Crime Scene Training

Crime Scene Investigation-Providing Crime Scene Training for Crime Scene Technicians

This blog is devoted to crime scene investigation training and updates in crime scene forensics. 

All posts are painstakingly researched to ensure that the most up-to-date, factual information is published.  

Our goal is to provide information in the science of criminalistics and to encourage our readers to participate in this information sharing process. The articles posted on this blog will be of interest to those seeking more information on:

Crime scene forensics

Crime scene investigation

What you need to know to be a crime scene investigator.

What you need to know about forensic science.

Learning what a crime scene technician does at the scene.     

While much of what is presented here is written by our internal staff, we hope to present materials submitted by our readers too. The CSI Tech Blog will be continually updated and we encourage our readers to submit articles of forensic interest.

 Introducing PrinTips

In keeping with our efforts to provide useful, timely information to the crime scene investigation community, we have added this new category to the CSI TECH BLOG. We will be offering posts relating to Latent Fingerprint Development Techniques that include specific information that makes this task more of a pleasure rather than a chore.

 PrinTips will include up-to-date information on the well-established latent print development methods—like powder and brush—to chemical processing using the old favorites like iodine fuming and ninhydrin. Among the mix will be cyanoacrylate (superglue) fuming and more. 

Visit YouTube to learn more about Crime Scene Technology Training

Posts will be short snippets providing just what you need to get the job done—quickly yet efficiently. Click on "PrinTips" under Categories. 

Sign up for Email alerts when new articles are posted: Email Alert Signup.

  Please Note: At the end of each posted article is a place to leave comments. Please let us and our other readers share in your feedback. This blog is not a one-way street, and we encourage your comments, input, ideas and requests. We are depending upon the professionalism of our readers to demonstrate their willingness to participate in an open sharing of ideas. If your agency or organization maintains a website, please feel free to include the URL: http://www.csitechblog.com

 To locate posts please use the Navigation window on the right column. Select either Categories or Recent Posts.  Thank you!          ====> 

Like Us on FACEBOOK

 

For E-Mail alerts when new posts are published: Sign Up for Email Alert Signup. 

Don Penven, Technical Support Group

 The CSI TECH BLOG has been granted The Top 25 Forensic Blog Award

 For more information contact Criminal Justice Degree Schools:           

 For more information contact Criminal Justice Degree Schools:           

 

 

Untested Evidence in Sexual Assault Cases: Using Research to Guide Policy and Practice

by Nancy Ritter

Readers of Sexual Assault Report are no doubt aware of the existence of thousands of untested, sexual assault kits that are stored in police evidence rooms around the country. Making decisions about how best to handle all of this older, unanalyzed evidence is anything but straightforward-and these decisions are affecting every stakeholder in the nation's criminal justice system: law enforcement and crime laboratories, courts, victim service agencies, policy makers, the federal, state and local levels, and, most significantly, victims.

Untested sexual as sault kits (SAKs) can be stored in a number of places; police department evidence rooms, crime labs , hospitals, clinics, rape crisis centers. We do not know how many unanalyzed SAKs there are, nationwide. There are many reasons for this, but one of the primary ones is that tracking and counting SAKs is an antiquated process in many U.S. jurisdictions. A survey sponsored by the National Institute of Justice (NlJ) found that, as of 2007, 43% of the nation 's law enforcement agencies did not have a computerized system for tracking forensic evidence, either in their property room or after it was sent to the crime lab.

Read the Full Article, Untested Evidence in Sexual Assault Cases, here.

 

Crime Scene Training for Crime Scene Investigators

Evidence Collection Course

In 2013, law enforcement professionals operate in an increasingly complex environment where budgets are tight, crime scenes are complicated, and the public you serve and protect counts on you to make the cases you investigate lead to justice. Cognizant of this, Sirchie is committed to helping you by delivering training solutions that enhance your skills and knowledge base

in evidence collection and crime scene technology. Over the past 50 years, Sirchie has trained thousands of law enforcement professionals from around the globe. Our Evidence Collection Accelerated Training Program provides you with hands on training with limited class sizes in our state of the art facilities. This class, commonly known as Crime Scene Technology, covers the scientific methods of collection, identification, evaluation, and preservation of physical evidence.

You should attend this class if:

• You process crime scenes

• You want to learn more about the latest tools and techniques used to process crime scenes

• You want to find as much evidence as possible at the crime scene.

Sirchie instructors are passionate about developing expertise with the latest crime scene technology and

passing their knowledge of proper use on to you. Our instructors discuss real world scenarios you may face in the field and are available as a reference for you after completion of your class if you have questions.

Sirchie’s Evidence Collection Course has been approved for “POST” (Peace Officer Standards and Training) Credit or for Continuing Police Education Credits in a number of states. Please contact our Training Coordinator at (800) 356-7311 or training@sirchie.com for more information and a complete list of participating states.

Download the CSI Training Brochure for full details covering all of the top-level courses offered by Sirchie

 

 

 

 

 

New Tool for Law Enforcement Executives

Law enforcement executives now have it all in one place: Five critical concepts that are proven to improve policing and save money. NIJ's "Five Things" synthesizes many years of research and distills evidence-based practices that can make a difference into a single list. The list was developed by former NIJ director John Laub and current Police Foundation president (and former NIJ visiting fellow) Jim Bueermann.

Five Things Law Enforcement Executives Can Do to Make a Difference:

      1. Crime is rarely random; patrols shouldn't be either. Focusing on  small geographic locations and times when crimes occur and targeting specific, high-impact repeat offenders can decrease crime.

     2. Quality is more important than speed. In most cases, thorough investigations, problem solving and careful forensic evidence collection contribute more to arresting suspects than shaving a few seconds off of initial response times.

     3. DNA works for property crimes, too. Collecting and using DNA evidence substantially increases the likelihood of solving property crimes -- leading to twice as many arrests and twice as many cases being accepted for prosecution than in non-DNA "traditional" investigations.

     4. In police work, perceptions matter. When people see the police as fair, lawful and respectful, officers are safer and citizens are more likely to obey the law and comply with police orders.

     5. Officer safety and wellness should be a priority. Safety training, certain shift lengths and using body armor prevents injuries and saves lives.

Learn more at the Five Things topic page

Learn when new articles are Posted: Sign up for Email Alerts

  

 

 

 

The quest to crack the world’s most mysterious malware warhead

It was straight out of your favorite spy novel. The US and Israel felt threatened by Iran's totalitarian-esque government and its budding nuclear program. If this initiative wasn't stopped, there was no telling how far the growing conflict could escalate. So militaries from the two countries reportedly turned to one of the most novel weapons of the 21st century: malware. The result was Stuxnet, a powerful computer worm designed to sabotage uranium enrichment operations.

 When Stuxnet was found infecting hundreds of thousands of computers worldwide, it was only a matter of time until researchers unraveled its complex code to determine its true intent. Today, analysts are up against a similar challenge. But they're finding considerably less success taking apart the Stuxnet cousin known as Gauss. A novel scheme encrypting one of its main engines has so far defied attempts to crack it, generating intrigue and raising speculation that it may deliver a warhead that's more destructive than anything the world has seen before. 

Gauss generated headlines almost immediately after its discovery was documented last year by researchers from Russia-based antivirus provider Kaspersky Lab. State-of-the-art coding techniques that surreptitiously extracted sensitive data from thousands of Middle Eastern computers were worthy of a James Bond or Mission Impossible movie. Adding to the intrigue, code signatures showed Gauss was spawned from the same developers responsible for Stuxnet, the powerful computer worm reportedly unleashed by the US and Israeli governments to disrupt Iran's nuclear program. Gauss also had links to the highly advanced Flame and Duqu espionage trojans. 

Gauss contains module names paying homage to the German mathematicians and scientists Johann Carl Friedrich Gauss, Kurt Friedrich Gödel, and Joseph-Louis Lagrange. Its noteworthy features only start there. Gauss has the ability to steal funds and monitor data from clients of several Lebanese banks, making it the first publicly known nation-state sponsored banking trojan. It's also programmed to collect a dizzying array of information about the computers it infects—including its network connections, processes and folders, BIOS, CMOS, RAM, and both local and removable drives.

 But the most intriguing characteristic of Gauss is an encrypted payload that has so far remained undeciphered, despite the best efforts of cryptographers who have already tried millions of possible keys. Tucked deep inside the Gödel module, the secret warhead is loaded onto USB sticks and removable drives when they're connected to Gauss-infected machines. When the drives are plugged into an uninfected computer later, the mysterious code is executed—but only if it encounters the specific machine or machines targeted by the Gauss developers. On every other computer, the module remains cloaked in an impenetrable envelope that prevents researchers and would-be copycats from reverse engineering the code. The extreme stealth has stoked speculation that the payload may contain a potent exploit that could rival the Stuxnet attack that was bent on destroying uranium centrifuges inside Iran's high-security Natanz enrichment facility. Certainly not your everyday malware. 

"Considering the link with Flame and Stuxnet, the payload of Gauss must be of similar magnitude," Costin Raiu, director of Kaspersky Lab's global research and analysis team, told Ars. "Given how careful the attackers were to make sure the Gauss payload doesn't fall into the 'wrong' hands, we can assume it is very special."

Built to last 

Gauss is by no means the first malware with a payload that was programmed to remain dormant unless it was installed on computers meeting a narrow set of criteria. Stuxnet also contained code instructing it to destroy uranium-enrichment centrifuges only when they were physically located at Natanz. Researchers have theorized that the trigger was implemented to reduce the chances of collateral damage that might result if Stuxnet took hold in other facilities. (The precaution proved wise, since Stuxnet infected more than 100,000 computers scattered all over the globe.) 

But as cryptographer Nate Lawson observed more than two years ago, the mechanism Stuxnet used to protect unintended targets from destruction was surprisingly crude for an otherwise advanced cyberweapon developed by countries with almost unlimited budgets. The coding techniques were largely limited to conditional "if/then" range checks that identified computers running German conglomerate Siemens's Simatic Step7 software inside Natanz. If an infected computer met the criteria, the sabotage payload was activated. If not, the exploit sat dormant.

 Noticeably absent from Stuxnet was any kind of mechanism preventing researchers, enemies, or potential copycat programmers from peering inside the malware to see what the highly selective payload did. That's precisely what security experts such as Ralph Langner did following the Stuxnet discovery. Within a few weeks, the world had its answer: Stuxnet was a powerful cyberweapon unleashed by a well-resourced government bent on sabotaging Iran's nuclear program. While the developers may have taken care to prevent the worm from attacking other countries, they did little to conceal the true aim and methods of their malware, which attacked programmable logic controllers at the heart of the enrichment process. 

"Encrypting your payload so that only the intended target can decrypt it hides both the identity of the victim and the worm's purpose," Lawson recently told Ars. "If Gauss came after Stuxnet, it's clear the authors disliked the publicity its PLC [programmable logic controller] payload received and made an effort to hide it properly the second time."

Read entire article HERE

Learn when new posts are made to this blog: Sign up for Email Alerts

 

 

 

 

Understanding What Happens in an Erroneous Conviction

Why are innocent people wrongfully convicted in certain cases yet acquitted in others?

Research is starting to uncover what happens. A new study, "Predicting Erroneous Convictions: A Social Science Approach to Miscarriages of Justice" compared cases where innocent defendants were wrongfully convicted to "near misses" – cases in which an innocent defendant was acquitted or had charges dismissed before trial. They found 10 significant facts that could lead to a wrongful conviction.

Watch an introductory Video Here

        Wrongful Convictions Study

 

 

 

 

 

 

Forensic Technique Offers Hope in Homicides

ANTHONY M DESTEFANO

SOURCE: NEWSDAY

CREATED: MARCH 1, 2013 

Experts say isotopes can eliminate 90 percent of the world in an attempt to identify a homicide victim and have been used to solve European criminal cases.

Canadian police are using an advanced forensic technique to help determine the identity of a homicide victim who may have traveled or lived in the area around New York City in the months before he died in the late 1990s.

 The forensic tool, known as stable isotope analysis, determines the concentration of certain isotopes in the body, which in turn can help show where a victim may have been before death. Isotopes are variations of basic chemical elements and are deposited in hair and bone through food and water consumption.

 Experts say isotopes can eliminate 90 percent of the world in an attempt to identify a homicide victim and have been used to solve European criminal cases.

 Could stable isotopes be useful in the Gilgo Beach investigation, where four sets of remains are still unidentified?

 "Absolutely," said retired detective Paul Dostie, of Mammouth Lake, Calif., who used the method to find the town in Mexico where a still-unidentified female slaying victim came from. "When you don't have a match in a DNA database, you don't give up; you go to other resources like stable isotope analysis."

 Suffolk County Medical Examiner Yvonne Milewski said she was familiar with the isotope technique.

 "We are aware of the use of stable isotope analysis of human remains in human investigations. We cannot comment on the ongoing Gilgo investigations. As a general policy, the medical examiner's office would consider pursuing any scientific method that could potentially provide additional information, and possibly assist in a criminal investigation."

 Asked if her office has ever used the technique, Milewski said through a spokeswoman that it had not been used in any "closed" case and declined to comment further when asked if it was used in any open cases.

 Deputy Chief Kevin Fallon, spokesman for the Suffolk County police department, also said investigators were aware of the isotope method and would use it if it were deemed helpful. However, Fallon declined to comment on whether the method has or is being used in any homicide or missing person case, in contrast to the NYPD and Nassau County police, where spokesmen said their departments had never used it.

 While the Canadian homicide victim, who tests showed was born around 1958, has yet to be identified, police used isotope analysis to narrow down the geographic area where he lived and traveled. The zone is an oval shaped area encompassing Newfoundland in eastern Canada, northeastern Pennsylvania, New York State and New England. The southern edge of the zone includes a fringe of the north Bronx, as well as nearby suburban counties.

 A smaller search area allows police to focus their investigation of missing person databases so they aren't looking for a needle in a giant haystack, said superintendent John House, of the Royal Newfoundland Constabulary.

 "This allows you to make that haystack smaller," said House. "It doesn't eliminate the haystack; it makes it a lot smaller."

 After a photo of a reconstruction of the man's head and face circulated in newspapers in eastern Canada, investigators got a number of calls but no DNA match, said House. Looking for new leads in the United States, House provided the image to Newsday.

 House turned to isotope analysis by contacting Wolfram Meier-Augenstein, an expert in isotopes, at the James Hutton Institute in Scotland. (Police labs can't do isotope analysis in-house.) The science turns on the adage that "we are what we eat," explained Meier-Augenstein in a telephone interview. While isotopes are plentiful in nature, they are deposited in water and food substances at different rates depending on geographic location, said Meier-Augenstein. For instance, North American people consume more corn products than Europeans so the isotope signature for the Carbon-13 isotope would be greater than in a European person, whose primary source of dietary sugar would be from sugar beets.

Global distribution rates of stable isotopes for hydrogen and oxygen can be mapped globally, although there are some variations, noted Meier-Augenstein. Because a person absorbs stable isotopes from food and water, hair will act as a recorder, providing a roadmap about a person's travel and help focus an investigation, he said.

 Copyright 2013 - Newsday

McClatchy-Tribune News Service

Article Source "Officer.com"

For notification when new articles are posted: Sign Up for Email Alerts

Latent Fingerprint Suitability for ID Judgments

From the National Institute of Justice

NIJ Releases two important publications dealing with latent fingerprints.

 Cognitive and Contextual Influences in Determination of Latent Fingerprint Suitability for Identification Judgments

  Quantitative Measures in Support of Latent Print Comparison

For alerts when new posts to this blog occur: Sign Up for Email Alerts

 

Is the U.S. a target of massive cyber-espionage campaign?

New York Post - By Ellen Nakashima (http://www.nypost.com/) 

A new intelligence assessment has concluded that the United States is the target of a massive, sustained cyber-espionage campaign that is threatening the country’s economic competitiveness, according to individuals familiar with the report.

The National Intelligence Estimate identifies China as the country most aggressively seeking to penetrate the computer systems of American businesses and institutions to gain access to data that could be used for economic gain.

 The report, which represents the consensus view of the U.S. intelligence community, describes a wide range of sectors that have been the focus of hacking over the past five years, including energy, finance, information technology, aerospace and automotives, according to the individuals familiar with the report, who spoke on the condition of anonymity about the classified document. The assessment does not quantify the financial impact of the espionage, but outside experts have estimated it in the tens of billions of dollars.

Cyber-espionage, which was once viewed as a concern mainly by U.S. intelligence and the military, is increasingly seen as a direct threat to the nation’s economic interests.

In a sign of such concerns, the Obama administration is seeking ways to counter the online theft of trade secrets, according to officials. Analysts have said that the administration’s options include formal protests, the expulsion of diplomatic personnel, the imposition of travel and visa restrictions, and complaints to the World Trade Organization.

Cyber-espionage is “just so widespread that it’s known to be a national issue at this point,” said one administration official, who like other current and former officials interviewed spoke on the condition of anonymity to discuss internal deliberations.

The National Intelligence Estimate names three other countries — Russia, Israel and France — as having engaged in hacking for economic intelligence but makes clear that cyber-espionage by those countries pales in comparison with China’s effort.

China has staunchly rejected such allegations, saying the Beijing government neither condones nor carries out computer hacking.

Dating to at least the early 1980s, China has made the acquisition of Western technology — through means licit and illicit — a centerpiece of its economic development planning. The explosion in computer use has greatly aided that transfer of technology.

China’s intelligence services, as well as private companies, frequently seek to exploit Chinese citizens or people with family ties to China who can use their insider access to U.S. corporate networks to steal trade secrets using thumb drives or e-mail, according to a report by the Office of the National Counterintelligence Executive.

The National Intelligence Estimate comes at a time when the U.S. government is making a concerted effort to develop policies that address cyberthreats against the nation.

“We need the NIE on cyber for a systematic and comprehensive understanding of what the most dangerous technologies are, who are the most threatening actors and what are our greatest vulnerabilities,” said former deputy defense secretary William J. Lynn III, who requested the report in 2011 but has not seen or been briefed on the contents.

Get alerts when new articles are posted: Signup for Email Alerts

 

Microsoft and Symantec Disrupt Cyber Crime Ring

From: Reuters News Service

 Software makers Microsoft Corp and Symantec Corp said they disrupted a global cybercrime operation by shutting down servers that controlled hundreds of thousands of PCs without the knowledge of their users.

The move made it temporarily impossible for infected PCs around the world to search the web, though the companies offered free tools to clean machines through messages that were automatically pushed out to infected computers.

 Technicians working on behalf of both companies raided data centers in Weehawken, N.J., and Manassas, Va., accompanied by U.S. federal marshals, under an order issued by the U.S. District Court in Alexandria, Va.

 They seized control of one server at the New Jersey facility and persuaded the operators of the Virginia data center to take down a server at their parent company in the Netherlands, according to Richard Boscovich, assistant general counsel with Microsoft's Digital Crimes Unit.

 Boscovich told Reuters that he had "a high degree of confidence" that the operation had succeeded in bringing down the cyber crime operation, known as the Bamital botnet.

 "We think we got everything, but time will tell," he said.

 The servers that were pulled off line on Wednesday had been used to communicate with what Microsoft and Symantec estimate are between 300,000 and 1 million PCs currently infected with malicious software that enslaved them into the botnet.

HIJACKING SEARCHES 

The companies said that the Bamital operation hijacked search results and engaged in other schemes that the companies said fraudulently charge businesses for online advertisement clicks.

 Bamital's organizers also had the ability to take control of infected PCs, installing other types of computer viruses that could engage in identity theft, recruit PCs into networks that attack websites and conduct other types of computer crimes.

 Now that the servers have been shut down, users of infected PCs will be directed to a site informing them that their machines are infected with malicious software when they attempt to search the web.

Microsoft and Symantec are offering them free tools to fix their PCs and restore access to web searches via messages automatically pushed out to victims.

 The messages warn: "You have reached this website because your computer is very likely to be infected by malware that redirects the results of your search queries. You will receive this notification until you remove the malware from your computer."

 It was the sixth time that Microsoft has obtained a court order to disrupt a botnet since 2010. Previous operations have targeted bigger botnets, but this is the first where infected users have received warnings and free tools to clean up their machines.

 Microsoft runs a Digital Crimes Unit out of its Redmond, Washington, headquarters that is staffed by 11 attorneys, investigators and other staff who work to help law enforcement fight financial crimes and exploitation of children over the web.

 Symantec approached Microsoft about a year ago, asking the maker of Windows software to collaborate in trying to take down the Bamital operation. Last week they sought a court order to seize the Bamital servers.

 The two companies said they conservatively estimate that the Bamital botnet generated at least $1 million a year in profits for the organizers of the operation. They said they will learn more about the size of the operation after they analyze information from infected machines that check in to the domains once controlled by Bamital's servers.

 Their complaint identified 18 "John Doe" ringleaders, scattered from Russia and Romania to Britain, the United States and Australia, who registered websites and rented servers used in the operation under fictitious names. The complaint was filed last week with a federal court in Alexandria and unsealed on Wednesday.

 The complaint alleges that the ringleaders made money through a scheme known as "click fraud" in which criminals get cash from advertisers who pay websites commissions when their users click on ads.

Bamital redirected search results from Google, Yahoo and Microsoft's Bing search engines to sites with which the authors of the botnet have financial relationships, according to the complaint.

 

The complaint also charges that Bamital's operators profited by forcing infected computers to generate large quantities of automated ad clicks without the knowledge of PC users.

 Symantec researcher Vikram Thakur said Bamital is just one of several major botnets in a complex underground "click fraud ecosystem" that he believes generates at least tens of millions of dollars in revenue.

He said that researchers at will comb the data on the servers in order to better understand how the click fraud ecosystem works and potentially identify providers of fraudulent ads and traffic brokers.

 "This is just the tip of the iceberg in the world of click fraud," said Thakur.

 Boscovich said he believes the botnet originated in Russia or Ukraine because affiliated sites install a small text file known as a cookie that is written in Russian on infected computers.

The cookie file contains the Russian phrase "yatutuzebil," according to the court filing. That can loosely be translated as "I was here," he said.

Microsoft provided details on the takedown operation on its blog.

(Reporting By Jim Finkle; Editing by Claudia Parsons and Leslie Gevirtz)

 Original Reuters Article

Keep up with new posts on this blog: Sign up for Email alerts Here

 

 

Manual Outlines Policies and Procedures for Digital Evidence

Electronic devices such as computers, cellphones and digital cameras must be properly seized, processed and stored to preserve the integrity of the data and ensure its evidentiary value. A manual developed by the Electronic Crime Technology Center of Excellence (ECTCoE) can provide agencies with much-needed guidance on drafting policies and procedures for handling digital evidence.

As stated in the text, the purpose of the sample Policy and Procedure Manual is to give law enforcement agencies a collection of documents that can serve as a starting point for developing policies and procedures for the collection, handling and processing of digital evidence. Once final, the manual will be posted to the National Law Enforcement and Corrections Technology Center (NLECTC) System website, in a Microsoft Word format to facilitate editing as needed by individual agencies. The NLECTC System is a program of the Office Justice Programs’ National Institute of Justice.

“The document was written in response to the many requests we’ve seen on the various computer forensic email lists requesting copies of policy and procedure 
manuals by state and local officers and agents who have been tasked with developing such a document for their own agency,” explains Russell Yawn, ECTCoE deputy director.

In developing the manual, the ECTCoE was able to take advantage of in-house expertise along with information gathered from law enforcement agencies.

“The ECTCoE deals with the law enforcement community at large so we have contacts throughout the country and some internationally that we can rely on for input,” says ECTCoE Director Robert O’Leary. “We have a well-established network and relied on that network to provide us with examples that agencies were using at the state level, and combined it with the expertise in the ECTCoE. Every CoE staff member has criminal justice experience with digital evidence collection and examination, so we were able to leverage all those resources and put together this set of policies and procedures.”

Some of the agencies that provided assistance include the Southern Oregon High Tech Crimes Task Force, the New York Police Department, Orlando Police Department, Austin Police Department, Dallas Police Department and Charleston Police Department. The ECTCoE also looked at sample policies from the U.S. Department of Defense.

“We were able to get a great deal of information from a number of agencies and contacts, and look at the policies that had been implemented and ensure that we did not overlook any topics or points of interest that other agencies may have found important,” O’Leary says.

The manual should also help agencies performing the Commission on Accreditation for Law Enforcement Agencies (CALEA) accreditation process regarding digital evidence procedures. The purpose of CALEA accreditation programs is to improve the delivery of public safety services, primarily by maintaining a body of standards and establishing and administering an accreditation process.

“Another thing we tried to keep in mind was the CALEA standards,” O’Leary says. “We wanted to ensure that these procedures would lend themselves to compatibility, and we were able to rely on some of our contacts that perform CALEA reviews.”

The manual has sections covering case assignment and prioritization; equipment testing, validation and updates; evidence and property handling; search and seizure; storage of evidence and retention policy; reports; materials and supplies; computer forensic lab access; Manual Outlines Policies and Procedures for Digital Evidence2 release of information to the media; quality assurance policy and process; and sample forms (e.g., computer lab request for service, evidence inventory and details, and evidence access and tracking).

“Some forms we developed, others are based on forms received from other agencies. We simply wanted to give agencies a format they could work with as a guide,” O’Leary says.

For more information, contact NLECTC at (800) 248-2742. For information on NIJ’s electronic crime technology portfolio, contact Program Manager Martin Novak at martin.novak@usdoj.gov or (202) 616-0630

Visit NLECTC's Interactive TechBeat.

Learn about new posts to this blog: Sign up for Email Alerts

 

What Happens to the Brain During Sexual Assault

Follow the transcript or watch the video of a Seminar with Becki Campbell - NIJ Event Update

In the latest Research for the Real World presentation, Dr. Rebecca Campbell discusses the neurobiology of sexual assault and the effect trauma has on victim behavior. Is she exhibiting normal post-trauma behavior? Or is she lying?

Dr. Campbell has given this presentation before numerous law enforcement officers. She has several tips that help officers make arrests and strengthen the case.

Rebecca Campbell is Professor of Psychology and Program Evaluation at Michigan State University. For the past 20 years, she has conducted victimology research and evaluation, with an emphasis on violence against women and children. Her work examines how rape crisis centers and the legal, medical, and mental health systems respond to the needs of adult, adolescent, and pediatric victims of sexual assault. Her current work, funded by the National Institute of Justice, focuses on Sexual Assault Nurse Examiner (SANE) programs and the criminal justice system.

Visit the NIJ website HERE

 

 

            Learn about new blog posts - Signup for Email Alerts

Market Survey on Through-the-Wall Sensors

The Sensor, Surveillance, and Biometric Technologies (SSBT) Center of Excellence (CoE) has undertaken a market survey of through-the wall sensors (TTWS) certified by the Federal Communications Commission (FCC) for operation by law enforcement and first responder agencies in the United States. These devices generally use a form of radar to detect small amounts of movement behind barriers; in some cases, the movement associated with normal breathing is enough to allow detection.

TTWS allow for enhanced situational awareness during operations when knowledge of the presence of individuals behind opaque barriers would be of benefit, during law enforcement operations requiring forced entry, in hostage situations, in building sweeps by firefighters or when locating individuals in rubble during search-and-rescue operations. Some devices provide a range to the moving target and others, a two-dimensional (2D) graphical display of multiple targets.

This report provides an unbiased survey of available equipment and its operational capabilities and limitations (as reported by manufacturers). This information provides individuals and organizations with a better understanding of the capabilities and limitations of available equipment.

This report is a product of an NIJ-funded project but is not published by the Department of Justice.

Get your copy of the Report Here

Learn about new posts to the CSI TECH Blog - Register for Email Alerts

 

 

 

'Dementia' The Newest Threat to Tracking Cyber Intruders

By Kelly Jackson Higgins
Dark Reading 

Forensics increasingly encompasses the analysis of potentially valuable clues and intelligence in the physical memory of an infected machine. But like anything in infosec, it's a constant cat-and-mouse game, with attackers finding new ways to hide their tracks in memory from incident response handlers trying to get to the bottom of a breach.

A researcher has developed a new tool called Dementia that cheats forensics tools that inspect attacker’s footprints in a Windows computer's memory. Dementia basically renders a phony image of the infected machine's memory as a way to hide evidence of an attacker's movements. The tool removes "specific artifacts from the memory or the image being created. While the image itself is correct -- it can be analyzed -- specific artifacts are not present, which can hide traces of attacker's activities," says Luka Milkovic, who developed the tool. Milkovic, who is a information security consultant with Croatia-based Infigo, recently demonstrated the tool at the CCC conference in Hamburg, Germany.

Dementia demonstrates how an attacker who has wrested control of a system can muck with the forensics investigation process by fooling memory-acquisition tools. It can hide artifacts such as processes and threads from several popular tools: Moonsols Win32dd (in kernel-mode only); Mandiant Memoryze; Mantech MDD; FTK Imager; and Winpmem.

Memory analysis has become a vital process for triaging machines after an attack. Security experts say it's more efficient than just slogging through hundreds of gigabytes of hard drive space, for example, and to instead drill down on a few gigs of RAM where the attacker is executing code.

"Disk forensics has been prevalent for more than a decade, and there are lots of tools and methodologies for extracting valuable information or forensic evidence from a target computer or device," Milkovic says, such as files, folders, file and folder metadata, system logs, and registry entries.

"Incident handlers realized that by acquiring the memory of the examined machine, they might create less 'side effects' on the machine, while obtaining a cleaner and more trusted snapshot of the state of the machine," he says. "In the last couple of years, a significant rise in the number of tools for acquiring and analyzing memory can be seen, and memory forensics are now considered a vital part of the incident-handling workflow."

But anti-forensics tools and techniques are nothing new. Attackers already can block memory acquisition altogether or "break" memory analysis itself so that an investigator can't study the memory image. Dementia is basically an evolution of previous breakthroughs in cheating memory forensics, Milkovic says. "Dementia can be considered as a beginning of the memory anti-forensic framework aimed at hiding arbitrary artifacts from the memory dump," he says.

It doesn't stop investigators from memory acquisition nor does it touch artifices in the live system. Instead, it modifies artifacts in the memory dump that the memory acquisition tool creates. Milkovic points to other anti-forensics techniques, such as Haruyama and Suzuki's work on breaking memory analysis and Sparks/Butler's ShadowWalker.

"Compared to these techniques, Dementia is a bit more noisy -- no advanced self-hiding capabilities implemented so a forensic expert can easily detect Dementia's presence -- but [it] can hide arbitrary artifact, has little performance impact, and does not break the analysis," he says. Dementia has two modules, user mode and kernel mode.

So what can incident handlers do when faced with anti-forensics methods by attackers? Employ another method of acquiring memory from the live and infected machine, for example, such as Firewire, or enlist an integrated crash-dump technique, Milkovic suggests. While that causes a reboot, it's tougher for the attacker to modify the artifacts.

The bottom line: Live forensics can't always be trusted because it relies on an infected machine that the investigator doesn't have complete control over. "I think they can be of extreme forensic value, but I just wanted to demonstrate that they cannot be trusted at all times," he says.

Milkovic plans to release the free Dementia tool this month.

How Prosecutors Make Decisions

Published by the national Institute of Justice
Executive Summary 
Prosecuting attorneys enjoy broader discretion in making decisions that
influence criminal case outcomes than any other actors in the American justice
system. They make pivotal decisions throughout the life of a case—from
determining whether to file charges, to crafting plea offers and recommending
sentences. That they do so with little public or judicial scrutiny generates
questions about the justice and fairness of the process.
There is an extensive body of research on factors that affect prosecutorial decision making.
However, this material has several important limitations. First, it focuses
overwhelmingly on quantitative analyses that identify factors having reliable
statistical relationships with case outcomes; few studies have applied
qualitative methods to explore how and when prosecutors’ interpretation of
those factors influence the decision making process. 
Second, few studies are comparative. Some rely on analyses of outcomes in one jurisdiction. 
Others examine one decision point. Still others focus on one offense type.
These studies have found case outcomes to be primarily associated with the strength
of evidence, the seriousness of offenses, and the culpability of defendants.
However, there is scant research on contextual factors that may influence prosecutorial
decisions, such as prosecutors’ characteristics, organizational constraints,
and social context (relationships among participants in the courtroom
workgroup, for example).
Finally, there has been little research examining the influence of prosecutors’ 
conceptions of justice and fairness—how much, for
example, case-level decisions are influenced by the system-level pursuit of
procedural or distributive justice, or by prosecutors’ concerns about the
consequences of their decisions for individual victims and defendants.
With support from the National Institute of Justice, the Vera Institute of Justice undertook
research to better understand how prosecutors make decisions throughout the
processing of a case. The study used data from two moderately large county
prosecutors’ offices, selected because of previous working relationships with
the Vera Institute. The participating counties—identified in the report as
Northern County and Southern County—are roughly comparable in size and
demographics, with just under a million residents each and recent increases in
their Latino populations. Both offices operate in states with determinate
sentencing structures (no discretionary parole), mandatory periods of
post-release supervision, and statutorily defined sentencing guidelines based
on seriousness of the conviction offense and either prior conviction history or
a broad evaluation of risk to the community.8 The guidelines are mandatory in
Southern County but only advisory in Northern County.
Vera researchers examined initial case screening and charging decisions, plea
offers, sentence recommendations, and post-filing dismissals for multiple
offense types in each of the two participating jurisdictions. At each decision
point, they analyzed the impact of legal, quasi-legal, and extra-legal factors
on case outcomes and examined how prosecutors weighed these factors in their
decision making. The research was guided by the following questions:
1. How did prosecutors define and apply the concepts of justice and fairness?
2. What factors were associated with prosecutorial outcomes at each stage?
3. How did prosecutors interpret and weigh different case-specific factors in making
decisions at each stage?
4. How did contextual factors constrain or regulate prosecutorial decision making? This
document is a research report submitted to the U.S. Department of Justice. This
report has not been published by the Department. Opinions or points of view expressed are those of
the author(s) and do not necessarily reflect the official position or policies of the U.S. Department of
Justice.
5. How consistent were prosecutors’ decisions across similar cases? What case-level
and contextual factors influenced the degree of consistency?
Read The entire Executive Summary


 

Footprints at Crime Scenes-- CSIs Need to Tread Carefully

Guest Article

ScienceDaily (Oct. 26, 2012) — A new computer algorithm can analyze the footwear marks left at a crime scene according to clusters of footwear types, makes and tread patterns even if the imprint recorded by crime scene investigators is distorted or only a partial print.

Footwear marks are found at crime scenes much more commonly than fingerprints, writes a team from the University at Buffalo, New York, in a forthcoming issue of the International Journal of Granular Computing, Rough Sets and Intelligent Systems. They point out that while footprints are common they are often left unused by forensic scientists because marks may be distorted, only a partial print may be left and because of the vast number of shoe shapes and sizes. However, matching a footprint at a crime scene can quickly narrow the number of suspects and can tie different crime scenes to the same perpetrator even if other evidence is lacking.

The team, Yi Tang, Harish Kasiviswanathan and Sargur Srihari, has developed a way to group recurring patterns in a database of footwear marks to that the clustered data can be searched and compared to suspect prints much more quickly than by other techniques whether manual or computer-based. The team explains that geometric shapes including line segments, circles and ellipses can be the focus and allow the footwear to be quickly identified using an "attributed relational graph" or ARG. The attributes for every shape are defined in a way to provide scaling, rotation and translation invariance, the researchers explain. The team adds that the introduction of a measure of how different two marks might be, which they refer to as the footwear print distance (FPD) allows them to home in on a particular boot or shoe even if the recorded print is noisy or degraded perhaps by perpetrator retracing their steps or other marks present at the scene.

The researchers have successfully tested their approach against the currently used footwear print retrieval systems used in forensic science. "In experimental runs our system has significantly higher accuracy than state-of-the-art footwear print retrieval systems," Tang says.

Learn when new posts are made:  Sign Up for Email Alerts

Digital Detectives – Expert Witness Testimony Video

Disclosure requirements for expert witnesses and written reports under

Federal Rule of Civil Procedure Rule 26.

 No part of this recording should be considered legal advice.

 Expert Witness Testimony Video

 

 

 

 

 

 

 

 

 

To be notified when new posts are made to this blog - Signup for Email Alerts

 

Digital Evidence – From Crime Scene to Court Room Part 1

Introduction

Evidence Collection Constraints

Keeping up with the criminal element is an on-going challenge for the legal system in the USA. As more and more fantastic advances are made in digital technology, the cyber-criminal seems to grasp this new technology and adapt it to illegal use before the criminal justice participants have the opportunity to study and understand it.

The front line law enforcement agencies, prosecutors, and judges are often overwhelmed by the amount of information required to keep pace with the ever-evolving changes involving computers and their associated hardware, software and operating characteristics. The criminal element continually alters, revises, or creates hardware, software, viruses, malware, and other attacks in an effort to mask criminal activity and prevent detection. As if keeping up with digital technology isn’t enough, the criminal justice system must keep pace with the latest revisions and modifications of existing laws and push legislatures and the congress to create new laws as each new cyber-threat appears.

While computer technology has been with us for nearly 60 years, our problems really began in the late 1980s. An example of how this technology has leap-frogged along includes child pornography cases where evidence appeared mostly in underground magazines consisting of photographs, 8mm film and videotapes. But in the mid-1990s, the Internet began its evolution and brought with it significant change. Now it is unusual to find child pornography that involves anything other than digital images and hardcopies of those images.

Once the province of “computer crime” such as hacking, digital evidence is now found in virtually every crime category. But all too often law enforcement agencies and the judicial system are ill-prepared to deal with the issues created by the increasing use of cyber-technology.

Specially trained and experienced investigators should not assume that prosecutors fully grasp the problems they encounter in the recovery and analysis of digital evidence. Thus… the burden for education must be borne equally by prosecutors, investigators, and examiners who are obliged to share their knowledge of the technical complexities and map strategies.

 Search and Seizure

The collection of digital evidence in criminal cases falls under the Federal and State levels by myriad constitutional and statutory requirements, including those laws regulating the communications and computer industries and that directly detail the collection and use of digital evidence. Previous court decisions and procedural rules established to implement them also need to be included.

The Privacy Protection Act (PPA) (42 U.S.C. § 2000aa et seq.) limits law enforcement’s use of a search warrant to search for or seize certain materials possessed for the purpose of public dissemination. The protected materials may be either “work products” (i.e., materials created by the author or publisher) or “documentary materials” (i.e., any materials that document or support the work product).

For example, a person who is creating an online newsletter may possess interview notes that could be considered “documentary materials”; the text of the newsletter to be published could be considered a “work product.”

If the material is covered by PPA, law enforcement cannot use a search warrant to obtain it.

PPA’s prohibition on the use of a search warrant may not apply when:

• Materials searched for or seized are “fruits” or instrumentalities of the crime or are contraband.
• There is reason to believe that the immediate seizure of such materials is necessary to prevent death or serious bodily injury.
• There is probable cause to believe that the person possessing the materials has committed or is committing a criminal offense to which the materials relate. (Except for the possession of child pornography and certain government information, this exception does not apply where the mere possession of the materials constitutes the offense.)      

Of course, the criminal justice system must also consider constitutional issues as well. Searches for digital evidence, like searches for other forms of evidence, are subject to the constraints of Federal and State constitutional search and seizure laws and court rules. Traditional Fourth Amendment principles, such as those governing closed containers, apply to digital evidence.

Additionally, there is the issue of privileged information:

In some instances, law enforcement may have reason to believe that the place to be searched will contain information that is considered “privileged” under statute or common law (e.g., the office of a lawyer, health professional, or member of the clergy). Before drafting a warrant and conducting the search, law enforcement should take care to identify and comply with the legal limitations that the jurisdiction may impose. Law enforcement also may wish to:  

• Consider the use of taint teams (also known as privilege teams), special masters, or another process, as approved by the court.
• Consider in advance whether the media to be seized contain privileged or proprietary information.
• Consider obtaining a stipulation before seizing information from the target to avoid confiscating potentially privileged or proprietary information. (See appendix D, “Stipulation Regarding Evidence Returned to the Defendant,” for an example.)
• To avoid tainting the acquisition of evidence, ensure that the prosecution team addresses the issue of privileged or proprietary information when drafting the search warrant.

Handling traditional forms of physical evidence has resulted in specific guidelines that have been a part of crime scene protocol for a considerable time, but maintaining the integrity of digital evidence throughout the examination procedure presents different problems. Some common problems are further complicated by the complexity of networked computers. This text assumes that the seized media contains relevant information and that the forensic procedures used to examine that media have not altered the evidence from the time it was seized. After seizure, ensuring that the traditional chain of custody remains unbroken is necessary but not sufficient to establish the authenticity of the data or evidence obtained from the forensic examination. Additionally… the traditional chain of custody and its associated precautions may be required for examining digital evidence.

An additional concern is that the examination of digital devices be accomplished through the use of tools recognized and accepted by the forensic community. Because the process used to acquire the data is itself electronic, both the evidence and the process may be subject to legal challenges. Additional expert testimony may be required to authenticate the machine, applications, and forensic tools.

Both for purposes of admissibility and persuasive value of digital evidence, the prosecutor must show to the court that the information obtained from the media is a true and accurate representation of the data originally contained in the media, irrespective of whether the acquisition was done entirely by law enforcement or in part or entirely by a third party of civilian origin.

Thorough and accurate documentation of the evidence is critical. It is essential to establish both admissibility … and the persuasive force of the evidence. A well-documented case is much more likely to result in a guilty plea, saving valuable prosecutorial and court resources. (Previous test) describes the information that law enforcement should gather to document what happened with respect to the data before seizure. Law enforcement also must thoroughly document its own actions with respect to the data. Documentation should include the steps taken to acquire, examine, and store the data.

With respect to examination notes, keep the following in mind:

• Comply with agency policy with regard to preparation and retention of notes.
• Be aware that retained notes and other records may be discoverable. The prosecutor must be notified and given an opportunity to review them.
• Do not commingle notes from different cases.

Italicized segments in this article are verbatim from the NIJ Manual, “Digital Evidence in the Courtroom: A Guide for Law Enforcement and Prosecutors.”

 To keep up to date on new posts to this blog: Sign up for Email Alerts        

   

BloodTips-05 – BLUESTAR FORENSIC KIT

Introduction

New to SIRCHIE's line of Blood Search Reagents! The BLUESTAR Forensic Kit affords the crime scene investigator a complete tool to determine the presence or absence of blood. The extreme sensitivity of BLUESTAR allows the detection of bloodstains down to 1:10,000 dilutions, including minute traces that have been visibly washed off, with or without detergent. (Tub with blood stains)

 Unlike other blood reagents, total darkness is not always required. Subsequent DNA Profiling and ABO Typing is possible because BLUESTAR does not alter the DNA in suspect blood stains.

Reaction-False Positives

When reacting with blood, the BLUESTAR® FORENSIC latent bloodstain reagent emits an intense blue-white chemiluminescence in the range of 420 to 440 nanometers. Keep in mind, however, that "false" positives may occur due to the presence of many common household detergents, chlorine (from bleach), certain paints and varnishes, copper (from plumbing), certain iron-metabolizing plants like lichens, thyme and some tree mosses, and certain soils rich in iron. 

Such "false" reactions are easily identifiable by the trained technician because their color, brightness, and duration of chemiluminescence differs from those of the typical reaction from blood. Typically, "false" reactions offer markedly dimmer chemiluminescence and are whiter in color. "False" reactions due to chlorinated detergents are often worth a second look, because they may reveal attempts to wash or clean up bloodstains, and to conceal crimes of violence. 

Photography

Photography of latent blood prints developed and visualized from chemiluminescence is not fundamentally different from regular daylight photography. The same basic elements of photography apply: subject lighting, ISO setting, aperture setting, and shutter speed) interact in exactly the same way. Photography of BLUESTAR® FORENSIC detected blood prints is easy and produces excellent results. 

Equipment

The chemiluminescence produced by the reaction of the BLUESTAR® FORENSIC latent bloodstain reagent to blood is bright enough that, most often, no special equipment is needed. However, relatively long exposures may be needed for maximum photo quality and a tripod and flexible cable release are highly recommended in order to maintain stability of the camera, which must remain motionless during the time of the exposure. A wide-angle lens is recommended. 

Use at the Crime Scene

BLUESTAR offers different kits so by all means follow the specific recommendations supplied with the kit you will be using. Shelf-life of BLUESTAR after mixing is limited to a maximum of 24 hours. When mixing the tablets in the carrier solution, do not shake or invert the sprayer. Rather… swirl the sprayer until the tablets are dissolved.  (Blood Print on Tile ===>)

Safety Precautions

As with handling any chemical, use Best Practices during the application of the spray. Wear latex gloves, safety glasses or goggles, dust respirator and protective clothing.                                                                                                                            

Final Word

Chemical field tests are considered “Presumptive” in determining the nature of the substance tested. None of the bloodstain reagents explained in this, or preceding articles in this series of “BloodTips” offer definitive proof that the tested substance is blood. The final determination must be made in the crime laboratory. Best practices and agency protocol dictate that samples of the substance tested are to be collected for scrutiny in the lab. 

To receive notification when new articles are posted on this blog: Sign up for Email Alerts

 

“Like” us on Facebook                                             Watch the BLUESTAR Video

 

Basic Stages for a Crime Scene Investigation—Possible Homicide

By: Don Penven

Approaching the Scene:

The crime scene investigator returns the microphone to its clip and begins the drive to the latest assignment.  A crime scene investigation begins well before the CSI enters a structure, an open field   or wooded area. Usually the radio dispatch message is brief and seldom reveals the full nature of the incident. Most often this is done to avoid drawing on-lookers and the media who may be monitoring the dispatch frequency. As the CSI turns onto the street in question, his first obligation is to “turn on” his powers of observation. He may make a mental note of what he sees, hears and smells—or better still—records them on a digital voice recorder. His first reaction to the scene must be, “Does anything look out of place? What odors may be noticeable and are there unusual sounds.

Secure and Protect the Scene

Hopefully the first responders haven’t caused too much disruption to any potential physical evidence. Before even stepping inside the structure, ingress and egress to it must be controlled. Sentries at all possible entrances should be put in place. The CSI, after learning the basic facts—in this case it appears that a white male appears to have a single bullet wound the head and rigor has set in-- this from the first responders, so the CSI will establish the boundaries of the crime scene. Then… out comes the crime scene tape.

 Initiate Preliminary Survey

Again… before entering the structure an exterior survey is needed. This may be nothing more that walking around the exterior of the structure to see if any obvious evidence is apparent. This would include open windows, damaged doors, ladders and the like. The question the CSI is asking is… how was entry made to the structure?

Once indoors, the CSI will make a visual survey of the actual room in which the incident reported took place. This is a good time to also take overall photos of the scene. He will then survey adjoining rooms to determine if these spaces may have information relative to the incident.

Most law enforcement agencies conduct such investigations of an unattended death (no physician present) as a possible homicide—until it is determined otherwise.

Unlike some TV dramas, the CSI is on site for the purpose of finding, evaluating and collecting physical evidence. In most agencies, statements from witnesses and survivors are handled by the investigators/detectives.

Of course, during this entire survey period, the CSI is taking notes and/or recordings of his sensory observations.

Evaluate Physical Evidence Possibilities

The very nature of what appears to be obvious should trigger the thought-processes of the CSI. What happened here, when did it happen and what sort of evidence should be present? Questions that should be answered initially are:

• Did the shooting occur in this room
• Has the body been moved (by first responders or perpetrator(s)
• Has any object been moved (especially by first responders or family members
• Were additional shots besides the one in the victim’s head. This means examining walls, ceiling, room objects, etc.
• Are shell casings apparent. If so—mark them with placards, evidence tents, etc. so they will be obvious in photos.
• Are traces of blood apparent in other areas of the room—indicating movement of the victim
• Is blood spatter apparent
• Are there signs of a struggle
• Are there visible footprints in the blood

Each crime scene may well generate other questions to be answered by the CSI. The above list is simply the most obvious questions.

Prepare a Narrative of the Scene

The CSI’s notes can serve as a very critical part of the overall physical evidence available from the scene. The investigator must keep in mind that months or even years later this case may go to trial. Your notes must present the full story of what you saw and any impressions the evidence gave you. Avoid speculation as to what occurred unless you have physical evidence to back it up. 

Capture the Scene Photographically

Be certain to have overall, medium range and close-up shots of any potential physical evidence. Be certain to include scales in the close-up shots. 

Prepare the Crime Scene Sketch

Many CSIs will prepare the rough sketch at the scene and will complete a detailed sketch back at headquarters. The rough sketch should contain no more or no less than the final, detailed sketch. It is always recommended that an assistant help out when taking measurements, and it’s a good idea is to have this individual verify each measurement to avoid questions later. 

Conduct a Detailed Search

Go over every square inch of the scene in an attempt to locate even the smallest particle of evidence. (This brings to mind a recent case wherein a woman was brutally beaten to death in her bedroom. Several days after the crime scene was released to the family, the victim’s sister found a tooth from the victim on the bedroom carpet).

Many crime scenes warrant the use of an evidence vacuum in the scene to collect any potential microparticle evidence such as hair and fibers. This step should be performed prior to any close in inspection of the victim. 

Record and Collect Physical Evidence

As potential evidence is located it should be recorded on the crime scene sketch as well as in photographs. If your agency offers the luxury of having a videographer on hand, video often tells a compelling story to a jury.

Crime scene evidence is useless unless it is properly marked and packaged and a Chain of Evidence is begun from the time it is picked up. Use the proper type of containers for all evidence collected. Never package objects wet with blood or other physiological fluids in plastic bags, as this will accelerate decomposition. Label and identify all evidence collected, including the notes taken by the investigator.

Of course, the digital age we live in takes note of electronic devices like computers and cellphones.  This type of evidence requires special handling and only experts trained in working with digital items should be permitted to handle and collect these items. 

Conduct a Final Survey

Be certain that every package containing physical evidence is collected—leave nothing behind. Make a final walk-through to be certain that all potential evidence is bagged and tagged. 

Release the Crime Scene

While it is normal for others having an interest in the property to want to regain access, the CSI should not be rushed, coaxed or bullied into releasing the scene until the job is done.

This website is populated with articles of interest to the law enforcement community and we encourage your feedback. Use the Comments Section below to give us your personal impressions of the information contained here. 

To learn when new posts are published: Signup For Email Alerts HERE

Join us on Facebook

Clan Lab – Synthetic Cannabinoids

Toward the end of June, 2012, a joint operation between the Palm Beach County
Sheriff ’s Office (Narcotics) and the DEA Palm Beach Resident Office successfully
raided and dismantled a clandestine laboratory for synthetic cannabinoids.
The following is a series of pictures which have been shared in order to help educate law enforcement across the country on the ease of manufacturing synthetics and some of things you should be watching for in your fight against these labs.

This series of pictures gives you an excellent overview of the simplicity of the lab.
Now for the revenue associated: A typical lab will have an annual cost of $200,000.00 in materials for manufacturing. This translates into $.50 per package of substance.

DOWNLOAD YOUR COPY TO SEE ACTUAL PHOTOS: NARK News Volume 4.

Behavioral analysis in the interrogation room

From Police One (By: John Bowden)

If you fall into the mindless routine of following the “enumerated process” you will miss the subtle hints that take you to the confession

Encarta Dictionary defines behavior as, “The way something behaves.”  Analysis is defined as, “The examination of something in detail in order to understand it better or draw conclusions from it.” Behavioral analysis is simply the observation of behavior and then analyzing that behavior to determine its meaning.  In the process of observing behavior we make the following assumption.  In living organisms there is a “cause” which is the impetus of the “behavior” — that behavior has a “purpose or meaning.”

 In observing this process, we try to determine the connection from “cause” to “behavior” to “purpose or meaning.”  The cause can be initiated either internally or externally.  Hunger would be an internal cause.  This would cause the behavior of seeking food.  The purpose of the behavior is to obtain food for consumption.  An external cause would be a speeding car approaching a person in a cross walk.  The behavior would be to move out of the way.  The purpose would be for survival.  Knowing the cause of the behavior can reveal the internal, mental processing of the subject.  For instance, you inform a subject that you know they are the one that committed the offense.  When we say this, the subject jumps from the seat of the chair and immediately sits back down. That behavior is caused by the adrenaline rush caused by shock of the accusation. The meaning of the behavior helps to confirm that this subject is the perpetrator.

 Behavioral Analysis gives us the “cause” of the “behavior” as well as the “purpose” or the “meaning.”  Knowing the cause and the meaning can guide our investigation. 

The Coordinated Behavioral Response is an investigative philosophy where the investigator responds appropriately to the behavior exhibited by the subject.

Throughout history researchers have studied behavior trying to analyze the cause and effect of human behavior.  It has been studied by researchers in psychology, sociology, criminology, anthropology, management and other fields of study. Behavioral Analysis is used in a variety of occupations.  The business community uses behavioral analysis in the screening of new employees.  They ask business related questions and analyze the responses of the potential employees.  It is used by promotion boards to determine the best candidate for advancement.  Psychologists and psychiatrists use it in the treatment of their patients.  The FBI Behavioral Analysis Unit uses it to evaluate the behavior of psychopathic and sociopathic criminals to determine their personal characteristics to aid in their identification and capture.

Coordinated Behavioral Response

In interviews and interrogations the classic use of behavioral analysis is to determine the truth or deception of a subject’s responses.  If a person is telling the truth they did not commit the offense.  If they are deceptive they are the perpetrator, had a part in the offense or know the perpetrator.  This is a valuable tool in the arsenal of the investigator — it is only one of many uses of behavioral analysis.  The analysis of a person’s behavior tells us more than if they are guilty or innocent. A subject’s behavior informs us of the subject’s state of mind — do they like or dislike us — do they like or dislike other people in the case: are they holding back — are they ready to confess — are they trying to make an admission — are they ready to or want to leave — as well as other states of mind.  This knowledge of their state of mind can guide us in our response to their behavior.  Our response is specifically calculated to match up with the subject’s mental state in order to obtain the information about the case leading to its resolution.  This response is called a Coordinated Behavioral Response. 

In the interview and interrogation process we are taught to start at the interview of the victim and progress to the confession.  The interview or the interrogation is not a set of defined steps you must follow.  There are critical stages you should recognize and respond to in a particular fashion.  However, they do not always occur in a particular order.  The subject of “Interviews and Interrogations” is often taught as an “enumerated process”, usually beginning with the interview and progressing to the confession.  Many texts and articles on interviews and interrogations have been written about these ordered processes, putting them in steps, stages, phases, segments, levels, parts, periods, chapters, divisions or ordered tasks. 

In fact, this type of instruction will start off with an introduction stating the number of steps in the process.  For example: “The interview and interrogation process consists of (5, 7, 9, 11 or whatever number of steps).” 

This is usually followed by giving each step a name.  The instruction will start at step 1 and take you through the ordered process.  In her research, Ellen Langer has shown the learner will subconsciously adhere to this proscribed, ordered list, not recognizing that any of these stages can occur at any time during the interview or interrogation. This learned process hinders the investigator’s ability to adapt to irregularities or variances in the interview process. The investigator should recognize there is not one ordered process to be followed — instead, there is a myriad of potential possibilities that might occur. The investigator must be prepared to respond appropriately to the behavior that is presented by the subject. The investigator does not try to force an “enumerated process” but instead responds with a “Coordinated Behavioral Response.”

 The “Coordinated Behavioral Response” is the recognition of the subject’s behavior and then responding in a fashion designed to move the investigation to its resolution, a confession.  The response is one that is correct for the behavior that is observed.  The investigator is always working to move the subject to the confession.  However, the investigator must respond correctly to the subject’s behavior. 

For instance, you sit down to interview a subject in a theft case.  The status of the subject is as of yet undetermined. The subject may be a witness, an uninvolved employee or the perpetrator of the theft. Initially you may be prepared to conduct an exploratory interview to determine the subject’s possible involvement. When you introduce yourself, the person goes into the confession position and starts crying. Using the “Coordinated Behavioral Response” you would recognize this and respond accordingly, without any intervening steps.  Suppose the same person made a small admission, apologizing for the missing money.  Again, using the “Coordinated Behavioral Response” you would respond to the admission.  Perhaps during the initial interview the person behaves erratically, displaying the mannerisms that indicate deception.  Using the “Coordinated Behavioral Response” you would respond by moving into a subject identification interview that will reveal the subject is lying and is the perpetrator.  From there you may move to the interrogation or return after interviewing other subjects associated with the case. 

In another scenario, you enter the room and introduce yourself.  You explain to the subject why they are there and you would like to chat with them about what happened.  As the conversation begins, the subject starts to make excuses for what has happened, emphasizing it could happen to anyone.  You recognize this person has moved into the beginning of the interrogation phase.  The difference to the normal model is that the subject is introducing the interrogation strategy, as opposed to you introducing it.  Using the “Coordinated Behavioral Response” you should recognize the beginning of the interrogation strategy, regardless of who started it.  You would respond appropriately, agreeing with the subject that these things happen, taking their side and continuing on with the strategy the subject has selected.  This would naturally lead to an admission and on to confession — or it may go immediately to the confession. 

Be Vigilant for Subtle Signals

In the “Coordinated Behavioral Response” process you respond according to the stage the subject has presented.  The important point to remember is to avoid being trapped in a mindless process where you first do “A,” then “B,” then “C,” and so on.  If you fall into the mindless routine of following the “enumerated process” you will miss the subtle hints that take you to the confession.  An episode of COPS I once saw offers an example for consideration.  An undercover drug squad move in and serve a search warrant on group of drug dealers in a house.  The search warrant was for a large cache of drugs being stored in the house.  The team moved in with cool precision.  It was early in the morning and all of the occupants of the house were asleep — some in the bedroom and others in the living room. 

The ring leader of the group was a woman I will call “Maggie.”  After the team entered and secured the scene, they moved everyone to the living room.  As they searched they were able to only find a small amount of drugs, not near the amount they were looking for.  While the team was searching the team leader was talking to the subjects in the living room, particularly to Maggie.  She claimed to have no knowledge of any drugs.  The team leader refused to believe her and began to accuse her, telling her he knew she was dealing, he knew she had a “bunch” of drugs hidden in the house.  He went on to state she could not fool him — he knew what was going on.  Maggie was standing handcuffed in the living room. 

The team leader was pacing back and forth as he ranted not closely watching Maggie.  As he continued to speak and accuse Maggie, she gave a big sigh, her face went to a sad expression, and her head dropped forward.  Her shoulders drooped and she began to nod her head in agreement to what the team leader was saying.  He continued on, not picking up on her confession position and expression of submission.  As he continued, Maggie straightened up, the sad expression gone. 

The team arrested Maggie and the other members of the group for drug possession and a number of other charges they had already established in previous buys.  The big cache was never found. In the post interview on camera the team leader was disappointed he did not get the large amount of drugs he had hoped for, but considered it a success because of the arrests that were made.  I find this to be an example of mindless procedure on the part of the team leader.  He was not in an interrogation room — he had not established the interrogation process and therefore missed the confession position of Maggie.  Had he been attuned to her behavior and responded to her with a “Coordinated Behavioral Response,” I feel he could have obtained a confession from Maggie and possibly the location of the drugs. 

As you speak to the subject, monitor the subject’s behavior, determine their stage in the process and respond with the appropriate “Coordinated Behavioral Response.”  Remember, “The correct behavioral response will cause the subject’s poor tortured soul to pour out on the table in front of you.” 

My new book “Interview to Confession, The Gentle Art of Interrogation” presents the methods to establish a rapport and guide the person to a confession.  It presents a new concept called the “Coordinated Behavioral Response,” a method that gets away from the standard stepped investigative process currently taught and used today.  The “Coordinated Behavioral Response” is an investigative philosophy where the investigator responds appropriately to the behavior exhibited by the subject, whether they are a victim, witness or suspect, to gather information and solve a case.

PoliceOne Article

To receive notice when new articles are posted: Sign Up For Alerts

Join US on Facebook

 

Forensic Scientist Tracks the Crime Scene Invaders

FORENSIC ENTOMOLOGY 

Forensic Scientist Tracks the Crime Scene Invaders

ScienceDaily (May 11, 2012) — Marks on a dead body could indicate violence and therefore murder. But they might have been made by legions of insects. A forensic scientist has built up data that will be a big aid to detectives faced with investigating gruesome discoveries.

A forensic scientist is unmasking the planet's tiniest criminals -- minute creatures who contaminate crime scenes and threaten to throw detectives off the scent.

Italian-born Dr Stefano Vanin, who lectures at the University of Huddersfield in the UK, is making valuable discoveries which will enable crime scene investigators to determine whether injuries to a body or damage to a corpse's clothing were caused by a human killer... or were the work of insects which moved in after death had taken place.

Very often, says Dr Vanin, tiny creatures can cause lesions to a dead body which closely resemble injuries left by a human assailant. For example, ants which clamber over a corpse's face can deposit marks which mimic the effects of a punch.

It is vital that detectives are quickly able to separate post-mortem insect damage from wounds that were caused before death by a killer.

Dr Vanin is building up a body of knowledge about the various ways in which insects can distort crime scenes and he reports on some of his latest findings in the journal Forensic Science International. This time he investigates the damage caused to dead bodies that are found underwater, where they are preyed on by aquatic creatures.

It was the retrieval of the body of a 28-year-old man in the River Brenta, at Padova in Italy, that provided Dr Vanin with the opportunity to add another piece to his jigsaw of knowledge.

The man had drowned -- witnesses had seen him struggling in the water -- and there were no signs of injury on the body. But during the autopsy a series of small abrasions in the upper eyelids were discovered.

These were caused by large numbers of amphipods -- tiny, eyeless crustaceans which had been feeding on the body and were discovered when the corpse was pulled out of the water.

This enabled Dr Vanin and his colleagues to analyse and record the post-mortal damage caused by the amphipods. The marks were very similar to those deposited by ants on dry land.

As a result, when detectives and forensic scientists are examining future corpses recovered from fresh water, they will have data which will help explain unusual markings on the body.

Get notification when new posts are made: Sign Up for Email Alerts

JOIN US ON FACEBOOK

US Cyber Chief Accuses China of Targeting Pentagon

Reuters: 10/1/2012

Cyber Command intelligence chief says attacks accelerating

* Plans under way to promote Cyber Command to top-level unit

 * China accused of seeking to "exfiltrate" Pentagon secrets

 By Jim Wolf 

WASHINGTON, Sept 27 (Reuters) - The U.S. Cyber Command's top intelligence officer accused China on Thursday of persistent efforts to pierce Pentagon computer networks and said a proposal was moving forward to boost the cyber command in the U.S. military hierarchy.

"Their level of effort against the Department of Defense is constant" while alleged Chinese attempts to steal corporate trade secrets has been growing, Rear Admiral Samuel Cox, the command's director of intelligence, told Reuters after remarks to a forum on the history of cyber threats.

 The Office of the National Counterintelligence Executive, a U.S. intelligence arm, said in a landmark report a year ago that "Chinese actors are the world's most persistent perpetrators of economic espionage."

 "It's continuing apace," Cox said. "In fact, I'd say it's still accelerating." He accused China of trying to "exfiltrate" Pentagon secrets, jargon for sneaking them out.

 Asked whether any classified U.S. networks had been successfully penetrated - something not publicly known to have occurred - Cox replied: "I can't really get into that."

 A spokesman for the Chinese embassy did not immediately respond to a request for comment. In the past Chinese officials have denied such accusations.

 Cyber Command is responsible for defending Defense Department networks as well as mounting any U.S. offensive operations in cyberspace. It was created about two years ago as a unit of the U.S. Strategic Command, the outfit responsible for U.S. nuclear and space operations.

 Cox said a proposal was moving forward to elevate the cyberwarfare unit to the status of a full unified combatant command. This would put it on the same footing as its parent Strategic Command and the Defense Department's eight other top-level military units.

 The matter was headed to the secretary of defense and the president for a decision that possibly would come by the end of the year, he said.

 Cox spoke after telling a conference hosted by the Atlantic Council think tank that the overall sophistication and danger of cyber threats is increasing at "an accelerating rate, not a linear rate."

 "So the potential for these things to do destructive damage is very high," he said.

 The United States is among the few countries reliably reported to have mounted a destructive keyboard-launched attack - against Iran's disputed nuclear centrifuges using malicious code known as Stuxnet that surfaced in 2010.

 Army General Keith Alexander, who simultaneously heads Cyber Command and the National Security Agency, told a forum in July that unspecified foreign countries, hackers and criminal gangs contributed to a 17-fold jump in cyber attacks on U.S. infrastructure from 2009 to 2011.

 Promoting Cyber Command in the military hierarchy would simplify its operations in cyberspace and boost its ability to work directly with U.S. government agencies, allies and coalition partners.

Young Criminals Leave Digital Clues

Article Source

These days, even entry-level cellphones come standard with a decent digital camera and basic Internet access. That makes it easy to update your Facebook status or share pictures and video with family and friends in a matter of seconds. 

But that convenience can lead to trouble, too -- particularly among teenagers and young adults who don't consider the consequences of their actions beforehand. 

It's something that Chuck Hagen, a longtime Tippecanoe County deputy prosecutor, witnesses often. 

"The younger crowd uses technology to its fullest extent, including the criminal aspect," he said. "... Everything is so easily recorded, so easily transferred, so easy to use. 

"When I was in high school, it would take half an hour to load a photo. Now they just snap pictures of everything and share, at little cost." 

Take, for example, the two former Faith Christian School students, ages 13 and 14, who admitted sexually assaulting a 13-year-old girl last April in a wooded area near school property. Both were sentenced to an Indiana Department of Correction facility for youth. 

According to court records, prior to the sexual assault, the 14-year-old took a photo of the victim topless, and without her knowledge, in December 2011. He then shared the digital image with other juveniles and used it to blackmail the girl for four months. 

The same boy also recorded the April sexual assault, which lasted 45 minutes, and later watched it with other juveniles. 

Technology did not prompt the crimes, but it played a key role in the blackmail and subsequent police investigation and prosecution. 

The boy's behavior and actions fall under what the U.S. Department of Justice calls cybercrime, described as using a computer as a target, a weapon or an accessory. 

According to the National Crime Prevention Council, it's just as important for parents, schools and caregivers to teach children about "cyberethics" as it is to protect them from Internet-related crimes. 

"While youth who commit cybercrimes may realize that their actions are wrong, they may not know that their Internet behaviors are illegal," an article on the organization's website states.

 Where all can see

With his office computer, Hagen recently shared how he can easily pull up Facebook pages for juvenile defendants he has prosecuted. Often the photos he uncovers can be used in court as evidence.

 

Hagen displayed the Facebook page of a Lafayette, Ind., boy whose cover photo is of him pointing a black handgun directly at the camera. 

"Not only did he put that out there where I could see it, but he's sharing that with the world," Hagen said.

 The most common photos that Hagen has found are of minors consuming alcohol or using drugs. It provides compelling evidence in court when minors insist they've been well-behaved.

 "I can look up almost any kid on Facebook and see all the pictures they uploaded from their smartphone," he said. "Part of the problem is when you have parents who want their kids to be happy at any cost. They want to keep up with the other kids, so they get them fancy cellphones.

 "What I definitely don't see are pictures of kids studying. And they don't realize that once it's out there, it's not going to go away easily."

 As the lead crime scene investigator for the Lafayette Police Department, Detective Paul Huff has received specialized training on evidence recovery from computers and cellphones.

 He's been able to recover everything from hidden child pornography to Internet searches from a cellphone Internet browser. Suspects wrongly assumed that such information had been deleted.

 "Every time people get online, they leave some type of artifact," Huff said. "We basically see it all here."

 Some smartphones, such as iPhones, essentially track every keystroke that a person makes, from chat logs to text messages, Huff said.

 "Just four years ago, it was extremely difficult to get something that was deleted from a cellphone," he said. "Now it's much less difficult, though time consuming."

 Huff also warns that just because something is deleted on the user's end, it can be saved by another party -- for instance, if speaking to someone via video chat.

 So what can parents do? Hagen's best advice is to stay vigilant, even if children protest to phone or computer checks.

 "You may know your kid well, but you will never know all of your kid's friends," he said. "All this technology does make it easy to see what they're up to. ... It's a way to connect with your kids, too, by having them show you how something works."

Cyber Warriors Wanted: Scholarships for Cybersecurity

 

Millions of people depend on the Internet every day and cyber criminals are counting on that,
according to a Kansas State Univ. cybersecurity expert.

"Hackers are performing cyber espionage by gathering information on companies, seeking out national secrets or starting cyber warfare by disabling critical infrastructure," says Xinming "Simon" Ou, associate professor of computing and information sciences.

To help counter the threat, the National Science Foundation has awarded $2.3 million to Kansas State University's department of computing and information sciences to provide scholarships to qualified students interested in becoming cybersecurity and information assurance professionals. A team of computing and information sciences faculty, including Ou, Gurdip Singh, Eugene Vasserman, John Hatcliff and Scott DeLoach, lead the scholarship program.

According to Ou, many systems society uses every day — such as smartphones, online companies, media communications, transportation, electricity and hospital systems — are highly dependent on a very fragile cyber infrastructure that, if hacked into, could be disastrous and shake people's sense of security like a cyber version of Pearl Harbor or 9/11.

"The nation is in dire need of people who are capable of handling the cybersecurity challenges we face," Ou says. "We are lagging behind in the number of experts we have versus the threats we see."

About 6 million attempts are made each day to hack into the U.S. Department of Defense's computers, Ou says. While safeguarding national secrets is a priority, experts also realize that disrupting physical infrastructure is a real possibility.

"It has been shown that by hacking into the computer systems controlling a power generator's turbine, it can set the turbine into high speed until self-destruction," Ou says. "And our power grid in the U.S. is pretty much accessible from anywhere in the world thanks to the Internet."

A newly developed course by the computing and information sciences department, Cyber Defense Basics, uses a contained off-the-grid cybersecurity lab for mock exercises. The lab allows instructors to test students' abilities to defend against cyber attacks without infecting systems outside the lab. It teaches students the basics of cyber defense and how to counterattack.

"The public may not be very aware of how vulnerable we are these days, but the government is," says Gurdip Singh, head of the department of computing and information sciences at Kansas State Univ. "There have been successful incidents where attackers from another part of the world were able to penetrate U.S. financial and government computer systems. That's why training the next generation to counter these attacks is so important. This scholarship program will be a wonderful opportunity for students interested in the field."

Scholarship applicants must be U.S. citizens and will be subjected to background checks. The scholarship package includes a $20,000-$30,000 stipend plus tuition and fees, as well as money for materials and professional development such as attending cybersecurity conferences and trainings. Scholarship recipients are obligated to serve a government agency in a cybersecurity and information assurance position for the equivalent number of years they received the scholarship.

"Cybersecurity is not a pure technical problem; it needs the whole society’s attention and effort to address," Ou says.

The first scholarships will be awarded sometime in 2013.

Source: Kansas State Univ. 

 

 

 

Prevention of Pollution at the Crime Scene

Movies, TV and novels tell us a great deal about forensic science. Some of what we see, hear and read offers  excellent coverage of the topic—but some of it does not. Fictional TV shows and many movies offer just that—fiction. They are crafted with the goal of entertaining the public and not necessarily educating them. The problem is a universal one; if the storyline gets bogged down with factual information, the viewer or reader quickly loses interest.

 The topic covered in this post deals with pollution of the crime scene. Not much film footage is devoted to this problem in the entertainment media. But it is indeed a big problem and if it isn’t dealt with in an intelligent manner, the available physical evidence in the scene may be damaged, compromised or destroyed altogether. 

Many forms of physical evidence are highly fragile like fibers, hairs, blood droplets, DNA and fingerprints. Quite often the crime scenes and the evidence they contain are susceptible to various forms of chemical pollution too.  The most common forms of chemical pollution are:

•             Rain water and snow melt

•             Seawater or water from rivers and streams

•             Dust, dirt, oil and grease tracked in by the building occupants as well as the crime scene team

•             Industrial and household chemicals 

Contamination that arises from natural sources is unavoidable since it was present at the scene before the CSIs arrived. Some contamination, especially that caused by law enforcement can be avoided if not eliminated. 

Some of the pollution that contaminates physical evidence is in the form of contributions made by those individuals present during the processing of the scene. Evidence technicians may contribute their own hair and fibers as they move about. They may have traces of soil, oil or grease on the soles of their shoes. Sometimes agency budgets are stretched to the point that disposable jumpsuits, head and shoe covers aren’t available. 

Something can be done about the law enforcement-induced contamination. The place to begin contamination prevention is in the agency protocols and directives. Any agency that can expect to be called to investigate a crime scene should have written policies covering crime scene security.

 The duty of the first officer or first responder on the scene is to preserve life and property. This would entail administering First Aid where necessary and removing victims from burning buildings. Once these steps are accomplished, then the scene must be secured. This means blocking access to the scene by anyone not essential to the evidence collection mission. Guards must be placed at all possible points of entry and an access log should be maintained showing who was permitted in and the time of access.

 Avoiding crime scene pollution is the task of every individual entering the scene. This is a good reason why the audience present must be limited. Too many high profile cases have been lost in court due to limited or useless physical evidence.

Nitol Virus Found by Microsoft in Counterfeit OSs

Source: The Associated Press, Richard Lardner

A customer in Shenzhen, China, took a new laptop out of its box and booted it up for the first time. But as the screen lit up, the computer began taking on a life of its own. The machine, triggered by a virus hidden in its hard drive, began searching across the Internet for another computer.

 The laptop, supposedly in pristine, super-fast, direct-from-the-factory condition, had instantly become part of an illegal, global network capable of attacking websites, looting bank accounts and stealing personal data.

 

For years, online investigators have warned consumers about the dangers of opening or downloading emailed files from unknown or suspicious sources. Now, they say malicious software and computer code could be lurking on computers before the bubble wrap even comes off.

 The shopper in this case was part of a team of Microsoft researchers in China investigating the sale of counterfeit software. They received a sudden introduction to malware called Nitol. The incident was revealed in court documents unsealed in a federal court in Virginia. The records describe a new front in a legal campaign against cybercrime being waged by the maker of the Windows operating system, which is the biggest target for viruses.

 The documents are part of a computer fraud lawsuit filed by Microsoft against a web domain registered to a Chinese businessman named Peng Yong. The company says the domain is a major hub for illicit Internet activity, home base for Nitol and more than 500 other types of malware, which makes it the largest single repository of infected software that Microsoft officials have encountered.

 Peng, the owner of an Internet services firm, said he was not aware of the Microsoft suit. He denied the allegations and said his company does not tolerate improper conduct on the domain, 3322.org. Three other unidentified individuals accused by Microsoft of establishing and operating the Nitol network are also named in the suit.

 What emerges most vividly from the court records and interviews with Microsoft officials is a disturbing picture of how vulnerable Internet users have become, in part because of weaknesses in computer supply chains. To increase their profit margins, less reputable computer manufacturers and retailers may use counterfeit copies of popular software products to build machines more cheaply. Plugging the holes is nearly impossible, especially in less regulated markets such as China, and that leaves openings for cybercriminals.

 "They're really changing the ways they try to attack you," said Richard Boscovich, a former federal prosecutor and a senior attorney in Microsoft's digital crimes unit.

 Distance doesn't equal safety. Nitol, for example, is an aggressive virus found on computers in China, the United States, Russia, Australia and Germany. Microsoft has even identified servers in the Cayman Islands controlling Nitol-infected machines. All these compromised computers become part of a botnet, or collection of compromised computers; it's one of the most invasive and persistent forms of cybercrime.

 Nitol appears poised to strike. Infection rates have peaked, according to Patrick Stratton, a senior manager in Microsoft's digital crimes unit who filed a document in the court case explaining Nitol and its connection to the 3322.org domain.

 

For Microsoft, pursuing cybercriminals is a smart business. Its Windows operating system runs most of the computers connected to the Internet. Victims of malware are likely to believe their problems stem from Windows instead of a virus they are unaware of, and that damages the company's brand and reputation.

 But more than Microsoft's image is stake when counterfeit products are tainted by malware that spreads so rapidly, Boscovich said. "It's more than simply a traditional intellectual property issue," Boscovich said. "It's now become a security issue."

 The investigation by Microsoft's digital crimes unit began in August 2011 as a study into the sale and distribution of counterfeit versions of Windows. Microsoft employees in China bought 20 new computers from retailers and took them back to a home with an Internet connection.

 They found forged versions of Windows on all the machines and malware already installed on four. The one with Nitol, however, was the most alarming because the malware was active.

 "As soon as we powered on this particular computer, of its own accord without any instruction from us, it began reaching out across the Internet, attempting to contact a computer unfamiliar to us," Stratton said in the document filed with the court.

 The laptop was made by Hedy, a computer manufacturer in Guangzhou, China, according to the court records. The company, reached by phone, declined to answer questions.

 Stratton and his colleagues also found Nitol to be highly contagious. They inserted a thumb drive into the computer and the virus immediately copied itself onto it. When the drive was inserted into a separate machine, Nitol quickly copied itself on to it.

 Microsoft examined thousands of samples of Nitol, which has several variants, and all of them connected to command-and-control servers associated with the 3322.org domain, according to the court records.

 "In short, 3322.org is a major hub of illegal Internet activity, used by criminals every minute of every day to pump malware and instructions to the computers of innocent people worldwide," Microsoft said in its lawsuit.

 Peng, the registered owner of 3322.org, said he has "zero tolerance" for the misuse of domain names and works with Chinese law enforcement whenever there are complaints. Still, he said, his huge customer base makes policing difficult.

 "Our policy unequivocally opposes the use of any of our domain names for malicious purposes," Peng said in a private chat via Sina Weibo, a service like Twitter that's very popular in China. "We currently have 2.85 million domain names and cannot exclude that individual users might be using domain names for malicious purposes."

 Peng is the founder and chief executive of Bitcomm, a company he and his wife own. They founded an earlier company, which started 3322.org in 2001. Bitcomm took over the domain in 2007.

 Past warnings by other online security firms have been ignored by Peng, according to Boscovich. 3322.org accounted for more than 17 percent of the world's malicious web transactions in 2009, according to Zscaler, a computer security firm in San Jose, Calif. In 2008, Russian security company Kaspersky Lab reported that 40 percent of all malware programs, at one point or another, connected to 3322.org.

U.S. District Judge Gerald Bruce Lee, who is presiding in the case, granted a request from Microsoft to begin steering Internet traffic from 3322.org that has been infected by Nitol and other malwares to a special site called a sinkhole. From there, Microsoft can alert affected computer users to update their anti-virus protection and remove Nitol from their machines.

 Since Lee issued the order, more than 37 million malware connections have been blocked from 3322.org, according to Microsoft.

 Associated Press researcher Fu Ting in Shanghai contributed to this report.

Meth Labs - Part 2

Video provided by Police Officers Safety Association, Courtesy of Officer.com

Meth Labs - Part 1

Video supplied by Police Officers Safety Association, Courtesy of Officer.com

Digital Evidence and Forensics

National Institute of Justice (NIJ)
 

Computers are used for committing crime, and, thanks to the burgeoning science of digital evidence forensics, law enforcement now uses computers to fight crime.

Digital evidence is information stored or transmitted in binary form that may be relied on in court. It can be found on a computer hard drive, a mobile phone, a personal digital assistant (PDA), a CD, and a flash card in a digital camera, among other places.[1] Digital evidence is commonly associated with electronic crime, or e-crime, such as child pornography or credit card fraud. However, digital evidence is now used to prosecute all types of crimes, not just e-crime. For example, suspects' e-mail or mobile phone files might contain critical evidence regarding their intent, their whereabouts at the time of a crime and their relationship with other suspects. In 2005, for example, a floppy disk led investigators to the BTK serial killer who had eluded police capture since 1974 and claimed the lives of at least 10 victims.

In an effort to fight e-crime and to collect relevant digital evidence for all crimes, law enforcement
agencies are incorporating the collection and analysis of digital evidence, also known as computer forensics, into their infrastructure. Law enforcement agencies are challenged by the need to train officers to collect digital evidence and keep up with rapidly evolving technologies such as computer operating systems.

NIJ's Electronic Crime Program, which includes the Electronic Crime Center of Excellence, supports the development of tools to assist state and local law enforcement in combating e-crime and collect digital evidence. The program has five main focus areas:

 

Mobile and Cellular Device Forensics Tools

Digital Evidence Investigative Tools

Digital Evidence Analysis Tools

Digital Forensic Training

Digital Forensics Standards and Capacity Building

More detailed information is available at: The National Institute of Justice:

 

 

Digital Evidence Investigative Tools

 

Digital evidence investigative tools are needed to efficiently and effectively collect digital evidence from crime scenes.

On this page, find:

The critical role of first responders in collecting digital evidence

Why traditional forensics techniques are less effective with digital evidence

Types of images captured by digital evidence investigative tools

Digital evidence investigative tools supported by NIJ

The Critical Role of First Responders in Collecting Digital Evidence

As technology advances, so have the knowledge and duties required of law enforcement officers at a crime scene. The scope of evidence to be searched for and collected at a crime scene now includes digital evidence such as cell phones and computer networking devices. Some of these devices might be hidden in ceilings or other locations that are not immediately evident. At the same time, forensics experts face an ever-expanding backlog of digital evidence due to the increased use of computers. Training and preparing first responders to perform preliminary investigations could help reduce the digital evidence backlog and help law enforcement make significant headway into solving a range of crimes, including:

Computer threats

Missing person cases

Fraud cases

Theft

NIJ supports the development of tools that allow law enforcement officers who are not computer experts to conduct basic analysis of digital evidence at crime scenes. Onsite analysis by first responders would speed up initial investigative tasks, reducing the workload of digital forensics experts and allowing them to focus on more in-depth digital evidence analysis.

Why Traditional Forensics Techniques Are Less Effective With Digital Evidence

In the early days of digital evidence collection and analysis, law enforcement officers would confiscate a computer, and then create an exact duplicate of the original evidentiary media — called an image — onto another device. Analysis of the device's image would then be conducted in a controlled setting.

However, some data cannot be recovered once the device is shut down, so law enforcement has moved away from "grab-and-go" tactics. The emphasis is now on capturing as much data as possible at crime scenes while devices are still running.

When dealing with digital evidence, first responders should still observe general forensic and procedural principles, including:

Evidence should not be changed while it is being collected, secured and transported.

Digital evidence should be examined only by those trained specifically for that purpose.

Everything done during the seizure, transportation and storage of digital evidence should be fully documented, preserved and available for review.

Types of Images Captured by Digital Evidence Investigative Tools

Digital evidence investigative tools capture two types of images:

Physical images: Images of passwords stored in memory, whole disk encryption keys, information stored by Windows and other user-related information that may not be stored once volatile memory is flushed upon reboot or shutdown. Physical images hold up better in court as evidence.

Logical images: Information that could be easily viewed by any user, including a list of running processes and programs, screen captures (to document open windows) and graphic files or documents that may be relevant to an open investigation.

Digital Evidence Investigative Tools Supported by NIJ

NIJ supports several digital evidence investigative tools that:

Prevent Data Loss When Seizing Electronic Devices of Interest

Identify Intrusion and Unauthorized Activities

Acquire Data From Networked Computers

Analyze Live Memory

Enhance "At-the-Scene" Digital Analysis Capabilities of First Responders

For more detailed information, visit the National Institute of Justice  

To receive updates on new blog posts, Sign up for Email Alerts

LIKE US ON FACEBOOK

NC State Research On Buried Blow Flies

Help For Crime Scene Investigators

ScienceDaily (Dec. 8, 2011) — When investigating a murder, every clue helps. New research from North Carolina State University sheds light on how -- and whether -- blow flies survive when buried underground during their development. It's an advance that will help forensic investigators understand how long a body may have been left above ground before being buried -- or possibly whether remains were moved from one grave to another.

"Blow flies are probably the most important insects to forensic entomology," says Dr. Wes Watson, a professor of entomology at NC State and co-author of a paper describing the research. "They are usually the first insects to arrive after an animal -- or a person -- has died."

These flies can arrive at a body in less than 10 minutes, and lay their eggs within an hour. These eggs hatch into larvae -- or maggots -- that go through three stages, called instars, before they're ready to turn into adults. Near the end of the third instar, if the body is above ground, the larvae crawl up to 40 yards away from the remains and burrow as much as six inches into the ground to pupate. The pupa is similar to the cocoons used by moths, where the larvae turn into adults. The fully developed fly emerges from the pupa three to five days later and the cycle repeats itself.

Understanding the life cycle of blow flies is extremely useful for murder investigations. Forensic entomologists, such as Watson, can determine approximately when insects found the corpse based on the blow flies' stage of development and the size of the maggots. This is different from estimating time of death, because multiple factors can influence the time of insect arrival. For example, a body could be stored in an airtight cooler for several days before being dumped in a field.

But while much is known about the development of blow flies when bodies are exposed above ground, Watson and his team wanted to know how their development would be affected if a body was buried after the blow flies had laid their eggs.

To find out, the researchers buried pupae, second instar larvae and third instar larvae from two different blow fly species. The insects were buried at depths of 5 centimeters (cm), 25 cm and 50 cm, because murder victims are usually buried in shallow graves. The researchers also gave the insects beef and pork as a food source.

"We discovered that these insects do survive," Watson says. "Soil, it appears, is not much of a barrier to flies." In fact, when buried under 50 cm of soil, 35 percent of the third instar larvae survived to adulthood and dug their way out of the ground. For third instar larvae buried under 5 cm of soil, the survival rate was 43 percent.

"This gives investigators additional information. We can now tell that a body was on the surface long enough for blow flies to arrive and lay eggs," Watson says, "or that the body may have been moved -- exposing it to blow flies." In fact, this research stemmed directly from questions that arose during a murder investigation, in which a body had been moved from one burial site to another.

The paper, "Blow flies (Diptera: Calliphoridae) survive burial: Evidence of ascending vertical dispersal," is published online by the journal Forensic Science International. The paper was co-authored by Watson; Geoff Balme, a former NC State post-doctoral researcher; Steve Denning, an entomology research specialist at NC State; and Jonathan Cammack, a Ph.D. student at NC State. The research was supported, in part, by the National Institute of Justice.

NC State's Department of Entomology is part of the university's College of Agriculture and Life Sciences

To be notified when new blog posts are available: Sign Up For Alets HERE

LIKE US ON FACEBOOK

 

Crime Scene Photography Requirements of Criminal Investigative Analysis

Behavioral Science Investigative Support Unit FBI Academy Quantico, Virginia 22135

This paper reflects on current approaches to crime scene photography described in numerous photographic publications but also includes the observations and suggestions of profilers and photographic examiners who analyze these photographs for behavioral and forensic evidence.

For purpose of criminal investigative analysis (profiling), it is important to record much more than those areas in which acts of violence took place. Photographs can be instrumental in recording the victim's lifestyle and personality; the topography and socioeconomic conditions surrounding the crime scene; and much more which is important to any investigator or analyst who is unable to visit the crime scene. When photographing violent crime scenes, the aim should be to record a maximum of useful information which will enable the viewer to understand where and how the crime was committed.

Crime Scene Defined

The term "crime scene" refers not only to the immediate locality where the crime took place, but adjacent areas where important acts occurred immediately before or after the commission of the crime. Long range, medium range and close-up photographs should be taken to enable the viewer to gain a clear concept of where each object or area interrelates to another.

Exterior and Aerial Photos

Aerial photographs are particularly important in serial rape or murder investigations since they geographically link crime scenes together. Overlapping photographs should be taken of the exterior of the crime scene to show its locale in relation to the rest of the neighborhood. Place the camera on a tripod or hold it steady at eye level so the horizon line is constant for each shot. The photograph can be cut and pasted together to create a panoramic view of the scene.

Photograph On-Lookers

Also photograph any crowds which gather at a crime scene and the license plates of vehicles parked in the vicinity, since the killer may still be in the area observing the investigation. The point of entry and exit should be shown in such a manner that the marks of force will be shown clearly. A scale should also be visible but never place a suspect tool into the tool mark because it may alter the evidence.

Interior Photos

When photographing the interiors of room with a 35mm camera, use a normal lens (45mm to 55mm) in stead of a wide angle lens. A wide angle lens creates distortion, especially when close up photographs are taken. (the distance between objects appears to be greater than it actually is). The camera should be held with a vertical format and overlapping photographs should be obtained. A vertical format insures that the scene will be observed from the top of the walls to the floor. Once again, a composite photograph can be created. Photograph every room in the residence but overlapping photographs need only be taken at the crime scene itself. Interior photographs should depict the conditions of the room, articles left at the scene, trace evidence such as cigarette butts, tool marks and impressions of shoe prints.

Latent fingerprint  and other evidence 

The location of fingerprints should be photographed and in all instances, some notation should be made in the photo log or on the photograph explaining what the photograph is showing. Signs of activity prior to the occurrence, such as the telephone receiver off the hook or wires cut, playing cards orderly stacked or scattered, TV and lights turned on, food in cooking stages, coffee cups, drinking glasses or liquor bottles, time watch and clock stopped should be recorded on film. In general, articles apparently in use immediately prior to the commission of the crime or which appear to have been disturbed from their customary position should be photographed.

Sex Crimes

During a rape investigation, the purpose of the photographic record is to record information on signs of any struggle at the scene where the attack occurred, or indications of the victim's effort to resist attack; such as bruises, black and blue marks, torn clothing, etc. Bite marks should be photographed using oblique lighting, with and without a measuring device at the crime scene and also the morgue. In a rape-homicide investigation, infrared ultraviolet photography of the body may detect latent bite marks since hemorrhaging can occur in tissue under the skin. The location of foreign hairs and fibers, biological fluids and stains should be depicted. If alive, permission from the victim to photograph her body should be obtained and if the victim was a minor, written permission from the parent or guardian. It is recommended that the victim's physician be present when such photographs are made.

Blood Spatter

Blood spatter on walls should be photographed with the lens parallel to the stain so that directionally (the direction the blood flowed can be determined. In sexual exploitation of children cases, every room in a suspect's residence should be photographed even if no physical evidence (such as photographs or video tapes) are found during a crime scene search. Chances are the suspect has concealed this material at another location. Rarely will these photographs be discarded since they represent a trophy or remembrance of the conquest. When these photographs are recovered, they may be compared with the crime scene photos to prove they were taken in the suspect's dwelling. Occasionally, a suspect will place his own camera on a tripod and by using a cable release, will photograph himself with his victims. Usually, he will compose the photograph so his face is not seen. However, if the photograph is sharp enough, the suspect may still be identified through body characteristics such as scars, marks, wrinkles, etc.

Homicide or Suicide?

In death due to asphyxia as a result of a hanging, doubt sometimes exits as to whether the occurrence is murder, suicide, or an accident. photograph the original position of the body to help in determining the manner of death. Overall view of the body and rope should be taken at torso and foot level. Show the height of the body above ground; a murderer usually tries to raise the body completely, while the suicide victim frequently never gets his feet off the ground and is sometimes found in a sitting position or half-prone position.

Position of Physical Objects

Photographs should be made to show the relative position of any object, such as a chair or stool, which appears to have been kicked from under the feet of the deceased. Subjects for close-up shots are the knot, its size, type and location on the neck; depth and location of the grooves in the neck; black-and-white marks around the edge of the groove (here, color film is especially helpful); signs of violence about he neck, suggesting prior strangulation; protrusions of the tongue, binding of hands and feet, etc.

Drowning Scenes

In drowning cases, the body is usually the sole object of interest. But did the deceased actually die of drowning or was he thrown into the water after death from some other cause? The photographic operation should be directed towards those facts which will help to resolve this question. Color film is exceptionally useful here since many of the significant clues may be matters of discoloration. Photograph the whole body, both from the position of standing observer and from the ground level. The latter view will show any distention of the body. Close-ups should include any foam about the mouth; wounds, peculiar markings, bruises, or unusual discoloration’s; articles, such as seaweed, grasped in the hand; and any rope or wire bindings. Many of these views can be made at the morgue before autopsy.

Videotaping the Scene

The videotaping of crime scene has become common practice in many jurisdictions, however, it should never replace still photography. Common errors committed when videotaping a crime scene include panning the camera rapidly, poor focusing and lighting and improper use of the zoom feature of the cameras. The cameraman should describe on tape each room and view of the crime scene and insure that other investigators and crime scene technician are silent during the taping. If done properly, crime scene photography greatly assists the profiler in developing a psychological and behavioral profile of the offender.

To receive notification when new posts are made--Signup for Alerts HERE

LIKE US ON FACEBOOK

Investigating Indoor Marijuana Grows

This video is made available by the Police Officer's Safety Association.

Watch the Video HERE

 

 

 

 

 

 

 

To Learn when new posts are made on this blog--Sign Up For Email Alerts

Crime Scenes and Alternate Light Sources

By: Don Penven

Alternate light sources, a much needed tool for CSIs

Over many decades, visible light sources were used during most searches of crime scenes. Although some forensic investigators would occasionally use ultraviolet (UV Black Light) to examine for crime scene evidence, white light was the mainstay. But in the 1970s the Royal Canadian Mounted Police (RCMP) added a new dimension to forensic examination of physical evidence.

The “Mounties” pioneered the use of argon-ion lasers, but these expensive, cumbersome, bulky machines were impractical for use at crime scenes, so their use was limited to the crime lab.

The birth of alternate light sources

Portable lasers began to appear in the marketplace in the 1980s, but their usefulness was limited to mostly a single color of light. In the 1990s the availability of high intensity incandescent lamps slowly revolutionized alternate light source analysis of physical evidence since these machines, many weighing less than 20 pounds, could provide an intense light beam that could be passed through various filters covering from visible blue, green, yellow and red light. Using these colors enhanced the ability to reveal an abundance of what would otherwise be invisible evidence. But one element is still missing.

What is fluorescence?

Merely shining a blue or other visible color light onto an object in and of itself does not show us much. You see, certain materials possess a property called fluorescence. Fluorescence occurs when light of a certain color and light frequency strikes an object, and the object returns light of a different color and frequency. This fluorescence is much weaker in intensity than the light beam that created it, so to visualize the fluorescence, the crime scene technician must use filtration that blocks the visible light but passes the fluorescence. For example: if the visible light beam is blue light, the filter must be orange in color. This blocks the intense blue light but passes the weak fluorescence. UV light, on the other hand, is invisible, but it produces visible fluorescence from certain objects and substances. No filtration is required to view UV fluorescence, but eye protection in the form of clear glass or plastic lenses is recommended.

Detecting hidden blood stains in crime scenes

If you watch many of the TV “Cop” shows, you will see at some point those working a crime scene using a blue light in search of invisible blood (blood stains that were cleaned up). Shazam! Blue-white stains appear all over the floors, walls and objects sitting around the crime scene! But in reality—this cannot happen. You see, blood does not fluoresce by applying UV or visible blue light.

Blood, even minute quantities that remain after clean-up, can be made to “luminesce; that is, by spraying certain chemicals such as Luminol, BlueStar or Fluorescene on the various surfaces, blood will luminesce, or simply “glow in the dark”—and adding blue light is not necessary. So what can alternate light sources reveal? Although blood does not fluoresce, certain other physiological fluids will. UV alternate light sources can reveal the following: seminal fluid, saliva and urine stains. Also, certain narcotics will fluoresce as will bone and teeth fragments.

Other uses of alternate light sources Indeed, many forms of physical evidence will fluoresce. But modern science has resulted in the development of chemicals that “make” objects fluoresce. When using fluorescent chemicals, latent fingerprint development can be greatly improved. Fluorescent latent print powders have the ability to make the latent residue on a surface fluoresce. The benefit here is that the ridges fluoresce brightly and when photographed, a multi-colored or confused background can be minimized to the point where it does not show up in photographs. Fluorescent liquids are used to develop latent prints on porous surfaces such as paper and cardboard.

Fluorescent dyes are used to enhance latent prints developed using superglue fuming. The use of alternate light sources provides a highly practical and efficient means of locating physical evidence at crime scenes. The invention and perfection of Light Emitting Diodes (LEDs) has further advanced evidence recovery since even 1 and 3 watt LEDs can be installed in small, hand-held flashlights, and their performance is remarkable.

To learn more about the methods and tools used by today’s real-world crime scene investigators, please check out the Categories in the navigation window to the right. 

To learn when new posts are made on this blog, Sign Up for Email Alerts.

To check out various alternate light sources, download the Introduction to Alternate Light Sources

Visit us on Facebook

 

How police tracked down Steve Jobs' stolen iPads

Digital breadcrumbs left by the iMac and iPad computers were key in tracking them down

 By Martyn Williams

IDG News Service - The digital breadcrumbs left behind when people use Internet-connected gadgets are what led California investigators to recover iMacs, iPads and other items stolen from the home of the late Apple CEO Steve Jobs.

 Based on the police report, obtained by the IDG News Service, here's how they did it.

 The burglary took place while the Jobs family home, in a leafy and quiet area of Palo Alto, was being renovated and was unoccupied. Sometime between the construction crew leaving the site at 5:00 p.m. on Tuesday, July 17, and arriving just before 8:00 a.m. the next morning, someone entered the house and stole several personal effects and Apple gadgets.

 Within several days, the Palo Alto Police Department had enlisted the help of the Rapid Enforcement Allied Computer Team, a San Jose-based organization formed by local, state and federal law enforcement agencies that specializes in computer-related crimes. Local police wanted assistance tracking down the Apple computers and iPads that were reported stolen from the house.

 The REACT team reached out to Apple's own investigators, who had access to the company's computer systems, and supplied them with a list of serial numbers of stolen devices. Apple was quickly able to determine that one of the stolen iPads had connected with Apple's servers soon after the burglary.

 The iPad was trying to reinstall its operating system and was recorded connecting from an AT&T U-verse Internet IP address from 7:22 a.m. to 7:31 a.m. on July 18, the morning after the house was broken into and minutes before the returning construction workers would discover the break-in.

 Upon searching logs for the IP address, Apple investigators discovered a different iPad had connected from the same address at 8:10 a.m. on July 17, before the burglary took place, and again at 1:56 p.m. on July 20, after the break-in was reported to police. That iPad wasn't suspected stolen, but the iTunes account information gave investigators a lead.

 Tied with information from AT&T U-verse about the Internet connection, investigators were led to an address in Alameda, on the east side of San Francisco Bay. At that address Kariem McFarlin, the suspect in the case, was paying for AT&T Internet service, according to investigators.

 While police were building their case there was more activity on the stolen devices.

 Over a five day period, Apple investigators recorded activity on McFarlin's iTunes account linked to the iPad that originally connected to restore its operating system, a second iPad stolen from the Jobs' home and an iMac computer that was also missing, according to police. One of the iPads later connected from a Comcast Internet connection in Alameda using a different iTunes account.

 Investigators say they searched McFarlin's Facebook page and discovered their suspect and the owner of this new iTunes account were friends.

 Before investigators made their move there was one final check that had to be made.

 They traveled to the Alameda address where McFarlin lived and swept the immediate area for Wi-Fi signals.

 Police wanted to determine whether there was an open Wi-Fi network that perhaps was being used without the owners' permission. If the AT&T Internet address was tied to an unsecured connection, it could complicate the case because anyone could have used it. Finding only secured Wi-Fi signals, investigators could argue it was being used by the person paying the bill or those with permission.

On August 2 police entered McFarlin's apartment and discovered one of the stolen iMac computers on his kitchen table, according to the police report.

 The other iPads were recovered from people associated with McFarlin, the police say.

 To get rid of stolen jewelry, McFarlin told police, he had Googled selling jewelry and found a dealer in Pennsylvania. Police say they found email messages in McFarlin's phone indicating the sale and were able to recover the stolen jewelry by contacting the broker.

 In a subsequent interview with McFarlin, police say he admitted breaking into the home by climbing over the builders' scaffolding and finding a spare key for the house in the garage. He said he stole two iMacs, three iPads, three iPods, one Apple TV, a diamond necklace and earrings, and several other items.

 In explaining his actions, investigators say McFarlin said he had money problems and had taken to breaking into houses. He wrote a single page letter of apology admitting he had burglarized Steve Jobs' house and stolen property, but had done so because he was desperate.

 McFarlin is due in court on Monday.

 Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service.

To learn when new posts are available on this blog: Register Your Email Address.

 

BloodTips-04 Hemastix Blood Test Strips

By Don Penven

Chemical field testing for blood using “presumptive" methods has long been practiced by crime scene investigators. Granted, many of the red to reddish brown stains found at crimes scenes are “obviously blood,” and presumptive testing may be eliminated. This circumstances may be when the victim is lying in the middle of a large red stain.

But when it comes to possible blood spatter in various areas of the crime scene, a chemical field test is in order.

As with any chemical field test, avoiding contamination to the suspected stain is mandatory. Thus, the contact method is used to lift a sample of the stain while leaving it intact and uncontaminated. This is easily accomplished by moistening a piece of clean filter paper or cotton-tipped swab with distilled water. All tests are ten performed on the lifted stain.

Hemastix® are 3” plastic strips with a special blood reagent material at the tip. The strips detect the peroxide-like activity of hemoglobin in a substance. Simply rub the Hemastix on a moistened stain as collected above or across a swab that has a suspected dried blood sample on it. The reagent coated tip will turn a shade of green if hemoglobin is detected. Compare the color reaction to the chart on the side of the bottle to determine the level of hemoglobin in the sample. If the reaction is positive, take a photograph of the test strip by the substance to document the reaction and retain the strip as evidence.

Please note: Expired Hemastix®  will generally still react to the presence of blood, but should only be used for training purposes. Also, Hemastix®  will not detect the difference between human and animal blood.

Hemastix Blppd Test Strips

RUVIS and The Effects of Ultraviolet Light Exposure on DNA Analysis of Fingerprints

Julie Luby Nicholson*, M.F.S.; Todd W. Bille*, M.S.; Michael J. Malia*, Ph.D; Robert A.

Bever*, Ph.D. 

 

 

 

The Sirchie® KRIMESITE Imager. is a tool that can be used to detect and document latent fingerprints on various surfaces without the use of chemical enhancement. The Imager takes advantage of the different UV light reflectance properties of the fingerprint and the surface on which it is located. Large surfaces can be searched quickly and then any fingerprints detected can be digitally photographed for comparison purposes. Due to the use of specific optic filters, the search for fingerprints can be conducted in daylight or darkness. A growing trend in forensic DNA analysis is the analysis of the epithelial cells contained within a fingerprint or fingerprint smudge that is not suitable for fingerprint comparison purposes. One concern from a DNA analysis perspective is the exposure of the limited biological material to the UV light used by the KRIMESITE Imager. which can be harmful to the DNA. 

The objective of this study was to determine the effects of ultraviolet light on DNA analysis and to determine the ideal circumstances for biological fluid examination when using a shortwave ultraviolet light source. 

Human buccal cells on paper were used to simulate a biological stain. The cells were exposed to a 12 Watt, shortwave (254nm) ultraviolet light for one minute, two minutes or three minutes at distances of one foot, two feet, or three feet. After exposure to the ultraviolet light, DNA was extracted from the stains for subsequent quantification and STR (Short Tandem Repeat) analysis using PowerPlex® 16 (Promega Corporation). 

Results indicate that short-term (one minute) exposure of these biological samples to ultravioletlight does not greatly affect downstream DNA analysis. A longer exposure (two minutes) at a short distance (one foot) causes allelic dropout, which may be due to degradation of the biological sample. However, increasing the exposure distance to two feet or three feet improves the recovery of DNA from the paper. DNA analysis was most affected by longer exposure (three minutes) to ultraviolet light, resulting in poor recovery and increased allelic drop out.

 This technique was subsequently used on probative evidence successfully. Ultimately, this information will be applied to the examination of fingerprints and a method will be developed to scan evidence for biological stains using ultraviolet light causing minimal damage to the DNA.

 *The Bode Technology Group, Springfield, Virginia

 

RUVIS Photo of

latent Print on Soda Can

BloodTips-03 Luminol Reagent

By: Don Penven

Luminol is a chemiluminescent substance that is used as a presumptive test for the presence of blood. Making use of the peroxidase-like activity of the heme portion of hemoglobin, Luminol produces a bluish-white light that can be viewed in total darkness. Invisible blood stains react with the Luminol reagent by luminescing—but darkness is essential. Luminol is a useful test for searching large areas for blood, especially if the area has been cleaned up. Sensitivity:1:100,000.

 

Luminol is available in several different packages and quantities. It is supplied as a pre-measured dry powder along with a specific amount of distilled water. Once mixed, Luminol has a relatively short shelf life.

The advantages of using Luminol for locating minute traces of blood are numerous: it is non-destructive to subsequent DNA profiling; it is a relatively safe compound if used according to directions; and it is simple to mix and apply.

 

Preparations for use:

Note: Since the luminescence fades rather quickly, have a tripod-mounted camera ready to use as soon as luminescence appears.

Warning! Luminol, in its solid or mixed state, is hazardous and should be mixed in a well-ventilated area or laboratory hood. Severe skin, eye and respiratory irritant—wear protective clothing, gloves and safety glasses/goggles.

1. Remove cap from bottle of “B” solution.

2. Remove clip and pour entire contents of pouch “A” powder into bottle of “B” solution.

3. Recap bottle with supplied spray head attachment and shake well until all solid material dissolves.

4. Luminol is ready to be applied to suspect areas. Set the spray nozzle to “MIST.”

Instructions for use:

1. Photograph the scene prior to processing with Luminol.

2. Turn off all lights and darken the area as much as possible—luminescence may be very weak and is best seen in total darkness. Note: A night vision flashlight (red beam) such as LVL100 LumaVision™ may be used to illuminate the area while processing the scene.

3. Process small 2-3 sq. ft. areas at a time. When luminescence is revealed, prepare to take photos  (absolutely no flash is to be used). Notes: Photo Evidence Markers such as PEN15 can be used to indicate the locations of luminescence so they can later be photographed under full light or with a flash.

4. Reapply Luminol as necessary if luminescence fades too quickly before photos can be taken.

 

 Carpet suspected of holding blood prints

 

 

 

 

 

 

 

 

 Luminol developed footprint

 

 

 

For complete instructions, you may download the Technical Information Bulletin on Luminol 

 

BloodTips-02 Dischaps Reagents

By: Don Penven

Note: Dischaps is the name of a product line manufactured by Sirchie Finger Print Laboratories. It refers to the type of packaging for a series of different chemical reagents. This packaging refers to DISsposable CHemical Applicators.

 

DISCHAPS™ packaging virtually eliminates the possibility of contamination of chemical reagents, and it dramatically increases shelf life. Reagents are contained within easily crushed glass ampoules. The ampoules are then sealed inside tough, flexible polyethylene dispenser tubes.

Blood DISCHAPS™ applications rely on using the contact method of testing—that is, a few drops of ethyl alcohol or distilled water (See Technical Information Bulletin) are placed on a strip of filter paper, and the wet filter paper is pressed against the suspected stain. The DISCHAPS™ reagent is then applied to the filter paper, thus preserving the original evidence stain.

 

PHENOLPHTHALEIN DISCHAPS™ (DCB100)

Note:  Phenolphthalein reagent requires that ethyl alcohol be used to wet the filter paper during the contact stain lifting method.

Blood causes a Pink stain in just a few seconds. This reagent is considered by many field crime scene technicians to be one of the most reliable presumptive tests for the presence of blood because of its non-reaction to plant materials. Sensitivity=1:500,000.

 

Phenolphthalein reagent reaction to blood 

 

 

LEUCO-MALACHITE DISCHAPS™ (DCB200)

An intense Blue/Green color reaction in 3 seconds is presumptive evidence that

blood is present. Sensitivity (1:10,000).

 

Leuco-malachite Reaction

 

 

LUMINOL DISCHAPS™ (DCB300)

 Luminol reagent requires a darkened area for observation. This is the ideal reagent for

“aged” or invisible blood stains. In fact, the older the stain, the brighter the Blue/

White color reaction (within five seconds). Sensitivity: 1:100,000.

 

Luminol Reaction

 

 

For more specific instructions for use of the Dischaps Blood Test Reagents, you may download the Technical Information Bulletin  <===

To learn when new blog posts are available, sign up for Email Alerts  <===

 

 

 

BloodTips-01 Introduction to On-Scene Identification of Blood

By: Don Penven

The purpose of BloodTips is to provide quick tutorials in the use of the most frequently used blood screening methods at crime scenes. These tests are PRESUMPTIVE in nature. They, like narcotic and drug field tests, serve a singular purpose—they provide the crime scene investigator with the knowledge that a particular stain possesses the possibility that it is blood, and these tests are not a substitute for crime laboratory analysis.

The most commonly employed field tests available for use at crime scenes are:

1. Phenolphthalein
2. Leuco malachite
3. Luminol

A variety of commercially-available packaging methods permit simplified, uncomplicated use of these reagents at crime scenes. Each BloodTips post will present a simplified application procedure while existing posts on this blog provide more in-depth coverage of these techniques.

Uses are strongly advised the conduct their own experiments using each of these processes prior to any use at a crime scene. The crime scene investigator is also encouraged to examine the Material Safety Data Sheets (MSDS) readily available from the manufacturer to learn of any hazards that may exist when using these reagents:

To download these MSDSs, please use the following links:

Phenolphthalein:  http://www.sirchie.com/Assets/msds/dcb100a.pdf,  http://www.sirchie.com/Assets/msds/dcb100b.pdf

Leuco malachite:  http://www.sirchie.com/Assets/msds/dcb200a.pdf, http://www.sirchie.com/Assets/msds/dcb200b.pdf

Luminol: http://www.sirchie.com/Assets/msds/dcb300.pdf

The Contact Method of Testing

In order to preserve the integrity of the stain to be testing, we strongly recommend that the Contact method of stain sampling be used in all cases.

Procedure:

• Using a clean piece of filter paper, moisten it by adding a few drops of ethyl alcohol or distilled water, whichever is indicated on the instructions accompanying the particular reagent.
• Press the wet filter paper against the suspected stain for a few seconds.
• Please the filter paper test strip on a clean surface (paper towel, napkin, etc.)
• Add the test reagent to the stain.

In the case of phenolphthalein a pink stain will develop in a few seconds indicating the presumptive presence of blood.

In the case of leuco malachite an intense blue/green stain will develop in a few seconds indication the presumptive presence of blood.

In the case of luminol, the presumptive presence of blood will be indicated to a bluish-white luminescence.  This luminescence is only visible in near total darkness.

 

Check out BloodTips02

 

Was Sherlock Holmes The First of a Long Line of Crime Scene Investigators

By: Don Penven

The adventures of Sherlock Holmes began in 1887 with the publication of A Study in Scarlet, the
first of four novels and 56 short stories penned by British author, Sir Arthur Conan Doyle. Few fictional characters have survived the test of time, but Holmes continues to thrill, and yet befuddled many readers to this day. Motion pictures and TV documentaries keep the legend alive.

Holmes and Watson—a Dynamic Duo

 The exploits of Holmes, and his roommate and biographer, Dr. John H, Watson, have fascinated countless generations of crime fans eager to learn more about this London-based "consulting detective," whose uncanny abilities defy normal thought-processes of most Holmes devotees. Through skillful narration, using the words of Holmes, Watson and also third-person script, Conan Doyle mesmerized his followers with Holmes’ use of logical reasoning, the ability to devise virtually any form of disguise, all coupled with an in-depth knowledge of forensic science.

Author Conan Doyle stated that the inspiration for Homes was the persona of Dr. Joseph Bell, for whom he clerked at the Edinburgh Royal Infirmary. He also admitted to using snippets from lecturer, Sir Henry Littlejohn.

Keeping Track of the Criminal Population

 A system of criminal identification was implemented in Europe prior to Conan Doyle’s introduction of his master detective. Alphonse Bertillon. a French anthropologist, introduced his system of anthropometry, a method requiring precise measurements of the bone structures of incarcerated criminals. Bertillon’s formula of measurements was used to verify the re-arrest of the criminal element. It was not until 1903, as a result of the Will West case (more on this at the website listed below) that anthropometry was shelved to make room for the new science of fingerprint identification.

The Introduction of Fingerprint Science

During this same fateful year when fingerprint identification was heralded as a new science, Conan Doyle published the Adventures of the Norwood Builder, in which a bloody fingerprint provides a solid clue to the nature of the crime in question.

Fingerprint identification reigns-supreme as a virtually infallible means of identification. But some forensic specialists would challenge this determination, countering that DNA profiling is a far more accurate means of identifying a perpetrator. No doubt this debate will rage on for some time to come.

The CSI Phenomenon

Once of the most successful television dramas of the past decade is “CSI: Crime Scene Investigation.”  Along with its progeny, CSI Miami and CSI New York, this series has done more to influence how crimes are solved than all of the textbooks on the subject combined.  Unlike so many “cop shows,” the CSI-series has created a new public awareness—to the point that many affected crime victims expect their particular brush with the criminal element  to be solved within an hour (less the time for commercials), using futuristic methods and crime scene equipment . The CSI characters utilize the most innovative forensic examination equipment and work in pristine, shiny new laboratories equipped with every conceivable evidence discovery, evaluation and identification tool imaginable. But just taking into account the economic stress most crime labs are feeling, cost often outweighs practicality.

Now doubt, most people would agree that Sherlock Holmes was the ultimate model for today’s CSIs, even if they never read a single one of Conan Doyle’s novels or short stories. The very name serves as a monument to the fictional character that frequently set forth from his lodgings at 221b Baker Street to pursue evil-doers wherever their crimes may have occurred.

This website is devoted to providing information covering the various disciplines of crime scene investigation, The list of Categories in the right navigation window will provide the reader with time-tested methods and applications for the myriad situations the crime scene technician will face at the scenes of crimes. 

To keep up to date when new posts

are availble on this blog,

please sign up for Email Alerts.

 

PSA - Slow Down or Move Over

Watch the PSA - Slow Down or Move Over 

 

Give this link to your local TV stations:

http://www.youtube.com/watch?v=LroL2xlVH1U

Overview of Chemical Tools and Methods for Latent Print Development

Powders

Powders adhere to both water and fatty deposits. These are generally useful

on newer prints only. Choose a powder to contrast with the background. They

are useful on any dry, relatively smooth, non-adhesive surfaces. Use after

laser fluorescence. May be used before ninhydrin and after cyanoacrylate.

Results may vary with skill of technician. “Lift” developed prints by

photography or conventional methods.

Fluorescent Powders

Powders made of fluorescent materials offer advantages to the limitations of

conventional powders. Apply as with conventional powders. “Lifts” can be

made photographically or by conventional means. Fluorescent powders are

especially useful on confused backgrounds. An ultraviolet or forensic light

source is required.

Iodine Fuming

Iodine fumes react with oils and fatty deposits to produce a temporary

yellow-brown reaction product. Iodine is useful on fresh prints on porous

and non-porous, non-metallic surfaces. Developed prints must be fixed or

photographed immediately because reaction will rapidly fade. Use iodine

before ninhydrin and silver nitrate.

DFO

DFO, 1,8 Diazafluoren-9-one, is a fluorescing ninhydrin analog found to

develop up to two and a half more prints than ninhydrin itself. It is useful on

porous surfaces, especially paper. Development may be accelerated through

the application of controlled heat. Use it before ninhydrin. DFO also is useful

to develop weak blood stains. It requires a specialized light source, such as

the BLUEMAXX™.

Ninhydrin

Ninhydrin reacts with amino acids to produce a purple reaction product

called “Rhuemann’s Purple”. It is useful on porous surfaces—especially paper.

Development time is up to 10 days, but may be accelerated through the

application of heat and humidity. Use ninhydrin after iodine and before silver

nitrate. Ninhydrin is not useful on items which have been exposed to water.

Silver Nitrate

Silver nitrate reacts with the chlorides in skin secretions to form silver

chloride, a material which turns gray when exposed to light. Developed prints

must be photographed immediately because the reaction will eventually (and

permanently) fill the background. It is useful on paper, cardboard, plastics and

unvarnished, light-colored woods. Use it after ninhydrin and iodine. It is not

useful on items which have been exposed to water.

Physical Developer

Physical developer is another silver-based developer which reacts to form a

dark gray reaction product. It is useful on paper, cardboard, and unvarnished,

light-colored woods. Use physical developer after ninhydrin and iodine. It is

very successful on items exposed to water.

Cyanoacrylate (Glue Fuming)

Cyanoacrylate fumes react (polymerize) with water and other possible

fingerprint constituents to form a hard, whitish deposit. It is useful on most

non-porous and some porous surfaces. Cyanoacrylate produces excellent

results on styrofoam and plastic bags. Developed prints may be dusted with

powders or treated with fluorescing dyes, such as ardrox and basic yellow to

enhance.

Amido Black

Amido black reacts with the proteins found in blood to form a black reaction

product. Amido black is useful only on blood-contaminated prints. It is highly

sensitive. It is useful on non-porous and some slightly porous surfaces. It

sometimes offers successful development of blood prints on dead human

skin

Adhesive Side Powder

Adhesive side powder attaches itself to plastic print impressions on the

adhesive side of tapes. It produces excellent results on light-colored or

transparent tapes, including duct tape, masking tape, plastic surgical tape,

foam tape, clear and reinforced packing tapes and labels. This process

involves wetting tapes.

Fluorochromes

Prints may be treated with special dyes called fluorochromes which easily

are made to fluoresce and bond with the print deposits. They are useful

with forensic lights such as SIRCHIE’s BLUEMAXX™. DFO is a fluorescing

ninhydrin analog found to develop up to two and a half times more prints

than ninhydrin itself. It is useful on porous surfaces. Development may be

accelerated through the application of controlled heat. A specialized light

source such as  SIRCHIE’s BLUEMAXX™ is required. Basic yellow, ardrox, and

rhodamine are dyes especially useful staining latent prints developed with cyanoacrylate.

Download more information: Latent print Development

 

PrinTips 11—An Overview of Latent Print Development Powders

By: Don Penven, Tech Support

Latent print powders come in five different formulations:

Regular-Oxide, Metallic, Magnetic, Combination and Fluorescent. This article covers the basic theory of each type. Keep in mind that if you are uncertain which powder to use on a particular surface—experiment by placing your print in an area not likely to have been touched by the perpetrator.

 Regular-Oxide Powders

These powders are considered the basic choice by crime scene investigators for use on many of the surfaces encountered at crime scenes. But many practitioners are not aware of some of the limitations. Examples of regular-oxides are: black, white, gray and red. These finely milled powders are highly sensitive toward the moisture or oily content of latent fingerprints. But their use should be limited to just non-porous surfaces such as most painted metals, plastics, waxed surfaces, glass, rubber, leather  and wood (painted and unpainted). They should not be used on highly polished surfaces such as chrome or silver plating or other polished metals. Regular-oxide powders are applied with a brush. A powder color is selected based on how much contrast from the background it affords. Use black powder on light-colored surfaces and white powder on dark colored surfaces. Gray and red powders are often used on either light or dark surfaces.

 Metallic Powders

As the name suggests, these powders are formulated from metallic substances such as aluminum, copper and zinc. They are specifically formulated for use on highly polished surfaces like chrome or silver plating. Using a regular-oxide powder on this type of surface generally results in the moisture residue from latent prints being damaged or destroyed—these ridge structures are simply wiped away. Metallic powders are applied with a brush.

 Magnetic Powders

Magnetic powders are formulated from iron or iron oxide. The powders themselves are not magnetic, but they are easily magnetized by a magnetic wand. Magnetic powders may be used on virtually any surface EXCEPT a surface containing iron or steel. The principle of delivery is this: a magnetic wand is passed over the powder, which is then attracted to the wand to form a “brush” made of the powder. The CSI then passes this powder brush over the surface so that the tip of the wand does not touch the surface, but the powder does.  When carefully applied, magnetic powders leave very little surface residue so cleanup is simplified. Magnetic powders are available in black, gray and white for contrast with the surface.

 Combination Powders

These powders combine the properties and chemistry of both regular-oxide powders and metallic powders. The benefits here are:

1. Combination powders may be used on virtually ANY non-porous surface
2. These powders appear dark on a light background and light on a dark background.

Combination powders are applied with a brush.

 Fluorescent Powders

Note: fluorescent powders use a formulation similar to regular-oxide powders and are thus best suited to work on those surfaces mentioned above.

Fluorescent powders appeared in the crime scene kits of CSIs who wanted a powder that was usable on multi-colored, confused backgrounds like soda cans, snack wrappers and bags, wallpaper, ceramic surfaces, etc. These powders contain a chemical that produces fluorescence when exposed to ultraviolet (UV) light or certain frequencies from alternate light sources (blue, yellow, green and red). When developed latent prints are viewed under subdued ambient light the fluorescence is bright enough that when the prints are photographed, the background is mostly dropped out. Fluorescent powders are applied with a brush.

 For more information on latent print development using powders, chemicals and fuming techniques, download the Latent Print Development section of our catalog and read over pages 9-12.        Latent Print Development

To receive notice when new blog posts are available; Signup For Email Alerts 

Sample Consent Search of Computers

CONSENT TO SEARCH COMPUTER/ELECTRONIC EQUIPMENT

I, _____________________________, have been asked to give my consent to the search of my computer/electronic equipment. I have also been informed of my right to refuse to consent to such a search. 

I hereby authorize ________________________ and any other person(s) designated by [insert Agency/Department] to conduct at any time a complete search of:

¤ All computer/electronic equipment located at ___________________

_________________________. These persons are authorized by me to take from the above location: any computer hardware and storage media, including internal hard disk drive(s), floppy diskettes, compact disks, scanners, printers, other computer/electronic hardware or software and related manuals; any other electronic storage devices, including but not limited to, personal digital assistants, cellular telephones, and electronic pagers; and any other media or materials necessary to assist in accessing the stored electronic data.

¤ The following electronic devices:

[Description of computers, data storage devices, cellular telephone, or

other devices (makes, models, and serial numbers, if available)]

I certify that I own, possess, control, and/or have a right of access to these

devices and all information found in them. I understand that any contraband or evidence on these devices may be used against me in a court of law.

I relinquish any constitutional right to privacy in these electronic devices and any information stored on them. I authorize [insert Agency/Department] to make and keep a copy of any information stored on these devices. I understand that any copy made by [insert Agency/Department] will become the property

 

of [insert Agency/Department] and that I will have no privacy or possessory interest in the copy.

This written permission is given by me voluntarily. I have not been threatened, placed under duress, or promised anything in exchange for my consent. I have read this form; it has been read to me; and I understand it. I understand the _____________ language and have been able to communicate with the agents/officers.

I understand that I may withdraw my consent at any time. I may also ask for a receipt for all things turned over.

Signed: ________________ Signature of Witnesses:  _______________

Date and Time:__________ Date and Time:_______________

 

Consent Form: Search and Seizure of Computers

As published in:

Searching and Seizing Computers  and Obtaining Electronic Evidence in Criminal Investigations

Computer Crime and  Intellectual Property Section, Criminal Division

U.S. Dept . of Justice

 

Blood Stain Terminology

FBI Forensic Science Communications

Scientific Working Group on Bloodstain Pattern Analysis (SWGSTAIN)

Objective

This document provides a recommended list of terms to use when teaching, discussing, writing, or testifying on bloodstain pattern analysis.

Introduction

The Scientific Working Group on Bloodstain Pattern Analysis (SWGSTAIN) comprises bloodstain pattern analysis (BPA) experts from North America, Europe, New Zealand, and Australia.  SWGSTAIN provides a professional forum in which practitioners in BPA and related fields can discuss and evaluate methods, techniques, protocols, quality assurance, education, and research. SWGSTAIN’s ultimate goal is to use these professional exchanges to address substantive and operational issues within the field of BPA and to build consensus-based, or “best practice,” guidelines for the enhancement of the discipline of BPA.

Statement of Purpose

SWGSTAIN has developed and defined a list of recommended terminology for use in BPA. In developing this list, SWGSTAIN reviewed terminology in use across BPA. 

Recommended Terminology

Accompanying Drop

A small blood drop produced as a by-product of drop formation. 
 
Altered Stain

A bloodstain with characteristics that indicate a physical change has occurred.
 
Angle of Impact

The acute angle (alpha), relative to the plane of a target, at which a blood drop strikes the target.
 
Area of Convergence

The area containing the intersections generated by lines drawn through the long axes of individual stains that indicates in two dimensions the location of the blood source.
 
Area of Origin

The three-dimensional location from which spatter originated. 

Backspatter Pattern

A bloodstain pattern resulting from blood drops that traveled in the opposite direction of the external force applied; associated with an entrance wound created by a projectile.

Blood clot

A gelatinous mass formed by a complex mechanism involving red blood cells, fibrinogen, platelets, and other clotting factors.

Bloodstain 

A deposit of blood on a surface.

Bloodstain pattern

A grouping or distribution of bloodstains that indicates through regular or repetitive form, order, or arrangement the manner in which the pattern was deposited.

Bubble Ring

An outline within a bloodstain resulting from air in the blood.

Cast-off Pattern

A bloodstain pattern resulting from blood drops released from an object due to its motion.

Cessation Cast-off Pattern

A bloodstain pattern resulting from blood drops released from an object due to its rapid deceleration.

Directionality

The characteristic of a bloodstain that indicates the direction blood was moving at the time of deposition.

Directional Angle

The angle (gamma) between the long axis of a spatter staintarget. and a defined reference line on the

Drip Pattern

A bloodstain pattern resulting from a liquid that dripped into another liquid, at least one of which was blood.

Drip Stain

A bloodstain resulting from a falling drop that formed due to gravity.

Drip Trail

A bloodstain pattern resulting from the movement of a source of drip stains between two points. 
 
Edge Characteristic

A physical feature of the periphery of a bloodstain.

Expiration Pattern

A bloodstain pattern resulting from blood forced by airflow out of the nose, mouth, or a wound.

Flow Pattern

A bloodstain pattern resulting from the movement of a volume of blood on a surface due to gravity or movement of the target.

Forward Spatter Pattern

A bloodstain pattern resulting from blood drops that traveled in the same direction as the impact force.

Impact Pattern

A bloodstain pattern resulting from an object striking liquid blood.

Insect Stain

A bloodstain resulting from insect activity.

Mist Pattern

A bloodstain pattern resulting from blood reduced to a spray of micro-drops as a result of the force applied.

Parent Stain

A bloodstain from which a satellite stain originated.

Perimeter Stain

An altered stain that consists of the peripheral characteristics of the original stain.

Pool

A bloodstain resulting from an accumulation of liquid blood on a surface.

Projected Pattern

A bloodstain pattern resulting from the ejection of a volume of blood under pressure.

Satellite Stain

A smaller bloodstain that originated during the formation of the parent stain as a result of blood impacting a surface.

Saturation Stain

A bloodstain resulting from the accumulation of liquid blood in an absorbent material.

Serum Stain

The stain resulting from the liquid portion of blood (serum) that separates during coagulation.

Spatter Stain

A bloodstain resulting from a blood drop dispersed through the air due to an external force applied to a source of liquid blood.

Splash Pattern

A bloodstain pattern resulting from a volume of liquid blood that falls or spills onto a surface.

Swipe Pattern

A bloodstain pattern resulting from the transfer of blood from a blood-bearing surface onto another surface, with characteristics that indicate relative motion between the two surfaces. 

Target
 
A surface onto which blood has been deposited.

Transfer Stain

A bloodstain resulting from contact between a blood-bearing surface and another surface.

Void

An absence of blood in an otherwise continuous bloodstain or bloodstain pattern.

Wipe Pattern

An altered bloodstain pattern resulting from an object moving through a preexisting wet bloodstain.

 Follow us on Facebook 

Victim of Cybercrime Fights Back

By Ellen Messmer - Originally Published at: Digital Forensic News

It started out as an ordinary workday for Michelle Marsico, who runs a business based in Redondo Beach, Calif., handling escrow funds for clients in real estate. But when she went online to check the funds-transfer activity in her commercial bank account, she found to her horror that it had been cleaned out by cybercrooks to the tune of almost half a million dollars.

Two dozen fraudulent electronic-funds transfers had whisked about $450,000 out of her account to bank accounts elsewhere for roughly 20 recipients whose names and addresses she didn't recognize. "I was in shock for a few minutes," says Marsico, president of Village View Escrow. "I thought, there must be a mistake."

 It was all an online cyberheist against her and Professional Business Bank, where she had the Village View escrow account, and it turned her life upside down. The next shock was when she realized her bank, which called the FBI, wasn't going to be able to speedily recover the funds that had been sent to these 20 or so "money mules," the individuals recruited to help the organized cybercrime gang.

And since her bank wasn't going to quickly go after the money mules, Marsico decided to do it herself.

"I finally received a copy of the wire transfers, with the names and addresses of the recipients," she says. She frantically set out to find as many as she could through online searches.

 Strangely, one of the recipients had actually called the company, angrily demanding that it "stop harassing him."

 "They thought we were harassing him to send out the money after he had his bank call him about it. He thought the money legitimately came from us, and the criminals were trying to hurry him up," she says.

Some of the money mules that had been recruited to transfer stolen funds on to the crooks were indeed unaware they were part of a cybercrime, often having been recruited by means of fake job advertisements at online job sites like CareerBuilder.com. One older man in Hawaii thought the funds transfers were part of a textile-buying operation.

 But "some did know what it was," says Marsico.

 One man in New York that had received about $29,000 "was frank with me and said, 'I feel bad about it.' I said if you return the money, I'll let the Secret Service know that." She managed to get about a dozen of the recipients to cough up $72,000 of the stolen funds. But that left her out $373,000.

 That left Marsico and her bank to square off over how this had happened, whether someone had broken into a Village View Escrow computer or something else. The focus of the dispute came to center around the nature of the authentication and funds-transfer validation process.

Village View Escrow ended up suing Professional Business Bank. Basically, the company contended that the authentication and funds-transfer authorization and validation process was insufficient, and the bank should be held responsible for the loss that Village View suffered.

 Marsico does not represent herself as a security expert, but her painful experience has also been a learning experience. Basically, Professional Business Bank -- later acquired by Bank of Manhattan -- at the time claimed to use "two-factor authentication," says Marsico, but the process was only two people from the company who had to log in to release the wire transfer. "One of input, one to release," she says. "Only using a user name and password." The process was also supposed to entail the company getting an email or callback response, but "nothing was consistent. Sometimes it happened, sometimes it didn't."

 She switched to another bank where token-based variable passwords are part of the security in online banking.

 The lawsuit took two years to settle. Marsico was represented by Silicon Valley Law Group, whose lead attorney, Kim Dincel, had been a friend since she was 14. One filing from the suit almost mockingly recites the advertising Professional Business Bank used to attract clients:

 "Now you can do all your banking from home or office! ProBizBank offers NetTeller -- advanced and secure financial online banking services that's available 24 hours a day 7 days a week. All you need is a computer, a ProBizBank account and your personalized user ID and password. It's simple, safe and so convenient, you'll wonder how you lived without it."

 Law enforcement wasn't much help to Marsico.

 "Every department I talked with, it was out of their jurisdiction. The Secret Service agent -- he was very kind -- but he said you need to do what it takes to survive." Marsico had to go get a loan to cover the stolen funds and the situation also put her in jeopardy of losing the license she needed to operate her business.

But after a two-year fight, Professional Business Bank, which had by that time become part of Bank of Manhattan, finally agreed to pay Village View Escrow $600,000 in late June. The settlement basically covered Marsico's losses, plus interest and expenses.

 Julie Rogers, attorney at Silicon Valley Law Group, points out that businesses that end up in disputes with their banks over cybercrime-related theft actually find they have less legal protection than consumers. When in a dispute with their commercial customers, "banks typically deny liability," says Rogers, adding small to midsize businesses are often more on the defensive than larger corporations that may have more resources.

 Not only that, business owners will find themselves under investigation as law-enforcement authorities or others question whether the business actually committed the fraud. And in these circumstances, the person being investigated may also have to pay for this investigation under the law. In Marsico's case, competitors in her business even took advantage of the situation by sending out fliers alluding to her plight, trying to impact her reputation, Rogers adds.

As to where all those stolen funds from the money mules were being transferred, Rogers says it appeared they were destined for the Middle East and Russia.

Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security.

 

Digital Forensics: Cybercrime Investigation

by Mirko Zorz - Tuesday, 10 July 2012.

Published in Digital Forensic Investigation News 

Jess Garcia, founder of One eSecurity, is a senior security engineer and an active security researcher in areas of incident response, computer forensics and honeynets. In this interview he talks about mobile forensics, cyber crime scenes, how forensics experts testify in court, privacy concerns, and more. Garcia will be teaching at SANS Forensics Prague 2012.

 Let's say we're looking at a cyber-crime scene comprised of several still powered on computers as well as confiscated smartphones. When the forensic investigator arrives, what does his workflow look like?

 Mobile devices are typically the most volatile of all the evidence, because they are constantly exchanging data (via wifi, 3G, Bluetooth, calls/SMS, etc.). The typical first step is to isolate those devices using appropriate measures (such as Faraday bags), to prevent a potential remote wipe or alternative technique directed to alter or destroy evidence in the device.

 Certain precautionary measures should also be taken into account, like disabling access passwords or PINs in case the device is unlocked (for preventing re-locking), connecting it to a power source (to prevent battery exhaustion), etc. Similar steps should be taken with computers (in case they are connected to the network).

 After that, a traditional forensics process can be carried out: on-site triage and pre-analysis if required, forensic acquisition of memory, hard drives, evidence preservation, etc.

 Mobile devices can at times be acquired at the forensic lab, where you work in a more friendly environment with a better signal isolation. In that case, you need to make sure the device is kept connected to a power source at all times, since the signal isolation will quickly drain the batteries.

 What forensics tools do you prefer and why?

 I literally have hundreds of forensic tools in my "bag", both open source and commercial, Windows, Linux and Mac. Each case typically requires different tools and techniques, and sometimes a specific small utility can save you hours of work. It is important to be up to date with the latest versions, keep an eye on new tools and new features of your current tools.

 If I have to mention just one tool, I will mention the SANS SIFT, which is open source and freely downloadable from the SANS website, and which comes with a myriad of forensic tools ready to use in a forensically friendly environment.

 What advice would you give to a forensic investigator that needs to present his findings in front of a jury in court?

 Court is a weird, confusing and at times hostile environment for technical professionals. In our world things are binary, black or white. Law is all about interpretation.

 f you need to testify in court, just be objective, translate to normal words any non-technical person can understand your findings and conclusions, in a professional and scientific way.

There is an excellent book, A Guide to Forensic Testimony, which I love and I always recommend to my students. It is a must read if you are going to testify in court, as it will open your eyes to how things work. A perfect case can be a lost case if the expert witness is not able to properly translate the findings for the audience.

 How can a forensic investigator make sure he strikes a balance between his work and a users' right to privacy?

 In a corporate environment there should be policies that take care of this, defining what a forensic Investigator can or cannot do. However, in many cases they are actually not in place, and you will have to use your common sense. But beware: the boundaries and interpretation of law are not easy to understand for a forensic examiner, and our common sense is sometimes not valid.

I always recommend to check with a lawyer as required. My advice would be: "be conservative and ask for expert advice if in doubt."

 Said that, our forensic tools can also help, as they allow us to do "blind searches" over the evidence which, with the right keywords, might be enough evidence that something is fishy.

 What are the fundamental differences in investigating Windows, Linux and Mac OS X systems?

 The difference is that in the Windows environment almost every artifact is a proprietary format and requires a different tool and technique for analysis, while in the Linux and Mac OS X worlds (which are part of the same *NIX family) artifacts are typically text or pseudo-text (some plist files can be compressed, but they can easily be decompressed on the fly).

 This allows easily automating many of the tasks in Linux/Mac investigations, consequently speeding them. Also there are many more obscure artifacts in the Windows world that we tend to discover day by day, being the Registry a world on its own.

 When I teach the SANS FOR408 course, in which we cover many of those artifacts, the vast majority of the students are not familiar with most of these artifacts, including very experienced professionals.

 What does your SANS training course look like? What skills can attendees expect to acquire?

 Think of a SANS course like one of the most extreme learning experiences you've ever had. One of the old sayings that students repeat is: "It feels like drinking from a firehose!" A SANS course is much more than just teaching some material.

Every instructor makes an effort to share his own real world experience (which in my case is 15+ years in computer security and forensics), in an intense and passionate way. We cover lots and lots of content, in a VERY hands-on way, with demos, in-class discussions, experience sharing, real world examples, etc.

 We all love this field, students and instructors, and both enjoying and learning as much as possible is the final objective. Always with a focus on real world practical things, on things that you can put to use as soon as you go back to the office. 

Thinking About Trying Bath Salts?

MEET A FEW FOLKS WHO DID!

Watch the NIJ Video--Human Factors in Latent Fingerprint Identification

Government Demands Growing for Twitter User Data

Reprinted from DFI News;  DFI NEWS Website 

In its first ever transparency report, Twitter reported Monday that the United States leads the pack when it comes to government demands for user data, having filed 679 requests in the first half of the year.

Worldwide, Twitter said it has received more government demands for data in the first six months of this year than all of last year.

In Twitter’s transparency report, it said it has complied with 75 percent of user-data disclosure demands by producing “some or all information” requested by U.S. authorities. Globally, the average was 63 percent.

Data previous to 2012 was not available. Twitter said it notifies its users of government demands “unless prohibited by law.”

The closest country behind the United States was Japan, which lodged 98 requests with a 20 percent Twitter compliance rate. The United Kingdom and Canada came in with 11 requests, with an 18 percent compliance rate. All of the other countries in the 23-nation Twitter report registered with less than 10 government demands.

“We’ve received more government requests in the first half of 2012, as outlined in this initial dataset, than in the entirety of 2011,” Twitter said on its blog.

The disclosure follows Google’s lead — nearly two years ago, when the search giant turned heads by publishing a treasure trove of data surrounding government demands for user data, in addition to information on the number of takedown notices connected to copyright infringement.

“Wednesday marks Independence Day here in the United States. Beyond the fireworks and barbecue, July 4th serves as an important reminder of the need to hold governments accountable, especially on behalf of those who may not have a chance to do so themselves,” Twitter said.

The Twitter report came the same day a New York state judge ordered the San Francisco-based microblogging site to divulge the tweets and account information allegedly connected to an Occupy protester.

Twitter did not say whether, at least in the United States, the authorities presented probable-cause warrants for user data. Manhattan Criminal Court Judge Matthew A. Sciarrino Jr.’s ruling Monday did not require local prosecutors to have probable cause to get the tweets and accompanying account information of an Occupy protester.

The company, however, listed a few reasons why it does not acquiesce to all government-issued, user-data requests.

“We do not comply with requests that fail to identify a Twitter user account. We may seek to narrow requests that are overly broad. In other cases, users may have challenged the requests after we’ve notified them,” Twitter said. Most famously, Twitter successfully fought to allow individuals being investigated for their connections to WikiLeaks to challenge requests for their Twitter data.

In a separate reporting category, Twitter said it received 3,378 requests to remove copyrighted material from Twitter in the United States for the first half of the year. The Digital Millennium Copyright Act requires internet service providers to remove works, at the copyright holder’s request, to avoid legal liability.

Overall, Twitter said it removed 38 percent of the material specified in the takedown requests. Among other reasons, Twitter said it does not comply with all requests because sometimes they “fail to provide sufficient information” or were “misfiled.”

Twitter also reported that it did not comply with any of the handful of requests from France, Greece, Pakistan, Turkey and the United Kingdom to remove content that is illegal in those nations.

Twitter’s not the first to follow Google’s transparency lead – Dropbox, LinkedIn, SpiderOak and SonicNetbeat

Among those who ought to be next: Facebook, AT&T, Verizon, Sprint, Yahoo, Comcast, Time Warner Cable, and Microsoft.

To Learn When new posts Are added: Sign Up For eMail Alerts Here