By Alexis Mavros
, Forensic Data Analyst
A photograph can capture a critical moment. A medical device can store in its memory records of what happened before and after. In the investigation into the death of George Mazonakis, linking such evidence can help clarify the sequence of events and verify the accounts of what happened.
Press reports and leaked information regarding the case mention the recovery of a photograph from a cell phone and the analysis of data from the ATM. According to these reports, the photo had previously been sent to a third party. The key question is how this information relates to the devices’ operation, communications, and the time at which help was requested.
This is what digital forensic analysis examines: the origin, content, and connections of electronic data. The expert verifies exactly what was recorded, what it means, and whether it is consistent with other sources. Of particular interest are the recordings from both the defibrillator and the defibrillator machine. The following examples explain how such data is examined, without reproducing actual times or undisclosed findings from the case.
The device’s electronic log
The log files of a medical device function as an electronic log. Depending on the model and its software, they may include the start and end times of a procedure, alerts, changes in settings, or operational interruptions. Their value lies in the fact that they allow the stages of a process to be reconstructed from the logs themselves. To do this, we must first determine which events the specific device logs and what each entry signifies.
Let’s take an illustrative example: the log shows a warning, followed by a pump shutdown, and then a confirmation of the warning and a restart are recorded. This sequence helps formulate specific questions about what happened in the meantime. However, acknowledging an alert is not enough to determine whether the problem was resolved or what action was taken. These answers require the remaining logs, technical documentation, and a comparison with the available descriptions of the incident. A period without logs also needs to be investigated. The device may only store specific events rather than continuous recordings. It is therefore necessary to verify when it generates recordings and whether the file under examination is complete. The absence of logs does not in itself prove a system failure or data deletion.
The correct interpretation of each indicator is essential. A pressure warning may pertain to the machine’s circuitry rather than the patient’s blood pressure. Similarly, an indication that the pump is operating does not, by itself, constitute a measurement of actual blood flow. Digital analysis clarifies what the system has recorded. Its significance for the patient’s condition is evaluated in consultation with the appropriate medical and technical specialists.
The Value of Defibrillator Recordings
Defibrillator recordings can help reconstruct the resuscitation effort. Depending on the device, they may record when it was activated, when it analyzed the heart rhythm, what instructions it provided, and whether electrical shocks were delivered. Some models also record the heart’s electrical activity, that is, an electrocardiogram, as well as measurements of chest compressions during cardiopulmonary resuscitation (CPR).
Comparing this information with the other recordings helps assess the sequence of actions. However, it is necessary to distinguish between what the device instructed and what is documented as having been performed. An instruction to perform CPR does not mean that CPR was actually performed. The message “shock not recommended” does not mean that the patient has regained consciousness. Even an alert regarding the electrodes must be evaluated in conjunction with the other data before it is attributed to a specific action. Repeated voice prompts do not necessarily correspond to different shocks. The number of shocks delivered is verified in the device’s relevant records, based on the technical documentation for that specific model.
The photograph and accompanying information
On a cell phone, the examination goes beyond what is visible in the image. Along with a photo, information about when it was created, copies of it, or records of it being sent via a messaging app may have been preserved. Experts examine whether it is the original file or a later copy. The time an image was saved to another device may differ from the time it was taken, and sending it does not indicate when the recipient viewed it.
Deleting an image from one location does not necessarily mean that all copies have been lost. An image may have been removed from the photo library but still remain in a chat, in a backup, or on the recipient’s device. This explains why it’s worth checking different sources. This does not mean, however, that every deleted file can be recovered: the possibility depends on the device, the app, the method of deletion, and what happened afterward.
A photograph can also be linked to the device’s history. If, for example, the device’s screen is clearly visible in the image, its display can be compared with stored logs. The photo’s metadata can be examined alongside other communications. In this way, an image takes its place within the sequence of events.
Computers and Accurate Time Tracking
The clinic’s computers can provide additional information through electronic appointments, documents, communications, or revision histories, provided these are maintained. Here, a simple distinction is important: the time of an event is one thing, and the time someone wrote the relevant note is another. A later entry may describe something that happened earlier. The two times need to be recorded separately so that it is clear what each one represents.
Before combining the time information, the devices’ clocks are checked. A cell phone, a medical device, and a camera may not show exactly the same time. As a result, two recordings may appear to disagree with each other, when in fact the discrepancy is due to an incorrect setting. Experts examine these discrepancies and compare them with independent sources, such as available recordings of a distress call. The goal is to determine the sequence of events as accurately as the data allows. The original timestamps are retained in the source files. Any time discrepancies and uncertainties in their calculation are documented separately.
Protection of Original Records
The reliability of the examination begins with the collection of evidence. The collection and examination of evidence must be conducted in accordance with legal procedures, and the manner in which it is handled must be documented. A record is kept of where each file came from, how it was collected, and who handled it. The original data is retained for review, and checks are performed to determine whether it has been altered since collection. A screenshot or printout may help illustrate a finding, but it often does not include all the information from the original file. An exported report may also include only a portion of the data stored on the device. Preserving the original file allows for the same finding to be re-examined, along with the reasoning behind the conclusion.
When the evidence is examined together
In the Mazonakis case, the key issue is how the photograph, communications, device logs, and the time when help was requested are connected. If the information matches, it can support a description of the events. If it differs, the discrepancy requires an explanation: it may be due to a device’s clock, a different type of log, or a substantive difference between the descriptions. Every possibility must be examined, without jumping to conclusions.
Technological advancements also create an ongoing need for training for government and police digital forensics laboratories. Training must cover, beyond cell phones and computers, every category of device that stores or processes electronic data: from medical equipment to security systems and vehicles. Each such device may contain evidence useful to an investigation, but requires knowledge of how it operates and records data. Continuous training of examiners, updating of tools, and collaboration with specialists from various fields are essential prerequisites for the reliable collection and interpretation of this evidence.
It is the expert’s responsibility to clearly explain which facts are supported by the data, where gaps exist, and which questions require further investigation. The timeline alone does not determine the cause of an event or a person’s liability. Digital findings are considered in conjunction with witness statements, medical data, and other evidence. This allows the competent authorities to verify the allegations with specific evidence and to base their judgment on a more complete picture of the events.
Alexis Mavros is a forensic digital data analyst, holds a master’s degree (MSc) in digital forensic analysis from University College Dublin, and is a certified computer examiner (CFCE, IACIS). He has no involvement in this specific case and has no access to the case file. All factual information cited is derived exclusively from published sources. The technical explanations are based on his education, professional training, and experience, and the examples are illustrative: they do not describe findings from the investigation.
SEE ALSO: Communications secrecy lifted in the Mazonakis case; phone records of those involved are being accessed | AlphaNews
