That one artifact: The search history that spoke volumes
Note: This series is based on real-world criminal investigations. Some content may be graphic or disturbing.
In digital forensics, the fight against technology can sometimes get in the way of the fight for justice.
Whether it’s an encrypted phone sitting in a lab queue awaiting support or a crucial lead buried in gigabytes of data, solving a case can sometimes come down to a single update or surfacing a single artifact.
And in some cases, that one artifact doesn’t just whisper its significance—it screams.
This case study continues my ongoing Magnet Forensics series, “That One Artifact,” where I share real-world investigations I’ve worked on—cases in which an artifact played a pivotal role.
In this case, the artifact came from a suspect’s locked phone, a device that had been stored in the lab for months, encrypted and inaccessible, until just weeks before the trial. When the window of access finally opened, what was uncovered was undeniable.
A community shattered by violence
It was a crime that deeply unsettled our city of Nashville—a senseless act of unspeakable violence that left a lasting mark on the community and shook even the most seasoned investigators.
A young woman, six months pregnant, was gunned down during a walk with her boyfriend. What should have been a quiet, ordinary moment turned tragic in an instant. Emergency responders arrived quickly and did everything they could. But despite their best efforts, the young woman and her unborn child passed away from their injuries in the days that followed. Thankfully, her boyfriend survived. He sustained serious injuries and was left with the lasting trauma of both the attack and the heartbreak of losing his girlfriend.
The urgency of the investigation was immediate. Detectives knew that answers had to come quickly, not just for the sake of justice, but for a grieving family and a shaken community that needed closure. Like so many tragic and unthinkable cases, there was immense pressure to piece together what happened quickly. Every angle was pursued, every witness interviewed, every camera canvassed, and every digital device collected. All leads pointed to one individual: the victim’s ex-boyfriend, and the father of her unborn child.
One phone: A locked vault
The suspect’s Android phone was locked and encrypted. At the time, no available tools could penetrate its security, so it was placed in the evidence charging cabinet awaiting the development of new access support.
These holding patterns of evidence aren’t ideal, but they are a necessary part of modern forensics. Every device represents a potential breakthrough. It might contain a flood of proof—or just one artifact with the power to deliver justice on its own.
Either way, access is key.
As the weeks passed, the case continued to move forward. The suspect was arrested, but his phone remained a locked vault, holding potential evidence we still couldn’t access.
Then, with the trial date looming, everything changed—Magnet Graykey released a crucial update that unlocked support for the exact phone model. Within hours, we extracted the data and had it processed with Magnet Axiom.
The artifact that exposed intent
With digital evidence, it’s often a single clue that makes all the difference.
Buried within the phone’s contents were three internet searches that would come to define the case. The searches stood out, were deliberate, and impossible to ignore:
- “How deep is Percy Priest Lake”
- “Depth chart of Percy Priest Lake”
- “What foods to eat to cause a miscarriage”
The first two searches occurred weeks before the murders; the last was made the night before. The suspect had no known interest in fishing, boating, or swimming in a lake.
What he had was a motive and a chilling digital trail that exposed it.
Combined with prior statements expressing disinterest in fatherhood, the timing and content of these searches made one thing clear: this wasn’t impulsive.
It was premeditated.
These artifacts became the crucial element of the prosecution’s case—evidence of premeditation captured in plain, intentional text.
*Magnet Review showcasing its simple yet powerful view of web-related artifacts
*Magnet Axiom/Portable Case showcasing its simple yet powerful view of web-related artifacts
Delivering the final blow in court
After hundreds of trials, I’ve seen firsthand the weight digital evidence carries in the courtroom. It can cut through uncertainty, reveal intent, and, in many cases, be the difference between doubt and conviction. Digital artifacts often provide the critical details that seal the case, resolving unanswered questions and delivering the final, decisive proof.
Now, imagine trying to prosecute without evidence of premeditation like this—without the digital proof that confirms intent. The case wouldn’t be nearly as strong, and proving all the elements of a crime would be much more difficult.
As is the case in most trials, I was the last to testify. Step by step, I walked the jury through the suspect’s search history—click by click, timestamp by timestamp.
I watched as their expressions changed. If there had been any uncertainty, it evaporated at that moment.
After years of experience, I knew the verdict was sealed. Especially after the prosecutor’s closing arguments, when those very search terms were printed in huge letters on a posterboard, propped on an easel and pointed directly at the jury:
- “How deep is Percy Priest Lake”
- “Depth chart of Percy Priest Lake”
- “What foods to eat to cause a miscarriage”
The suspect was convicted and sentenced to life in prison. In this case, that one artifact’ spoke volumes when the victims themselves could not.
No device left behind: The power of Magnet One
This case highlights one of the challenges in digital forensics: sometimes devices must wait for newly developed exploits before data can be accessed.
With Magnet One’s case management and update notifications, no device falls through the cracks. When a Magnet Graykey update is released that enables support, investigators are alerted immediately. Instead of manually checking backlogs, teams can focus on active investigations, confident they’ll be notified when locked devices become accessible again.
*Magnet One showcasing a device added to a case, complete with all relevant details. When integrated with Magnet Graykey, the device information is automatically populated as soon as the phone is connected. Magnet One then continuously monitors all connected devices that are unsupported and alerts you the moment support becomes available.
Closing the gap between evidence and justice
Time to Evidence (TTE) isn’t just a saying, it’s a foundational value at Magnet Forensics.
For over a decade, Magnet Forensics has built its platforms and features around accelerating access to critical data when it matters most. Every device in the lab holds potential evidence, information that can confirm a suspect’s intent, support a timeline, or deliver the final piece needed to secure a conviction. Without timely access, that data risks being delayed or overlooked.
Magnet One helps ensure nothing slips through the cracks, empowering investigators to act the moment access becomes possible.
Because sometimes, that one artifact isn’t just important, it’s the key to justice.
In this case, it was.
To learn more about the importance of individual artifacts in various cases, read more of our ‘That One Artifact’ series here.
Explore Magnet One, Magnet Graykey, and Magnet Axiom.