Timothy R. Primrose, Mobile Forensic Analyst
When a device is connected to a Wi-Fi network, it typically stores the credentials for future use, allowing it to automatically reconnect to the Wi-Fi network the next time it is in range. Every time the user leaves a saved location with their cell phone, it disconnects from the Wi-Fi network and automatically reconnects when the user gets home. The date and time of the last auto-connect is stored on the device for each set of Wi-Fi network credentials.
The preceding table displays the Wi-Fi connection history of an iPhone 8 Plus. The “Last Connected” column displays the last time the device was manually connected to a Wi-Fi network. The “Last Auto Connected” column displays the last time the device automatically connected to the Wi-Fi network. The “SSId” column displays a recognizable name for the Wi-Fi network.
Background – A woman that lived alone was murdered in her home one night. Local law enforcement marked her ex-husband as their first suspect. He claimed that he was at home, watching the Sixers game.
Forensic Analysis – Analysis of the ex-husband’s cell phone showed that it auto connected to the Wi-Fi network of his ex-wife’s home 12 minutes before the time the coroners said she died. His ex-wife’s home is the same place that he called home before the divorce. While the locks had been changed, the internet service remained. The ex-husband’s phone held onto the Wi-Fi network’s credentials and connected to the Wi-Fi network when he arrived at the property, placing him at the scene of the crime, and not at home watching the game.