Digital forensics 'vitally important' to Bruce McArthur murder investigation: expert

Digital forensics experts are assisting with the investigation of alleged serial killer Bruce McArthur to unlock a trove of electronic data that may provide clues about how his victims died.

Forensic examiners are working to unlock alleged Toronto serial killer's electronic footprint

After alleged serial killer Bruce McArthur was arrested last month, experts tell CBC Toronto forensic examiners would have searched his apartment for "vitally important" digital information alongside physical evidence like blood. (Digital Forensics Corp)

Digital forensics experts are assisting with the investigation of alleged serial killer Bruce McArthur to unlock a trove of electronic data that may provide clues about how his victims died.

This electronic information, typically gathered from smartphones and computers, can unlock a suspect's behaviour by providing a bountiful source for leads.

Ryan Duquette, a former Peel Regional Police officer and founder of a Toronto-based digital forensics consulting firm, says "we now live on our devices."

"Everything about us is on it."

McArthur, 66, is charged with five counts of first-degree murder in the deaths of five men. Police believe there may be more victims. (Bruce McArthur/Facebook)

McArthur is charged with the first-degree murder of five men — Andrew Kinsman, Selim Esen, Majeed Kayhan, Soroush Mahmudi and Dean Lisowick. 

​The 66-year-old Toronto landscaper was arrested at his home in Thorncliffe Park on Jan. 18.

Since then, forensic pathologists have been sifting through the contents of at least 15 large planters and approximately 30 properties where McArthur may have worked throughout the Toronto area. They are searching for human skeletal remains.

Lead investigator Det. Sgt. Hank Idsinga told CBC Toronto on Tuesday that "digital forensic experts have been, and are continuing to assist" with the investigation. 

Earlier he told reporters at a news conference that "searches of online and cellphone activity" are part of this investigation, but would not confirm if police have seized McArthur's computer or cellphone. 

It's not only important to preserve the evidence that's on there, then you have to do the analysis to try and link it all together.-Ryan Duquette

Based on what electronic devices are seized from a scene, Duquette says forensic examiners will start by making copies of "everything, including the deleted content" before they start using forensic hardware tools to preserve the integrity of the data. 

These tools allow forensic examiners to augment digital data that investigators have obtained from smartphones and laptops, he explains, enabling them to establish a historical usage pattern that can map a suspect's behaviour. 

"It's not only important to preserve the evidence that's on there, then you have to do the analysis to try and link it all together ... Where were they at certain times and what were they doing at certain times?" says Duquette, who left Peel Regional Police in 2014 and founded Hexigent. 

Cellphone as a tracking device

Until his arrest last month, McArthur was self employed as a landscaper under the company name Artistic Design. Investigators allege he hid human remains in planters through his business.

Typically, serial killers will use their occupation as a way to acquire victims and will use their time at work to scout locations, said criminologist Michael Arntfield. 

"One of the things I look at is the nexus between occupation and opportunity in serial murder," Arntfield, a professor at Western University, said in a previous interview with CBC Toronto. 

Although Idsinga will not say what items investigators have seized, CBC Toronto knows McArthur conducted some of his business over his cellphone. Police have confirmed they have his client list.   

Most cellphone providers log the phone numbers of incoming and outgoing calls and texts, the time and date they were made, the duration of calls, and the approximate location of the phone when the activity took place, says Daniel Tobok, chief executive officer of Cytelligence Inc., a Toronto-based cyber security company. 

What's actually recorded is the location of the "cell site" that a phone connected with in order to place or receive a call or text. For example, these can be cellular towers or antennas mounted on buildings.

Since the range of each cell site is limited to a certain distance and a phone will often connect to the nearest one, police and prosecutors use this information to build a case about someone's whereabouts.

Facebook and online dating apps

McArthur was active on Facebook. His account has been disabled, but it previously catalogued his evenings out and vacations, Halloween parties, birthday dinners, concerts and trips to Mexico.

Younger men, who appear to be of Middle Eastern or South Asian descent, showed up in several of his vacation and nightlife pictures.

Duquette says forensic examiners will mine Facebook to see who someone is connected with, "what were they doing on social media and what groups do they belong to." 

McArthur's profile on app manjam describes him as spiritual and liberal. In his bio, he writes that he's 'not sure' what he's looking for. (CBC)

"If a user does delete their profile, Facebook will have historical records that law enforcement can go with a judicial order and get copies of," Duquette said.

The same applies to dating apps, he said, noting many are location based and leave digital remnants on cellphones and computers.

"It can tell you a lot about their behaviour and where they're going," he said. 

McArthur was also active on sites like manjam and silverdaddies, where he often used a variation on the username "silverfox." 

The Globe and Mail has also reported that he had a profile on fetish dating site Recon, in which he asked to be contacted by "submissive men of all ages."

If McArthur's dating app accounts have been deleted, they can still be accessed by a judicial order to the app provider who stores historical information. 


Amara McLaughlin

Senior producer, CBC News

Amara McLaughlin is the senior producer of social media for CBC News in Toronto.