Major Goals of a Crime Scene Search
* The recongnition and identification of physical evidence
* The collection and proper preservation of the evidence
* Reconstrutction of the crime
* To assist detectives in forming a theory about the crime
The job of the CSI in "forensic science"
Is to properly recongnize, identify, collect, and preserve those pieces of evidence that begin the process known as justice.
CSIs are responsible for what two of the four steps in the admissiblity of phiysical evidence for court?
recognition and collection
Four Major Factors that Determine the Value of Physical Evidence
Recognition-the CSI must have the knowledge and understanding to recongnize potential items of physical evidence located at the crime scene
Collection-Utilizing the appropriate skills and following accepted protocols to gather and preserve the physical evidence
Testing Procedures-Application of acceptable scientific procedures to analyze the physical evidence
Courtroom Presentation-Qualifications of the witnesses to provide objective reports on the forensic analysis of the evidence
Utilizes archaeological recovery techniques at scenes of mass graves or exhumations
Can aid in determining time since death or assist in placing a suspect or victim at a location by studying the anatomy of plant evenidence
Can evaluate the life cycle of insects found at the scene or on the body of a victim to assist in establishing investigative leads such as the movement of a body after death, manner of death, and the postmortem interval
Dentist with special training in the evaluation and handling of dental evidence, including bitemark comparison and the identification of victims/suspects
A medical doctor with additional specialty training in determination of injuries and disease that cause death
A medical doctor with five or more years of specialized training in recognition of the cause and manner of death
An eleted or appointed official who conducts death investigations. the coroner is not required to have a medical background and his/her duties are dictated by jurisdiction.
Forensic Specialties Accreditation Board- provides accreditation to those certifying bodies that meet stringent requirements for training, education, experience, and testing of individual forensic scientist and specialist.
the duty of the expert witness is to
educate the jury and provide testimony using terminology that is easily explainable and not misunderstood.
expert witness testimony may be challenged in the following ways:
*the case may not require the expertise
*Basic qualifications and ability to give an opinion in the field at issue
*Insufficient education or experience to have anything of value to offer (no vaule added)
*the methodology utilized to support the opinion may not be scientifically sound or capable of supporting the profered opinion
*The methodology may be scientifically sound, but the opinion based on the method is not sufficiently derived from that scientific methodology
discrediting the chain of evidence, the scientists, or the science is known as the OJ effect and has become a key defense technique
Physical evidence is valuable in many aspects and can reveal data that will aid the investigation by:
*Providing essential information on the facts of the case-corpus delicti
*Revealing the modus operandi (MO)-the preferred method of operation
*Demonstrating linkages between the vicitm, suspects, locations, and objects
*Proving or disproving witeness statements
*Identifying a suspect through DNA or other individualization
*Classifying unknown substances
*Reconstructing the crime scene-how a crime was committed
*Developing investigative leads
physical evidence that cannot be related to a common origin with a high degree of certainty, therefore it can only be associated with a group and never a single source
are distinct differences in the physical evidence that allow it to be associated with a single source and allow the examiner to determine the uniqueness of any single object or piece of evidence
items of physical evidence located during a crime scene search can be used to demonstrate linkage or to "associate" the victim to the suspect or to a particular location
Mincey v. Arizona
dictated what actions law enforcement personnel are authorized to take without first obtaining a warrant
Items that can be obtained without obtaining a warrant
1. Seach the scene for rictims and render aid in areas where a victim could resonably be found
2. Enter the scene to search for perpetrators (only in areas where a suspect could be located)
3.While officers are legally in a location performing either of the two aforementioned actions, they may swize items of evidentiary nature that are in plain view-however, this should only occur in exigent circumstances, such as an unsecured weapon
is defined as physical evidence that may be lost forever if not immediately preserved
Fruit of the poisonous tree
If the physical evidence is tainted then any subsequent information derived from that evidence would also be tainted
Frye v. United States
rejected the admission of a polygraph test on the basis that the reliability of the intrument had not been proven.
established the criteria that define judicial acceptance of scientific advances. Basically, the ruling requires expert testimony to be based on scientific principles or procedues that have already been generally accepted winthin the scientific community. Courts will hear testimony from experts in the field as well as consider scientific papers before determining the acceptability of a technique
Federal court system guideline when dealing with the admissibility of expert tesimony relating to scientific analysis of physical evidence. The judge is responsible for the determination of qualifications of an expert witness and if they can offer an opinion based on knowledge, skill, training, or education and experience. Only apply to fedeal court proceedings but many state courts have adopted these guidelines.
the court will require proof that the scientific basis underlying the opinion is generally accepted in the scientific community and is relevant and reliable. Judges must assume the responsibility of becoming the gatekeeper in determining the admissibility of scientific evidence.
"Relevant and Reliable" standard of Daubert
Prior to acceptance of expert testimony the jusdge must determine if the reasoning or methodolog underlying the testimony is scientifically valid and can be applied to the facts at issue
Chain of custody
usually referes to the documentation of the location of all physical evidence at all times
The purpose of documentation is to
create a permanent record of the condition of the crime scene and the physical evidence
Four stages that must be completed during documentation include:
1. taking notes 2. videography 3. photography 4. sketching
Photo log indicates:
time and date, roll number, camera settings, distane to the subject, and a brief describtion.
Is the control included in final laboratory results?
the control will be documented and included in final laboratory results
When establishing boundaries should they be smaller or larger?
Always secure a larger area and then reduce the area as additional information is determined
*No eating, drinking, smoking, or using cell phones in the crime scene
*Be alert for biological, chemical, environmental, or mechanical hazards
*Watch for sharp objects such as hypodermic needles, knives, razors, broken glass, nails, exposed metal, or other objects
*Do not use the bathrooms at the crime scene
*Never pick up broken glass with your hands. Use a brush and dust pan, tongs, forceps, or tweezers and place the pieces in a secure container
*Place all syringes, needles, and other sharp objects in a puncture resistant container with a biohazard waring label. Never recap or place covers such as erasers over hypodermic needles.
*When searching confined spaces, use mirrors, flashlights, and other tools before placing your hands in the space. Do not overlook the potential for poisonous spiders and/or snakes in narrow or confined dark areas
*Always use caution in unknown environments. Exotic pets may pose a hazard-poisonous snakes, scorpions, and spiders can startle the unsuspecting CSI
*Always wash your hands or other skin surfaces thoroughly and immediately if you come in contact with any body fluid. The universal decontamination solution is a diluted solution of bleach 1:10 or 70% isopropyl alcohol
Types of PPE
Gloves, Tyvek suits, shoe covers, and eye and respiratory protection are essential for ensuring personal safety.
are infectious disease causing microorganism that may be found or transported in biological fluids. Treat all human blood and body fluids as though they are potentially infectious.
Fluids other than blood that may contain pathogens include:
urine, feces, tears, sweat, nasal secretions, saliva, semen, vaginal secretions, breast milk, and vomitus. Human body also contains cerebral spinal fluid as well as synovial (joints), Pleural (chest), peritoneal (abdomen), amniotic and pericardial (heart) fluids that can carry bloodborne pathogens.
Most common bloodborne pathogens
Human Immunodeficiency Virus (HIV-AIDS), Hepatitis, rabies, and sexually transmitted diseases.
Does PPE guarantee total protection from bloodborne pathogens
PPE does not reduce the hazard or guarantee total protection-it is used to minimize the exposure or contact with potentially hazardous materials
When should you change gloves
frequently to reduce the possibility of cross contamination. Immediately if they become punctured or torn
A face mask must be used with what?
with goggles or safety glasses-it does not provide adequate protection if used alone
A disposable dust/surgical mask will fillter what?
will filter out large particulate matter, but does not provide repiratory protection from chemical vapors or biological contaminants.
What type of respirator is required for the CSI to work in a potentially contaminated enviornment?
Air purifying respirator (APR)
High-efficiency particulate air (HEPA) filter attached to the APR provides additional protection as air is drawn through the filter by the wearer.
Indirect contamination of your face can occur how?
Touching or rubbing your face with contaminated gloves
For HazCom yourr employers mmust
1. Develop, implement, and maintain at each workplace a written hazard communication program
2. Compile a list of every chemical that is in use with MSDSs on each
3. List the methods or procedures the employeee will perform that iincolves thhe use of chemicals. Precautionary measures must be included in the Hazzcom program. Written protocols must be establiished that ensure that appropriate emergenccy procedures are in place in th event of an acciident.
Hazardous Materials Identification System-chemicals must be properly labeled with appropriate hazard warnings labels
Color standards for HMIS
white section=special info ie what PPE to wear
Numarical system for HMIS
0 (no hazard)-4 (Severe hazard) which indicates the severity of the hazard. label also must include OSHA threshold limitys, if it is a potential carcinogen, proper emergency and first aid procedures and name and contact info of the chemical mau
What should be in a CSIs Notes?
* time and date of notification/how notified/by whom
*Time of arrival on the scene, weather conditions, climate, lighting, outdoor and indoor temp
*Fixtures, doors, windows, gates, and their condition (open/shut locked/unlocked)
*Odors and other changing or eteriorating items (we footprints, melting ice cream)
*Identification and appearence of persons in the crime scene
*Location and condition of items within the scene
*Items that were moved or changed, by whom, and for what purpose
*Appliances (off-on, hot-cold)
*Peronal items-either miss or in place (wallet, keys, shoes)
*what tasks were performed and who completed those tasks
Gun and powder create blowwback on the rear of the gun, which deposits what?
primer, lead, barium, and atimony
Can be tested by swabbing the suspect's hands by swabbing with
use a cotton swab moistened with nitric acid. GSR can remain on the hands for up to 6 hrs after after a weapon has been fired.
fingerprints, palm prints, nose or ear prints, toolmarks, and foot wear/tire impressions
Four findings that can be related to the examination of bitemarks, provided a suspect has been identifed:
*Definite-to the exclusion of all others
*Consistent-no features present that will exclude the suspect
*Possible-due to the nature of injury, ubable to positively confirm or exclude the suspect
*Exclusionary-Definitely not made by the suspect
composed of calcium sulfate (plaster of paris( with potassium sulfate for greater hardness
analysis of the properties and effects of serums (bood, semen, saliva, sweat, or feal matter
screening test is the first of two processes the lab performs to check for the presence of a drug or poison
is the second step. the most common process for this is gas chromatography-mass spectrometry (GC/MS)
Common locations (of the body) where DNA can be easily obtained
blood, bone, urine, dandruff, ear wax, fingernails, skin, sweat, hair, seminal fluid, vaginal or rectal cells, teeth.
Advantages of DNA Analysis
*Identify a suspect
*Implicate or eliminate a suspect
*Place a known individual at a crime scene
*refute a claim of self defnse
*Put a wapon in a suspect's hand
*Change a suspect's story from an alibi to one of consent
*Analyze unidentified remains
*resolve paternity/maternity cases
*Link related cases
*Provide leads in cold or unsolved cases
*Be used to appeal convictions
What should be documented when presumtive blood tests are done?
location, time, date, name of CSI performing tests, and specific test that were conducted
PERK kit contains
physical evidence recovery kits contain swabs, slides, test tubes, combs, and paper envelopes
is the emission of light without the emission of heat as the result of a chemical reaction
Bloodstain pattern analysis
is the examination of the shapes, locations, and distribution patterns of bloodstains, in order to provide an interpretation of the physical events that occured at the crime scene
How much bloodmust be lost to produce irreversible shock and death?
40% of the total volume of blood. Men have 5-6 liters of blood in the body, women have 4-5 liters
Low velocity impact spatter
results when blood is traveling at about 5 feet per second. This type of blood spatter averages about 3mm or more in diameter.
Medium velocity impact spatter
creats smaller spatter and is produced when velocity of the force is between 5-25 feet per second. Blunt trama may result in MVIS or stabbing that can range from 1mm to 3mm in diamter
are created by blood being propelled by a force greater than gravity from being flung off a blood object
High velocity impact spatter
occurs when the velocity of the force is above 100 foot per second and is generated by a gunshot, explosion, power tool, or automobile accident. Almost mist like smatter and less than 1mm in size
Impact and projected spatter stains
result of splashes, cast off, arterial spurt, or gushing, as well as from the impact itself and expiration
may indicate movement of a victim after being injuried. They are created when large columes of blood are falling from a source such as an injury.
is created when a wet blood surface comes in contact with a seondary surface. a recongnizable image of all/a portion of the orginal surface may be observied in the patter. Transfer stains occur from sipes, swipes, transfers, or contacts
are observed when a perpetrator attempts to clean up a crime scene by wiping away blood with a cloth
is created when n item is removed from the area after bloodstain spatter has been created
occur when the perimeter of the stain has dried and the center has flaked away, leaving the visible outer ring
what can a bloodstain pattern analyst tell you
*Position of victim or suspect
*Evidence of a struggle
*Areas where stains are absent
*In line stain patterns created by cast off
*sequence of events
*How many impacts and from what direction
*whether stains or patterns are sonsistent with statements
*May determine information that eliminates other avenues of investigation by identifying whose blood is where
Questions a firearms examiner can answer
*What type and caliber of weapon was disccharged?
*What angle and distance was the gun fired?
*what was the sequence of events?
*was the firearm function properly
Bloodstain pattern analysis is a science because
the stains and patterns can be reporduced under controlled circumstances
Jacket is usually
brass, copper, or an alloy and this keeps the bullet from jamming, melting, or disintegrating.
Firearms identification is primarily concern concerned with
the determination of whether a bullet, cartridge casing, or other ammunition was discharged, extracted, or ejected from a specific firearm.
Class characteristics of bullets
*Number of lands and grooves
*width of lands and grooves
*Degree of twist
*Direction of rifling twist
Class characteristics of cartridges discharged in guns
*Firing pin location
*Relative location of extractor/ejector
*Extractor and ejector marks
*Firing pin size and shape
Three conclusions the firearms examiner can render concerning the comparison of a suspect weapon to recovered bullets:
1. The bullet was fired by the suspect gun
2. Class characteristics and striations do not match; therefore, the suspect gun is excluded
3. Class characteristics match, but striations do not; therefore the resuults are inconclusive.
After doucmenting the firearms' position do what?
examine the firearm for trace/transfer evidence, such as latent fingerprtins, hair and fiber, toolmarks (defaced serial numbers, and blood spatter evidence.
If the firearm is a revolver indicate...
the position of the cylinder as well as the chamber from which wach cartridge or cartridge casing was unloaded
why photograph the front and back of the cylinder?
this will allow you to document the cylinder GSR flash rings (halos) around the chambers on the front of the cylinder as well as the cartridge head stamps that indicate caliber and make of the firearm.
Bullets or bullet fragments may be classified as...
projectiles, components from a cartridge, or deformed bullets.
On the container containing bullets/bullet fragements indicate
the souce of each item, affix appropriate labels, and seal the evidence package.
what should be done before attempting to remove shot material
Take meaurements, videotape, and make written notes before attempting to remove the shot material
Firearm recovered underwater should be packaged...
in water in a sealed plastic bag to keep the weapon from rusting. This bag should be packed in a sturdy box and properly labeled and sealed. Then it should be hand delivered to the laboratory to prevent any damage occuring to the weapon or packaging.
Fired cartridge casings may contain marks left by....
the firing pin, ejector, extractor, magazine, chamber, and breech face
What information can the wadding or pistons bring to light
make of the shotgun shell used, gauge of the gun, approximately position from which the shot was fired, and the size of the shot that was loaded in the shell
You can expect to finding wadding or pistons with a distance of _ from where the shot was fired?
0 to 40 feet
Chemical test for lead
Sodium rhodizonate test. the solution should preferable be mixed fresh at the scene because it has a very short shelf life. Positive result is a dark red to purplish color
When should field tests not be done of bulestic evidence?
should not be performed on possible bassistic damaged clothing in the field. Better perofrmed in a laboratory.
Other questions that may arise with ballistic damage evidence are:
*Which damage indicates and entrace or an exit hole?
*what is the sequence of events and shots fired?
Other facts to consider when formulating the discharged shell casing pattern tests:
shotter's height or suspected height, shooter's hand position and grib, the angle, trajectory, and sequence of shots, any movement of the shooter, weather conditions, and type of ground surface at the scene
Impact side when a bullet hits a surface
Imapct side will cause the impacted surface to come under compression
Opposite side of the impact will come under
tension. It will break or fracture first, causing uneven, rough, damaged edges
begin at the center of the impact site and propagate outward like an asterisk symol and occur on the exit side of the glass due to the tension breaks
are a series of circular cracks that surround the impact site and move away from the site eith each circular fracture increasing its diameter as it propagates outward. Concentric fractures occur on the impact side of the glass after the radial fractures
Laser protractor kit
is set to the calculated angle and placed in the appropriate locatin at the site of the pattern. the laser is then projected to a possible terminal point
Trajectories sjould be documented...Methods of photographic documentation that can be employed
1. utilize photographic fog to visualize the lasers and phtograph the illuminated trajectories from several vantage points
2. After identifying the terminal points, mark them. then, utilizing reflective photographic strings or colored strings stretched tightly and secured between the sites-bullet hole(s) ard terminal points, take photographs of the trajectory strings from several vantage points
Laser trajectory rod kit consists of a variety of items needed for determining trajectory
*set of brightly colored trajectory rods, with female scre connectors
*At least two end rods (one end of which has a blunt rounded tip and the other female screw connector)
*Several double sided male screw connectors
8several plastic bullet hole centering guides with rubber o ring stoppers
*Several plastic eye hook string attachments with male screw connectors
*Several brass tripod base plates with femal screw connectors
*An angle finder
Note of caustion about using lasers over extremely long distances
the longer the distacne the less likely your laser trajectory will be accurate
GSR is projected at a high velocity out of the
muzzle, chamber, breech, trigger, or any other area of the firearm where there is an opening
The absence of powder residues may be due to one of the following
*A shot may be fired beyond the maximum distance at which residues would have been deposited
*Excessive blood may wash away any gunshot muzzle residue orginally present
*there may have been an intervening object between the gun and the target
*Improper handling of clothing may have dislodged residues
*In the case of a contact shot, the powder reidues can be introduced into the would and may be visible under the flaps of the skin surrounding the entrance wound
is the term used to describe the physical defect caused by the penetration of the skin by gunpowder particles.
integrated ballisticcs information system equipment digitally captures images of fired bullets and fired cartridge casings and compares them to the images of test fired ammunition from recovered firearms
GSR is composed of
the deposits of unburned or partially burned gunpowder particles, primer residues, and soot that remain after a firearm is discharged. Primer residue inclues barium, antimony, and lead and is producted from ignition of the primer
Variables that can impact gunpowder residue
Type of firearm and ammunition as well as the barrel length, weather conditions, and distance of the weapon to the target all affect the probability of locating GSR as physical evidence
Procedures that can be conducted in an attempt to recover the orginal serial number
Magnaflus (magnetic particle inspection), chemical etching, ultrasonic cavitation, and other procedures
Three chemical processes utilized at the laboratory to recover serial numbers are:
*Acidic ferric chloride
A tool mark is
any impression, cut, couge, or abrasion left on an object that is sofer than the object or tool that caused the marks
Tool mark impressions are didvided into three general categories
primary safety concerns of fire scenes
enviromental health concerns and dange of collapse due to continuing deterioration of physical structures
fire scenes should be worked from...
the area of least damage inward to the area where the most destruction has occured
Fire is a chemical process that requires
heat, fuel, and oxygen. This is known as the fire triange. If any one of the elements is remvoed the fire will go out
indicate the nature of the flame, heat, and smoke movements within a structure and the damage creates patterns that investigators can use to locate the area of origin
also known as fire patterns, are visible effects, such as charring, smoke, and soot deposits, changes in the character of materials, and the consumption of consumables, that may indicate the ignition source of a fire
Three modes of heat transfer
Convection, conduction, and radiation; together these modes produce many of the fire patterns found in a structure.
Trailers or streamers
are fire patterns that are created when ignitable substnaces, are deliberately trailed from one area to another in an incendiary fire
Inspection and movement or removal of debris to ensure that smoldering embers are not allowed to rekindle the flames
Physical evidence recovered at the scene of a fire may be relevant to
determining the orgin, cause, spread, or responsibility for the fire
Three Primary reasons for the investigations of fire scenes
*the point of origin must be determined in order to establish the cause of the fire; accidental, natural, incediary, or undetermined
*There may be public safety issues concerning product reliablity and the investigation can assist with uncovering areas of concern for manufacuring defects or misuse of these products
*Owners may be in violation of state or local fire codes and/or building codes, which has placed the lives and property of others in jeopardoy
Motives for setting fires include
vandalism, excitement, revenge, profit, extermism (terrorism), and concealment of another crime.
Four identified categories of excitement motivated fire setters
Thrill-seeking, attention-seeking, recognition, sexual gratification/perversion
is the willful and malicious burning of another's property or of one's own property for some illegal purpose
Area of origin of a motor vehicle fire is determined by
the burn patterns on the body panels and the interior of of the vehicle
At time of arrival at a vehicle fire, first responders should
one should etermine what was on fire or what part of the vehicle was on fire and whether there was nything present that indicated the cause of the fire. Inquire of firefighters whether they observed anything unusal and identify who reported the fire.
Additonal information you should include in your vehicle fire documentaiton
odometer reading, last service date and location, what equipment was on the vehicle (radio and other accesories), how far the vehicle had been driven, when the vehicle was last fueled, and any unusual damage or unreported damage
The goal of fire investigation is to
identify the location at which the fire began (origin) and then determine the reason that the fire started (cause).
standards that dicate the knoledge skills and abiliies that arson investigators must master
CBRNE crime scnes
scenes involving weapons of mass destruction-chemical, biological, radiological, nuclear, and explosive
Validated methods for searching for ISR
certified accelerate dectection K9s, electronic detectors, forensic and alternate light sources, and field flame/burn tests. these are all presumptive field tests
Electronic detectors cannot
differentiate between isrs and the pyrolyzed fire scene debris with the exception of gas chromatorgraphy/mass spectrometry and the Fourier transform infrared spectroscopy
when evidence interacts with the various wavelengths of light, four possible effects can occur
it may fluoresce, absorb, cast shadows, reflect. FLS/ALS will cause many types of ISR to fluoresce from several light wavelengths. the fluorescence strength is directly proportional to the strength of the absorbed light
refers to the destruction or alteration of evidence or the failure to preserve property as evidence in pending or potentiial litigation
Sources of ignition
power cords, irons, lights, matches, buring cigarettes, lighting, stoves, and heat sources such as floor or kerosene floor heaters
Accelerant will spread towards
the lowest point in the room and is often not fully consumed during the fire
deliberately set under circumstances that the person knows the fire should not be set
Chapter 20 of NFPA 921
emphasizes the importance of investigating every fire scne that involves serious injuries and a fire or expolosion that has immediate fatalities.
For an adult body to be reduced to ashes it must be exposed
for several hours to temperatures ranging from 1800-2000 degrees fahrenheit
Fire victims are often found in a
crouching 'pugilistic" stance which results frm the effects of the fire on the body
An explosion is
the sudden and rapid escape of gases from a confined space, usually accompained by high temperatures, violent shock, and loud noise
occurs when there is a build up of pressure in a container until the pressure exceeds the structural resistance of the container
are produced by fission-splitting of the nuclei of atoms, or fusion, which forces the nuclei of atoms together under great pressure
Two categories of explosives
low explosives, which burn rather than explode
High explosives, which are detonated by shock and do not have to be confied to explode
High explosives are subdivided into three groups based on their sensitivity
*Primary-will detoneate forefully and are extremely sensitive to heat, shock, or friction. Generally used to manufacture blasting caps and are not often used as the main charge
*Secondary-include dynamite and military grade explosives require a detonating device or initiating explosion such as that found in a blasting cap
*Tertiary explosives-least sensitve explosive type. Require a booster or secondary high explosive to cause detonation. ie ammonium nitrate soaked in fuel oils
When explosives detonate three events occur:
*The blast pressure effect-a powerful detonation (shock wave) moves outward at a massive spped and creates tremendous overpressures and primary blast injuries
*Air rushes back into the void created by the positive pressure causing tertiary blast injuries from blunt trama
*Fragmentation of the container and dispersal of shrapnel that was inclosed in the device causes secondary blast injures
batteries, flashbulbs, match heads, and remote detonators such as cell phones or walkie talkies
any data stored or transmitted using a computer that is probative in nature and can be used to generate investigative leads
Digital evidence examiners can analyze data and establish...
both class and idivdual characteristics
consists of a myriad group of offensees defined by state and federal statues and raning from unauthorized access, sofeware piracy, alteration or theft of electronically stored information, transmission of destrutive viruses or commands and child pornography and predatory activies
is a term refferning to technology assisted crimes that generally involve the use of the internetISPs
Some types of digital Crime
*Internet Crimes against children
*Cyberstalking and Harassment
is one of the fastest growing high tech crimes comprising approximately 40% of all fraud complaints filed with the Federal Trade Commission
Identify Theft and Assumption Deterrence Act of 1998
establised identity theft as a federal offence. Crimes covered, Credit card fruad, utilities fraud, bank fraud, loans, government documents
is a self installing software program that exploits infected computers by monitoring the internet activies of the computer user and providing this data to third parties
PROTECT Act of 2003
modified federal pornography laws to define the possession of child pornography as being in possession of contraband
takes the traditional crime of stalking and adds the complexity of the Internet to the situation
is the process of following a perpetrator through varius computer networks in an attempt to identify a suspect
Motives for hackers
Revenge-to inflict inury or damage
Profit-for personal gail or extortion
Pride-to demonstrate who is in control or to release a virus
Curiosity-because it is intellectually challenging
referes to an inexpeienced hacker who uses commonly available tools to search for vulnerable computers on a network. the goal of the script kiddie is to "own" the susstem and delete files
is often a disruntled employee seeking revenge by disable critical technology or trying to gainn personal profit through altering employment records or changing payroll records
is an internet fraud scheme that utilizes fake web sites that look like they belong to bank or creddit caard companies to atempt to secure person account infomation from victims
Crime Scene staging
occcurs when perpetrators attempt to plant or fabricate digital evidence that will implicate someone else
Stagingg can reveal information about the offender
level of technial skill, economic status, and the IP address of the source computer
The internet address of a serveer combined with the IP adress of aan indivdual computer is the equivalennt off an
Reconsstructtion off data fragmeents can locate information such as
time, date, origin, recipients name, headers and footers, file names, and the date the message was last accressed will provide valuable lleads for the detectives conducting the investigation
Documentrary evidence may include items that indicate motive such as
love letters, financial records, personal diaries, and threatening letters
maps, phone numbers and idented writings may uield information about
suspects, victim,s and/or locations.
A questioned document is
one for which authenticity of the document itself is in question (ie counterfiet documents or forgeries) or for which the identity of the writer is in question (anonymous threat letters and suspect suicide notes0
Unquestioned document is
one for which authenticity is not questioned or the identity of the writer is not in dispute (personal letters, diaries, and finacial records)
is what medium is being employed to create the document (ink, typewriting, blood, paper, etc)
may provide investiagtors with clues as to the identity of the perpetrator, character, personality, motive and so on.
An evidentiary document
can be almost anything involving written communications and is not limited to paper writing surfaces
Questioned communication are not limited to handwriting can be
driver's licenses, birth certificates, pasports,currency, and typed and printed documents are frequently forged or altered.
because of the diversity of questioned documents an interdisciplinary investigative approach incolving
chemistry, physics, psychology, physiology, and information technology may be necessary
documents recovered in crime scene investigations can include
anonymous notes, suicide notes, altered documents (such as checks), bank robbery notes, ransom notes, or pawn receipts
Paper documents are preferable handled with
white cotton gloves. latex gloves have been known to leave fingerprint impressions on paper documents, especially if the gloves are thin and have foreign residue on the fingertips. Cotton gloves may be worn over latex gloves to preent such contamination.
Paper documents should be handeled
as little as possible and secured in a way so as to prevent any further handling, folding, or eimpressions on the document
In order to initiate an ivestigation of a questioned document it may be beneficial to secure what other material from the scene
computers, printers, seals, paper, notepads, checks, other nonquestioned documents and writing instruments
How should you preserve a charred document?
Spraying a fine mist of clear varnish or clear coat and placing charred documents in a box loosely packed with cotton. Should be transported in person not in mail due to its fragile nature
destructive ink or paper testing should be conducted when?
Only after other nondestructive tests have been perofmed to determin if the question can be adequately answered through nondestructive means
American Society for Testing and Materials publishes recommended standards and procedures for the examinations of documents. Currently more than 15 published standards
None destructive lighting techniques
shortwave and longwave UV can reveal chemical erasures or different paper types, chemicals used to alter documents, checking multi-page documents for consistance fluoresce.
IR light can be used in examining and differentiating ink
Other nondestructive lighting include oblique and transmitted lighting
or transmitted lighting is performed by placing a light behind the document to make the document more transparent.
Electrostatic detection device
can develop latent fingerprints and other latent impressions such has handwriting, typing or marks
Thin layer chromatography
Semidestructive techniques, can be used to determine iff two inks are the same
small particles of toner appearing in the same location on multiple copies may identify a particular copier as producing the questioned doucument
Normal course of business documents
checks, rental agreements, mortgages, deeds, driver's licenses, identification cards, passports, social security cards, credit cards, and other documents
If a signatures mateches perfectlyy
then it is evidence that the signature was transferred to another document falsely
Procedure for requesting exemplars from suspects:
1. the questioned document should not at any timme be shown to the suspect
2.To preventing disguising or altering, exemplars should be taken under various conditions.
3. The writer is instructed to write in his or her nomal writing and then instructed to write aas fast as possible.
4. sampes shoulld be taken with the dominant and nondominant hand.
5. for anonymous notes/handwritten text-handwritten and handprinted exemplars are taken
6. Important to do several samples bc it is harder for a person to disguise handwriting the more the person writes