That One Artifact: The video that mapped a murder
By Chad Gish
In this series, Chad Gish draws on more than two decades of digital investigative experience to examine cases that were solved, or dramatically advanced, by a single piece of digital evidence.
Note: This series is based on real-world criminal investigations, and some content may be graphic or disturbing.
In my That One Artifact series, I’m often asked what kind of digital evidence can change the direction of an investigation. Sometimes it’s a text message, a location point, or a search history. In this case, it was a video recorded on a suspect’s phone only a short time before a planned carjacking turned into a murder.
Over the years, I’ve seen suspects create some of the strongest evidence against themselves without ever realizing it. This video did more than connect two people. It identified a second suspect, captured them discussing the plan, showed the weapon, and laid out how they intended to take the victim’s vehicle and get away. When you’re working through changing stories, deleted messages, and multiple devices, finding one artifact that maps out the plan in the suspects’ own words can change everything.
A story that kept changing
When officers arrived, they found the victim in the driver’s seat of his vehicle. The engine was still running, and the vehicle was in reverse. A woman at the scene said she knew the victim and had planned to meet him that night, but as investigators began asking questions, her story changed.
In one version, she said she had been sitting in the passenger seat before going inside and hearing gunshots. In another, she said the victim had just arrived when the shots were fired. Investigators repeatedly asked whether anyone else had been there, but she kept insisting she was alone.
We knew there was more to the story, but inconsistencies alone were not enough. We needed evidence that could tell us what happened before the victim arrived and whether another person had been involved. There were no other witnesses and no surveillance video.
The phone held what the story left out
The woman allowed investigators very limited access to her phone, but some messages from that evening appeared to have been deleted. After investigators obtained a search warrant, I conducted a full forensic examination of the phone.
During that examination, I recovered a video recorded only a short time before the homicide. I still don’t know why the woman chose to record it. Whatever her reason, the video became the smoking gun in the case, capturing the suspects together as they discussed the plan that would soon cost a man his life.
In the recording, the woman was with a second person she had never mentioned to investigators. The two talked about waiting for the victim, taking his vehicle, and how they would get away afterward. A handgun was visible and was handled as they talked. In just a few minutes of video, we could see the preparation, hear the intent, and begin to understand the role each suspect would play.
Finding that video required a more traditional forensic review at the time. In a similar investigation today, Magnet Axiom’s Mobile View could help an examiner locate and review relevant media more efficiently. Mobile View presents the extracted device in a familiar phone-style layout, allowing an examiner, detective, or prosecutor to select the Photos app and review the recovered images and videos in a thumbnail view. From there, the media can be filtered, sorted, and previewed alongside details such as timestamps and available location information. Instead of working through the phone data only as rows of artifacts, the investigator can navigate the evidence much as they would use the device itself and quickly focus on the video that matters.
That one video provided the breakthrough we needed. It also provided a map of the crime before it happened.
Magnet Axiom Mobile View presents extracted mobile evidence in a familiar device layout, making it easy to open the Photos app, review media as thumbnails, and quickly locate and preview a case-relevant video.
Identifying the second suspect
The video immediately showed us that the woman had not been alone. The second suspect could clearly be heard discussing the victim and the planned carjacking shortly before the victim arrived. That gave investigators a way to identify the other person involved and a clear direction for the next phase of the case.
Other digital evidence helped build out the timeline. Communications showed contact with the victim leading up to the homicide, and another conversation referenced the idea of “jacking” him. A later search also recovered firearms and additional evidence connected to the investigation.
I also recovered iOS cached locations from the suspect’s phone, which helped corroborate the video evidence. The cached location data placed the device inside the residence at the time the video was created. Around the time of the murder, the data placed the device outside near the dumpster where the victim was shot. Shortly afterward, it showed the device moving back into the apartment. This created another digital trail that followed the suspect through the critical moments of the crime and supported the emerging timeline.
In a similar case today, Magnet Axiom’s Route View could help investigators interpret this type of location evidence by plotting geolocation artifacts, including iOS cached locations, on a map in chronological order. Instead of reviewing individual latitude and longitude points in isolation, investigators can play back a device’s movement to see where it traveled, when it stopped, and how that movement fits within the case timeline. Investigators can view the route at different playback speeds, examine key locations along the way, and record the playback as a video to share with investigators and prosecutors or to help explain the evidence in court.
Magnet Axiom Route View turns individual geolocation artifacts into an animated timeline, allowing investigators to play back and record the route a device traveled.
Each piece was important, but the video from the phone gave the other evidence context. It showed us that the encounter was not random, while the cached locations helped confirm where the device was during the planning, the shooting, and the return to the apartment. Together, the evidence helped explain how the victim was brought to the location, what the suspects intended to take, and how they planned to get away.
From evidence to leverage
The video became important for another reason. It gave investigators leverage during later interviews. Both suspects could change their stories, minimize their involvement, or deny that there had ever been a plan. But they could not easily explain away a recording made in their own voices shortly before the victim was killed.
Investigators were no longer asking questions based only on suspicion or one person’s changing account; the evidence showed the planning in real time. Investigators could use the video to challenge parts of each story that did not make sense and to show both suspects that they already knew far more about the crime. The evidence ultimately helped obtain confessions from both of them.
The artifact that preserved the plan
In digital forensics, we often find one artifact that changes the direction of an investigation. It might be a message that establishes contact, location data that places someone near a scene, or a search that helps show intent. In this case, one video provided the breakthrough. It identified both suspects, documented the original carjacking plan, showed the weapon, explained the setup and getaway, and preserved the moments leading up to a murder. The cached location evidence then helped place the device at key locations and complete the timeline.
The suspects created that evidence themselves, likely never imagining how important it would become. The case began with a murder victim, a running vehicle, and a story that kept changing. The video provided a starting point. From there, the rest of the digital evidence helped build the timeline, identify the second suspect, and reveal how the plan unfolded.
As the investigation came together, the motive behind the carjacking was revealed. The suspects simply wanted a vehicle so they could joyride through the city. That was it. A decision made for a few hours of joyriding cost one man his life and left two other young people facing the better part of their lives in prison.
That one artifact did more than help solve the case. It preserved the suspects’ plan in their own words, while the cached locations helped confirm their movements through the critical moments that followed. Together, these artifacts gave investigators the leverage needed to uncover the truth and ultimately helped bring justice to the victim.
About the author
Chad Gish, Senior Principal Forensic Specialist at Magnet Forensics, is a retired police detective with more than 25 years of experience investigating homicides, mass casualty events, and crimes against children. He is a recognized expert in digital forensics, playing a key role in high-profile cases and the development of forensic labs and crime centers.