That One Artifact: How an overlooked device uncovered a hidden crime scene

In this series, Chad Gish draws on more than two decades of digital investigative experience to examine cases that were solved, or dramatically advanced, by a single piece of digital evidence.

Note: This series is based on real-world criminal investigations, and some content may be graphic or disturbing.

Crime scenes don’t always exist behind yellow tape. Sometimes, they’re buried in forgotten devices, ignored not because they’re unimportant, but because their evidentiary value isn’t always obvious.

Digital evidence can be easily overlooked without the specialized skills of a digital forensic examiner. In today’s tech-driven world, crime scenes are no longer confined to physical locations. Evidence often originates from digital sources: mobile devices, computers, external drives, cloud storage, social media accounts, and IoT devices. Every artifact matters. Even seemingly, minor data points can uncover critical insights.

Understanding where digital evidence comes from and how to interpret it is essential to solving crimes and achieving justice. This case study from my ongoing Magnet Forensics “That One Artifact” series demonstrates just that. Previous articles in the series have shown how digital artifacts have helped crack cases and secure prosecutions and can be viewed here. This one, however, stands out for its tragic circumstances, and the pivotal role of a forgotten GPS unit.

Digital forensic examiners play a critical role in modern investigations by uncovering hidden digital evidence from GPS devices, smartphones, computers, and cloud data, often turning cold cases into solvable ones.

The crime

During a vacation to an unfamiliar city, four young women were approached by a man who struck up a conversation and eventually asked for a ride. Reluctantly, they agreed. Tragically, the situation escalated when the man pulled a handgun and forced them to drive to an unknown location.

The women were held captive for hours and subjected to repeated sexual assaults. After a courageous escape, they drove for miles in a state of shock, trying to find safety before contacting the police.

Unfortunately, their trauma and unfamiliarity with the city made it difficult for them to provide precise details about the crime scene. They recalled a two-story brick building and a house with a small yellow cross, but the descriptions weren’t enough for investigators to identify the location.

At the time, mobile phones provided little more than primarily call logs and text messages, and advanced geolocation features or modern mobile forensic tools were not yet available. With no viable leads, the case stalled.

The breakthrough

Months later, I was invited to a case briefing and started reviewing the evidence. I noticed something that had been collected, but never submitted for examination: a standalone GPS unit from the victims’ vehicle.

One of the victims mentioned the GPS hadn’t been actively used during the kidnapping, but it had remained connected to the car’s charger the entire time. That detail sparked something. From a recent GPS forensics course, I remembered that some models record their last known coordinates before losing power.

If the GPS had stayed powered while the car was in motion, then lost power when the car was turned off, it might have logged the vehicle’s final location, possibly the crime scene.

Digital forensics in action

I analyzed the GPS unit and confirmed my theory. It had indeed recorded coordinates from the last known location before shutdown. It was a reminder that even passive devices can become an active witness. I immediately informed the lead detective, and we rushed to the spot.

What we found matched the victims’ memories: a cluster of two-story brick buildings and a house with a small yellow cross, now obscured by spring blooms. The crime scene was a vacant home nestled between the buildings. We quickly identified the suspects, and DNA evidence from the scene matched each person.  Each suspect pleaded guilty and will spend the remainder of their lives in prison.  

One small artifact, one giant impact

This case highlights how even minimal digital evidence, like a 100-byte data point, can play a crucial role in shaping the outcome of a case, especially if it proceeds to trial. Without that overlooked GPS device, justice may never have been realized for those four women.

It also highlights the importance of ongoing training in digital forensics. Technology evolves quickly, and staying ahead means knowing what data is available, where to find it, and how to use it effectively.

Then and now

Today, Magnet Axiom allows investigators to extract and visualize location data from mobile devices and cloud sources in a single workflow. Features like Animated Maps and Route View make it possible to reconstruct movement, identify patterns, and present findings clearly, both in reports and in court.

Creating routes in Axiom from geolocation information using the Route Wizard can be efficiently accomplished by following these four steps:

Step 1: Select the evidence source

Step 2: Select the artifacts to use when generating routes.

Step 3: To view routes within a specific date and time range, select the start and end time

Step 4: Artifacts that occur within a time and distance interval of each other will be connected to the same route. The time and distance interval can be adjusted to include or exclude more geolocation points.

Axiom Route View allows the investigator to record routes in video format, which enriches forensic reporting and provides valuable contextual information for courtroom testimony.

Route View within Axiom detailing three routes located from cached locations on 03-18-22 between 7:30PM and 8:00PM. The routes are animated and can be played and recorded for export directly from Magnet Axiom.

Final thoughts

Digital evidence is often subtle, fragmented, or easy to miss, but it is never insignificant. In this case, justice came from a device no one thought to examine. How many more answers are still waiting – silent, preserved, and unnoticed — until someone knows where to look?

That’s why it pays to periodically take a second look at what’s already been collected. As tools improve and platforms change, software updates can expose artifacts that were previously unsupported, partially parsed, or simply invisible in older workflows.

Ongoing training matters just as much. The best examiners don’t just learn new buttons — they learn new places to look, new questions to ask, and new ways to connect small data points into a defensible narrative.

A few things to keep in mind:

• Keep your tools current: Software updates may uncover overlooked evidence and reveal artifacts that didn’t decode cleanly the first time.
• Invest in training: Additional education can spark new ideas on where to look — and how to validate what you find.
• Revisit what’s stalled: “Cold cases” may contain evidence that wasn’t supported when it was initially submitted, but becomes actionable as technology evolves.

To learn more about the importance of individual artifacts in various cases, read more of our ‘That One Artifact’ series here.

Explore Magnet One, Magnet Graykey, and Magnet Axiom.