The “Anti-Hero” Timeline: How A Taylor Swift Song Helped Uncover Crash Evidence

To begin this case, we were given the motor vehicle collision report and the original extraction data from a full file system extraction of the plaintiff’s iPhone 12.

From the collision report, we see that this incident occurred in Northern California at 10:59 AM on October 6th, 2023. The trooper who completed the collision report illustrated the scene and how the collision occurred. The drawing shows the plaintiff traveling on a four-lane road eastbound, and the tractor-trailer “T-boned” the vehicle on its left side as it took a left turn to travel westbound. There are no traffic lights at this intersection, and the location is identified by latitude and longitude. We know that the driver of the plaintiff’s vehicle is Evelyn, age 17, driving a Ford Focus with her sister, Judith, age 14. The statements from both parties indicate that they didn’t see each other and that they were traveling within the speed limit. Evelyn and Judith were extricated and transported to the hospital but survived the collision. Evelyn’s statement to the police was that they were driving down the road when the tractor-trailer pulled out in front of them. She stated that she was not distracted while driving and had both hands on the steering wheel leading up to the collision. The truck driver stated that there were no vehicles coming as he made the turn, and he did not see the plaintiff’s vehicle.

We began our analysis of the extraction data by running it through our protocol to verify the integrity and source of the data. First, we searched the timeline of the data within the parameters provided in the motor vehicle collision report. What we found was that on October 6th, 2023, at 10:59 AM, there was very limited activity, and it appears that the device was inactive for 15 minutes leading up to the collision. At this point, we could have noted the limited activity at the time of the collision and moved on to see what applications may have been operating in the background. However, as thorough digital forensic examiners, we decided to dig deeper and expand our search.

We widened our timeframe beyond what the motor vehicle collision report stated and searched the message log of the device. That is when we uncovered an important revelation. On October 6th, 2023, at 10:43:49 AM, the device received a message: “Potential crash detected. Have you been in a vehicle collision?” This is an automated message from Apple as part of a new function that detects sudden substantial movement in the device and prompts the user with a text message. This message occurred at least 15 minutes and 11 seconds before the time indicated on the collision report. Now the collision had a defined time, and our analysis could continue.

First, we exported the entire KnowledgeC database from the extraction data. This database stores all actions of the device, whether user-initiated or device-initiated. These actions range from the phone being locked, unlocked, playing music, using an app, or a message being received and displayed for the user. In our analysis, we found that the device was locked early in the morning on October 6th, 2023, at 2:14:55 AM. The phone was then unlocked at 10:09:39 AM with significant activity in the KnowledgeC database leading up to the time of the collision. We were able to determine that Evelyn likely went to sleep after locking her phone at 2:14:55 AM and woke up at 10:09:39 AM based on this data.

Analyzing the phone’s timeline and the KnowledgeC database, we were able to learn what took place that morning. We went line by line analyzing the codes given for actions performed by the device from the KnowledgeC database. They wouldn’t make it so easy as to give the entry time and description in one place. As we decoded the entries, the story started to emerge:

• 10:09:39 AM – Phone unlocked.

• 10:09:42 AM – Phone accessed Messages.

• 10:10:12 AM – Outgoing SMS message to “Miah.”

• 10:11:13 AM – Phone is locked.

• 10:29:07 AM – Phone unlocked.

• 10:32:02 AM – Apple Music “paused.” This entry indicates that Apple Music was accessed by the phone, but music was in a paused status at that time. No music was playing, but it wasn’t manually paused.

• 10:32:38 AM – Apple Music “play.” Details included the artist and song title: Taylor Swift, “Anti-Hero.”

• 10:33:04 AM – Apple Music “paused.”

• 10:33:51 AM – Apple Music “play.” Again, the details listed Taylor Swift, “Anti-Hero.”

• 10:35:15 AM – Apple Music “paused.”

• 10:36:09 AM – Apple Music “play.” Taylor Swift, “Anti-Hero.”

• 10:42:39 AM – Bluetooth device connected. In the details of this entry, we found the model number of the connected device, SRS-XB33. After a simple internet search, we found that this model number belongs to a Sony wireless Bluetooth speaker. This indicates that 50 seconds before the device detected a vehicle collision, the phone was being paired to a Bluetooth speaker.

• 10:42:58 AM – Apple Music “play.” The song again: Taylor Swift, “Anti-Hero.”

• 10:43:38 AM – The device received a Snapchat message.

• 10:43:49 AM – Eleven seconds later, a vehicle collision was detected by the device.

We can see it now; we can see the morning unfolding for Evelyn. She went to bed late the night before, so she slept in. She unlocked her phone at 10:09:39 AM and checked her text messages. She immediately responded to Miah. She locked her phone at 10:11 AM and likely got ready for the day. She checked her phone again at 10:29 AM when she unlocked it. For the next 14 minutes leading to the vehicle collision, she accessed Apple Music to play what is obviously her favorite song, and even paired it with her Sony Bluetooth speaker. Eleven seconds before the accident, she received a Snapchat message.

Furthermore, the vehicle collision report lists the address of the owner of Evelyn’s vehicle. If we map that address to the site of the vehicle collision, we get an estimated travel time of 13 minutes. This would mean she had to leave the house around 10:30 AM to reach the collision site at 10:43 AM, and all the actions on the device after 10:29 AM occurred while she was driving the vehicle. This information is enough to change the fault of the collision from one party “at fault” for the trucking company to both parties “at fault” due to distracted driving.

The story of what happened that morning leading to the collision has become a lot clearer because of this analysis. The experience and expertise of our digital forensics examiners are invaluable. Due to their hard work and analysis, a story was uncovered that no one was even looking for.

After an incident like this, all parties involved are left wondering: What happened? What did I do wrong? What could I have done differently? Sometimes you need to conduct some deep analysis of the digital evidence. Sometimes you need to listen closely to your favorite song to find the answer. As Taylor Swift says in “Anti-Hero”: “It’s me. Hi! I’m the problem. It’s me.”