Forensic Science Investigator Examining Computer Hard Drive. Digital Forensic Science Concept.
In a major development in a four-year-old cold case, the Douglas County Sheriff’s Office announced on October 15th the arrest of two suspects in the 2019 murder of Kimberly Bell, a 51-year-old woman who was reported missing from Franktown, Colorado.
Javier “Alex” Martell, 30, and Jennifer Bremer, 38, were arrested in connection to Bell’s murdermarking a breakthrough achieved through a combination of witness statements and cutting-edge digital forensic techniques.
Case Background
Javier “Alex” Martell and Jennifer Bremer were accused of being involved in the 2019 murder of Kimberly Bell, a 51-year-old Colorado woman who went missing in July of that year. According to the grand jury indictment and investigative reports, Bell was last seen alive with Martell and Bremer on the day of her disappearance.
The indictment states that Martell became enraged with Bell while they were in her rental car. He allegedly pulled her into the backseat and strangled her. Bremer, who was Martell’s girlfriend at the time, drove the car while Martell continued to choke Bell until she was dead.
After the murder, the pair drove around the Denver area with Bell’s body in the back of the car. They stopped at a Home Depot, where Martell purchased an axe, and then later drove to a remote location near Estes Park, where Martell dismembered Bell’s body.
Bell’s body was placed in trash bags and discarded in a dumpster near a veterinary clinic, according to Bremer’s testimony in the indictment. Bremer also used Bell’s credit card during this time, which led to identity theft charges against her.
Despite the extensive investigation, Bell’s remains have not been recovered, but the detailed digital evidence, particularly Google location data and internet searches–which included queries such as, “does phone ping location if off” and “take a tracking system out of a Ford focus”–from Bell’s devices was crucial in the arrests.
How Experts Use Google Location Data
To access Google location data, law enforcement must first obtain a search warrant. This involves presenting probable cause to a judge, showing that accessing a suspect’s location data is crucial to an investigation.
This could be related to tracking a suspect’s movements before or after a crime, verifying alibis, or determining whether the device was present at a particular scene. The warrant specifies the time frame and the type of data to be collected, such as GPS data or interactions with Wi-Fi networks.
After the warrant is issued, law enforcement submits a formal request to Google, typically through the Google Law Enforcement Request System. Google is legally obligated to provide the requested data under the terms of the warrant.
Google is legally obligated to provide the requested data under the terms of the warrant.For more information on how law enforcement handles such requests, you can visit Google’s transparency report.
A user’s location data is stored with Google on their servers, but this is changing. Soon, location data will be stored on each user’s device. To learn about why and the implications of this change, read my article:
How Location Data is Used in Forensics
Forensic experts use location data to reconstruct a person’s movements over time, which can be critical in criminal investigations.
- Timeline Reconstruction: Investigators can retrieve a detailed timeline of where a device has been over specific time periods. For example, the timeline can place a person at a crime scene or show their travel route before and after a criminal event.
- Corroborating Testimony: Google location data can confirm or contradict statements made by suspects or witnesses. If someone claims they were not near a particular location, but their phone’s location data shows otherwise, it can be used as evidence against them.
- Tracking Patterns: Beyond specific moments, Google location data can reveal broader patterns of behavior, showing frequently visited places or routes over a period of time.
How Digital Forensics Recovers Search History
To recover search history from a phone or computer, law enforcement must first obtain a search warrant by showing probable cause—which means providing evidence that accessing the search history is critical for the investigation.
Once the warrant is granted, digital forensics experts use specialized tools to extract the search data from the device or from cloud services linked to the device.
Recovering Search History from Devices
- Local Device Storage: Even when a user deletes their search history, traces of it can remain in the device’s storage. Web browsers like Chrome or Safari store information in small files and databases, such as SQLite databases (a storage system used by apps and browsers to keep track of your activity). These databases can still contain data after it’s deleted from the browsing history.
- Deleted Data: When files are deleted from a device, they aren’t immediately erased. Instead, they are no longer shown to the user and appear “gone” even if they are still there, or they go to places like unallocated space—essentially “empty” or “unused” space on a hard drive where the data lingers until new data is written over it. Digital forensic tools can scan this unallocated space to recover deleted searches and browsing history.
How Search History Is Used As Evidence
Search history data plays a crucial role in forensic investigations, providing insight into a person’s behavior, intentions, and activities. Digital forensic experts use search history data in investigations to:
- Establishing Intent: One of the primary ways search history is used in forensics is to demonstrate intent. If a suspect’s search history includes terms related to committing a crime, it can show that the individual was planning or considering illegal activities. For example, searches about how to commit a specific crime, how to hide evidence, or how to evade law enforcement can indicate premeditation.
- Reconstructing Timelines: Search history helps investigators create a detailed timeline of a suspect’s activities. The timestamps on searches and browser history provide a chronological record of when a person researched certain topics, visited websites, or engaged in other online activities. This can help confirm or contradict a suspect’s version of events.
- Tracking Patterns of Behavior: Beyond specific moments, search history data can reveal broader patterns of behavior. By analyzing long-term search behavior, investigators can identify repeated searches related to specific activities and persons or a pattern of behavior that supports the investigation’s findings.
- Linking to Other Digital Evidence: Search history can also be combined with other digital evidence, such as location data, communication logs, or social media activity. Together, these pieces of evidence can help paint a complete picture of a suspect’s movements, actions, and mindset at the time of the crime.
The arrests in the Kimberly Bell case underscore the powerful role that digital forensics plays in modern criminal investigations. Digital footprints, often hidden from plain view, allow law enforcement and private digital forensics experts to reconstruct timelines, track behaviors, and determine historic locations.
