By Magnet Forensics
When the Portland Police Bureau arrested Nancy Crampton Brophy, an author who once published an essay titled “How to Murder your Husband,” and charged her with that very crime, they had everything except the literal smoking gun.
Police had recovered a Glock 17 9mm from Crampton Brophy’s home – the same gun investigators believed was used to kill her husband, Daniel Brophy – but it didn’t match the ballistics of the murder weapon. Neither did a kit to build a ghost gun, an unregistered and untraceable firearm, they found in Crampton Brophy’s storage unit.
However, the investigators and the prosecutor on the case shared a theory. They alleged Crampton Brophy swapped out the slide and barrel of her Glock 17 with a different set to murder her husband and then reinstalled the originals to conceal her crime. A photo of Crampton Brophy’s Glock 17, which showed that the slide and barrel weren’t properly seated, only increased their suspicions.
Former Portland Police Bureau Officer Aaron Sparling was tasked with analyzing Crampton Brophy’s computers to see if the digital evidence would confirm or dismiss this theory. “There were a couple of things that were of interest to the investigators: There was the purchasing of a slide and barrel for the handgun and the purchasing of a complete Glock 19 kit,” Sparling said, a digital investigator with more than nine years of experience.
Uncovering the Internet evidence
Sparling turned to a digital investigation platform developed by Magnet Forensics that police often use to recover and analyze digital evidence from computers, phones and other devices. Sparling had three of Crampton Brophy’s laptops to analyze: One was found in a closet, another on her bed and the final computer was recovered from a storage unit.
In Sparling’s experience, the standard case requires him to analyze multiple types of digital evidence recovered from computers belonging to suspects, victims and witnesses. This case was different.
“This case wasn’t built around photographs and text messages, it was built [entirely] around Internet evidence,” Sparling said. “It’s all search history. I can’t recall a single other case in my tenure that was built off of Internet-related [evidence].”
Sparling says every digital investigation at the Portland Police Bureau directly involves the detectives. They prioritize the devices they need analyzed and provide keywords to guide the evidence search in the digital investigation platform. Once the evidence processing is complete, they bookmark any evidence that they want more information on.
“One of the things that make [Magnet Forensics’ digital investigation platform] unique is it has a collaborative ethos to it,” said Sparling. “The interface is very investigator friendly and with very little tutelage on my part, investigators can search through the dataset and find what is important to the investigation.”
Browsing history
In the Crampton Brophy case, Sparling used the keywords “handgun” “gun” “glock” and “murder” to search for evidence on the three computers. The computer found in Crampton Brophy’s storage unit and the one found on her bed were both dead-ends.
The laptop found in Crampton Brophy’s closet, however, quickly proved to be a different story. Sparling began following the “breadcrumbs” he found in the computer’s Internet browsing history. He retraced her steps with her browsing history and followed her activity between November 2017 and March 2018 as she bought the ghost gun kit, researched the gun police recovered from her home and, most importantly, purchased a separate slide and barrel.
“It’s not totally out of the norm to look up a Glock 17 purchase, but when you break it down to a barrel and slide, well that’s a little more interesting,” Sparling said.
Crampton Brophy’s browser history revealed that she first began her research by looking into ghost guns and logging into a website where they’re sold. In January, she was performing online searches into whether Glock pistols “have a big kick back.” She also searched for videos on ghost guns.
In February 2018, she began looking into how to buy a gun locally. Searches included “gun shops in Portland,” “when do you have to register a gun in Oregon,” and “Portland expo gun show 2018.” Crampton Brophy bought the gun police seized from her home at a local gun show, investigators said during her trial.
Then came the browsing history that was of most interest to Sparling. Crampton Brophy visited an eBay listing for a Glock slide and barrel and then won an auction for those items. In March, she searched online for videos about “cleaning a glock17” and “loading a 9mm glock.” She also watched a video detailing how to disassemble, clean and assemble a Glock 17.
Just under three months later, Daniel Brophy was murdered with what investigators determined was a Glock 17 9mm. While Crampton Brophy’s Glock 17 and ghost gun kit were recovered by police, the additional slide and barrel she ordered on eBay never were.
In cross-examination, Crampton Brophy admitted that she took apart the Glock 17 recovered by police and reassembled it. She also admitted she bought an extra slide and barrel for the gun. The extra slide and barrel were never found, she said, because they had been lost in a closet.
Crampton Brophy was convicted for her husband’s murder and sentenced to life in prison.
The importance of digital evidence
The Nancy Brophy case is a prime example of just how important digital evidence is to modern investigations and prosecutions, Sparling said. Along with his work on Crampton Brophy’s computer, Sparling’s colleagues recovered and analyzed video surveillance footage that showed her car arriving at the scene of the crime, parking minutes before she murdered her husband and then leaving. Location data recovered from Crampton Brophy’s cellphone confirmed she was in the area at the time of the murder.
“If digital forensics wasn’t available, you would’ve had a much more difficult time with this case,” Sparling said. “If you take the work we did along with the cellphone tower data and surveillance video collection, that’s three different types of digital evidence that played significant roles in the case and the prosecution.”