Digital forensics 'vitally important' to Bruce McArthur murder investigation: expert

Digital forensics experts are assisting with the investigation of alleged serial killer Bruce McArthur to unlock a trove of electronic data that may provide clues about how his victims died.

This electronic information, typically gathered from smartphones and computers, can unlock a suspect's behaviour by providing a bountiful source for leads.

Ryan Duquette, a former Peel Regional Police officer and founder of a Toronto-based digital forensics consulting firm, says "we now live on our devices."

"Everything about us is on it."

McArthuris charged with the first-degree murder of five men Andrew Kinsman, Selim Esen, MajeedKayhan, Soroush Mahmudi and Dean Lisowick.

The 66-year-old Toronto landscaper was arrested at his home in ThorncliffePark on Jan. 18.

Since then, forensic pathologists have been sifting throughthe contents of at least 15 large plantersand approximately 30 properties where McArthurmay have worked throughout the Toronto area. They are searching for human skeletal remains.

Lead investigator Det. Sgt.HankIdsingatold CBC Toronto on Tuesday that"digital forensic experts have been, and are continuing to assist" with the investigation.

Earlierhe told reporters at a news conference that "searches of online and cellphone activity" are part of this investigation, but would not confirm if police have seized McArthur'scomputer or cellphone.

It's not only important to preserve the evidence that's on there, then you have to do the analysis to try and link it all together.-Ryan Duquette

Based on what electronic devices are seized from a scene, Duquettesays forensic examiners will start by making copies of "everything, including the deleted content"before they start using forensic hardware tools to preserve the integrity of the data.

These tools allow forensic examiners to augment digital data that investigators have obtained fromsmartphonesand laptops, he explains, enabling them to establish a historical usage pattern that can map a suspect's behaviour.

"It's not only important to preserve the evidence that's on there, then you have to do the analysis to try and link it all together ... Where were they at certain times and what were they doing at certain times?" says Duquette,wholeft Peel Regional Police in 2014 and foundedHexigent.

Cellphone as a tracking device

Until his arrest last month, McArthurwas self employed as a landscaper under the company name Artistic Design.Investigators allege he hid human remains in planters through his business.

Typically, serial killers will use their occupation as a way to acquire victims and will use their time at work to scout locations, said criminologist Michael Arntfield.

"One of the things I look at is the nexus between occupation and opportunity in serial murder," Arntfield, a professor at Western University, said in a previous interview with CBC Toronto.

Although Idsingawill not say whatitemsinvestigators have seized, CBC Toronto knows McArthurconducted some of his business over his cellphone. Police have confirmed they have his client list.

Most cellphone providers log the phone numbers of incoming and outgoing calls and texts, the time and date they were made, the duration of calls, and the approximate location of the phone when the activity took place, says Daniel Tobok, chief executive officer of Cytelligence Inc., a Toronto-based cyber security company.

What's actually recorded is the location of the "cell site" that a phone connected with in order to place or receive a call or text. For example, these can be cellular towers or antennas mounted on buildings.

Since the range of each cell site is limited to a certain distance and a phone will often connect to the nearest one, police and prosecutors use this information to build a case about someone's whereabouts.

Facebook and online dating apps

McArthur was active on Facebook. His account has been disabled, but it previously catalogued his evenings out and vacations, Halloween parties, birthday dinners, concerts andtrips to Mexico.

Younger men, who appear to be of Middle Eastern or South Asian descent, showed up in several of his vacation and nightlife pictures.

Duquettesays forensic examiners will mineFacebook to see who someone is connected with, "what were they doing on social media and what groups do they belong to."

"If a user does delete their profile, Facebook will have historical records that law enforcement can go with a judicial order and get copies of," Duquette said.

The same applies to dating apps, he said, noting many are location based and leave digital remnants on cellphones and computers.

"It can tell you a lot about their behaviour and where they're going," he said.

McArthurwas also active on siteslike manjam and silverdaddies, where he often used a variation on the username "silverfox."

The Globe and Mail has also reported that he had a profile on fetish dating site Recon, in which he askedto be contacted by "submissive men of all ages."

If McArthur'sdating app accounts have been deleted, they can still beaccessed by a judicial order to the app provider who stores historical information.