Earlier this week, the FBI announced that it had successfully accessed the locked phone of Thomas Matthew Crooks, the individual responsible for the shooting at a Trump rally last Saturday. A new report from Bloomberg has provided additional details about the phone Crooks used and the process employed to unlock it.
Unlocking the Phone
Following the shooting incident at the Trump rally, the FBI initially struggled to unlock Crooks' phone. On Sunday, the phone was sent to the FBI lab in Quantico, Virginia. By Tuesday, the bureau confirmed that the phone had been successfully unlocked.
Details of the Device and Process
Bloomberg reports that Crooks used a “newer Samsung model running Android’s operating system.” On Sunday, the FBI attempted to unlock the phone using Cellebrite software to bypass or identify the phone’s passcode, but this initial effort failed.
Subsequently, the FBI sought direct assistance from Cellebrite, which provided “additional technical support and new software that was still in development.” With this new software, the FBI was able to unlock the Samsung device in just 40 minutes.
Content Found on the Phone
According to The Associated Press, Crooks had “photos on his phone of the former Republican president, President Joe Biden, and other officials.” The FBI also discovered searches related to “information about major depressive disorder” on the phone.
Cellebrite's Limitations with iOS Devices
In a related development, a leak on Thursday revealed that Cellebrite is currently unable to unlock iPhones running iOS 17.4 and later. Additionally, most iPhones running iOS 17.1 to 17.3.1 remain secure against Cellebrite's unlocking capabilities, except for models with hardware vulnerabilities, such as the iPhone XR and iPhone 11.
This case highlights the ongoing challenges and advancements in digital forensics and the crucial role of specialized software like Cellebrite in law enforcement investigations.