In today’s world of social media, investigators are taking on a new role; they are becoming a form of eyewitness. As the eyewitness, an investigator observes evidence that might not be visible to any other available investigator. The investigator is wise to create a record of what he or she sees at any particular point in time, including print outs of screenshots.
Every CSI needs a good crime scene kit. Take the time to build your own kit. Yes, it will involve more effort on your part, but you’ll save a lot of money and end up with only the things you really need.
A key factor in placing any person at the scene of a crime is obtaining evidence that can place an identified suspect as it relates to the scene of the crime. Previously discussed methods of physical surveillance and obtaining records are usually the best evidence of placing a suspect at a specific place and at a specific time, but as most investigations involve reacting to incidents, this may not be always possible.
Develop a program for dating stored chemicals and for recertifying or discarding them after predetermined maximum periods of storage.
It has now reached the point that it is no longer practical for an examiner to forensically analyze each and every piece of evidence. Depending upon the alleged crime, often the incriminating evidence can be found in an e-mail, a document, the browser history, an SMS, or some other source. This leads to the obvious conclusion that examiners are going to need a new approach to streamline their workflow.
In 2012 we published an article called “Why SSD Drives Destroy Court Evidence, and What Can Be Done About It,” back then SSD self-corrosion, TRIM, and garbage collection were little known and poorly understood phenomena. In 2014, the situation looks different. We now know things about SSD drives that allow forensic specialists to obtain information from them despite the obstacles.
When patrol officers and/or first responders arrive at the scene, they should look for dust footprints by taking a flashlight and rolling it along the floor. If they simply shine it into the room from a standing position, they’re likely to miss the prints. When they find prints, they should mark them with plastic or disposable tent markers.
A surprisingly powerful and less costly binary analysis technique, which does not require reverse engineering, is a review of the character strings contained in the executable. These strings might include, in an ATM machine, words like “Please enter your 4-digit PIN."
Malware is an important consideration for examiners working on traditional computer forensic cases. Malware can add complexity to a case, but in some instances, it actually can help investigators. Like any other piece of data, malware can be used as a clue within a forensic examination.
A manager’s procrastination tendency raises its ugly head, commonly, when planning for a new project. “Paralysis by analysis” becomes the mode of operation—or non operation. As a manager, your job is to get things done. Don't let procrastination keep you from getting there. If you think that procrastination is a problem for you, you have to deal with it.
Before you step under the tape, stop and study the tracks going into and out of the crime scene. Compare tracks to the tread pattern of those at the scene, and take care not to damage any tracks on your way in.
Working in forensic sciences will invariably bring you into potential contact with infectious agents. The foundation for safe performance of duties and proper containment is an effective exposure control plan. This article discusses the basic elements of a comprehensive exposure control plan, what each element should contain, and tips on successful implementation.
Laboratory equipment is one of the drivers of the design of a forensic facility. In this article I will review a few pieces of equipment which have changed over time and how lab design has been adapted to meet those changes. I will review a change in the equipment used to compare and analyze firearms evidence, genetic analyzers used in DNA analysis, and a piece of equipment which tests toxicology samples.
Often an examiner will analyze all the digital media only to determine that the probative data was limited to a browser’s history file, an e-mail, a document, the mobile devices’ logs, or an inappropriate graphic video or picture. Finding the critical probative data faster in a cost effective manner while reducing or eliminating case backlogs is going to require a more efficient methodology.
Recently I was training a group of investigators at a large law enforcement agency on wet-vacuum forensic DNA collection. Over the course of our conversation, I learned there were a couple of people who were not overly enthusiastic about introducing a new collection method to the cases. This hesitancy from some didn’t surprise me, but it did get me thinking about how to address it.