7. Telecommunications and other digital evidence 78. Within the confines of the applicable law, mobile telephone data should be requested from service providers. This information may help in establishing the identity, roles and relationships of persons of interest and their presence and participation in key activities (such as presence at key locations, attendance at meetings, the conduct of any surveillance, the procuring of materials and the execution of the crime). In planning an investigation, investigators should familiarize themselves with the data-retention policies of the service providers. Mobile phone data allows authorities to analyse the phone numbers that connect to a particular phone tower within a given period of time. Investigators can then match the mobile phone numbers with a particular customer’s name, address and other account information, potentially putting individuals at locations at specific times. The mobile phones of the deceased and all prime suspects should be legally recovered and relevant data (e.g. dialled, missed and received calls, text (sms) or other messages, photographs, contacts and diary entries) professionally downloaded. The phones can then be returned to the family of the deceased or to the suspect, as the case may be. Where a phone is recovered that appears to have been used by a perpetrator, but the identity of the user or owner of the phone is not otherwise established, service provider or other information showing that the recovered phone has made or received calls or messages from family members of a prime suspect will make it easier to demonstrate, using phone attribution analysis, that the phone belonged to or was used by a particular suspect. 79. For all phones identified as relevant it may also be useful to request subscriber details, method of payment and call data, together with mobile phone site locations and any other data providers can offer. This may include text messages or International Mobile Station Equipment Numbers, which may identify the type, model and capability of the handsets used. Smart phones used by the victim or any suspects should be analysed for Wi-Fi locations activated and Internet sites visited for information which may provide leads in the investigation. Where possible, investigators should also obtain cell site coverage maps from service providers. 80. Analysis should compare call-data numbers and data, cross-referencing the movements of all people of interest in the case, on pictorial charts using specialist software, if available. 8. Financial issues 81. A financial profile of the victim should be developed where necessary and appropriate. Where a body or remains are located, this may assist in establishing the time of death. In cases of missing persons, continued activity on an account may help to determine if the suspected victim is still alive. In all cases, a financial profile can reveal new leads for an investigation. 82. Once a suspect has been identified, a suspect financial profile should be developed. Evidence of uncharacteristic financial payments or an extravagant lifestyle should be sought. 9. Chronology of events 83. A “living” chronology of events should be developed as the investigation proceeds. This should be sourced from any material obtained during the investigation, including: (a) Witness statements (b) Known movements of the victim (c) Known movements of any suspects (d) Call and other communication data (e) Documents, including police reports logs and notebooks (f) Mobile phone site data (g) Financial transactions (h) CCTV footage and photographs (i) Lifestyle data. A chronology can help provide an overall understanding of events, identify gaps in knowledge and generate new lines of inquiry. 17