Case Study 1 — The House That Kept Notes

A man living alone was found deceased at the foot of his stairs, and the first read was an accidental fall. What turned a quiet closeout into a careful timeline was not a confession or a fingerprint — it was the realization that the home itself had been taking notes all night, on five devices with five different clocks, none of which had any reason to agree with the family's account.

Background

The decedent — call him the homeowner — was a retired engineer who lived alone in a small smart-instrumented house. A relative with a door code "found him in the morning" and reported a fall down the interior stairs the previous evening. Nothing about the scene was overtly suspicious, but the medical examiner's preliminary window for time of death was wider than the relative's tidy "I last spoke to him around 9 p.m. and came by at 8 the next morning," and the investigating detective did what the modern playbook now requires: before releasing the scene, she inventoried the devices. An Amazon Echo on the kitchen counter. A Ring doorbell at the front, with an active Ring Protect subscription. A Nest thermostat in the hall. An August smart lock on the front door. And — the find that mattered most — a Raspberry Pi humming in a closet, running Home Assistant, tying the whole house together. The homeowner had also worn a Fitbit, still on his wrist.

Six witnesses, in other words, and the examiner's first job was to classify each one across the three tiers and to acquire the most perishable data before anything timed out. The Home Assistant hub was local — Tier 1 storage she could image immediately under the warrant for the residence. The Echo, Ring, Nest, and Fitbit held little of lasting value on the devices themselves; their records lived in the cloud (Tier 3), reachable only through preservation letters and legal process to Amazon, Google, and Google/Fitbit. She sent the preservation requests the same afternoon, because retention timers do not pause for an investigation, and a record she could have saved with a timely letter would be evidence she destroyed by waiting.

The investigation

The local hub paid off first, and it paid off without a single subpoena. The examiner imaged the Pi's SD card behind a write-blocker, hashed it (SHA-256: 7af3…c19b), and pulled home-assistant_v2.db to a working copy. A query of the states table — joined to states_meta for the entity names, with last_updated_ts read as a Unix epoch float — reconstructed the evening:

  2024-03-10T21:02:14Z  device_tracker.relative_phone -> home        (a phone arrives)
  2024-03-10T21:03:09Z  lock.front_door               -> unlocked
  2024-03-10T21:03:51Z  binary_sensor.stairs_motion   -> on
  2024-03-10T22:41:30Z  binary_sensor.stairs_motion   -> on
  2024-03-10T22:58:05Z  lock.front_door               -> locked
  2024-03-10T22:58:44Z  device_tracker.relative_phone -> not_home    (the phone leaves)

The hub said a tracked phone associated with the relative arrived at 21:02 and left at 22:58 — nearly two hours, not the "I didn't come by that night" the relative had implied. But the examiner knew the discipline: a device_tracker entity shows a phone's presence, not a person's, and the hub's clock had to be proven against an external reference before any of this went on a master timeline. So she corroborated, device by device, normalizing every source to UTC.

The cloud returns arrived over the following weeks and triangulated the local record. The Ring doorbell (subscription confirmed, no end-to-end encryption enabled) had two motion clips: one at 21:01 of a person approaching, one at 22:59 of a person leaving — bracketing the hub's lock events to the minute. The Echo held a voice-history record whose creationTimestamp of 1710105869000 decoded — after dividing the milliseconds by 1,000 — to 2024-03-10 21:24:29 UTC, a routine utterance establishing that someone was speaking commands in the kitchen well after the relative's claimed last contact. The Nest thermostat logged a "Home" occupancy state continuous through the window and a manual setpoint change at 22:39 — a human action at a timestamp. And the Fitbit, the most consequential and most delicate source, told the timeline of the body.

  CLOCK NORMALIZATION — five sources, five epochs, one reference (UTC)
  -----------------------------------------------------------------
  Home Assistant   last_updated_ts (Unix epoch float)   -> direct
  Ring clips       Unix seconds (UTC metadata)          -> direct
  Echo record      creationTimestamp = epoch MILLISECONDS-> /1000
  Nest event       Unix seconds                         -> direct
  Fitbit cloud     epoch MILLISECONDS (UTC)             -> /1000

The Fitbit's intraday record showed continuous step and heart-rate data through 22:50, a sharp heart-rate change shortly after, and then the cessation of all step activity — the stream simply stopped. The examiner stated it exactly as the data allowed: the device on the homeowner's wrist recorded movement until roughly 22:50 and recorded no further step activity after that point. That did not prove who was present or what occurred; it constrained the time-of-death window to a span that began after the relative's phone had been in the house for nearly an hour and closed around the time the phone departed. The accidental-fall hypothesis was not impossible, but the relative's account — last contact at 9 p.m., no visit that night — was contradicted by five independent devices with five independent clocks, and that contradiction reopened the investigation on a defensible evidentiary footing.

Recovery vs. Forensics. The same home-assistant_v2.db would have been a pure recovery artifact in another life: a homeowner who bricked their Pi and wanted their automation history back is a restore job, no warrant, no chain of custody. Here it was forensics — imaged behind a write-blocker, hashed at acquisition, analyzed on a verified copy, and every event defensible on the stand. Identical bytes, opposite postures; what differed was the authority behind the acquisition and the documentation that had to survive cross-examination.

Chain of Custody. The case turned on two streams of evidence with two custody disciplines. The physical hub was imaged and hashed exactly as a disk (Chapter 14). The cloud returns were logged with what was requested, the legal instrument that compelled each one, who at the provider produced it, the date, and the SHA-256 of each production set the moment it landed. The examiner never logged into a live account to "look around" — doing so would have altered server-side state and forfeited her ability to prove she changed nothing.

The analysis

  1. Inventory the room, not just the computer. There was no computer at the center of this case — there was a house full of small witnesses. The detective who paused to enumerate every radio in the residence, and the examiner who classified each across the three tiers, are practicing the single habit that defines modern IoT casework: the evidence is ambient, and you have to go looking for it.

  2. The local hub was the immediate goldmine. Home Assistant's local database delivered a near-complete narrative with no provider, no subpoena, and no retention timer — available the same day. When a home has a local hub, image it first; it is the one rich source that survives whether or not the cloud cooperates.

  3. Clock normalization is the unglamorous heart of the work. Five devices reported time five different ways — two of them in milliseconds that a careless examiner would read as the year 56,170. Converting every source to a single UTC reference, and being able to prove each conversion, is what let the devices corroborate instead of appearing to disagree. One botched conversion would have handed the defense a real argument.

  4. State exactly what each device recorded — and no more. The hub showed a phone's presence, the Fitbit showed the device on the wrist recording and then ceasing activity, the lock showed a code being used. None of those, alone, names a person. The examiner's careful two-part phrasing — what was recorded, separately from what it proves — is precisely what makes the corroborated whole survive testimony.

  5. Send legal process early. The cloud returns mattered, and they exist today only because the preservation letters went out the same afternoon. The richest tier is also the most perishable to a deletion timer; speed of legal action protects evidence as surely as speed of technical action.

Discussion questions

  1. Walk the three-tier classification the examiner performed on each of the six devices. Which were Tier 1 (local), which Tier 3 (cloud), and how did that classification dictate the order and method of acquisition?

  2. The Home Assistant database showed a phone arriving and leaving, but the examiner refused to write "the relative was in the house from 21:02 to 22:58." Explain the gap between what a device_tracker entity records and what it proves, and how the Ring, Nest, and Echo data narrowed (but still did not close) that gap.

  3. Explain, to a non-technical prosecutor, why two of the five timestamps had to be divided by 1,000, and what the timeline would have looked like if that step were skipped. Why is this "the unglamorous heart of multi-device forensics"?

  4. ⭐ The Fitbit produced the most powerful and the most sensitive evidence in the case. Lay out (a) the careful, clinical language an examiner should use to describe the cessation of activity data, (b) two innocent explanations for a data gap that must be excluded before treating a stop as a time-of-death signal, and (c) the ethical obligations attached to handling a decedent's continuous physiological record. Cross-reference Chapter 28 — Ethics.

  5. The examiner never logged into the live Amazon, Google, or Fitbit accounts even though a cooperating family member could have supplied credentials. Defend that decision on chain-of-custody grounds, and contrast a consent-based recovery posture with the forensic posture this case required.