Time Matters - Getting Timestamps Right in Distracted Driving Cases
In forensic investigations and legal cases, accurate timestamps can be critical for reconstructing a sequence of events. Digital devices, however, can experience clock drift which is a gradual deviation of the device’s internal clock from the real time. A simple example is how a microwave clock slowly drifts away from the correct time after you set it.
You might be thinking, "What about devices like smartphones that synchronize with GPS or Assisted-GPS?" While these are generally more accurate than a household microwave, they too can experience clock drift. In real-world situations, this drift occurs more often than many realize especially when you begin comparing clocks from different digital devices. The result is uncertainty in recorded timestamps, which can complicate the correlation of events across multiple devices.
To mitigate this issue, investigators often corroborate mobile device timestamps with other digital sources such as Call Detail Records (CDRs), dash cameras, vehicle systems, surveillance systems, or even other mobile devices. CDRs, for example, are logs generated by telecommunications providers that capture metadata about phone calls, text messages, and data usage. These records typically include highly accurate, network-synchronized timestamps, along with details such as call duration, numbers involved, and cell site location information.
Perhaps the greatest advantage of CDRs and similar digital sources is that they provide an independent reference point to validate when a call, message, or other event occurred. Whether used as secondary or even tertiary sources, these records allow investigators to cross-check data, narrow down discrepancies, and build a more reliable timeline of events in real time relative to one another.
Why Corroboration Matters
Adjusting for Drift - Multiple sources serve as a reference point to correct and adjust for clock drift discrepancies on digital devices
Event Reconstruction - Provides a reliable timeline by verifying the chronological order of events
Evidence Integrity - Enhances the credibility of digital evidence in legal proceedings
Signs of Deletion/Overwrite - Calls and messages on a device can be deleted or overwritten, but those recorded in Call Detail Records (CDRs) cannot. While mobile devices may show signs of deletion or overwrite from a investigators perspective, additional sources such as surveillance or dash camera footage can corroborate the activity by capturing evidence of the actual call or message that no longer appears on the device.
Importance in Distracted Driving Cases
Accurate timestamps can be critical artifacts that can help determine whether a driver was using their phone at the time of an accident or not. When available, aligning mobile device data with other sources such as Call Detail Records (CDRs) allows investigators to establish whether a phone call, text message, app usage, or other event coincided with the crash.
Identify Potential Sources of Evidence – Look beyond the mobile device itself to include Call Detail Records (CDRs), dash camera footage, surveillance video, vehicle system data, or other digital devices that may have captured the same events.
Collect CDRs – Obtain records from network providers to secure accurate, network-synchronized timestamps of calls, text messages, and data activity.
Compare Timestamps – Cross-check mobile device data against CDRs and other sources (e.g., dash cameras, surveillance systems, vehicle event logs) to identify discrepancies.
Adjust for Drift – Calculate and correct for clock drift to align mobile device timestamps with CDRs and other corroborating sources.
Document the Process – Maintain transparency and validation by thoroughly recording methods, findings, and any adjustments made during the examination.