SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsThe murders of four University of Idaho students on November 13, 2022 jolted the nation, transforming a tight-knit college town into the center of one of the most haunting criminal investigations in recent memory. Maddie Mogen, Kaylee Goncalves, Xana Kernodle, and Ethan Chapin were brutally killed in their off-campus home in Moscow, Idaho, during the early morning hours. For weeks, the case gripped the public as law enforcement searched for answers and families demanded justice.
With the arrest and eventual guilty plea of Bryan Kohberger (BK), new light has been shed on how investigators pieced the puzzle together. Beyond traditional police work, the breakthroughs came from cutting-edge DNA analysis and digital forensics that exposed a chilling psychological profile. SANS DFIR Curriculum Lead Heather Barnhart led the forensics team tasked with examining BK’s phone and hard drive, discovering information that offered critical context into why the murders unfolded. Her findings exemplified the importance of digital forensics in bringing violent criminals to justice.
Investigators initially struggled with a lack of eyewitnesses and a crime scene that gave little away. However, a key forensic genealogy discovery is what first turned the tide. A knife sheath left at the scene contained DNA that, when cross-referenced with genealogy databases, pointed investigators toward BK. Specialists at Othram helped solidify the link, demonstrating how modern DNA methods can close gaps that would have been insurmountable a decade ago.
“BK thought he was the perfect murderer. His mistake, leaving the sheath behind, was a huge break in the investigation. I do believe his car would have led to him eventually, but the DNA work here was incredible.”- Heather Barnhart
While DNA provided the “who” behind the murders, digital forensics is what revealed BK’s intentions to remain undetected and cover his digital footprint. That’s where Heather and her husband Jared Barnhart, Head of CX at Cellebrite, played a pivotal role in the case. By digging into BK’s phone and laptop, they uncovered a disturbing pattern of behavior.
On the night of the murders, BK’s phone—normally active—was powered off between 2:54 a.m. and 4:48 a.m., precisely when investigators believe the killings occurred. This wasn’t a dead battery or lost signal; it was deliberate. The blackout suggested premeditation and awareness of how digital traces could be tracked.
In the hours after the killings, BK called his mother multiple times, including one nearly 90-minute conversation. Later, as police announced they were searching for a white Hyundai Elantra, his online activity spiked: looking up lists of registered Elantras, checking police press releases, and even shopping for a new car before he was arrested. Heather and Jared described this as the digital portrait of a man “scrambling” under pressure, which intensified up until his arrest on December 30, 2022.
BK downloaded materials on more than 20 serial killers, including John Wayne Gacy and Danny Rolling, whose crimes bore disturbing similarities to the Idaho murders. Even after deleting traces from his laptop and clearing browser history, his phone revealed these downloads — showing a fixation with killers who targeted young people and used knives. BK attempted to diligently cover his tracks but made several key mistakes, such as
forgetting that phone downloads can provide a vivid portrait of psychopathic behavior.
“He cleared history and selectively deleted files that really help piece the puzzle together.” Heather Barnhart
Autofill revealed graphic browser search terms like “raped,” “forced,” “sleeping,” and “voyeur” that suggested violent sexual fantasies. The consistency of these searches painted a psychological profile steeped in control and domination.
When analyzing BK’s digital behavior, the picture that emerged was of a suspect who tried to be meticulous — but whose digital habits betrayed him. He turned off his phone, cleared logs and data from his laptop, used VPNs, and relied upon Chrome In-Cognito browsing. His pattern of behavior before, during, and immediately after the murders painted a clear picture. His post-crime panic, obsessive research into other killers, and disturbing search history combined with DNA evidence to form a body of proof too strong to ignore.
The Idaho murders highlight the modern intersection of DNA science and digital forensics:
The tragedy in Moscow, Idaho, is first and foremost about four young lives cut short and the families forever changed. However, it’s also a case study in how today’s investigators combine traditional detective work with advanced technology to uncover critical truth.
Launched in 1989 as a cooperative for information security thought leadership, it is SANS’ ongoing mission to empower cyber security professionals with the practical skills and knowledge they need to make our world a safer place.
Read more about SANS Institute