Over the years we have been invited in to see many morgues of various ages, designs, and with varying wear and tear. We have designed and observed the construction of several facilities and have been invited to tour other new facilities. There are many lessons to be learned in each of these facilities. Some of these are lessons on what to implement in your own facility, while many of these are examples of what not to emulate.
This checklist can help you to build a penetration testing lab. To successfully set up your lab will require attention to detail, redundancy, and a littel bit of paranoia.
Just consider autoclaves as large specialized pressure cookers. Autoclaves use heat and pressure with water to create superheated steam. As such, they can pose significant hazards to un-trained or lackadaisical employees.
Cloud computing raises some unique law enforcement concerns regarding the location of potential digital evidence, its preservation, and its subsequent forensic analysis. Further forensic issues concern the potential effect the cloud services could have on the digital data itself and how the forensic examiner can explain all these indiscretions to the court.
To position a camera for impression evidence photography, place it on a tripod, position the focal plane parallel to the impression, and ensure the camera is at a sufficient distance from the impression to avoid using a wide angle. Wide angle views can create distortion around the edges of the photograph.
The ways in which we handle our goof-ups, guffaws, screw-ups, bad decisions, miscalculations, and blunders are critical—our reputations are at stake. And as managers, we should role model the behaviors we seek in others. Here are 10 ideas on how to react to and recover from mistakes.
In recent years we have seen the drug market flooded with new psychoactive substances, often misleadingly termed “legal highs.” The emergence of new compounds is growing year on year, leaving many working in this area floundering under the ingenuity of the market, and the speed at which it reacts.
In today’s world of social media, investigators are taking on a new role; they are becoming a form of eyewitness. As the eyewitness, an investigator observes evidence that might not be visible to any other available investigator. The investigator is wise to create a record of what he or she sees at any particular point in time, including print outs of screenshots.
Every CSI needs a good crime scene kit. Take the time to build your own kit. Yes, it will involve more effort on your part, but you’ll save a lot of money and end up with only the things you really need.
A key factor in placing any person at the scene of a crime is obtaining evidence that can place an identified suspect as it relates to the scene of the crime. Previously discussed methods of physical surveillance and obtaining records are usually the best evidence of placing a suspect at a specific place and at a specific time, but as most investigations involve reacting to incidents, this may not be always possible.
Develop a program for dating stored chemicals and for recertifying or discarding them after predetermined maximum periods of storage.
It has now reached the point that it is no longer practical for an examiner to forensically analyze each and every piece of evidence. Depending upon the alleged crime, often the incriminating evidence can be found in an e-mail, a document, the browser history, an SMS, or some other source. This leads to the obvious conclusion that examiners are going to need a new approach to streamline their workflow.
In 2012 we published an article called “Why SSD Drives Destroy Court Evidence, and What Can Be Done About It,” back then SSD self-corrosion, TRIM, and garbage collection were little known and poorly understood phenomena. In 2014, the situation looks different. We now know things about SSD drives that allow forensic specialists to obtain information from them despite the obstacles.
When patrol officers and/or first responders arrive at the scene, they should look for dust footprints by taking a flashlight and rolling it along the floor. If they simply shine it into the room from a standing position, they’re likely to miss the prints. When they find prints, they should mark them with plastic or disposable tent markers.
A surprisingly powerful and less costly binary analysis technique, which does not require reverse engineering, is a review of the character strings contained in the executable. These strings might include, in an ATM machine, words like “Please enter your 4-digit PIN."