Talk With an Expert

Inside the Idaho Murders: How Digital and DNA Forensics Helped Uncover the Truth

Authored bySANS Institute
SANS Institute

The murders of four University of Idaho students on November 13, 2022 jolted the nation, transforming a tight-knit college town into the center of one of the most haunting criminal investigations in recent memory. Maddie Mogen, Kaylee Goncalves, Xana Kernodle, and Ethan Chapin were brutally killed in their off-campus home in Moscow, Idaho, during the early morning hours. For weeks, the case gripped the public as law enforcement searched for answers and families demanded justice.

With the arrest and eventual guilty plea of Bryan Kohberger (BK), new light has been shed on how investigators pieced the puzzle together. Beyond traditional police work, the breakthroughs came from cutting-edge DNA analysis and digital forensics that exposed a chilling psychological profile. SANS DFIR Curriculum Lead Heather Barnhart led the forensics team tasked with examining BK’s phone and hard drive, discovering information that offered critical context into why the murders unfolded. Her findings exemplified the importance of digital forensics in bringing violent criminals to justice.

DNA: The First Break

Investigators initially struggled with a lack of eyewitnesses and a crime scene that gave little away. However, a key forensic genealogy discovery is what first turned the tide. A knife sheath left at the scene contained DNA that, when cross-referenced with genealogy databases, pointed investigators toward BK. Specialists at Othram helped solidify the link, demonstrating how modern DNA methods can close gaps that would have been insurmountable a decade ago.

“BK thought he was the perfect murderer. His mistake, leaving the sheath behind, was a huge break in the investigation. I do believe his car would have led to him eventually, but the DNA work here was incredible.”- Heather Barnhart

While DNA provided the “who” behind the murders, digital forensics is what revealed BK’s intentions to remain undetected and cover his digital footprint. That’s where Heather and her husband Jared Barnhart, Head of CX at Cellebrite, played a pivotal role in the case. By digging into BK’s phone and laptop, they uncovered a disturbing pattern of behavior.

The Phone Blackout

On the night of the murders, BK’s phone—normally active—was powered off between 2:54 a.m. and 4:48 a.m., precisely when investigators believe the killings occurred. This wasn’t a dead battery or lost signal; it was deliberate. The blackout suggested premeditation and awareness of how digital traces could be tracked.

Frantic Post-Murder Behavior

In the hours after the killings, BK called his mother multiple times, including one nearly 90-minute conversation. Later, as police announced they were searching for a white Hyundai Elantra, his online activity spiked: looking up lists of registered Elantras, checking police press releases, and even shopping for a new car before he was arrested. Heather and Jared described this as the digital portrait of a man “scrambling” under pressure, which intensified up until his arrest on December 30, 2022.

Serial Killer Fascination

BK downloaded materials on more than 20 serial killers, including John Wayne Gacy and Danny Rolling, whose crimes bore disturbing similarities to the Idaho murders. Even after deleting traces from his laptop and clearing browser history, his phone revealed these downloads — showing a fixation with killers who targeted young people and used knives. BK attempted to diligently cover his tracks but made several key mistakes, such as

forgetting that phone downloads can provide a vivid portrait of psychopathic behavior.

“He cleared history and selectively deleted files that really help piece the puzzle together.” Heather Barnhart

Autofill revealed graphic browser search terms like “raped,” “forced,” “sleeping,” and “voyeur” that suggested violent sexual fantasies. The consistency of these searches painted a psychological profile steeped in control and domination.

A Timeline of Desperation

When analyzing BK’s digital behavior, the picture that emerged was of a suspect who tried to be meticulous — but whose digital habits betrayed him. He turned off his phone, cleared logs and data from his laptop, used VPNs, and relied upon Chrome In-Cognito browsing. His pattern of behavior before, during, and immediately after the murders painted a clear picture. His post-crime panic, obsessive research into other killers, and disturbing search history combined with DNA evidence to form a body of proof too strong to ignore.

Lessons from the Case

The Idaho murders highlight the modern intersection of DNA science and digital forensics:

  • DNA genealogy can identify suspects in ways that once seemed impossible.
  • Digital footprints reveal state of mind, premeditation, and post-crime behavior.
  • Forensics analysis demonstrates how even when a criminal tries to hide, traces remain.

The tragedy in Moscow, Idaho, is first and foremost about four young lives cut short and the families forever changed. However, it’s also a case study in how today’s investigators combine traditional detective work with advanced technology to uncover critical truth.