Cell Phone Forensics in the Amber Guyger Murder Trial: How Digital Evidence Helped Secure a Historic Conviction

By Lance Sloves, CCE | Computer Forensic Services, Inc.

On September 6, 2018, off-duty Dallas Police Officer Amber Guyger entered the apartment of 26-year-old Botham Jean — one floor directly above her own at the South Side Flats complex — and fatally shot him, claiming she believed he was an intruder in her home. What followed became one of the most closely watched murder trials in Dallas County history, a case that drew national attention and raised profound questions about policing, accountability, and the power of digital evidence.

As the cell phone forensic expert hired by the prosecution, I had the privilege of examining the mobile device evidence in this case. That evidence would prove central to the State's argument — and ultimately, to the jury's guilty verdict.

The Role of Cell Phone Evidence

In any criminal investigation, a suspect's cell phone can be one of the most revealing sources of evidence. In the Guyger case, the digital forensic examination of her device uncovered a timeline of communications that directly contradicted key elements of the defense narrative and helped prosecutors establish Guyger's state of mind in the critical minutes before the shooting.

The forensic analysis revealed that Guyger had been exchanging sexually explicit text messages and Snapchat messages with her patrol partner, Senior Corporal Martin Rivera, throughout the day and evening of September 6, 2018. The two were engaged in an intimate relationship, and the phone records painted a picture of a distracted officer — not simply an exhausted one, as the defense claimed.

A Timeline Told Through Text Messages

The prosecution used the cell phone evidence to reconstruct a precise timeline of events leading up to the shooting. That evening, Guyger sent Rivera a suggestive Snapchat message at approximately 9:30 p.m. as she finished her shift. The two then spoke on the phone for 16 minutes — a call that ended just three minutes before the fatal shooting.

What made the post-shooting messages particularly significant was that at 10:02 p.m., after she had shot Jean, Guyger texted Rivera: "I need you. Hurry." One minute later, at 10:03 p.m., she sent a second message: "I f---ed up." Prosecutors demonstrated to the jury that these messages were sent while Guyger was simultaneously on the phone with 911, reporting that she had shot someone. Botham Jean lay on his living room floor with a fatal gunshot wound to the chest.

These messages helped the prosecution argue that Guyger's first instinct was not to render aid to the man she had just shot, but to reach out to her romantic partner — a powerful piece of evidence regarding her priorities and state of mind.

Recovering Deleted Evidence

One of the most critical aspects of the cell phone forensic examination involved the recovery of deleted data. Both Guyger and Rivera acknowledged on the witness stand that they had deleted their text message exchanges the day after the shooting. Rivera testified that he deleted the messages because "that's not something I want to be reminded of."

Through forensic examination techniques, the prosecution was able to recover these deleted messages — evidence that both parties had attempted to destroy. The recovery of this data was essential. Without it, the jury would never have seen the full scope of communications that painted a picture of distraction, the suggestive messages exchanged that evening, or the revealing post-shooting texts.

The deletion of evidence by both Guyger and Rivera also raised serious questions about potential evidence tampering and obstruction. Prosecutors argued this was a deliberate effort to conceal the nature of their communications and the role those communications may have played in the events of that night.

Digital Evidence During the Sentencing Phase

The cell phone evidence continued to play a pivotal role after the guilty verdict was delivered on October 1, 2019. During the sentencing phase, prosecutors introduced additional text messages and social media posts recovered from Guyger's devices that revealed racially charged language and violent rhetoric.

Among the evidence presented were text messages Guyger exchanged while working security at a Martin Luther King Jr. Day parade in Dallas in January 2018. When asked when the parade would end, she responded with a joke referencing Dr. King's assassination. Additional text exchanges between Guyger and Rivera contained racially insensitive comments about fellow officers. Prosecutors also presented Pinterest posts saved by Guyger containing violent imagery and commentary.

This digital evidence gave the jury critical insight into Guyger's character and mindset — context that informed their sentencing decision.

Why Cell Phone Forensics Matters

The Amber Guyger case is a powerful example of how cell phone forensic evidence can make or break a criminal prosecution. In this case, the digital evidence accomplished several things that witness testimony alone could not:

It established a precise, minute-by-minute timeline of events before and after the shooting. It revealed the nature and extent of a relationship that spoke directly to Guyger's state of mind and level of distraction. It recovered communications that both parties had deliberately attempted to destroy. And it provided character evidence during sentencing that gave the jury a fuller picture of the defendant.

Guyger was sentenced to 10 years in prison. Her conviction was upheld on appeal by the Texas Fifth Court of Appeals, and the Texas Court of Criminal Appeals declined further review.

The Importance of Qualified Forensic Examiners

High-profile cases like this underscore the need for certified, experienced digital forensic examiners who can withstand the scrutiny of cross-examination and present complex technical evidence in a way that judges and juries can understand. The integrity of the forensic process — from evidence acquisition to analysis to courtroom testimony — must be beyond reproach.

At Computer Forensic Services, Inc., we have provided expert digital forensic analysis and testimony in criminal and civil cases across Texas and beyond since 1997. Our work in the Amber Guyger trial is just one example of how thorough, professional cell phone forensics can serve the interests of justice.

---

Lance Sloves is the founder and owner of Computer Forensic Services, Inc. (CFSI), a veteran-owned digital forensics firm based in Dallas, Texas. He holds Certified Computer Examiner (CCE) certification #282, Cellebrite certification, and a Texas Private Investigator license (#A11665). With 28 years of investigative experience, Lance has provided expert forensic analysis and testimony in high-profile cases across multiple jurisdictions. For more information, visit cfsiusa.com.

---

This article was prepared by Computer Forensic Services, Inc. (CFSI) with AI-assisted research and drafting. All content has been reviewed for accuracy by CFSI's certified forensic examiners.