Skip the navigation
News

How police tracked down Steve Jobs' stolen iPads

Digital breadcrumbs left by the iMac and iPad computers were key in tracking them down

By Martyn Williams
August 17, 2012 01:15 PM ET

IDG News Service - The digital breadcrumbs left behind when people use Internet-connected gadgets are what led California investigators to recover iMacs, iPads and other items stolen from the home of the late Apple CEO Steve Jobs.

Based on the police report, obtained by the IDG News Service, here's how they did it.

The burglary took place while the Jobs family home, in a leafy and quiet area of Palo Alto, was being renovated and was unoccupied. Sometime between the construction crew leaving the site at 5:00 p.m. on Tuesday, July 17, and arriving just before 8:00 a.m. the next morning, someone entered the house and stole several personal effects and Apple gadgets.

Within several days, the Palo Alto Police Department had enlisted the help of the Rapid Enforcement Allied Computer Team, a San Jose-based organization formed by local, state and federal law enforcement agencies that specializes in computer-related crimes. Local police wanted assistance tracking down the Apple computers and iPads that were reported stolen from the house.

The REACT team reached out to Apple's own investigators, who had access to the company's computer systems, and supplied them with a list of serial numbers of stolen devices. Apple was quickly able to determine that one of the stolen iPads had connected with Apple's servers soon after the burglary.

The iPad was trying to reinstall its operating system and was recorded connecting from an AT&T U-verse Internet IP address from 7:22 a.m. to 7:31 a.m. on July 18, the morning after the house was broken into and minutes before the returning construction workers would discover the break-in.

Upon searching logs for the IP address, Apple investigators discovered a different iPad had connected from the same address at 8:10 a.m. on July 17, before the burglary took place, and again at 1:56 p.m. on July 20, after the break-in was reported to police. That iPad wasn't suspected stolen, but the iTunes account information gave investigators a lead.

Tied with information from AT&T U-verse about the Internet connection, investigators were led to an address in Alameda, on the east side of San Francisco Bay. At that address Kariem McFarlin, the suspect in the case, was paying for AT&T Internet service, according to investigators.

While police were building their case there was more activity on the stolen devices.

Over a five day period, Apple investigators recorded activity on McFarlin's iTunes account linked to the iPad that originally connected to restore its operating system, a second iPad stolen from the Jobs' home and an iMac computer that was also missing, according to police. One of the iPads later connected from a Comcast Internet connection in Alameda using a different iTunes account.

Reprinted with permission from IDG.net. Story copyright 2014 International Data Group. All rights reserved.
Our Commenting Policies
Blog Spotlight
Sharky

This pilot fish is a contractor at a military base, working on some very cool fire-control systems for tanks. But when he spots something obviously wrong during a live-fire test, he can't get the firing-range commander's attention.

Sharky
Sharky