This is an in-debth analysis of data that was found on the mobile phones of Kris Kremers and Lisanne Froon, the two young women that disappeared in Panama in 2014. Kris Kremers carried an iPhone 4 with her and Lisanne Froon carried a Samsung Galaxy S3. After they disappeared, both phones were found in their backpack on the bank of a river. The data that was extracted by investigators tells a story that may offer insights into what happened after the girls had disappeared.

This excellent analysis was done by Matt, whom can be reached at researchtt2@gmail.com. Matt also previously published a thorough analysis of the Night Photos (link) and organized a comprehensive timeline of the Daytime Photos (link). Matt is tremendously strong with data analysis and graphing information. As you’ll see below, Matt’s charts and graphs make it easy to visualize the phone activity of Kris Kremers and Lisanne Froon after their disappearance.

Romain has also published a similar article in French available on CamilleG.

Kris Kremers & Lisanne Froon Phone Data Analysis

This article reviews the phone logs of the iPhone4 and Galaxy S3 mini between 01 April 2014 and 11 April 2014. The data is based on forensic analysis from the Dutch police and other official reports, that were made available to me for review by a source to supports my goals (published on reddit).

This article offers data but no conclusions and no theories.

I would like to stress that the data in this article is not simply data, but it reflects a desperate situation and tragic events in the lives of two young women. This should be remembered and respected.

As with all data, the first question that should be asked is if it is correct and complete. There is no doubt that the phones were the actual phones of Kris and Lisanne, which was confirmed by their IMEI numbers, and content found on them. There is also no doubt that the Dutch forensic examination was truthful and correct, which however does not exclude mistakes or omissions being made.

It is unknown though who was in control of those phones between 01 April 2014 and 11 April 2014. Most likely it was Kris and Lisanne, but it cannot be ruled out with that there were 3 rd parties involved to some degree. It is also not known where the phones were between 02 April and 11 June when the phones were found and who may have been in control of them. Between 12 June and 23 June, the phones were in the custody of the Panamanian police and from 23 June on they were in the custody of the Dutch police.

There was ample opportunity to access the phones and make modifications to the data within. It is unknown if this happened. There is no indication in the forensic analysis that there are signs of manipulation, however it was not specifically looked for.

There are generally two types of data that can and have to be manipulated:

  1. User generated data like photos and videos

This data is easily deleted by anybody with access to the phone.  The iPhone4 had a login code that has to be entered to access the phone.  Although it is not clearly stated, it can be inferred that this code was still active and required when the phone came into the custody of the Dutch police.  Anybody who would have deleted user generated data from the phone would have needed this code and could have only gotten it from Kris or Lisanne in the period of 01 April to 11 April.  The login pin was 0556 and although not very secure, it was secure enough to not be guessed easily.  Note that there is no operating system log for when the known pictures were taken, so it is not impossible that other pictures were taken and deleted.    

There is however no mention in the police report if any user data was deleted. 

  1. System generated log files

The operating system of the phones (iOS and Android) creates log files for most activities the OS performs. For example, iOS will leave the following entry n the log file powerlog.gz:
03/31/14 20:15:08 [Log] state=booting; existinglogdate=<unknown>; periodStart=<unknown>; rolloverDate=<unknown>; rotatePowerlog Key= Default; logging Mode=Lite; binary=aggregated; pid=38;

Although it is possible to manipulate those entries, it is difficult and requires root access to the phone.  This is above the abilities of the average person and requires someone with advanced skills and tools. There is no mention in the forensic report that data may have been deleted or modified, however it was also not particularly looked for.  

It can be summarized that it is possible to delete user data when knowing the login PIN to the phones, but it is very difficult to manipulate OS system information.  The forensic analysis of the phones themselves is assumed correct.  

Fingerprints and DNA samples were taken from the phones. There was no DNA profile recovered and the recovered fingerprints were not suitable for identification. Any results would be questionable anyways since the phones were handled by several people after being found.   

The following section will describe the activities found on the phones.

General Analysis

There is no GPS data available for either phone for the time period past 01 April.  None of the 911 calls connected to the cell network in Panama.  For a call to connect it must ring at least once, but none of the calls did for a lack of cell network connection.  For that it is assumed that also none of the 112 calls connected, however the author has no records from the Dutch phone system to show this or otherwise.  It is also likely that if “112” is dialed in Panama it would be routed to the 911 center in Panama and not to the Dutch emergency center.  

It should be noted that on “the internet” it is often discussed that there were over 70 attempts to enter the SIM pin in the iPhone4.  Although, this is correct it covers the time period of March to April and is completely irrelevant for anything that occurred after 31 March.  

Image 1 below summarized all relevant events.  Events are only plotted by day on the x axis but not by time.  This means that all activities of each day are on the same vertical axis, while technically the activities later in the day should be displayed further to the right on the x axis.  This is done to increase visibility.  

For all times where a phone was booted up or shut down, it is represented by a single dot.  For all occurrences shown by a dot the phones were turned on for 1-3 min only.  Where the phones were turned on longer, it is represented by a line, for example on 02/03 April and 11 April.  There is no line representing the time the phones were Powered up on 01 April 2014 as it would be too convoluted and only the times the phones were turned off is displayed.  

For this article, all times are given in 24h military time.  So 15:00 is 3:00PM and 5:00 is 5:00AM.   All times are local time in Panama.  

It is not always possible with absolute certainty to determine when a phone was on and in use or only on and at what exact time it was turned off.  The data presented here is the best judgment of the forensics expert.  

Kris Kremers iPhone Samsung Call Logs Chart
Image 1: Summary of Phone use

Another important factor is the battery capacity.  The following image shows the remaining battery capacity from 01 – 11 April.  Note that battery data is not available for all days, especially not for the iPhone4 and for those days the battery capacity is estimated.   This is possible since the iPhone4 has seen very consistent usage and the battery consumption per day would be very consistent.  All data points that were estimated are marked in red.  On this graph, data points are plotted at the actual time on the x axis when they occurred.  

Between 02 and 03 April the battery capacity of the iPhone4 increases from 42% to 43%.  This likely caused by the battery recovering slightly.  The battery was not charged, and it is not something of concern.  

Kremers Froon Phone Call Logs Chart
01 April

The last time the Galaxy S3 had a WIFI connection was at 10:10:25.  It would never regain another WIFI connection thereafter. 

The phones were not fully charged with the iPhone4 having 51% battery capacity at 11:40, while the Galaxy S3 had 49% at 11:40. 

Several pictures were taken with the phones between 13:14 and 13:15.  Those pictures were most likely taken on the Mirador.  

13:14

The Galaxy S3 accessed Google Maps.  

13:38

The iPhone4 lost GSM network contact and would never regain it again.  It is likely the Galaxy S3 lost GSM network contact at the same or similar time and it would also never regain network contact.  

13:54:58

The last known picture was taken with the Canon Camera, indicating there were no issues at this time. 

16:39

“112”, the Dutch emergency number was called from the iPhone4

16:51

“112” was dialed from the Galaxy S3.  

17: 40

The Galaxy S3 was likely powered off.  It is not possible to determine this time with absolute certainty.  The worst case is that it was turned off up to an hour later.  

17:52

The iPhone4 was likely powered off

What happened on this day after 13:54 is not known, however within roughly 2.5h after the last image was taken, something severe enough must have happened to prompt the 112 calls.  

It had been nearly exactly 3h since GSM contact was lost and if Kris and Lisanne had been mobile and had the ability to move freely, they could have reversed and moved 3h back towards the mirador and regained contact to the cell network.  However, this was not done.  

Possibilities for this are:

  • They both were not mobile
  • They did not want to move
  • They both could not move freely
  • They did not know the direction back
  • One did not want to leave the other potentially immobilized behind

12 min elapsed between the two 112 calls from the phones and 112 was attempted to be called only once with each phone.  

What situation is serious but not serious enough to try 112 immediately and instead of trying again, wait 12 min. Even if there was no network contact, why was it not tried more often?  Did the phone users have the discipline to simply look at the phone status, see “No Service” and not try again?  Is this an indication that, at this time the situation was not yet very serious?  Or were they not in control of their actions?  Both phones were turned off between 17:40 and 17:52 so at this time it must have been clear that network contact would not be regained and that batteries need to be preserved, which indicates a situation arose that prevented a return to the mirador and indicated a potential wait for help would be required.  If they were forced to turn of the phones by a 3rd party, it would be likely the phones would have been turned off at the same time or within the same minute.


02 April

6:58

The Galaxy S3 was powered on, “112” was dialed and the phone powered off.  The phone had no cell network connection and the call did not go through.  

8:14

The iPhone4 was powered on, “112” was dialed from the iPhone4 and the phone powered off.  The phone had no cell network connection and the call did not go through.  

10:52

The Galaxy S3 was powered on, “112” and “911” was dialed and the phone powered off.  The phone had no cell network connection and the calls did not go through.  

13:50

The Galaxy S3 was powered on and powered off.  The phone had no cell network connection, no calls were made.  

16:19

The Galaxy S3 was powered on and left on.  The phone was then powered during the night.  


03 April

2:21 – 2:41

The Galaxy S3 had been continuously on since 02 April at 16:19.  It appears as if the phone was not actively used and only left on.  It is not clear if this was an oversight that depleted the battery or if it was done on purpose.  

2:21 

Weather application used

2:41.  

Applications of the Android OS were used but it is not known which ones

7:36

The battery had depleted to 1% and the phone was most likely turned off at this time or shortly after.  

9:32

The iPhone4 was powered on, “911” was dialed twice from the iPhone4 and the phone powered off.  The phone had no cell network connection and the call did not go through.  

11:47

The iPhone4 was powered on and the phone powered off.  

15:59

The iPhone4 was powered on, the contact “Mytiam, 00 507 679xxxxx” looked up in WhatsApp (Note: the spelling in this article is not a typo.  Full phone number is withheld) and the phone powered off.


04 April

4:50

The Galaxy S3 was turned on and turned off.  

5:00

The Galaxy S3 was turned on and turned off.  The battery was at 0%.  This was the last time the Galaxy S3 booted up.  

10:16

The iPhone4 was powered on and the phone powered off.  

13:42

The iPhone4 was powered on and the phone powered off.  


05 April

10:50

The iPhone4 was powered on and the phone powered off.  This was the last time the SIM Pin was entered correctly.  On all previous times the phone was powered up, the SIM pin was entered correctly.  

13:14

There is a logfile created on the Galaxy S3 which is only possible if the phone had power.  However, it did not power up and the conclusion by the author is that the battery had just enough power to start the phone’s boot process, but it shut down from a lack of power before having booted up. 

13:37 

The iPhone4 was powered on and then powered off.  Note that at this time the SIM Pin was not entered or not entered correctly (this cannot be determined).  The SIM pin will never be entered or entered correctly again.  Whoever entered the SIM Pin incorrectly (or did not enter it) must have known the Login pin to unlock the phone.  


06 April

10:26

The iPhone4 was powered on and then powered off.  The SIM pin was not entered or not entered correctly.  

13:37 

The iPhone4 was powered on and then powered off.  The SIM pin was not entered or not entered correctly.  


07 April

No Activity of either phone could be found


08 April

No Activity of either phone could be found

Note that in the night and early morning the “Nightphotos” (https://imperfectplan.com/2020/11/04/kris-kremers-lisanne-froon-deep-analysis-night-photos/) were taken.


10 April

5:15

There is a logfile created on the Galaxy S3 which is only possible if the phone had power.  However, it did not boot up completely and the conclusion by the author is that the battery had just enough power to start the phone’s boot process but it shut down from a lack of power before having fully booted up. 


11 April

10:51 

The iPhone4 was powered on and left on for 64 minutes.  The phone was then powered off.  The SIM pin was not entered or not entered correctly.  

There are no log files created during those 64 min and it is not known what the phone was used for during this time.  The fact that it was turned off indicates that the user had intentions to conserve battery and to use it again.  However, it was never turned on again after.  It is not known how much capacity was left in the battery but before having been turned on the capacity would have been in the range of 22% and it is likely that some capacity remained when it was turned off.  The author believes that there would have been sufficient battery capacity to boot up the iPhone4 again. 

Looking at the phone activity data, several observations stand out:

  • Emergency calls after the initial ones on 01 April were only made in the morning and only for the first two days
  • The Galaxy S3 was generally turned on more often.  On 02 April it was turned on 4 times while the iPhone4 was only turned on one time.  
  • The Galaxy S3 was used during the night and early mornings, while the iPhone4 was never used before 8:14 and on most days not before 10:00 AM. 
  • The iPhone4 was deliberately used to conserve power, while the Galaxy S3 was used for long periods of time draining the battery quicker.  
  • There are significant times at which the phones were used most, between 10:00 – 11:00 and between 13:00 – 14:00
  • There are distinct differences in the use of the phones

The following questions can be raised:

  • Why and how was the time of 13:37 selected and hit?
  • Why was the SIM pin not entered correctly after noon on 05 April?
  • Why was no phone used between 06 April and 10 April?
  • Why was the iPhone4 turned on for 64 min on 11 April?
  • Why was the iPhone4 not used again after 11 April?
  • Why was no note or message left in the phones?

Image 4 shows at which time of day the phones were most used.  The data is accumulated from both phones and between 02 April to 11 April.  It shows that 24% of all the times the phones were turned on it was done between 10:00 and 11:00 and 13:00 – 14:00.  There must have been cue or indication for this.  Was it the sun that came over a mountain at that time? Was this the time to rest from trying to walk to safety? Or was this the time they woke up when they slept during the day since it was not possible to sleep at night?  It should be noted that the Canon camera can be used as a clock as it displays the time in the setup menu, so if certain times were targeted deliberately it could be done by using the clock in the Canon camera. 

Lisanne Froon Camera Data
Kris Kremers Lisanne Froon Phone Logs Records

Image 4: Combined phone user per hour of day  

Phone Data Summary

There’s a lot to take away from this analysis. Many thanks to Matt for his rigorous and comprehensive work regarding this case. His observations and questions posed above are important to the effort of moving the case forward.

As Matt mentioned early in this article, the purpose of this article was to share data and organize the data in a meaningful way. The purpose of this article was not to draw conclusions, nor speculate on theories.

Our team is focussed on gathering and organizing information about the disappearance case. Our team places less emphasis on theorizing and guessing what could have happened. We know that there is still not enough information about the case to formulate conclusions about what happened to Kris Kremers and Lisanne Froon. Instead of speculating, we’re focussed on gathering more information and analyzing the existing information.

Again, many thanks to Matt for his expert work. You can reach Matt directly by emailing researchtt2@gmail.com.