, 1 bars - iPhone
Emergency call attempt to 911 – no connection
Battery 41.62%−113 dBm, 1 bars - iPhone
Second emergency call attempt to 911 – no connection; screenshot of the dialler
Battery 41.62%−113 dBm, 1 bars - iPhone
Powered on
- iPhone
Powered on; shortly afterwards the contact “Mytiam” is opened in the address book
Battery 39%−113 dBm, 1 bars
Friday, 4 April 2014
- Samsung
Powered on and off again
- Samsung
Last boot attempt at 0 per cent battery, shutdown activity
Battery 0% - iPhone
Powered on
no powerlogs - iPhone
Powered on
no powerlogs
Saturday, 5 April 2014
- iPhone
Powered on, SIM PIN entered correctly
no powerlogs - iPhone
Powered on, SIM PIN not entered – last PIN attempt, SIM locked
no powerlogs
Sunday, 6 April 2014
- iPhone
Powered on, SIM PIN not entered
no powerlogs - iPhone
Screenshot of the World Clock app (last app screenshot)
no powerlogs - iPhone
Powered on, SIM PIN not entered
no powerlogs
Monday, 7 April 2014
- iPhone
No activity recorded
Tuesday, 8 April 2014
- Camera
IMG_0510.JPG – first night photo, seven days after the last daylight photo
- Camera
IMG_0511.JPG to IMG_0609.JPG – further night photos; 100 night photos in 2 hours 41 minutes in all
- Camera
IMG_0609.JPG – last photo on the camera
- iPhone
No activity recorded
Thursday, 10 April 2014
- Samsung
No further activity after 4 April
Battery 0%
Friday, 11 April 2014
- iPhone
Powered on – files are created, deleted or changed; no app use recognisable; battery estimated above 10 per cent
- iPhone
Last activity before the manual switch-off
Battery levels of the phones
The documented battery levels on a real time axis. Between the measured points the devices were mostly switched off.
iPhone 4 · Kris
- First value (31 Mar, 13:13)
- 70%
- Last measured value (3 Apr, 15:59)
- 39%
- Last activity
- 11 April
- Notable
- long boot times
Samsung Galaxy S III Mini · Lisanne
- Evening before (31 Mar, 23:40)
- 64%
- 1 April, 10:10
- 51%
- Last boot attempt (4 Apr)
- 0%
- Notable
- app use at 4 per cent
Canon PowerShot SX270
- Daylight photos (1 Apr)
- 33
- Night photos (8 Apr)
- 100
- Gap
- seven days
- Open question
- IMG_0509 is missing
All battery values as a table
| Time | Device | Battery | Event |
|---|---|---|---|
| 31 Mar 2014, 00:03:47 | Samsung | 16% | Battery level recorded |
| 31 Mar 2014, 13:13 | iPhone | 70% | Powered on – boot time 1:47 minutes (unusually long) |
| 31 Mar 2014, 14:00 | iPhone | 70% | WhatsApp message (“going hiking”) |
| 31 Mar 2014, 16:42 | iPhone | 70% | Wi-Fi connection “SbtR” |
| 31 Mar 2014, 16:59 | iPhone | 70% | Last WhatsApp activity |
| 31 Mar 2014, 19:07 | iPhone | 65% | Last documented activity before 1 April |
| 31 Mar 2014, 23:40:27 | Samsung | 64% | Battery level recorded |
| 1 Apr 2014, 04:13 | iPhone | 51% | System activity |
| 1 Apr 2014, 10:10:25 | Samsung | 51% | Last Wi-Fi connection |
| 1 Apr 2014, 11:05 | iPhone | 51% | First use on 1 April – contact with the GSM network (camped_rat=GSM) |
| 1 Apr 2014, 11:20 | iPhone | 51% | Contact with the GSM network (camped_rat=GSM) |
| 1 Apr 2014, 11:49 | iPhone | 51% | Dead spot – no contact with the GSM network (camped_rat=Unknown) |
| 1 Apr 2014, 12:33 | iPhone | 51% | Contact with the GSM network again (camped_rat=GSM) |
| 1 Apr 2014, 13:14 | iPhone | 51% | Fluctuating signal (camped_rat=GSM) |
| 1 Apr 2014, 13:14 | iPhone | 51% | Photo files IMG_2125.JPG to IMG_2127.JPG are created |
| 1 Apr 2014, 13:15 | iPhone | 51% | Photo file IMG_2128.JPG – last iPhone photo at the Mirador |
| 1 Apr 2014, 13:38 | iPhone | 51% | Final loss of GSM contact (camped_rat=Unknown), around 800 powerlog entries |
| 1 Apr 2014, 16:39 | iPhone | 42.18% | First emergency call attempt to 112 – no connection |
| 1 Apr 2014, 16:51:00 | Samsung | 22% | Emergency call attempt to 112 – no connection |
| 1 Apr 2014, 17:52 | iPhone | 40% | Powered off – no further file system activity until the next morning |
| 2 Apr 2014, 06:58:15 | Samsung | 19% | Powered on, emergency call to 112, powered off again |
| 2 Apr 2014, 08:12 | iPhone | 42.98% | Powered on – boot time 1:38 minutes |
| 2 Apr 2014, 08:13 | iPhone | 42.98% | Screenshot of the Control Centre, switching between 2G and 3G |
| 2 Apr 2014, 08:14 | iPhone | 42.98% | Emergency call attempt to 112 – no connection |
| 2 Apr 2014, 10:53:20 | Samsung | 19% | Powered on, emergency calls to 112 and 911, powered off again |
| 2 Apr 2014, 13:50 | Samsung | 18% | Powered on and off again, no calls |
| 2 Apr 2014, 16:19 | Samsung | 18% | Powered on and left on overnight |
| 3 Apr 2014, 02:21 | Samsung | 4% | Weather app and Android system apps used (until 02:47) |
| 3 Apr 2014, 07:36:46 | Samsung | 1% | Battery at 1 per cent, probably shut down |
| 3 Apr 2014, 09:32 | iPhone | 41.62% | Eingeschaltet |
| 3 Apr 2014, 09:33 | iPhone | 41.62% | Emergency call attempt to 911 – no connection |
| 3 Apr 2014, 09:33 | iPhone | 41.62% | Second emergency call attempt to 911 – no connection; screenshot of the dialler |
| 3 Apr 2014, 15:59 | iPhone | 39% | Powered on; shortly afterwards the contact “Mytiam” is opened in the address book |
| 4 Apr 2014, 05:00 | Samsung | 0% | Last boot attempt at 0 per cent battery, shutdown activity |
| 10 Apr 2014 | Samsung | 0% | No further activity after 4 April |
The three devices compared
iPhone 4
- Timeline entries
- 35
- Emergency call attempts
- 4
- Screenshots
- 4
- SIM locked
- 5 April
- Last activity
- 11 April
Samsung Galaxy S III Mini
- Timeline entries
- 23
- Emergency call attempts
- 4
- PIN
- no anomalies
- Last battery level
- 0%
- Last activity
- 4 April
Canon PowerShot SX270
- Timeline entries
- 7
- Photos in total
- 133
- Daylight photos
- 33
- Night photos
- 100
- Missing file
- IMG_0509
The emergency call attempts
Eight attempts over three days, four from each phone, using the numbers 112 and 911. None of them got through, because neither device had contact with the mobile network.
- iPhone
Emergency call 112
Battery 42 per cent · first attempt, no network
- Samsung
Emergency call 112
Battery 22 per cent · twelve minutes after the attempt from the iPhone
- Samsung
Emergency call 112
Battery 19 per cent · early in the morning; the device is switched off again afterwards
- iPhone
Emergency call 112
Battery 43 per cent · one minute after the Control Centre screenshot
- Samsung
Emergency call 112 and 911
Battery 19 per cent · two attempts, both numbers
- iPhone
Emergency call 911
Battery 42 per cent · first of two attempts
- iPhone
Emergency call 911
Battery 42 per cent · second attempt straight afterwards, screenshot of the dialler
Turning points in the data
Moments where the behaviour of the devices changes or the data raises questions. “Open question” means: the data shows that something happened, but not why.
Last GSM contact lost
The iPhone loses contact with the mobile network. After that it logs only placeholder values (−113 dBm); around 800 powerlog entries are created.
- Open question
IMG_0509 is missing
A file is missing from the camera’s numbering between the last daylight photo and the first night photo. Whether it was deleted or never saved cannot be deduced from the numbering alone.
First emergency call attempts
Within twelve minutes both phones dial 112. No connection is made.
iPhone switched off
There is no file system activity until the next morning.
- Open question
Screenshot of the Control Centre
A screenshot of the Control Centre is taken on the iPhone and the phone is switched between 2G and 3G. One minute later comes an emergency call attempt.
- Open question
Weather app at 4 per cent battery
With the battery very low, the weather app and system apps are used on the Samsung.
Two emergency call attempts to 911
The iPhone dials 911 twice in a row; a screenshot of the dialler is taken as well.
- Open question
Contact “Mytiam” opened
After the phone is switched on at 15:59, the contact “Mytiam” is opened in the iPhone’s address book.
Samsung off for good
Last boot attempt at 0 per cent battery, then shutdown activity. The phone never becomes active again.
Last correct PIN entry
The iPhone’s SIM PIN is entered correctly for the last time.
SIM card locked
After the last PIN attempt the SIM card is locked. At later start-ups no PIN is entered any more.
- Open question
Screenshot of the World Clock
The last app screenshot on the iPhone shows the World Clock.
First night photo
Seven days after the last daylight photo the camera takes pictures again.
100 night photos in 2 hours 41 minutes
Most of the images are almost black; some show vegetation, rock and hair.
Last photo
IMG_0609.JPG is the last exposure on the camera.
Last iPhone activity
The iPhone is switched on one last time. Files are created, deleted or changed; no app use can be identified.
Final switch-off
Last activity before the manual switch-off. Danach wird das iPhone nicht mehr eingeschaltet.
Technical anomalies
Boot times
- iPhone:
- about 1:40 to 1:50 minutes
- Reference value:
- about 1:10 to 1:20 minutes
- Possible causes:
- storage state, software or device configuration
Signal values
- Last network contact:
- 1 April, around 13:15
- Loss logged:
- 13:38
- After that:
- placeholder value −113 dBm
Powerlogs
- 1 April:
- sharply increased log volume (around 800 entries)
- From 4 April:
- no regular storage any more
- Assessment:
- to be judged technically, not read in isolation
Screenshots
- 2 April:
- Control Centre
- 3 April:
- dialler during the emergency call; contact “Mytiam”
- 6 April:
- World Clock app
Temperature values
- Range:
- about 19 to 24 °C
- Assessment:
- device temperature, not a weather or location measurement
IMG_0509.JPG
- Position:
- between the day and night series
- Status:
- file missing
- Limit:
- whether deleted or never saved, the numbering does not say
Sources and further material
Technical report
Jan B.’s detailed analysis of the phone data, with explanations of boot times, signal values, powerlogs and individual points in time.
Open the PDFStill Lost in Panama
Our book brings the investigation files, interviews, five months of research on the ground and the digital traces together into a full reconstruction.
Go to the book pageCase lexicon
A reference work covering the people, places, routes, search areas, authorities and find sites in the case.
Open the case lexiconAuthors and technical analysis
The technical analysis of the NFI phone data was done by Jan B. This dossier sums up selected results in plain language; the full report is available above as a PDF.
Information about ongoing missing persons or criminal investigations belongs with the responsible authorities. Factual notes and corrections about this dossier are welcome through the contact page.
