With no embedded manufacturer information, our investigator was still able to group files from the device.
Having seized a suspect computer in a voyeurism case, an investigator had intelligence that their suspect had been placing hidden cameras in public places. One of these ‘spy’ devices had been recovered from a scene. After processing the computer hard drive, the investigator exported all image and video media into a single analysis in S21 LASERi-X.
The investigator was specifically looking for images or videos which had originated from the ‘spy’ devices. They therefore added a sample image from the ‘spy’ device, as a reference image. After processing the reference image, no camera model or serial was visible, most likely as the ‘spy’ device in question appeared to be custom made from components sourced from the internet. This was consistent with results from other software. However, S21 LASERi-X was able to reveal other metadata about the image, which was not presented on data carvers or other image viewers.
Looking through this extra EXIF metadata, the investigator found a parameter that looked very strange, and perhaps unique to the device in question. Based upon this, they selected and ran a search for all other files with this parameter. Instantly, the grid of discovered images and videos updated to show files from the suspect computer that were created by the ‘spy’ device. Visual confirmation showed the position of the camera was the same as for the sample which they had extracted from the device, but also all the historic images and videos captured form the ‘spy’ device that were on the suspects computer.
The resulting media showed a number of victims whose privacy had been breached. It also showed the suspect themselves placing the ‘spy’ device into its hidden vantage point.
Without S21 LASERi-X’s extended EXIF metadata, the investigator would have had to review all the media to find matching imagery, whereas S21 LASERi-X enabled a single option to search for the unique EXIF parameter and reveal all matching files in seconds.