Timothy R. Primrose, Mobile Forensic Analyst

When a device is connected to a Wi-Fi network, it typically stores the credentials for future use, allowing it to automatically reconnect to the Wi-Fi network the next time it is in range. Every time the user leaves a saved location with their cell phone, it disconnects from the Wi-Fi network and automatically reconnects when the user gets home. The date and time of the last auto-connect is stored on the device for each set of Wi-Fi network credentials.

The preceding table displays the Wi-Fi connection history of an iPhone 8 Plus. The “Last Connected” column displays the last time the device was manually connected to a Wi-Fi network. The “Last Auto Connected” column displays the last time the device automatically connected to the Wi-Fi network. The “SSId” column displays a recognizable name for the Wi-Fi network.

Case Study:

Background – A woman that lived alone was murdered in her home one night. Local law enforcement marked her ex-husband as their first suspect. He claimed that he was at home, watching the Sixers game.

Forensic Analysis – Analysis of the ex-husband’s cell phone showed that it auto connected to the Wi-Fi network of his ex-wife’s home 12 minutes before the time the coroners said she died. His ex-wife’s home is the same place that he called home before the divorce. While the locks had been changed, the internet service remained. The ex-husband’s phone held onto the Wi-Fi network’s credentials and connected to the Wi-Fi network when he arrived at the property, placing him at the scene of the crime, and not at home watching the game.

Timothy R. Primrose, Mobile Forensic Analyst with DJS Associates, Inc., can be reached via email at experts@forensicDJS.com or via phone at 215-659-2010.