Digital Forensics and the Physiological Time of Death

By: Frank Thornton

During an investigation, the Physiological Time of Death (TOD) is often critical to investigators. This is especially true in homicide cases when the investigator tries to determine the victim’s last movements and whom they might have been in contact with at a given moment in time. Digital forensics can play an important role in determining the physiological time of death.

The increase in wearable devices, and the data they contain, provide a new tool for law enforcement. The TOD can now reveal a more accurate time using the health monitoring software built right into the device. A digital forensic examination can lead to a treasure trove of information.

Of the various times of death that are recorded, the Physiological TOD is usually the most interest to investigators. The more of an exact time of death that investigators know, the easier it is to either include or exclude possible offenders. The problem is that the physiological time is the most difficult to pin down.

The Estimated Time of Death

Homicide cases often lack a direct witness or at least one willing to speak with police investigators. The medical examiner, coroner or medicolegal investigator provide law enforcement with the Estimated Time of Death. The Estimated Time of Death is an educated guess based on several conditions and observations of the body. Here are a few of those factors:

• Livor Mortis (pooling of blood in dependent areas of the body)
• Rigor Mortis (stiffness of the joints)
• Algor Mortis (body temperature)

The exact moment when a person died is elusive. In a case of a natural unattended death, the uncertainty may be acceptable. However, crime-related deaths will lead to prosecution. Investigators must eliminate or account for time ambiguities that may lead to Reasonable Doubt.

Wearable Devices

Wearable devices have evolved from the days of general body movement, sleep pattern detectors and calorie burning counters. They have now become viable and sophisticated medical devices. Some of their abilities can rival that of hospital-grade equipment. These devices can now provide death investigators with a roadmap of the victim’s behavior prior to and right up to the moment of their death.

Real Cases

Examples of how wearables are helping to solve homicides are relatively low, but as these devices gain widespread use, we may see their use in solving cases gain ground.

• 2015 Connecticut: Connie Dabate’s activity levels on her device showed she was active until 10:45AM on the morning she dies. Her husband stated that she was murdered during a home invasion at 9AM.
• 2016 Australia: Police determined that Myrna Nilsson was attacked around 6:38PM and according to the prosecutor, there was certainty that she died at 6:45PM according to her device. This contradicted statements made by her daughter-in-law who claimed the victim was killed during a home invasion at about 10PM.
• 2018 California. San Jose police used Karen Navarra’s device to show that there was an eight-minute window when her heartrate spikes, slowed, and finally stopped at 3:28PM. The victim was found bludgeoned and stabbed with a sharp instrument. She was reportedly having a snack with her step father at the time. When interviewed, he stated when he left, she was fine. Data from other sources indicated that he left after the time in question and blood evidence on his clothes also indicated that he was there at the time of death.

Wearable Data

Figure 1 shows a screen snip of an actual health related data extract from an Apple Watch Series 4. This particular health data is encoded in Extensible Markup Language (XML). This data dump shows: heart rate and the average beats-per-minute (BPM).

Figure 2 represents an actual electrocardiogram (ECG) taken from the same Apple Watch in the same time frame as the XML (Figure 1). This ECG pattern is a “Normal Sinus Rhythm” in medical jargon. For comparison, Figure 3 represents Normal Sinus Rhythm ECG taken from medical equipment.

Digital Forensics

Digital forensic techniques pull information directly from the device and sometimes the cloud. Forensic examiners can build a timeline of the victim’s activities with this data. Some of these devices can also provide GPS data when available. This may also help identify a suspect.

Investigators should seek out a digital forensics professional. How that evidence is retrieved, recorded and properly stored is paramount. When possible, investigators should consult with a medical professional to explain the meaning of the ECG waveform shown in Figure 1.

When law enforcement uses any new technology in cases, legal questions arise. Like other evidence, health data obtained from wearables shouldn’t be the sole factor in establishing probable cause. It’s another tool to help get you there.

Conclusion

Wearables are here to stay. Television and movies have used the flatline trope more often than I can remember. Now for investigators, identifying that exact moment is possible. Wearables may finally present the answer to the age old question, “What was the time of death?”

About the Guest Author:

Frank Thornton is a retired Detective Lieutenant. He now runs, Blackthorn Information Security, a digital forensics firm located in Burlington, Vermont.

Related Articles:

Caveats of Death Investigations: Recording the Time of Death