Kris Kremers and Lisanne Froon – Forensic Analysis of Phone Data (2023)

Table of Contents

Kris Kremers & Lisanne Froon Phone Data Analysis General Analysis Phone Data Summary Submit a Comment FAQs Videos References

Updated April 25, 2021 – Our team made updates to our interpretation of the phone activity logs to ensure alignment with case reports.

This is an in-depth analysis of data that was found on the mobile phones of Kris Kremers and Lisanne Froon, the two young women that disappeared in Panama in 2014. Kris Kremers carried an iPhone 4 with her and Lisanne Froon carried a Samsung Galaxy S3. After they disappeared, both phones were found in their backpack on the bank of a river. The data that was extracted by investigators tells a story that may offer insights into what happened after the girls had disappeared.

This excellent analysis was done by Matt, whom can be reached at researchtt2@gmail.com. Matt also previously published a thorough analysis of the Night Photos (link) and organized a comprehensive timeline of the Daytime Photos (link). Matt is tremendously strong with data analysis and graphing information. As you’ll see below, Matt’s charts and graphs make it easy to visualize the phone activity of Kris Kremers and Lisanne Froon after their disappearance.

Romain has also published a similar article in French available on CamilleG.

Kris Kremers & Lisanne Froon Phone Data Analysis

This article reviews the phone logs of the iPhone4 and Galaxy S3 mini between 01 April 2014 and 11 April 2014. The data is based on forensic analysis from the Dutch police and other official reports, that were made available to me for review by a source to supports my goals (published on reddit).

This article offers data but no conclusions and no theories.

I would like to stress that the data in this article is not simply data, but it reflects a desperate situation and tragic events in the lives of two young women. This should be remembered and respected.

As with all data, the first question that should be asked is if it is correct and complete. There is no doubt that the phones were the actual phones of Kris and Lisanne, which was confirmed by their IMEI numbers, and content found on them. There is also no doubt that the Dutch forensic examination was truthful and correct, which however does not exclude mistakes or omissions being made.

It is unknown though who was in control of those phones between 01 April 2014 and 11 April 2014. Most likely it was Kris and Lisanne, but it cannot be ruled out with that there were 3 rd parties involved to some degree. It is also not known where the phones were between 02 April and 11 June when the phones were found and who may have been in control of them. Between 12 June and 23 June, the phones were in the custody of the Panamanian police and from 23 June on they were in the custody of the Dutch police.

There was ample opportunity to access the phones and make modifications to the data within. It is unknown if this happened. There is no indication in the forensic analysis that there are signs of manipulation, however it was not specifically looked for.

There are generally two types of data that can and have to be manipulated:

User generated data like photos and videos

This data is easily deleted by anybody with access to the phone. The iPhone4 had a login code that has to be entered to access the phone. Although it is not clearly stated, it can be inferred that this code was still active and required when the phone came into the custody of the Dutch police. Anybody who would have deleted user generated data from the phone would have needed this code and could have only gotten it from Kris or Lisanne in the period of 01 April to 11 April. The login pin was 0556 and although not very secure, it was secure enough to not be guessed easily. Note that there is no operating system log for when the known pictures were taken, so it is not impossible that other pictures were taken and deleted.

There is however no mention in the police report if any user data was deleted.

System generated log files

The operating system of the phones (iOS and Android) creates log files for most activities the OS performs. For example, iOS will leave the following entry n the log file powerlog.gz:
_{03/31/14 20:15:08 [Log] state=booting; existinglogdate=<unknown>; periodStart=<unknown>; rolloverDate=<unknown>; rotatePowerlog Key= Default; logging Mode=Lite; binary=aggregated; pid=38;}

Although it is possible to manipulate those entries, it is difficult and requires root access to the phone. This is above the abilities of the average person and requires someone with advanced skills and tools.There is no mention in the forensic report that data may have been deleted or modified, however it was also not particularly looked for.

It can be summarized that it is possible to delete user data when knowing the login PIN to the phones, but it is very difficult to manipulate OS system information. The forensic analysis of the phones themselves is assumed correct.

Fingerprints and DNA samples were taken from the phones. There was no DNA profile recovered and the recovered fingerprints were not suitable for identification.Any results would be questionable anyways since the phones were handled by several people after being found.

The following section will describe the activities found on the phones.

General Analysis

There is no GPS data available for either phone for the time period past 01 April. None of the 911 calls connected to the cell network in Panama. For a call to connect it must ring at least once, but none of the calls did for a lack of cell network connection. For that it is assumed that also none of the 112 calls connected, however the author has no records from the Dutch phone system to show this or otherwise. It is also likely that if “112” is dialed in Panama it would be routed to the 911 center in Panama and not to the Dutch emergency center.

It should be noted that on “the internet” it is often discussed that there were over 70 attempts to enter the SIM pin in the iPhone4. Although, this is correct it covers the time period of March to April and is completely irrelevant for anything that occurred after 31 March.

Image 1 below summarized all relevant events. Events are only plotted by day on the x axis but not by time. This means that all activities of each day are on the same vertical axis, while technically the activities later in the day should be displayed further to the right on the x axis. This is done to increase visibility.

For all times where a phone was booted up or shut down, it is represented by a single dot. For all occurrences shown by a dot the phones were turned on for 1-3 min only. Where the phones were turned on longer, it is represented by a line, for example on 02/03 April and 11 April. There is no line representing the time the phones were Powered up on 01 April 2014 as it would be too convoluted and only the times the phones were turned off is displayed.

For this article, all times are given in 24h military time. So 15:00 is 3:00PM and 5:00 is 5:00AM. All times are local time in Panama.

Note that there are some inconsistencies in the forensics report that lead to the activation on 06 April to be interpreted as 13:37 instead of 14:35. This was pointed out to me and is corrected in this article as of 25 April 2021.

The graph now also shows all signal bars for the iPhone4 that are 1 bar. All readings with more than 1 bar on 01 April are omitted to declutter the graph. When there is no indication of signal strength, then because it is not stated in the forensics report and most likely there was no signal at all or 0 bars.

It is not always possible with absolute certainty to determine when a phone was on and in use or only on and at what exact time it was turned off. The data presented here is the best judgment of the forensics expert.

Image 1: Summary of Phone use

The table below shows the signal strength as recorded by the iPhone4 and the bars on the signal display indicator of the iPhone4. The indicator ranges from 1 – 5 bars and those are not just proportional to the signal strength but also are affected by other attributes like connection type (e.g. 2G/3G) etc. If the phone shows 1 bar as it still did on and after 13:38 on 01 April, it does not mean that the phone had a network connection.

The signal strength in dBm is the cell signal strength received by the phone’s transceiver. In order to have a network connection and being able to make phone calls or send text messages, the phone has to establish a two way connection to a cell tower. Since cell towers have large elevated antennas and great signal strength, it is often possible to pick up the cell tower signal but the phone with its tiny antenna and limited transmitter power can not send a signal back. This results in situations where there is a bar indicated on the phone but the phone can not connect to the network and can not make calls.

Signal strength data is shown in the forensics report up until the data point at 15:59 on 04 April. After that, no more signal readings are shown and it is the assumption by the author that from then on, the phone did not receive any signal anymore and did not log signal strength data and it was not listed by the forensics examiner that no signal was detected.

A signal strength of -113 dBm per the forensics examiner means that there is essentially no signal. However it is the interpretation of the author, that the phone transceiver did pick up an extremely low signal.

No signal data is available for the Samsung Galaxy phone.

Date	Local Time	Network	Signal [dBm]	Bars [1 – 5]
1-Apr-2014	11:05:25	GSM	-82	5
1-Apr-2014	11:20:19	GSM	-85	4
1-Apr-2014	11:49:41	None	-82	1
1-Apr-2014	12:33:55	GSM	-82	1
1-Apr-2014	13:14:29	GSM	-91	3
1-Apr-2014	13:14:53	GSM	-82	4
1-Apr-2014	13:15:08	GSM	-87	3
1-Apr-2014	13:16:03	GSM	-76	5
1-Apr-2014	13:16:20	GSM	-89	4
1-Apr-2014	13:38:31	None	-94	1
1-Apr-2014	16:39:26	None	-94	1
1-Apr-2014	16:40:07	None	-94	1
2-Apr-2014	8:13:54	None	-113	1
3-Apr-2014	9:33:32	None	-113	1
3-Apr-2014	16:00:50	None	-113	1

Table: iPhone4 signal strength data. Where there are multiple values over a few minutes only the first is listed. Lower numbers mean weaker signal. So -113 dBm is the weakest signal.

Another important factor is the battery capacity. The following image shows the remaining battery capacity from 01 – 11 April. Note that battery data is not available for all days, especially not for the iPhone4 and for those days the battery capacity is estimated. This is possible since the iPhone4 has seen very consistent usage and the battery consumption per day would be very consistent. All data points that were estimated are marked in red. On this graph, data points are plotted at the actual time on the x axis when they occurred.

Between 02 and 03 April the battery capacity of the iPhone4 increases from 42% to 43%. This likely caused by the battery recovering slightly. The battery was not charged, and it is not something of concern.

01 April

The last time the Galaxy S3 had a WIFI connection was at 10:10:25. It would never regain another WIFI connection thereafter.

The phones were not fully charged with the iPhone4 having 51% battery capacity at 11:40, while the Galaxy S3 had 49% at 11:40.

Several pictures were taken with the phones between 13:14 and 13:15. Those pictures were most likely taken on the Mirador.

–