A forensic examination of former Bangladesh Air Force flight lieutenant KM Tahsif Souri’s iPhone could help investigators reconstruct his final movements and communications, International Crimes Tribunal prosecutor Tanvir Hasan Zoha has said, stressing the need to preserve digital evidence before potentially important clues are lost.
“Based on my experience, evidence collection cannot properly begin unless these steps are taken,” Zoha told Daily Waadaa.
Tahsif, 28, went missing on October 27, and his body was recovered from the Turag River near Rajabari Ghat in Dhaka on October 28.
Police said an iPhone found in his pocket helped establish his identity.
The cause of death had not been determined in initial reports, and the body was sent for an autopsy.
The first priority should be to preserve the iPhone in its existing condition and collect available data through authorised forensic procedures. Investigators should document the device, maintain a chain of custody and verify the integrity of the collected evidence, Zoha, a digital forensics expert, said.
Second, investigators should seek relevant iCloud and Apple account records through lawful channels, including available backups, photographs, device associations and account activity.
Third, Gmail and Facebook records should be examined for relevant login histories, security events, Messenger communications and unusual account access. Any evidence of access from an unknown device or internet protocol (IP) address would require further verification.
Accounts should not simply be reset as an investigative shortcut, Zoha said, adding that relevant data should first be preserved through appropriate procedures to minimise the risk of losing useful evidence.
Fourth, investigators should reconstruct Tahsif’s final 72 hours by correlating available calls, messages, location-related data, photographs, videos and application activity.
Fifth, they should examine whether deleted information remains recoverable and compare phone data with telecommunications call-detail records, CCTV footage and witness statements.
Finally, digital findings must be checked against the post-mortem report, physical evidence from the recovery site and other forensic results.