Crime Scene Training

Cybercrime - Collecting Digital Evidence

Compiled by Don Penven 

Digital evidence is fragile; and it is easily altered, damaged or destroyed, say experts in digital
forensic examination techniques. And the cause of anyone of these problems is generally not the suspect—it is from improper handling or examination. Obviously then, very special precautions must be taken with the goal of preserving any potential evidence an electronic device my hold.

Thus…some special steps are needed to ensure that the evidence is both protected and preserved in such a manner that it remains intact even during transport or temporary storage.

Those investigators charged with locating evidence on these devices are skilled and well-trained

In recovery methods and are acutely aware of the necessity for extracting the secrets held in the device’s memory. But the all too often, the crime scene investigators have had little or no specific training in dealing with digital evidence.

The point is that collectors and examiners should be exposed to virtually similar training. For the collectors of the evidence, departmental guidelines should be followed—if such guidelines exist. If not, an excellent source of information for “First Responders” is supplied in the “Guide of First Responders,” published by the Dept. Of Justice:  http://www.ojp.usdoj.gov/nij/pubs-sum/187736.htm.

For the digital forensic examiner, the following points are basic to a successful outcome:

• Document all hardware and software configurations of the examiner's working tools.
• The examiner must verify operation of his/her computer system to include hardware and software.
• Disassemble and remove the case of the computer to be examined in order to permit direct physical access to the storage devices while taking care to ensure the equipment is protected from static electricity and stray magnetic fields.
• Identify all storage devices that need to be examined. This includes devices can be internal, external, or both.
• Document internal storage devices and hardware configuration. Pay particular attention to the component’s condition as well as listing make, model, size, jumper settings, location and drive interface. Internal components such as the sound and video card, access control address, and PCMCIA cards.
• Disconnect storage devices using the power connector or data cable from the back of the drive or from the motherboard to prevent the destruction, damage, or alteration of any data present.
• Retrieve configuration information from the suspect's system through controlled boots   to capture CMOS/BIOS information and test functionality.
• Boot sequence (this may mean changing the BIOS to ensure the system boots from the floppy or CD-ROM drive).  Record time and date as well as any power-on passwords.
• Perform a second controlled boot to test the computer's functionality and the forensic boot disk.
• Ensure the power and data cables are properly connected to the floppy or CDROM drive, and ensure the power and data cables to the storage devices are still disconnected.
• Place the forensic boot disk into the floppy or CD-ROM drive. Boot the computer and ensure the computer will boot from the forensic boot disk.
• Reconnect the storage devices and perform a third controlled boot to capture the drive configuration information from the CMOS/BIOS.

 

• Ensure there is a forensic boot disk in the floppy or CD-ROM drive to prevent the computer from accidentally booting from the storage devices. Drive configuration information includes logical block addressing (LBA); large disk; cylinders, heads, and sectors (CHS); or auto-detect.
• Power system down.

Whenever possible, remove the subject storage device and perform the acquisition using the examiner's system. When attaching the subject device to the examiner's system, configure the storage device so that it will be recognized.

Exceptional circumstances, including the following, may result in a decision not to remove the storage devices from the subject system:

• RAID (redundant array of inexpensive disks). Removing the disks and acquiring them individually may not yield usable results.
• Laptop systems. The system drive may be difficult to access or may be unusable when detached from the original system.
• Hardware dependency (legacy equipment). Older drives may not be readable in newer systems.
• Equipment availability. The examiner does not have access to necessary equipment.
• Network storage. It may be necessary to use the network equipment to acquire the   data.

When using the subject computer to acquire digital evidence, reattach the subject storage device and attach the examiner's evidence storage device (e.g., hard drive, tape drive, CD-RW, MO).

Ensure that the examiner's storage device is forensically clean when acquiring the evidence. Write protection should be initiated, if available, to preserve and protect original evidence.

Note: The examiner should consider creating a known value for the subject evidence prior to acquiring the evidence (e.g., performing an independent cyclic redundancy check (CRC), hashing). Depending on the selected acquisition method, this process may already be completed.

 

If hardware write protection is used:

• Install a write protection device.
• Boot system with the examiner's controlled operating system.

If software with write protection is used:

• Boot system with the examiner-controlled operating system.
• Activate write protection.

Investigate the geometry of any storage devices to ensure that all space is accounted for, including host-protected data areas (e.g., non-host specific data such as the partition table matches the physical geometry of the drive).

Capture the electronic serial number of the drive and other user-accessible, host-specific data.

Acquire the subject evidence to the examiner's storage device using the appropriate software and hardware tools, such as:

• Stand-alone duplication software.
• Forensic analysis software suite.
• Dedicated hardware devices.

Verify successful acquisition by comparing known values of the original and the copy or by doing a sector-by-sector comparison of the original to the copy.

Sources:

1. Forensic Examination of Digital Evidence: A Guide for Law Enforcement by the NIJ

2. Electronic Crime Scene Investigation: A Guide for First Responders, Second Edition by the National Institute of Justice

 

 

 

Bath Salts – Confirming Probable Cause

By: Jack Thorndike, NARK News, Vol.2

One of the most common questions I’m asked concerning the new “Bath Salt” field tests is what kind of independent testing did they undergo before being offered to the law enforcement community?

Sirchie® prides itself in only offering presumptive field tests that meet both the stringent standards of the National Institute of Justice color test (NIJ standard: www.nij.gov/pubssum/183258.htm ) and scrutiny of independent government testing.

The Commonwealth of Virginia requires that all narcotic field tests being offered to law enforcement to confirm probable cause and bind through preliminary must have previously been approved by the Virginia Division of Forensic Science. (Regulations for the Approval of Field Tests for the Detection of Drugs - 6 VAC 20 - 220)

All of the standard field tests in both the tube and pouch configuration have all been approved through this process. Both the MDPV/Methylone Reagent (#NAR10024 –tube and #NARK20024 – pouch) and

Mephedrone Reagent (#NAR10025 –tube and #NARK20025 – pouch) have also been approved in 2011.

This now raises the issue of what probable cause do you have to suspect the substance being seized is potentially a synthetic stimulant (bath salts)?

• How is the substance packaged?

• Was it offered for sale as bath salts?

• What quantity of substance is being seized?

• Is the person suspected a known drug user or dealer?

• What does the substance look like?

Let’s now consider two (2) sets of circumstances and determine whether or not both of these cases meet the standard of probable cause.

Case #1: Through circumstances, a teenager agrees to be searched. In his pocket is a foil package labeled as “Ivory Wave” which reports to contain 1 gram of substance. Examining the substance itself, it is an off white powder.

Case #2: Through circumstances, a teenage agrees to be searched. In his pocket is a plastic baggie containing approximately 30 grams of a white powdery substance.

Even though circumstances allowed the officer to search the teenagers in both cases, their discoveries were drastically different. The 1st case is clearly leading the officer to suspect “bath salts” and would start his testing with the MDPV/Methylone Reagent.

In case #2, we have something drastically wrong. In most cases, the sale of 1 gram of suspected “bath salts” would run as high as $60.00. This means the teenager is carrying a value of $1800.00 of loose powder which potentially could be “bath salts”. Does that make sense? If this teenager were a dealer, his customers want to see the substance sold in a recognizable package or with recognizable markings.

In this case, the officer should be very wary of what he has seized.

Let’s now assume when the field tests were conducted, both cases were positive results in the #NARK20024 MDPV/Methylone Reagent. What would you do?

I would suggest that in Case #1, considering all the facts including the positive result of the field test,

there is clearly sufficient reasonable belief to establish probable cause to bind the suspect through preliminary hearing. However, in Case #2, even with a positive result I would be very wary of processing this case. Ask more questions and see whether or not there is a reasonable explanation for why this

teenager had the loose powder. Can his explanation be verified? If so, verify the explanation before proceeding.

What is a gram?

Investigators dealing in narcotics all the time have little difficulty in visualizing one (1) gram of substance. Those not dealing in dope regularly struggle with this concept. Take an everyday product we see, “Sweet ‘n Low”, and dump the whole package in front of you. You are now looking at one (1) gram of powder.

“Bath Salts” are sold in ¼, ½ and 1 gram packages. Relate that to the two cases presented above. Just one more piece of evidence that the zip lock bag containing a large volume of powder should be looked at with extreme caution.

In law enforcement we have long taken the results of field tests like Duquenois-Levine (Marijuana); Scott

Reagent Modified (Cocaine); and Mecke’s Reagent (Heroin) for granted. However, we must remember that all of these substances are “natural” products that originated from a plant. When legislation was enacted for these substances, they could be simply identified as THC, Cocaine and Opiates respectively. Since they are “natural” substances, they could not be changed to new formulations or new substances.

Now we have these synthetics. Even though the DEA emergency schedule recognizes the three (3) substances of MDPV, Methylone and Mephedrone, we also must recognize that you can “tweak” those substances into various analogs of the original formulas.

===> Bath Salts Test Reagent  <===

To receive notification when new posts appear, Signup For Email Alerts

 

 

 

 

Can Locard’s Exchange Principle Be Applied to Cyber Crime?

Cyber Crime is replacing drug trafficking.

By Don Penven

Recent government findings indicate that cybercrime has pushed aside the illicit drug trade as one of the top sources for hundreds of millions of dollars in ill-gotten gains the world over. In its infancy, the Internet seemed like something that could develop into a useable tool for scientific research. If we had only known back then what potential it held, perhaps more thought would have gone into its protection. 

Today the newswires are filled with reports of massive thefts of personal information as well as depleted bank accounts—all due to the criminal element that, for a small investment in a computer and an Internet connection, is changing the landscape of criminal investigation. One highly regarded research survey stated that 8.1 million Americans were victims of identity theft in 2010. Losses were in the hundreds of millions.

The Locard Exchange Principle (LEP)

Dr. Edmond Locard (1877–1966), known to many as the French “Sherlock Holmes,” was a pioneer in forensic evidence investigation. Locard formulated the basic principle of forensic science, “Every contact leaves a trace,” Of course Locard’s theory dealt with the physical contact made by the perpetrator to items in the crime scene. But today’s crime scene may not involve a physical structure—more than likely the crime scene is located out there in cyberspace.

So the question evolves, “Does Locard’s Exchange Principle apply to an electromagnet passing over a spinning disk?”  Some digital detectives believe that it does. For example, a hacker gains access to a computer system that may or may not be secure. Is any computer completely secure? Granted, security software is effective against many such invasions, but a secure system will only take the hacker a little longer to get into it. Now, the question is, does the exchange principle apply?

Cybercrimes leave no physical evidence

On the surface, the infiltrator would leave no physical trace of his having been there. But other electronic trace evidence may be present. If the computer’s file access logs were accessible, it’s possible that a record will be available showing that the file was, in fact, accessed, and even that a network transmission followed. Also a possibility is that a side-channel analysis of any activity on the hard drive will uncover network operations. As a last resort, the examiner may check the access logs of the Internet Service Provider (ISP) to uncover surreptitious entry. This step will not necessarily divulge what specific data was removed, but it will indicate that data was, in fact, lifted from the line. 

Industrial espionage is becoming commonplace

Personal information and cash are not the only targets of this spreading menace. Online industrial espionage is a growing threat to the U.S. economy as well as our national security. U.S. intelligence agencies recently warned elected officials that China and Russia are engaged in cyber-espionage. “Trade secrets developed over thousands of working hours by our brightest minds are stolen in a split second and transferred to our competitors,” said one counterintelligence executive. These foreign governments deny this claim.

The Cyber Exchange Principle

Perhaps when relating to cybercrime, the “Cyber Exchange Principle” applies. Forensic examination of a computer or server will uncover artifacts of invasion. The investigator is then, faced with a situation that the crime scene is not limited to a single computer and may involve another computer half the world away.

The hacker will not be leaving latent fingerprints, foot prints, or traces of physiological fluids in the wake of his intrusion. But electronic activity in this case can be far more valuable in the bits and bytes this activity leaves behind.  The principle that Locard espoused so long ago must be forefront in the minds of our digital detectives as they seek what clues an invaded computer holds as well as what traces are awaiting discovery out there in cyberspace. 

According to a leading manufacturer of cyber security software, the annual take by cyber criminals in 2011 was about $114 billion from 431 million adult victims globally. Learn more about cybercrime at Introduction to Cyber Crime

 

Steganography…An Introduction to Cyber-Encrypted Messages

By Don Penven

Steganographic methods are numerous. We see examples in spy movies and novels like invisible ink, microdots and plain cyphers. It seems only natural then that this covert means of sending messages would migrate into the cyber world of computers.

Computer technology opened up a whole new avenue of hiding messages using the hidden code on a page.  In fact using the electronic means of communication as most of us do, messages can be hidden within Web pages, images and online video and audio.

The term Steganography comes to us from the Greek-steganos (covered or protected) and graphei (writing). Cryptography (hidden-writing) is a term we are much more familiar with. But the two terms mean pretty much the same thing…and the terrorist element has learned how to use it.

USA Today reported a while back that (the late) Osama bin Laden and others "are hiding maps and photographs of terrorist targets and posting instructions for terrorist activities on sports chat rooms, pornographic bulletin boards and other websites, U.S. and foreign officials say."

This technique is a practice of embedding secret messages in other messages -- in a way that prevents an observer from learning that anything unusual is taking place. Encryption, on the other hand, relies on ciphers or codes to scramble a message in plain view.

Forensic cyber specialists cite the advantage for the “dark side” employing steganographic techniques. It should be noted that encrypted messages in plain sight—even if they are indecipherable—attract attention. Thus, steganography protects both the encrypted message but also the people sending and receiving them.

Steganography now includes the concealment of information inside of computer files, but In digital steganography, such communications may include coding inside of a carrier, like a Word  file, photographic file, and even software programs. Media files present the ideal platform for steganographic encoding mainly because of larger file sizes. As an example, a sender might start with an ordinary downloaded family photograph and manipulate the color of every so many pixels to correspond to a letter in the alphabet. This change is so subtle that someone not specifically trained to look for it is unlikely to see it.

I recently saw a stunning example of steganography that began with an image of a line of treetops, but hidden within this photo was a shot of cat curled up on a colorful blanket. We must never underestimate the abilities of those hell-bent on destroying us. Chances are that the very cryptographers plying this trade were educated right here in some of our finest U.S. universities.

Steganography is a really an interesting subject and it is outside of the common cryptography and system administration that most of us deal with day after day. But it is also quite real; this is not just something that's played with in the lab or some off-the-wall subject of study in academia. This threat may, in fact, be all too real — there have been unconfirmed reports that the terrorist’s behind the September 11 attacks used steganography as one of their means of communication.

It is very unlikely that the corner “Bookie” or embezzler will be using steganography any time soon. But look how the iPhone and iPad have revolutionized our daily lives in such a short time. A number of entrepreneurs have developed programs to seek out this form of encryption. Watch for updates on Digital Forensic News:  http://www.dfinews.com/  

Learn when new posts are made to this blog: Sign up For "Cyber" Alerts

CasTips07 – Casting With Polyvinylsiloxane

By Don Penven

Over the years I have worked with virtually every crime scene casting medium available. My first casts were of tire tracks in soft sand behind a business that had experienced a burglary during the previous night. Plaster-of-Paris was the casting medium because that’s all we could get from the local hardware store. And way back then, dental stone hadn’t even been heard of. Four 18” casts were submitted to the NJ State Police Crime lab, and all four were matched against the tires of a suspect vehicle.

Since then I’ve worked with several silicone compounds for toolmark and bite mark recovery. I’ve had good success with liquid silicone rubber, Mikrosil and Durocast, and I figured that nothing better was likely.

But remember that old saying, something about building a better mousetrap. Well someone did just that, but this mousetrap has become a valued addition to many crime scene investigation kits. And Polyvinylsiloxane is now my all-time favorite for most toolmark recoveries.

Polyvinylsiloxane (PVS) differs from the many silicone-based toolmark recovery methods in that it uses equal parts of base material and catalyst. Most of us who have used Mikrosil or Durocast have messed up casts because we used too little or too much catalyst when mixing the material. But the guesswork is eliminated when using PVS because of its unique delivery system.

PVS is supplied in cartridge form. Two side-by-side cartridges (base and catalyst) are hooked onto the delivery end of a device that resembles a caulking gun. A specially manufactured tip mixes the two compounds as the trigger is pulled on the applicator. Setup time for the cast is about 4-6 minutes.

What I’ve found most valuable with this delivery system is that mixing the correct amount of catalyst and base material is automatic—no guesswork or stop-watch needed.

PVS is the ideal medium for lifting powdered latent prints from textured surfaces. The base material is available in white brown and transparent. The technical manual explains it all HERE

 

To learn when new post are made to this blog: Signup for Email Alerts

Point of Interest: It hasn’t changed much in over 100 years.

The first spring-loaded mouse trap was invented by William C. Hooker of Abingdon Illinois, who received US patent 528671 for his design in 1894. James Henry Atkinson, a British inventor who in 1897 invented a prototype called the "Little Nipper", probably had seen the Hooker trap in the shops or in advertisements and used it as the basis of his model.

   

Top Photo: Quarter with developed latent print

Bottom Photo: PVS Cast of developed latent print

 

CasTips06 – Casting in Standing Water

By Don Penven

How often have you encountered footprints or tire tracks at the bottom of a puddle? Granted, this doesn’t happen often but when it does—desperate measures are needed to recover those impressions.

Most liquid silicone formulations will just float on top of the water’s surface. Casting plaster then seems like the best possible choice to make a useful cast. Here’s a technique I tried several years ago during a training session.

My students were from a state investigative agency and one student asked, “What about a footprint in a stream bed or puddle? How do we salvage that?”

I had no idea, but suggested we try a few techniques—maybe something would work.

At that time I had recently learned about dental stone as a casting medium, and we were using it during this training class. Nearby was a slow moving stream so one jack-booted student walked across the streambed. Sure enough, impressions were visible. Here’s the procedure we used:

1. Gather up some rocks along the streambed and build a protective dam across the line of flow. Don’t try to dam the entire flow—just use enough damming materials to divert the flow.
2. We had several plastic bags with a pre-measured amount of dental stone in each one. About 2 – lbs. per bag.
3. No special preparation was taken. We did place a casting frame around the impression to contain the plaster, and then just opened the bag and begin sprinkling the plaster onto the water’s surface directly above the impression.
4. The dental stone obligingly sank down to the bottom and collected over the footprint. We added a second bag that was mixed with water just to be sure, but that was probably overkill.
5. Naturally it took a while for the plaster to harden. While waiting for this to happen we set up sites to cast several damp footprints along the stream bank.
6. After about an hour or so I reached down and felt the cast and decided it was hard enough to lift it out. It worked!

We set the cast aside and allowed more curing time as we worked on the other impressions.

Since that time, at another training session, I tried out a different casting material. A product marketed as “Shake-N-Cast,” is available in pre-measured bags. Each bag has a built-in water capsule. To use the package merely apply pressure to the capsule until it breaks, and then squeeze the daylights out of the bag until a smooth mixture results.

But since my class wanted to see an underwater footprint recovered, we left the water capsule intact. (Special Note: It may be a good idea to use the water capsule, mix it up, and pour this mixture into the water. This may speed up the process.) Just behind our classroom we found a muddy area (it had rained for 24 hours straight). We found a couple of footprint impressions filled with water. This process provided a couple of excellent casts.

The Shake-N-Cast formula is a variation of dental stone and has an added ingredient—Portland cement. This makes a super-hard cast under most conditions, and it is ideal for casting submerged impressions at crime scenes.

Download the technical Information Sheet for Shake—N-Cast Here: 

http://www.sirchie.com/Assets/Manuals/pdf/UPD/SNC42-SNC100_TI03-190ENG.pdf

Keep up to date on the CSI Tech Blog posts: Register for Email Alerts HERE

 

Cyberspace: Where Did the Term Come From and What Does it Mean

By: Don Penven

Rarely does a day go by that we don’t come across the preface “Cyber.” We hear it in conversation, on TV and radio. We see it in print. Regardless of the source, we mostly tend to think of the term as having some relation to computers and the Internet.

Cyberspace is recognized in my Word spell-checker, but cyberstudy is not. And to further cloud the issue, cyber is often used as a single word, i.e. cyber crime, cyber intelligence. As time passes, what we once used as two words are now often merged into one. “Website” is now recognized as a single word in the Associated Press (AP) Style Manual (the guidebook for journalists).

After a lengthy search of more than a dozen websites for a definition of cyber and cyberspace, here’s what I found:

• Three different forums had subscribers say it stood for computer sex (we know where they are coming from).
• Webopedia: A metaphor for describing the non-physical terrain created by computer systems. Online systems, for example, create a cyberspace within which people can communicate…
• Wikipedia: Cyberspace is the electronic medium of computer networks, in which online communication takes place.
• And some believe the term cybernetics, and in particular “cyber” derives from the Greek for steersman, rudder, or pilot. Cybernetics is a term that referred to electronic communication and control science.
• The term cyberspace even appears on whitehouse.gov website.

Yes …I do have better things to do, but since I’ve been working on a series of articles about digital detectives, I wondered how a prosecution witness would define cyberspace or cybercrime if it was used during testimony.

In recent TV news broadcasts I heard representatives from the NSA, Homeland Security and the military express their beliefs that the greatest threat to the U.S. is not a terrorist attack. These officials believe that cyberspace will be the means whereby villains cross into our boundaries…through the Internet.

Statistics indicate that our federal government experienced over 41,000 cyberattacks in 2010 , and these are the ones they were able to detect. They spent close to $12 billion on Information Technology (IT) security that year—most of which covered employee salaries and benefits.

Identity theft is a growing problem. Chances are you have experienced it yourself or know someone who has. In my case I recovered a voicemail message from our home phone one Sunday afternoon. We were asked to call our bank’s credit card fraud unit. They verified that we used our credit card to pay for dinner on a Friday evening (in Raleigh, NC), and the next day our card made a number of purchases in Palm Beach, FL. The purchases continued through Sunday until the card was maxed out.

More recently, I received an Email from Facebook security (yes, they really have a security department). They asked if I had made posts on my page that morning. I had not. It seems that some chap in a Russian province (which I can’t pronounce, let alone spell) had been using my account.

Yes, law enforcement has made magnificent strides in the investigation of cybercrime. But will this prevent it? No it won’t. IT security experts tell us that over 800 million personal records have been stolen by hackers over the recent past. And despite the most complex, hi-tech security software available, some cybercreep will eventually hack into it.

 

Cyber forensics grew out of the screaming demand for greater law enforcement involvement in cybercrime. Today many agencies have created units that deal with this online mayhem, and many more are gearing up for it.  The trouble is that these computer specialists may never see the light at the end of tunnel called cyberspace.

We created a blog to provide online training in crime scene technology, and we will continue to post timely, easily understood posts covering criminalistics. But here of late we also see a pressing need for training in the dark world of cybercrime. Watch for more posts on this subject. 

To be alerted when new posts are made to this blog, Sign Up For <a href=http://www.sirchie.com/about/news.html>Email Alerting</a>

 

Digital Detectives: Search and Seizure of Electronic Devices

By Don Penven

The personal computer (PC) has ushered in a completely new way of living for people worldwide. Every day of the week, hundreds of millions of people spend countless hours on their PCs, tablets and mobile devices to handle their emails, surfing the Internet, add to or modify simple and complex files, and limitless other online activities…but so does the criminal element. 

The bad guys are very active in the information revolution and use the very same devices you may be using, but for unlawful, personal gain. All too often their computers provide the actual means of committing crimes. Some of the uses include the availability for thieves to grab your personal records; computers are used to distribute child pornography; a drug dealer, “Madam” or “Bookie” may maintain their client lists in spreadsheet databases; emails may be used to convey threats or sell fraudulent physical objects including stolen property.

 This criminal activity also generates a bread crumb trail of digital evidence that, and with skillful removal from the storage devices, will often lead to criminal convictions.

 Digital detectives are the newest cadre of specialists in the war against crime, and in-depth training and firsthand experience are basic requirements before the trainee ever touches a computer or smart phone.

 Along with the availability of opportunities for the aspiring confidence man or cyberthief, is a naïve, unsuspecting public that actually believes that the internet is a safe place to be. We have seen a dramatic increase in cybercrime over the past several years, and this requires law enforcement and prosecutors to be better able to obtain electronic evidence residing in myriad electronic devices. Electronic records such as computer network logs, email, word processing and image files increasingly provide the cybersleuth with valuable  evidence in criminal cases.

 There are two primary sources of the law governing electronic evidence in criminal investigations: the Fourth Amendment to the U.S. Constitution and the statutory privacy laws codified at 18 U.S.C. §§ 2510-22, 18 U.S.C. §§ 2701-12, and 18 U.S.C. §§ 3121-27. Although constitutional and statutory issues oftenoverlap on occasion, most investigations present a constitutional concern under the Fourth Amendment or a statutory issue under the above three statutes.

(For more specific information, please consult the Dept. of Criminal Justice Manual: Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations. 

As is always the case, the Fourth Amendment to The Constitution is open to the interpretation by the courts. But caselaw and the statutes listed above attempt to fill in the gaps. The Fourth Amendment to the Bill of Rights serves as a safeguard against unreasonable search and seizure. So the question that will often raise its ugly head is, do we need a search warrant? 

There is no quick answer this. As a general rule, many investigators find it most expeditious to get a warrant. When in doubt—write it out.  Of course there are several exceptions that permit warrantless searches of electronic devices. Here are just some of the situations when warrantless searches have been sanctioned by the courts: 

Consent Search: First, we need to understand…when does a search exceed the scope of consent? For example, when an individual consents to the search, to what extent does the consent authorize the seizure of information stored in computers at a particular location? Second, who is the authorized party that can consent to the search? May roommates, friends, and relatives give the authority to a search of someone else’s computer files? 

Exigent Circumstances: The exception to the requirement for a search warrant applies when one of the following circumstances is present: (1) the evidence is in imminent danger of being destroyed—either accidently or on purpose; (2) a threat exists that may put either the police or the public in danger; (3) the police are in “hot pursuit” of an individual; or (4) the suspect is likely to take flight before a search warrant can be secured. 

Search Incident to a Lawful Arrest: The rulings began with pagers and now it extends to cell phones and other personal electronic devices carried on the person. The courts have generally agreed that the search incident to arrest doctrine applies to such portable devices. But a PC sitting on a desk across the room would not be considered “incident to arrest,” unless, of course, the computer screen was displaying child pornography, which would be in … plain view. 

Plain View: To rely on this exception, the official must be in such a position to observe and recognize the evidence for what it is, and the incriminating character seen on the device must be immediately apparent and not subject to individual interpretation. 

Inventory Searches: This exception to the warrant requirement is valid when two conditions are met. First, the search must serve a lawful, non-investigative purpose (e.g., to protect the electronic device while he/she is in custody; thus insuring against claims of lost, stolen, or damaged property; that outweighs the violation of the individual’s Fourth Amendment rights. Second, the search must follow standardized procedures as reported in Colorado v. Bertine, 479 U.S. 367, 374 n.6 (1987) and Florida v. Wells, 495 U.S. 1, 4-5 (1990). 

 Border Searches: In order to protect the government’s ability to seize contraband and other unlawful property including guns, narcotics and drugs that may enter or exit the United States illegally, the U.S. Supreme Court has offered a special exception to the warrant necessity for searches that occur along the borders extending thousands of miles around the United States. 

Conditions of Probation and Parole: Individuals on probation, parole, or supervised release have no expectation of privacy in most matters and may be subject to warrantless searches based on a reasonable suspicion—without any particularized suspicion bring apparent. 

The Dept. of Justice manual listed above is an excellent source of electronic search guidelines. It was written for use by prosecutors and defense attorneys, but it should be required reading for all digital detectives. 

Crime scene investigation has been, of necessity, extended to cover the myriad electronic devices commonly in the possession of a sizable chunk on our population. Learn more about crime scene technology and investigation, as well as methods and equipment used by crime scene investigators and forensic experts in the CSI TECH BLOG.  Use the navigation bar to the right under Categories.

To receive notification when new posts are made to this blog: Sign Up for Email Alerts.