Updated April 25, 2021 – Our team made updates to our interpretation of the phone activity logs to ensure alignment with case reports.
This is an in-depth analysis of data that was found on the mobile phones of Kris Kremers and Lisanne Froon, the two young women that disappeared in Panama in 2014. Kris Kremers carried an iPhone 4 with her and Lisanne Froon carried a Samsung Galaxy S3. After they disappeared, both phones were found in their backpack on the bank of a river. The data that was extracted by investigators tells a story that may offer insights into what happened after the girls had disappeared.
This excellent analysis was done by Matt, whom can be reached at firstname.lastname@example.org. Matt also previously published a thorough analysis of the Night Photos (link) and organized a comprehensive timeline of the Daytime Photos (link). Matt is tremendously strong with data analysis and graphing information. As you’ll see below, Matt’s charts and graphs make it easy to visualize the phone activity of Kris Kremers and Lisanne Froon after their disappearance.
Romain has also published a similar article in French available on CamilleG.
Kris Kremers & Lisanne Froon Phone Data Analysis
This article reviews the phone logs of the iPhone4 and Galaxy S3 mini between 01 April 2014 and 11 April 2014. The data is based on forensic analysis from the Dutch police and other official reports, that were made available to me for review by a source to supports my goals (published on reddit).
This article offers data but no conclusions and no theories.
I would like to stress that the data in this article is not simply data, but it reflects a desperate situation and tragic events in the lives of two young women. This should be remembered and respected.
As with all data, the first question that should be asked is if it is correct and complete. There is no doubt that the phones were the actual phones of Kris and Lisanne, which was confirmed by their IMEI numbers, and content found on them. There is also no doubt that the Dutch forensic examination was truthful and correct, which however does not exclude mistakes or omissions being made.
It is unknown though who was in control of those phones between 01 April 2014 and 11 April 2014. Most likely it was Kris and Lisanne, but it cannot be ruled out with that there were 3 rd parties involved to some degree. It is also not known where the phones were between 02 April and 11 June when the phones were found and who may have been in control of them. Between 12 June and 23 June, the phones were in the custody of the Panamanian police and from 23 June on they were in the custody of the Dutch police.
There was ample opportunity to access the phones and make modifications to the data within. It is unknown if this happened. There is no indication in the forensic analysis that there are signs of manipulation, however it was not specifically looked for.
There are generally two types of data that can and have to be manipulated:
- User generated data like photos and videos
This data is easily deleted by anybody with access to the phone. The iPhone4 had a login code that has to be entered to access the phone. Although it is not clearly stated, it can be inferred that this code was still active and required when the phone came into the custody of the Dutch police. Anybody who would have deleted user generated data from the phone would have needed this code and could have only gotten it from Kris or Lisanne in the period of 01 April to 11 April. The login pin was 0556 and although not very secure, it was secure enough to not be guessed easily. Note that there is no operating system log for when the known pictures were taken, so it is not impossible that other pictures were taken and deleted.
There is however no mention in the police report if any user data was deleted.
- System generated log files
The operating system of the phones (iOS and Android) creates log files for most activities the OS performs. For example, iOS will leave the following entry n the log file powerlog.gz:
03/31/14 20:15:08 [Log] state=booting; existinglogdate=<unknown>; periodStart=<unknown>; rolloverDate=<unknown>; rotatePowerlog Key= Default; logging Mode=Lite; binary=aggregated; pid=38;
Although it is possible to manipulate those entries, it is difficult and requires root access to the phone. This is above the abilities of the average person and requires someone with advanced skills and tools. There is no mention in the forensic report that data may have been deleted or modified, however it was also not particularly looked for.
It can be summarized that it is possible to delete user data when knowing the login PIN to the phones, but it is very difficult to manipulate OS system information. The forensic analysis of the phones themselves is assumed correct.
Fingerprints and DNA samples were taken from the phones. There was no DNA profile recovered and the recovered fingerprints were not suitable for identification. Any results would be questionable anyways since the phones were handled by several people after being found.
The following section will describe the activities found on the phones.
There is no GPS data available for either phone for the time period past 01 April. None of the 911 calls connected to the cell network in Panama. For a call to connect it must ring at least once, but none of the calls did for a lack of cell network connection. For that it is assumed that also none of the 112 calls connected, however the author has no records from the Dutch phone system to show this or otherwise. It is also likely that if “112” is dialed in Panama it would be routed to the 911 center in Panama and not to the Dutch emergency center.
It should be noted that on “the internet” it is often discussed that there were over 70 attempts to enter the SIM pin in the iPhone4. Although, this is correct it covers the time period of March to April and is completely irrelevant for anything that occurred after 31 March.
Image 1 below summarized all relevant events. Events are only plotted by day on the x axis but not by time. This means that all activities of each day are on the same vertical axis, while technically the activities later in the day should be displayed further to the right on the x axis. This is done to increase visibility.
For all times where a phone was booted up or shut down, it is represented by a single dot. For all occurrences shown by a dot the phones were turned on for 1-3 min only. Where the phones were turned on longer, it is represented by a line, for example on 02/03 April and 11 April. There is no line representing the time the phones were Powered up on 01 April 2014 as it would be too convoluted and only the times the phones were turned off is displayed.
For this article, all times are given in 24h military time. So 15:00 is 3:00PM and 5:00 is 5:00AM. All times are local time in Panama.
Note that there are some inconsistencies in the forensics report that lead to the activation on 06 April to be interpreted as 13:37 instead of 14:35. This was pointed out to me and is corrected in this article as of 25 April 2021.
The graph now also shows all signal bars for the iPhone4 that are 1 bar. All readings with more than 1 bar on 01 April are omitted to declutter the graph. When there is no indication of signal strength, then because it is not stated in the forensics report and most likely there was no signal at all or 0 bars.
It is not always possible with absolute certainty to determine when a phone was on and in use or only on and at what exact time it was turned off. The data presented here is the best judgment of the forensics expert.
Image 1: Summary of Phone use
The table below shows the signal strength as recorded by the iPhone4 and the bars on the signal display indicator of the iPhone4. The indicator ranges from 1 – 5 bars and those are not just proportional to the signal strength but also are affected by other attributes like connection type (e.g. 2G/3G) etc. If the phone shows 1 bar as it still did on and after 13:38 on 01 April, it does not mean that the phone had a network connection.
The signal strength in dBm is the cell signal strength received by the phone’s transceiver. In order to have a network connection and being able to make phone calls or send text messages, the phone has to establish a two way connection to a cell tower. Since cell towers have large elevated antennas and great signal strength, it is often possible to pick up the cell tower signal but the phone with its tiny antenna and limited transmitter power can not send a signal back. This results in situations where there is a bar indicated on the phone but the phone can not connect to the network and can not make calls.
Signal strength data is shown in the forensics report up until the data point at 15:59 on 04 April. After that, no more signal readings are shown and it is the assumption by the author that from then on, the phone did not receive any signal anymore and did not log signal strength data and it was not listed by the forensics examiner that no signal was detected.
A signal strength of -113 dBm per the forensics examiner means that there is essentially no signal. However it is the interpretation of the author, that the phone transceiver did pick up an extremely low signal.
No signal data is available for the Samsung Galaxy phone.
|Date||Local Time||Network||Signal [dBm]||Bars [1 – 5]|
Table: iPhone4 signal strength data. Where there are multiple values over a few minutes only the first is listed. Lower numbers mean weaker signal. So -113 dBm is the weakest signal.
Another important factor is the battery capacity. The following image shows the remaining battery capacity from 01 – 11 April. Note that battery data is not available for all days, especially not for the iPhone4 and for those days the battery capacity is estimated. This is possible since the iPhone4 has seen very consistent usage and the battery consumption per day would be very consistent. All data points that were estimated are marked in red. On this graph, data points are plotted at the actual time on the x axis when they occurred.
Between 02 and 03 April the battery capacity of the iPhone4 increases from 42% to 43%. This likely caused by the battery recovering slightly. The battery was not charged, and it is not something of concern.
The last time the Galaxy S3 had a WIFI connection was at 10:10:25. It would never regain another WIFI connection thereafter.
The phones were not fully charged with the iPhone4 having 51% battery capacity at 11:40, while the Galaxy S3 had 49% at 11:40.
Several pictures were taken with the phones between 13:14 and 13:15. Those pictures were most likely taken on the Mirador.
The Galaxy S3 accessed Google Maps.
The iPhone4 lost GSM network contact and would never regain it again. It is likely the Galaxy S3 lost GSM network contact at the same or similar time and it would also never regain network contact. At this time the signal strength was -94 dBm and the phone showed 1 bar. This indicates that the phone picked up a cell tower signal but could not transmit back to establish a two way connection with the cell tower.
The last known picture was taken with the Canon Camera, indicating there were no issues at this time.
“112”, the Dutch emergency number was called from the iPhone4
“112” was dialed from the Galaxy S3.
The Galaxy S3 was likely powered off. It is not possible to determine this time with absolute certainty. It is concluded based on the fact, that there was no longer any activity of the operating system after this time. It would be logical that both phones were turned off at the same time (the iPhone4 was turned off at 17:52). Note that in the graph this time is rounded to 17:52
The iPhone4 was likely powered off
What happened on this day after 13:54 is not known, however within roughly 2.5h after the last image was taken, something severe enough must have happened to prompt the 112 calls.
It had been nearly exactly 3h since GSM contact was lost and if Kris and Lisanne had been mobile and had the ability to move freely, they could have reversed and moved 3h back towards the mirador and regained contact to the cell network. However, this was not done.
Possibilities for this are:
- They both were not mobile
- They did not want to move
- They both could not move freely
- They did not know the direction back
- One did not want to leave the other potentially immobilized behind
12 min elapsed between the two 112 calls from the phones and 112 was attempted to be called only once with each phone.
What situation is serious but not serious enough to try 112 immediately and instead of trying again, wait 12 min. Even if there was no network contact, why was it not tried more often? Did the phone users have the discipline to simply look at the phone status, see “No Service” and not try again? Is this an indication that, at this time the situation was not yet very serious? Or were they not in control of their actions? Both phones were turned off between 17:40 and 17:52 so at this time it must have been clear that network contact would not be regained and that batteries need to be preserved, which indicates a situation arose that prevented a return to the mirador and indicated a potential wait for help would be required. If they were forced to turn of the phones by a 3rd party, it would be likely the phones would have been turned off at the same time or within the same minute.
The Galaxy S3 was powered on, “112” was dialed and the phone powered off. The phone had no cell network connection and the call did not go through.
The iPhone4 was powered on, “112” was dialed from the iPhone4 at 8:14 and the phone powered off. The phone had no cell network connection and the call did not go through. At this time the signal strength was -113 dBm and the phone showed 1 bar. This indicates that the phone picked up a cell tower signal but could not transmit back to establish a two way connection with the cell tower.
The Galaxy S3 was powered on, at 10:53 “112” and “911” was dialed and the phone powered off. The phone had no cell network connection and the calls did not go through.
The Galaxy S3 was powered on and powered off. The phone had no cell network connection, no calls were made.
The Galaxy S3 was powered on and left on. The phone was then powered during the night.
2:21 – 2:47
The Galaxy S3 had been continuously on since 02 April at 16:19. It appears as if the phone was not actively used and only left on. It is not clear if this was an oversight that depleted the battery or if it was done on purpose.
Weather application used
Applications of the Android OS were used but it is not known which ones
The battery had depleted to 1% and the phone was most likely turned off at this time or shortly after.
The iPhone4 was powered on, “911” was dialed twice from the iPhone4 at 9:33 and the phone powered off. The phone had no cell network connection and the call did not go through. At this time the signal strength was -113 dBm and the phone showed 1 bar. This indicates that the phone picked up a cell tower signal but could not transmit back to establish a two way connection with the cell tower. A signal strength of -113 dBm per the forensics report means that there is essentially no signal. However it is the interpretation of the author that the phone transceiver did pick up an extremely low signal.
The iPhone4 was powered on and then powered off. For this data point is no raw data in the forensics report and no signal strength is stated. It is possible, that at this time there was also 1 bar but it is not reported in the forensics report.
The iPhone4 was powered on, the contact “Mytiam, 00 507 679xxxxx” looked up in WhatsApp (Note: the spelling in this article is not a typo. Full phone number is withheld) and the phone powered off.
At this time the signal strength was -113 dBm and the phone showed 1 bar. This indicates that the phone picked up a cell tower signal but could not transmit back to establish a two way connection with the cell tower. A signal strength of -113 dBm per the forensics report means that there is essentially no signal. However it is the interpretation of the author that the phone transceiver did pick up an extremely low signal.
This is the last data point for which signal strength data is reported in the forensics report. It is speculation by the author, that from this time on the phone did not pick up any signal anymore and the readings would have been -120 dBm and 0 bars.
No further attempts to call 112 or 911 are made again, which is likely attributed to the fact that the phone had no longer 1 bar and no hope of connecting to a cell tower.
The Galaxy S3 was turned on and turned off.
The Galaxy S3 was turned on and turned off. The battery was at 0%. This was the last time the Galaxy S3 booted up.
The iPhone4 was powered on and the phone powered off.
The iPhone4 was powered on and the phone powered off.
The iPhone4 was powered on and the phone powered off. This was the last time the SIM Pin was entered correctly. On all previous times the phone was powered up, the SIM pin was entered correctly.
There is a logfile created on the Galaxy S3 which is only possible if the phone had power. However, it did not power up and the conclusion by the author is that the battery had just enough power to start the phone’s boot process, but it shut down from a lack of power before having booted up.
The iPhone4 was powered on and then powered off. Note that at this time the SIM Pin was not entered or not entered correctly (this cannot be determined). The SIM pin will never be entered or entered correctly again. Whoever entered the SIM Pin incorrectly (or did not enter it) must have known the Login pin to unlock the phone.
The iPhone4 was powered on and then powered off. The SIM pin was not entered or not entered correctly.
The iPhone4 was powered on and then powered off. The SIM pin was not entered or not entered correctly. Note that this data point was previously incorrectly stated in this article as 13:37 and is also widely incorrectly stated on “the internet”.
No Activity of either phone could be found
No Activity of either phone could be found
Note that in the night and early morning the “Nightphotos” (https://imperfectplan.com/2020/11/04/kris-kremers-lisanne-froon-deep-analysis-night-photos/) were taken.
There is a logfile created on the Galaxy S3 which is only possible if the phone had power. However, it did not boot up completely and the conclusion by the author is that the battery had just enough power to start the phone’s boot process but it shut down from a lack of power before having fully booted up.
The iPhone4 was powered on and left on for 64 minutes. The phone was then powered off. The SIM pin was not entered or not entered correctly.
There are no log files created during those 64 min and it is not known what the phone was used for during this time. The fact that it was turned off indicates that the user had intentions to conserve battery and to use it again. However, it was never turned on again after. It is not known how much capacity was left in the battery but before having been turned on the capacity would have been in the range of 22% and it is likely that some capacity remained when it was turned off. The author believes that there would have been sufficient battery capacity to boot up the iPhone4 again.
Looking at the phone activity data, several observations stand out:
- Emergency calls after the initial ones on 01 April were only made in the morning and only for the first two days
- The Galaxy S3 was generally turned on more often. On 02 April it was turned on 4 times while the iPhone4 was only turned on one time.
- The Galaxy S3 was used during the night and early mornings, while the iPhone4 was never used before 8:14 and on most days not before 10:00 AM.
- The iPhone4 was deliberately used to conserve power, while the Galaxy S3 was used for long periods of time draining the battery quicker.
- There are significant times at which the phones were used most, between 10:00 – 11:00 and between 13:00 – 14:00
- There are distinct differences in the use of the phones
The following questions can be raised:
- Why was the SIM pin not entered correctly after noon on 05 April?
- Why was no phone used between 06 April and 10 April?
- Why was the iPhone4 turned on for 64 min on 11 April?
- Why was the iPhone4 not used again after 11 April?
- Why was no note or message left in the phones?
Image 4 shows at which time of day the phones were most used. The data is accumulated from both phones and between 02 April to 11 April. It shows that 45% of all the times the phones were turned on it was done between 10:00 and 11:00 and 13:00 – 14:00. There must have been cue or indication for this. Was it the sun that came over a mountain at that time? Was this the time to rest from trying to walk to safety? Or was this the time they woke up when they slept during the day since it was not possible to sleep at night? It should be noted that the Canon camera can be used as a clock as it displays the time in the setup menu, so if certain times were targeted deliberately it could be done by using the clock in the Canon camera.
Image 4: Combined phone user per hour of day
Phone Data Summary
There’s a lot to take away from this analysis. Many thanks to Matt for his rigorous and comprehensive work regarding this case. His observations and questions posed above are important to the effort of moving the case forward.
As Matt mentioned early in this article, the purpose of this article was to share data and organize the data in a meaningful way. The purpose of this article was not to draw conclusions, nor speculate on theories.
Our team is focussed on gathering and organizing information about the disappearance case. Our team places less emphasis on theorizing and guessing what could have happened. We know that there is still not enough information about the case to formulate conclusions about what happened to Kris Kremers and Lisanne Froon. Instead of speculating, we’re focussed on gathering more information and analyzing the existing information.
Again, many thanks to Matt for his expert work. You can reach Matt directly by emailing email@example.com
Please note: Our team is committed to accuracy of information and respecting the privacy of those involved with this disappearance case. If you have any supplementary information regarding the case, or if you were involved in this case and feel that the information available in this article impacts your privacy, please contact our team.