ROUTINE TYPES OF DIGITAL EVIDENCE
Just as there are ever-expanding types of digital devices, the data they generate are var ied and diverse. Some types of data are fairly routine for the forensic scientist, however, and these consistently show up in casework. E-mails are an excellent type of evidence given the volume sent daily for personal and professional purposes. E-mails also contain good metadata about the sender and recipient, such as the computer of the sent e-mail (the Internet protocol address, or IP address), the addresses of all systems the message passed through, and the type of software used to write the message. Browsing the Internet using software like Safari, Internet Explorer, or Chrome, is a part of daily life at home and at work. Browsers keep a detailed history of the sites visited, downloads, search terms, and more. Search terms may be useful in indicating criminal intent or action (“Where can I buy guns without serial numbers?” “Does bleach remove all traces of blood?” “chloroform”). For example, Scott Peterson was convicted of murdering his pregnant wife, Laci, in 2002 and part of the evidence against Peterson was browser history for purchasing a boat, studying water currents, a map of an island, and the purchase of a gift for his mistress. Laci’s body and that of the fetus were found on that island. Social media, such as Facebook and Twitter, have dominated the popular cul ture in the last few years. The near-constant connections with others yield reams of texts, chats, and data about who knows whom, where they are, and what they are up to. Social media programs log these data and telecommunications providers store that information on their corporate servers. These links between people, places, and activities can be important evidence in an investigation, providing leads or alibis. People love to brag and many do not understand the depth of information available on the web (it is said that “the Internet never forgets”); criminals have been caught by posting their activities on social media, as incredible as that seems. Rodney Knight Jr stole a laptop, a coat, and cash from the house of a Washington Post reporter; he then posted about his criminal exploits on the reporter’s son’s Facebook account, using the stolen laptop. The son’s friends alerted police and Knight was arrested for criminal larceny and possession of a handgun. Select a file, click on “delete,” and it’s gone, right? Wrong. Deleted files still exist but the operating system has flagged their location on the storage media as being available for reuse. Deleted files whose location has not been overwritten are still recoverable. This is of particular use to the forensic scientist as deleted files are typically information that people want to get rid of. Forensic science deals in the reconstruction of past events and digital evidence can greatly assist in the development of these investigative timelines. Timelines can help to prove innocence as well as guilt, for example, by providing location information based on cell phone data: Most cell phones log their geographical positions with cell towers and telecommunication companies store this information. Cell phone tracking has been used in a number of cases but is not without its critics; the use of single tower should be avoided and the system was never intended to be used like a GPS. Most users store their documents and images in the default locations that come with their operating systems (“Documents”). These files come with metadata that can provide information about who authored the document, changes, comments, time stamps, and sometimes geographical locations. For example, with documents, all previous changes could be seen and might provide insight into intent or reveal a masked conversation conducted between versions of a shared file. Images have information about the kind of camera that was used to take them, location information, time stamp, and settings. The types of digital crimes analyzed depend in part on the jurisdiction of the laboratory. Some crimes, like cyberbullying or cyberthreats, are local and others, like child pornography, may have a federal component. Some analyzes are very sophisticated and require highly skilled scientists and specialized tools. For example, messages that are hidden “inside” another message (steganography) can be extremely difficult to detect. The message could be hidden, for example, by starting with an innocent image file and changing the color of every 100th pixel to correspond with a letter of the alphabet, spelling out the hidden message. One image could be hidden inside another image (Figure 1). Originally thought to be too complex for “ordinary” criminals, steganography was being used by child pornographers by 2007. Steganography made news headlines in 2010 when the U.S. Department of Justice charged 11 suspected Russian Federation spies living as Americans in Boston, Seattle, and New Jersey. The alleged spies hid messages in over 100 images files on public websites using steganography. Other types of analysis include sorting out attempts to gain sensitive information, like passwords or account numbers, or access to computer systems by masquerading as a trusted source (phishing), like a bank, or as another entity by falsifying infor mation (spoofing) in electronic communications; header metadata identifying the sender and address may be stripped out and replaced, for example.
FIGURE 1 Electronic control units help to monitor, diagnose, and control the various electronic and computerized systems in modern automobiles. They also provide technical and geographic information to help reconstruct accidents, like the black box in an aeroplane.
