WK5: DNA EVIDENCE

260

Digital evidence: Crime-related information retrieved from an electronic device.

Internet Protocol (IP) address: An identifying number is associated with a computer or other device that can access the Internet.

, --

help verify when a victim was last seen)

• Reverse telephone directories (e.g., to determine a phone number from a known address)

• Other telephone records (e.g., to verify phone calls made and received and the timing of those calls)

LIMITATIONS

CRIMINAL INVESTIGATION

• Sex offender registries and related Department of Corrections information (e.g., to determine the whereabouts of particular offenders or to identify offenders who live in a particular area)

The primary limitation of information databases is that the database is only as good as the information it contains. If information is not entered into the system-for example, in the case of the NCIC, if a gun is not reported as stolen or a missing person is not entered as missing-the database will be of little use to the police in this regard. Similarly, if a person has not been identified as "wanted" in a particular crime, the information contained in the database will not provide the information necessary to make an apprehension. For exam­ ple, as discussed in the introduction to this chapter, Tamerlan Tsarnaev was on a national terrorism database watch list, but this information was of no use in the prevention of the bombings or in his identification.

• • • Information from Electronic Devices and Digital Evidence Digital evidence is "information and data of value to an investigation that is stored on, received, or transmitted by an electronic device." 59 Today, cell phones are the most common source of digital evidence; in fact, there is seldom a major investigation that does not include a search for information from a cell phone. Text conversations, records of phone calls, photographs, and video are especially useful evidence that can be obtained from cell phones. Other devices, such as desktop, laptop, and tablet computers; GPS devices; digital cameras; video cameras; surveillance equipment; computer servers; video game systems; external hard drives; and other storage devices (e.g., thumb drives), may also contain digital evidence. These devices serve as electronic filing cabinets that may contain evidence related to various types of crimes. In this era of information and computerization, many of our daily activities are in some way recorded digitally-where we went, when we went there, what we did when we got there, who we spoke with, and what we said. This applies to criminals as well, except with criminals this information may constitute evidence. Given the proliferation of electronic devices, it is not an exaggeration to say that nearly every crime could have digital evidence associated with it. Sometimes digital evidence is the primary evidence in a criminal investigation (see Case in Point 9.5).

In some investigations the objective is to confirm a link between a particular device and an Internet site or server (see Case in Point 9.6). In these cases the record of devices that accessed the site or server is analyzed. A linkage between Internet sites and computers is most often done through the identification of an Internet Protocol (IP) address. An IP address is an identifying number associated with a computer or other device that can access the Internet. However, there is much variation in the assignment of IP addresses: IP addresses on computers can change (dynamic), remain the same (static), or be shared by several computers. An IP address can be potentially useful for criminal investigation pur­ poses because it can be obtained from a Web site that maintains a log of IP addresses that accessed that site. When an IP address is in hand, that address can be linked to the Internet service provider (ISP) connecting that computer to the Internet. That ISP can then provide

Chapter 9 • Information From the Public, Socia l Media, Information Networks , Digital Devices, and Other Sources 261

Text messages and cell phone photos and video played a critical

role in the 2013 conviction of two high school football players,

Trent Mays and Ma'lik Richmond, in Ohio for the crime of rape.60

Mays and Richmond were found guilty of raping an intoxicated

sixteen-year-old girl at party. A critical issue at the trial was that

the girl was too intoxicated to consent or resist. The text mes­

sages, video, and photos spoke directly to these issue.

The crime was first brought to the attention of authorities

by the victim's parents, who learned that a video making fun

of the girl and her assault had been posted on YouTube by

some of the teens who attended the party. In that video the

victim was referred to as "the dead girl," and one attendee

commented, "She is so raped." A photo showing the two

defendants carrying the girl out of a house by her arms and

legs was posted on lnstagram. Subsequent to these discov­

eries, cell phones from seventeen of the teens were seized

by the police. Approximately 350,000 text messages were

recovered from the phones and analyzed, as were hundreds

of thousands of photos, videos, tweets, and other posts. As

reported in the media, some of the text conversations recov­

ered from Mays's phone included the following:

Friend of

Mays:

Mays:

Did u do it?

No, lol. She could barely move.

From another How dead is she?

friend:

Mays:

Mays:

Not at all, she's looking for her phone.

I'm pissed all I got was a hand job, though.

I should have raped since everyone thinks I

did.

From the victim's phone to a friend:

Victim:

Victim:

What the fuck? Who was there? What hap­

pened to me?

I swear to God I don't remember anything. I

remember at one point hearing Trent telling

me to do something, but I said no.

Later, the victim texted Mays:

Victim:

Mays:

Victim:

Ok, tell me right now what the fuck hap­

pened last night and don't lie to me. We

need to talk about this right now.

Nothing happen last night. You [sexual act]

last night and that's it.

OK, that's not all that happened. Tell me the

truth now.

Later, the victim e-mailed Mays:

Victim: Why the fuck would you let that happen to

me? seriously, you have no fuckin respect.

Later, Mays texted a friend:

Mays: Dude, I'm so fuckin scared. Her dad knows

where we brought her. If we are ques­

tioned, just say she was really drunk and

we were trying to keep her safe.

It was only as a result of these text messages that investigators

were able to reconstruct the past and determine, at the very

least, what the participants were saying about the incident

prior to the involvement of the police. 61

the billing name and address associated with the IP address. In this way the identification of an IP address may lead to the name and address of a person who controls or uses acer­ tain computer.

In some investigations the objective is to track or locate a device, usually a cell phone. This is most common when attempting to locate a missing person or monitoring the movements of a subject (see Case in Point 9.7). There are several technologies that can be used for this purpose, the most wellknown of which is Stingray (many cell phone tracking devices are

now often simply referred to as Stingray). The device sends a signal that tricks the phone to connect to it. Phones can be identified by unique codes, such as the international mobile subscriber number (IMSI) and the electronic serial number (ESN). Cell phone service pro­ viders may also provide location information on devices for criminal investigation pur­ poses. Cell phones can also be traced via phone-finding apps.

262 CRIMINAL INVESTIGATION

CASE in POINT 9·6 A Killer Identified via an IP Address62

Stephanie Renee Bennett, twenty-three, was found dead

in her apartment in northwest Raleigh, North Carolina. She

had been sexually assaulted and murdered. Stephanie had

lived in the apartment for about ten months with two female

roommates, one of whom was her stepsister. Stephanie's

stepsister had asked the apartment manager to enter the

apartment to check on the well-being of Stephanie as she

could not be contacted. Stephanie was discovered deceased.

Evidence indicated the perpetrator had entered the apart­

ment by removing the screen to an unlocked window in

one of the unoccupied bedrooms. Stephanie was found

nude, lying on her back, with her legs open and her head

tilted to one side. In her mouth was a gag (a pair of pant­

ies that belonged to one of her roommates). Visual marks

on Stephanie's wrist and ankles were attributed to a form

of restraint used by the offender to immobilize her. A well­

defined ligature injury mark encompassed Stephanie's neck,

and several marks at the rear base of her neck gave the

appearance that a garrotte-type device was used in conjunc­

tion with the ligature. The restraints and ligature had been

removed by the offender and taken with him when he left

the crime scene. An autopsy report disclosed that Stephanie

had been sexually assaulted orally, anally, and vaginally. DNA

from the unidentified offender was profiled but no hit was

obtained through CODIS.

Approximately three and a half years after Stephanie was mur­

dered, Drew Planten, thirty-five, was arrested in connection

with her sexual assault and murder. At the time of the crime,

Planten was living in the apartment complex located next to

Stephanie's. Two years after the murder, residents reported

to the police that Planten possibly matched the description

of a Peeping Tom seen near Stephanie's apartment weeks

before her death. But Planten was just one of many suspects

in the investigation. In an attempt to identify the perpetrator,

or at least develop leads on the cold case, investigators set

up a Web site, www.StephanieBennett.com, and monitored

who visited the site. one of the computers that accessed the

site (determined by the IP address) was located at the North

Carolina Department of Agriculture. This computer was used

by Drew Planten, a chemist who worked there. Authorities

already knew of Planten from the earlier identification.

Authorities obtained a pair of gloves that Planten used at

work (taken by a coworker and given to the police), and from

the gloves they obtained a DNA profile. It matched the DNA

profile taken from Stephanie. Investigators obtained a search

warrant of Planten's premises and recovered numerous

items, including property taken from Stephanie's apartment

and a large collection of guns and pornography. One of the

guns seized was linked to the unsolved homicide of a young

woman in Michigan several years prior. While awaiting trial for

the murder of Stephanie, Planten committed suicide in jail.

In other investigations the objective is to document the content of electronic devices (e.g., Internet sites accessed, text messages sent and received). In cases like this, the content of the device is analyzed (see Case in Point 9.5 and Case in Point 9.7) . The method used to obtain digital content from a device depend a great deal on the type of device in question. As noted in Case in Point 9.7, a commonly used machine for this purpose is known as Cellebrite. Cellebrite is a particular brand of a device that can extract data from a phone's memory, even if that data have been deleted. The cell phone is attached to a computer, and data from the phone are transferred to the computer. The machine can bypass the security codes on most phone models used today. Other methods and machines can be used to obtain infor­ mation from cloud-based sources, such as Web mail and social media sites.

Cellebrite: ·A brand of electronic machine used to extract data from the memory of a cell phone.

SEIZING ELECTRONIC DEVICES AND COMPUTER DATA EXTRACTION Regardless of the device, there must be a legal basis for the collection of electronic equip­ ment and the search for digital evidence. There is not a digital evidence exception to the search warrant requirement. Electronic devices are normally seized either as a result of consent, plain view, or the execution of a search warrant.

The place where the electronic item is located should be treated as a crime scene. As such, appropriate precautions and security measures as well as documentation of the scene are

Chapter 9 • Informat ion From t he Public , Social Med ia, Information Networks, Digi ta l Devices, an d Other Source s 263

CASE in POINT 9.7 Find the Phone, Find the Girl and More

In a 2016 case, a thirteen-year-old girl (referred to as "NC"

here) was reported missing from her home. Her mother

believed she might have run away. The window screen in

NC's bedroom had been cut; outside the house. a single set

of footprints led away from the window. NC's mother pro­

vided a description of NC and turned over NC's cell phone to

the police. Investigators contacted NC's friends and learned

they believed NC had been communicating with a male sub­

ject on the Internet site Kik while at a sleepover the previous

night.

To hopefully learn more about NC's whereabouts, data was

extracted from her phone. As written in the police report

The following programs were used during the acquisition

and exam of the Apple iPhone ss device.

- Cellebrite UFED 4PC [Version 4.S.0.307]

- Cellebrite UFED Physical Analyzer [Version 4.S.1.14]

I began by removing the SIM card from the side of the Apple

iPhone ss. Using a Cel lebrite provided nano SIM card reader,

I connected the iPhone's nano SIM card to the GLPD Forensic

Computer and obtained a Logical Extraction at 10:10AM on

Sunday, 01 / 31 /2016. The SIM card extraction indicated the

following information: ICCID: 89168000001S10417161 ; TIMSI:

6223830S.

Using the same above Cellebrite provided hardware and

software. I connected a blank Cellebrite provided nano SIM

card to the GPO Forensic Computer. I copied the above ICCID

and TIMSI that were located on the on the iPhone's origi­

nal nano SIM card onto the blank Cellebrite provided nano

SIM card. The cloned Cellebrite provided SIM card was then

placed into the Apple iPhone Ss. This was done to prevent

the iPhone from connecting to a cellular network during the

forensic extraction.

I then powered the iPhone ss 'on.' I immediately placed the

iPhone into 'Airplane Mode,' which disables all forms of wire­

less communication w ith the device. Using a Cellebrite pro­

vided #210 cable, I connected the above described iPhone

to the GPD Forensic computer and obtained an Advanced

Logical Extraction at 10:16AM on Sunday, 01 /31 /2016.

After completing the above extraction, the iPhone was pow­

ered back 'off.' The cloned Cellebrite nano SIM card was

removed from the device and the original was re-inserted.

Upon searching NC's phone, the investigator located a note

on the phone that read simply, "Shado.gl009." This was

believed to be a username. Investigators searched for this

name on the Kik Web site and found a matching account.

The profile photo for that account was a picture of NC.

Investigators then learned that NC might be in possession

of another cell phone. one that she might have stolen from a

classmate at school.

Investigators obtained an emergency locate order for the

stolen phone through the cell phone provider. The track indi­

cated the phone was located at or near the northeast cor­

ner of the Bayview Mall, which was in a suburb of the city

where NC lived. Investigators found a 2009 Ford Focus at

that location. As investigators approached the vehicle, a per­

son known to be NC exited the vehicle, as did another sub­

ject later identified as Ethan Harold [not his real name]. Both

subjects were detained. Inside the vehicle the investigators

found a phone matching the description of the one that was

reported stolen and that was being tracked by the cell phone

provider. That phone was seized.

When questioning Harold at the scene, he stated that NC was

his girlfriend and he had met her on Kik. He stated that he had

met NC in person for the first time that morning and they had

agreed to meet at the mall. He stated that he believed NC

was eighteen and that he had not had sexual intercourse with

her. NC also told investigators that they did not have sexual

intercourse. When Harold was asked if he had communicated

with NC via his phone, he stated that he had. Investigators

then seized his phone. He was asked for consent to search

the phone and told if he refused a search warrant would be

obtained. Harold signed the waiver allowing the police to

search his phone. He was released but advised he might face

charges in the future as a result of the ongoing investigation.

NC was transported to the police department and inter­

viewed, and her parents were notified. During the interview

NC stated that Harold had picked her up at her house and

that she had been staying with him since she ran away from

(Continued)

264

(Continued)

home. She denied that she and Harold had engaged in any

sexual contact and said she did not need medical care. NC

was then released to her parents.

The subsequent forensic exam of the stolen phone in pos­

session of NC revealed the following:

There were 3,565 images on the phone. Many of the images

were related to exchanges on Kik, including naked photos

sent by NC and naked photos sent by numerous other peo­

ple to NC's Kik account. These photos exchanges were the

result of "conversations" NC was having with other Kik users

of a sexual nature that led to them asking NC for photos or to

NC asking them for photos. There was nothing found in the

context of the exchanges to indicate other users having any

knowledge of NC's age.

Located among the Kik conversations was one between

NC and Ethan Harold. This conversation was about meeting

somewhere to have sex in his car. The last conversation dis­

covered on the phone between NC and Harold was Harold's

statement, "Hey Hun, I'm being real with you . You might

want to get yourself checked out because my dick hurts

really fucking bad. I'm going to get tested." Investigators rea­

soned that this conversation was a reference to Harold being

concerned about having a sexually transmitted disease and

him advising NC of that possibility, presumably because they

had engaged in sexual contact.

Forensic examination of Ethan Harold's phone revealed a Kik

conversation between him and NC in which seven images

CRIMINAL INVESTIGATION

were sent by NC that showed her either naked or partially

clothed . These images included an image of NC's exposed

vagina and one with her buttock exposed. Eight images were

sent by Harold to NC of his exposed erect penis. In addition,

there were 657 images on Harold's phone, some of which

were more nude photos of NC.

Shortly after the discovery of these conversations and

images, NC's mother contacted the police and stated NC

had told her that she and Harold actually did have sexual

intercourse while in the car parked at the mall. Upon being

interviewed again by the police, NC told investigators that

she and Ethan had taken off their clothes and had sex in

the car at the mall. NC stated that Ethan had laid down on

the seat and began kissing her; he then took off his pants

and "went inside of" her. NC clarified he put his penis in her

vagina and was moving it in and out. NC stated that Ethan's

"bodily fluid" went inside of her and she was then worried

she'd be pregnant.

Subsequent to this interview, Harold was again contacted

and interviewed. He stated to the investigator that he and

NC first met on the OK Cupid Web site but then moved

their conversations to Kik. He stated they had exchanged

nude photos and that he thought she was eighteen . He

denied having sexual intercourse with NC. In light of the

evidence retrieved from the phones and the statements

made by NC, Harold was arrested and booked for second

degree sexual assault of a child and possession of child

pornography.

necessary to preserve the integrity of the scene. The location of the electronic equipment and the device's connections should be noted. The device should be photographed and, for computers, the corresponding cables and connections should be labeled and noted prior to disconnection. It must also be remembered that physical evidence on the devices (e.g., fin­ gerprints, DNA) may be important evidence in the investigation, and efforts should be made to preserve and collect it.

Prior to collection, mobile devices like cell phones should be turned off and placed in anti­ static packaging, such as paper bags, envelopes, or cardboard boxes. Turning the phone off preserves cell tower location information and calls logs and prevents the phone from being used. If the phone cannot be turned off, then it must be placed in signal-blocking packaging to prevent it from receiving calls, text messages, or other signals that may alter or destroy the evidence. To prevent damage from moisture, under no circumstances should phones or other electronic devices be packaged in plastic bags. 63

When seizing computers different procedures should be employed depending on whether the computer is on or off, whether computer experts are available on scene, whether the com­ puter is part of a business network, and whether electronic evidence is visible on-screen.64

Generally speaking, if the computer is off, it should not be turned on. If it is on, it should not

Chapter 9 • Information From the Public , Social Media, Information Networks, Digital Devices, and Other Sources

PHOTO 9. 10: Some criminals realize cel l phones contain incriminating evidence that can be recovered by the police. As a result, it is not uncommon for investigators to discover cell phones that have been destroyed by suspects.

PHOTO 9. 11: In this case a cell phone contained evidence of previous threats made by a suspect to his ex-girlfriend

be touched or moved unless it appears that files are being deleted. In this case the computer should be immediately disconnected from the power source. If the computer is on and not in the process of deleting files, the computer should be turned off but only under the direc­ tion of a trained digital evidence expert. If the computer is off it can be unplugged and carefully transported for forensic analysis. Any external storage devices should also be seized

265

266 CR IMINAL INVESTIGATION

(e.g., thumb drives, CDs). Although this is standard practice, some data (e.g., recently typed passwords) may be lost when the device is turned off. Investigators should be aware of all possible devices that may contain digital evidence related to the investigation. 65

Information from those persons who have access to or ownership of the devices may also be useful in the investigation, and the following information should be collected from them:66

• Names of all users of the computers and devices

• All computer and Internet user information

• All login names and user account names

• Purpose and uses of the computers and devices

• All passwords

• Any automated applications in use

• Type of Internet access used

• Any offsite storage

• Internet service provider

• Installed software documentation

• All e-mail accounts

• Security provisions in use

• Web mail account information

• Data access restrictions in place

• All instant messaging screen names

• All destructive devices or software in use

• Social networking Web site account information

• Any other relevant information

The process of extracting data from a computer for forensic analysis is, in many respects, similar (but not exactly the same) as that of extracting data from a cell phone. Although specific details are beyond the scope and purpose of this chapter, understand that the pro­ cess is technical. Through the use of various forensic data extraction machines, the content of the hard drive in question is copied to a new, blank hard drive. The new hard drive is then examined for evidence. The imaged hard drive can also be examined for files that have been deleted (i.e., latent files). Systems files that were created by the computer operating system are also examined. These files have been described as sort of like a surveillance tape that shows user activity on the computer and files that were changed by the user.

The field of forensic digital evidence has continued to evolve as digital evidence has become relevant in more investigations. It used to be that a police officer with an interest in elec­ tronics would be designated as the digital evidence expert in the department. Now the techniques and standards of digital evidence collection have become more rigorous and scientific. Individuals who are designated as digital evidence collection experts should expect to receive considerable training regarding the collection and analysis of the evidence.

Digital evidence has become more and more significant in criminal investigations due to the increased use of digital devices in our daily lives. It has the unique ability to cast light onto past conversations, statements, and behaviors of victims and offenders. Although the pres­ ence of digital evidence may not be obvious and its collection is technical, investigators should always be mindful of the possible role it may play in criminal investigations.

• • • Psychics When all else fails, when there is nowhere else to turn, when the police are at a loss regard­ ing what to do next, the police may turn to a psychic for assistance in an investigation. In such a situation, investigators may be trapped between the embarrassment of an unsolved high-profile case and the embarrassment of enlisting the help of a psychic.