Forensics

Responsibilities of the first officer at the scene are:

Acquiring Medical Assistance for injured victims: Medical personnel avoid disturbing evidence and approach victim by an indirect route Detaining any potential suspects or witnesses: Statements are taken from victims, witnesses and suspects Securing the crime scene to the greatest extent possible: boundary sealed off, and if needed, guards posted at the entry to the crime scene. Civilians and unauthorized personnel are excluded from the crime scene Calling for any additional personnel: Personnel needed depends on nature of the crime scene

Recording and Collecting impressions

Before any impression is moved or otherwise handled, it must be photographed (including a scale) to show all the observable details of the impression.

Multi-purpose lens

Focal length from 28-80mm Used to take normal, wide and telephoto

Forensic palymology

Forensic palynology involves the collection and examination of pollen and spores in connection with crime scenes, illegal activities, or terrorism.

Forensics Toxicology

Forensic toxicologists are charged with the responsibility for detecting and identifying the presence of alcohol, drugs and poisons in body fluids, tissues and organs Forensics toxicologists not only work in crime labratories and medical examiner's offices, but also in hospital labs and health

Forensics Pathology

Forensics pathologists determine cauase, mannerand time of death. Under law-governemnt can order autopsy. May be ordered if: Someone dies without a physician Attending physician is uncomfortable signing a death certificate Autopsy is alos done when death is suspicious, violent or unexpected

Impression assault phot

Impression photography requires oblique lighting to show details and a scale to later create a 1:1 scale photograph for comparison to footwear or tire samples

Forensic database

It is important to remember, however, that the ultimate decision for making a final comparison will be determined by the forensic examiner through traditional microscopic methods

Prints on porous surfaces

Latent prints on hard and non-porous surfaces (e.g., glass, mirror, tile, and painted wood) are developed by the application of a powder.

Methods for paint comparison

Paint can be individualized if it has sufficiently complex layer structure

Crime Scene Safety

When processing and collecting evidence at a crime scene, personnel should be alert to sharp objects, knives, hypodermic syringes, razor blades, and similar items

Forensic value of fiber

evidence is its diversity in our environment.

Computer forensics

involves the preservation, acquisition, extraction, and interpretation of computer data.

Software

is a set of instructions compiled into a program that performs a particular task on the hardware

crime scene reconstruction

is the method used to develop a likely sequence of events by the observation and evaluation of physical evidence as well as statements made by those involved with the incident.

Blood color test

o A positive result from the Kastle-Meyer color test is highly indicative of blood. ♣ Hemoglobin causes a deep pink color. o Alternatively, the luminol or BlueStar test is used to search out trace amounts of blood located at crime scenes. ♣ Produce light (luminescence) in a darkened area. ♣ They are extremely sensitive and is capable of detecting blood that has been diluted up to 100,000 times.

Toolmarks

o A toolmark is any impression, cut, gouge, or abrasion caused by a tool coming into contact with another object. o Under no circumstances must the crime scene investigator attempt to fit the suspect tool into the tool mark. ♣ Any contact between the tool and the marked surface may alter the mark and will, at the least, raise serious questions about the integrity of the evidence.

Void Patterns

o A void is created when an object blocks the deposition of blood spatter onto a target surface or object and the spatter is deposited onto the object or person instead. o The blank space on the surface or object may give a clue as to the size and shape of the missing object or person. o Voids may be applicable for establishing the body position of the victim or assailant at the time of the incident.

Sexual Assault Evidence

o All outer and undergarments should be carefully removed and packaged separately in paper (not plastic) bags. o Bedding, or the object upon which the assault took place, may also be carefully collected. o Forceful physical contact between victim and assailant may result in a transfer of physical evidence such as blood, semen, saliva, hairs, and fibers. o If a suspect is apprehended within 24 hours of the assault, it may be possible to detect the victim's DNA on the male's underwear or on a penile swab of the suspect. o Items routinely collected from the suspect include all clothing, pubic hair, head hair, penile swab, buccal swab and a blood sample for DNA typing.

4 steps process to identify and individualize a fingerprint

o Analysis - examining the general ridge flow and pattern configuration o Comparison - locating and comparing ridge characteristics or minutiae o Identify - examining and locating ridge pores, breaks, creases, scars, and other permanent minutiae o Verification - examiner's conclusion is confirmed by a second examiner.

Arterial Spray Spatter

o Arterial spray spatter is caused by an injury to the heart, or a main artery, and the pressure of the continued pumping. o The site of the initial injury to the artery can be found where the pattern begins with the biggest spurt. The trail away from this point shows the victim's movement. The oxygenated blood spurting from the artery tends to be a brighter red color than blood expelled from impact wounds

Characteristics from use

o As is true for any mechanical device, use of a printing device will result in wear and damage to the machine's moving parts. o These changes will occur in a fashion that is both random and irregular, thereby imparting individual characteristics to the printing device. o The document examiner has to deal with problems involving business and personal computers, which often produce typed copies that have only subtle defects. o Another area of investigation relates to the typewriter ribbon, which may contain type impressions. •

Videotaping crime scene

o As with still crime scene photography, the crime scene video must include overview, medium-range, and close-up images. o A narrated crime scene video combines photography and notes. ♣ only one person should narrate and no side conversations should captured on the video. o Some video cameras can produce still photographs, but the quality is often poor. ♣ that means, still photographs from a film or digital camera are still required.

CPU

o Central Processing Unit (CPU): also referred to as a processor, is essentially the brains of the computer. o Input Devices: Devices used to get data into the computer, such as: ♣ Keyboard ♣ Mouse ♣ Joystick ♣ Scanner

chain of custody

o Chain of Custody: a list of all persons who came into possession of an item of evidence. o Continuity of possession, or the chain of custody, must be established whenever evidence is presented in court as an exhibit. o Adherence to standard procedures in recording the location of evidence, marking it for identification, and properly completing evidence submission forms for laboratory analysis is critical to chain of custody. This means that every person who handled or examined the evidence and where it is at all times must be accounted for

Cantamination ( pack)

o Contamination can occur either by introducing foreign DNA through coughing or sneezing onto evidence or if items of evidence are incorrectly placed in contact with each other during packaging. o To prevent contamination, the evidence collector must wear a face mask and use disposable latex gloves and disposable forceps when collecting evidence that may contain DNA.

Classifying Impact Spatter

o Low Velocity Spatter: drops with diameters of 4 mm or more normally produced by an applied force of up to 5 ft/sec. ♣ Free falling drops (gravity) ♣ Cast off from fist, shoe, ♣ Arterial spurt

Effects of surface texture

o Surface texture is of great importance. In general, the harder and less porous the surface, the less spatter results. o Blood droplets that strike a hard and smooth surface, like a piece of glass, will leave little or no distortion around the edges. o Blood droplets that strike a hard but a bit rougher surface, like linoleum flooring, will leave some distortion (scalloping) around the edges.

Glass

o Tempered glass is stronger than normal glass due to rapid heating and cooling of the glass surfaces. o Laminated glass found in car windshields has a layer of plastic between two pieces of ordinary window glass.

Testimonial evidence

o Testimonial evidence from eye-witness accounts should be carefully scrutinized because it is highly subjective and heavily biased. o Therefore, crime scene reconstruction should only include testimonial evidence that is corroborated by aspects of physical evidence.

Hard Disk Drive

o The Hard Disk Drive (HDD) is typically the primary location of data storage within the computer.

Forensics databases

o The Integrated Automated Fingerprint Identification System (IAFIS) is a national fingerprint and criminal history system maintained by the FBI and launched in 1999. It contains fingerprints for nearly 68 million subjects. o The Combined DNA Index System (CODIS) enables federal, state, and local crime laboratories to electronically exchange and compare DNA profiles. Launched in 1998, it contains 350,000 profiles in its forensic index from unsolved crimes. o National Integrated Ballistics Information Network (NIBIN) allows firearm analysts to acquire, digitize, and compare markings made by a firearm on bullets and cartridge casings. Nearly 1.6 million items have been entered into the database and 34,000 hits have been recorded. o International Forensic Automotive Paint Data Query (PDQ) database contains chemical and color information pertaining to original automotive paints. Contains information about 13,000 original paints. SICAR (Shoeprint Image Capture and Retrieval) is a shoeprint database

Search and Seizure protocols

o The United States Supreme Court has determined that search and seizure without a court-approved warrant is justified in four cases: ♣ The existence of emergency circumstances ♣ The need to prevent the immediate loss or destruction of evidence ♣ A search of a person and property within the immediate control of the person provided it is made incident to a lawful arrest ♣ A search made by consent of the parties involved

Why do we use fingerprints

o The basic principles of the use of fingerprints in criminal investigations: ♣ Fingerprint is an individual characteristic because no two fingers have yet been found to possess identical ridges ♣ Fingerprint remains unchanged during an individual's lifetime ♣ Fingerprints have general ridge patterns that permit them to be systematically classified (loops, arches, and whorls)

Handwriting exemplars

o The collection of an adequate number of known writings (exemplars) is most critical for determining the outcome of a handwriting comparison. o Known writing should contain some of the words and combination of letters present in the questioned document and be adequate in number to show the range of natural variations in a suspect's writing. o The writing implement and paper should also be alike. o The writing of dictation and several pages may serve to minimize attempts at deception. •

Forensics of blood

o The criminalist must be prepared to answer the following questions when examining dried blood: o Is it blood? ♣ Tested by ABA Card HemaTrace kit ♣ Two lines mean it's blood o Is it human or animal blood? ♣ Tested by Hexagon OBTI presumptive blood ID kit Two lines mean it's human blood

Prime residue on hands

o The firing of a weapon not only propels residues toward the target, but gunpowder and primer residues are also blown back toward the shooter. As a result, traces of these residues are often deposited on the firing hand of the shooter, and their detection can provide valuable information as to whether or not an individual has recently fired a weapon

Collection of glass

o The glass fragments should be packaged in solid containers to avoid further breakage. o If the suspect's shoes and/or clothing are to be examined for the presence of glass fragments, they should be individually wrapped in paper and transmitted to the laboratory.

Root

o The hair root is determined by hair's current growth phase: ♣ Anagen phase ♣ Catogen phase ♣ Telogen phase o When pulled from the head, some translucent tissue surrounding the hair's shaft near the root may be found. This is called a follicular tag. o By using DNA analysis on the follicular tag, the hair may be individualized.

Gun barrel markings

o The inner surface of the barrel of a gun leaves its markings on a bullet passing through it. These markings are specific to each gun

Other Techniques

o Using oblique lighting or applying electrostatic charge to the surface of a polymer film placed in contact with a questioned document will visualize indented writings left on a paper pad. • Ink and paper comparisons o A study of the chemical composition of the ink used on documents may verify whether or not known and questioned documents were prepared by the same pen. o The paper also may be analyzed. o A nondestructive approach to comparing ink lines is accomplished with a thin-layer chromatography.

Visible Data

o Visible data is that data which the operating system is aware of. o Consequently this data is easily accessible to the user. o From an evidentiary standpoint, it can encompass any type of user created data, such as: ♣ Word processing documents ♣ Spread sheets ♣ Accounting records ♣ Databases ♣ Pictures

Visible prints

o Visible prints are made when fingers touch a surface after the ridges have been in contact with a colored material such as blood, paint, grease, or ink. o Plastic prints are ridge impressions left on a soft material, such as putty, wax, soap, or dust. o Locating visible or plastic prints at the crime scene normally presents little problem to the investigator, because these prints are usually distinct and visible to the eye.

Comparing strands of hair

o When comparing strands of human hair, the criminalist is particularly interested in matching the color, length, and diameter. o Other important features for comparing human hair are: ♣ The presence or absence of a medulla. ♣ The distribution, shape, and color intensity of the pigment granules present in the cortex. o The most common request is to determine whether or not hair recovered at the crime scene compares to hair removed from the suspect.

Testing for powder residue

o When garments or other evidence relevant to a shooting are received in the crime laboratory, the surfaces of all items are first examined microscopically for the presence of gunpowder residue. o Griess chemical test detects gunpowder residues that are not visible.

other impressions

o When shoe and tire marks are present at a crime scene, their preservation is best accomplished by photography and casting.

AFIS

o When the AFIS search is complete (a computer can make thousands of comparisons per second), the computer produces a list of file prints that must be examined by a trained fingerprint expert.

Multiple penetrations

o When there are multiple successive penetrations to the glass, it is often possible to determine the sequence of impacts because fractures terminate at the existing line of fracture.

Medium Velocity Spatter

o drops with diameters from 1-4 mm with an applied force of 5 to 25 ft/sec. ♣ Blunt trauma ♣ Sharp trauma ♣ Cast off from hammer, baseball bat ♣ Baseball bat impact spatter

High Velocity spatter

o drops with diameters of less than 1mm from an applied force of 100 ft/sec or faster. ♣ Bullet impact spatter ♣ Power tools trauma ♣ Fast moving object trauma (e.g. airplane prop) ♣ Shrapnel trauma

Analyzing radial and concentric fracture patterns in glass

o forensic scientist can determine the direction of impact. ♣ Conchoidal fractures ♣ Hackle marks ♣ Cone shaped hole

Search Pattern depends on

o the size and locale of the scene and the number of collectors participating in the search ♣ strip/line search (for large areas) ♣ quadrant/zone search (for medium size areas) ♣ grid search (for small areas) ♣ spiral search ♣ wheel/ray search

Special Crime Scene photo

outdoor, indoor and nighttime photo

Fingerprint phto

• Black and white film used to show greater contrast

Hair origination on body

• Determining body area where hair originated o Each region, such as the head, pubic area, chest, axillae, and limbs, has hairs with microscopical characteristics attributable to that region. Although it is possible to identify a hair as originating from a particular body area, the regions of the body that are primarily used in forensic comparisons are the head and pubic areas.

Normal Lens

• Focal length of 50-55m • Used for most photographs that need to be taken at a crime scene because it can show as much area as half a wall

Photography

• Lossy compression condenses files by discarding some image information. Information lost during this compression is irretrievable. • Lossless compression condenses files without discarding information so no important image information is lost. For this reason, all digital crime scene photographs should be saved by lossless compression to avoid losing any important information contained in those images.

Physical evidence

• Physical evidence encompasses any and all objects that can establish that a crime has been committed or can provide a link between a crime and its victim or a crime and its perpetrator.

Evidence can be grouped under two major subgroups

• Visible data • Latent data

Bloodstain pattern interpretation

• interpretation may uncover: o The direction from which blood originated o The angle at which a blood droplet struck a surface o The location or position of a victim at the time a bloody wound was inflicted o The movement of a bleeding individual at the crime scene o The approximate number of blows that struck a bleeding victim The approximate location of an individual delivering blows that produced a bloodstain pattern

Arson photo

♣ Arson photography requires photographs of the point of the fire's origin and use of special equipment or techniques to provide maximum contrast in photographs of charred areas. • May also include photographs of crowd outside scene because arsonists commonly return to scene

Bloodstain photo

♣ Bloodstain photography requires photographs of all pertinent stains and determined area of convergence or area of origin. • Bloodstains sprayed with luminol are photographed in complete darkness

Rifling is usually accomplished by

♣ Cutting all the grooves into the barrel with a cutter ♣ Pressing all the grooves onto the barrel Hammer-forging the barrel over a mandrel containing the reverse image of the rifling

Semi-automatic pistols

♣ Feature a removable magazine ♣ Fire one shot per trigger pull

Revolvers

♣ Feature several firing chambers within a revolving cylinder ♣ Include swing-out revolvers, break-top revolvers, and solid frame revolvers

single shot pistols

♣ Fire only one round at a time

Types of fibers

♣ Natural fibers are derived in whole from animal or plant sources. For example: • Wool • Cashmere • Furs • Cotton ♣ Man-made fibers are manufactured. • Regenerated fibers are manufactured from natural raw materials and include rayon, acetate, and triacetate. • Synthetic fibers are produced solely from synthetic chemicals and include nylons, polyesters, and acrylics.

Sex Assault photo

♣ Sexual assault photography requires photographs of all wounds and clothing while showing discretion to the victim.

Crime Scene notes begin with:

♣ The identity of the person who contacted the investigator ♣ Time of contact ♣ Time of arrival at the crime scene ♣ Preliminary case information ♣ Personnel present on arrival ♣ Personnel being contacted

o Minimum three photographs required at a crime scene are:

♣ overview photograph of the entire scene and surrounding area, including points of exit and entry (taken first) ♣ medium range photograph show the layout of smaller significant areas of the crime scene (taken second) ♣ close-up photograph with scale (taken last) show greater detail of individual objects or evidence (taken at 90 angle to the object; handheld or on tripod)

Hardware is

♣ physical and tangible components of the computer.

Forensic Glass Comparison

To compare glass fragments, a forensic scientist evaluates two important physical properties: density and refractive index.

Recovering Human Remains

Tools used in the search: Infrared photography methane detector, Aerial photography,Probe, Cadaver Dogs

Re enactmnts

A re-enactment of events at a crime scene can show if a theory of how an event occurred is physically possible and if physical evidence is consistent with that theory.

Striations

o Striations are fine lines found in the interior of the barrel. o These striations form the individual characteristics of the barrel.

Alterations

o Document examiners must deal with evidence that has been changed in several ways, such as through alterations, erasures, and obliterations. o Erasures by rubber erasers, sandpaper, razor blade or knife to remove writing or typing disturb the fibers of the paper and are readily apparent when examined with a infrared light and additional light source. o Obliteration of writing by overwriting or crossing out to hide the original writing can be revealed by infrared lighting, which may pass through the upper layer of writing while being absorbed by the underlying area. o Infrared photography and reflecting light at different angles are sometimes successfully used to reveal the contents of a document that has been accidentally or purposely erased.

Packaging Evidence

o Each different item or similar items collected at different locations must be placed in separate container. Packaging evidence separately prevents damage through contact and prevents cross-contamination

Output Devices

o Equipment through which data is obtained from the computer. For example:

Evidence from arson

o Evidence from arson scenes should be packaged in airtight glass containers to prevent the loss of accelerant vapors.

Class characterisitics

o Evidence is said to possess class characteristics when it can be associated only with a group and never with a single source.

Individual Characteristics

o Evidence that can be associated with a specific source with an extremely high degree of probability is said to possess individual characteristics.

prints cont'd

o Fingerprints on nonporous surfaces can be treated with chemicals that induce fluorescence when exposed to lasers or high-intensity light sources ("alternate light sources"). o Dye combinations known as RAM, RAY, and MRM 10, when used in conjunction with Super Glue fuming, have been effective in developing latent fingerprints by fluorescence.

Firearms evidence collection

o Firearms are collected by holding the weapon by the edge of the trigger guard or by the checkered portions of the grip. ♣ Never place objects into the barrel; you could damage striations.

Analysis of internet data

o Forensic computer examiner might look to determine what websites computer user has visited recently through: ♣ Internet cache ♣ Cookies ♣ Internet history o The history file can be located and read with a forensic software package. o Another way to access web sites that have been visited is by examining bookmarks and favorite places.

Race hair

o Forensic examiners differentiate between hairs of Caucasoid (European ancestry), Mongoloid (Asian ancestry), and Negroid (African ancestry) origin, all of which exhibit microscopic characteristics that distinguish one racial group from another. However, mixed race and infants hair is difficult to originate. • Determining age from hair sample Individuals' age is very difficult to determine with high degree of accuracy. Must look for other clues. Infants hair is generally finer then adult hair. Elderly

Hair V fiber

o Hair ♣ Irregular ♣ Always circular shape ♣ Has cuticle, medulla and root o Fiber ♣ Uniformed and irregular ♣ Variety of shapes (circular, trilobar, etc.) Has no cuticle, medulla or root

If biological or bloodstained (packaging)

o If biological or bloodstained materials are stored in airtight containers, the accumulation of moisture may encourage the growth of mold, which can destroy the evidential value. ♣ In these instances, the material should be allowed to air-dry before being packaged in wrapping paper, manila envelopes, or paper bags.

Comparison of soil

o In forensic laboratories, forensic geologists will characterize and compare the mineral content of soils. o Considering the vast variety of minerals and rocks and the possible presence of artificial debris in soil, the forensic geologist is presented with many points of comparison between two or more specimens.

Serial numbers

o Increasingly, the criminalist is requested to restore a serial number when it has been removed or obliterated by grinding, rifling, or punching. o Restoration of serial numbers is possible through chemical etching because the metal in the stamped zone is placed under a permanent strain that extends a short distance beneath the original numbers. ♣ More recently, laser technology have been used to retrieve removed serial numbers.

Sex of hair sample

o Individuals' sex could be difficult to determine with high degree of accuracy if follicle tag is not present. Must look for other clues. Female hair is generally longer and may be treated. o If follicle tag is present than presence/absence of Barr body will determine sex with high degree of accuracy. Female cells have Barr body, male do not. • Determining speed and density of growth from hair sample

Comparison microscope

o Is the most important tool to firearms examiners. o Two bullets can be observed and compared simultaneously within the same field of view. o Not only must the lands and grooves of the test and evidence bullet have identical widths, but the longitudinal striations on each must coincide. • Firing a weapon

Purpose of physical evidence

o It is difficult to ascertain the weight of a given piece of evidence ♣ In each case, importance (weight) of a piece of evidence is ultimately decided by the jury.

Forensic two step comparison procedure

o Known sample (taken from the suspect) and the standard/reference specimen are compared. o Once the examination has been completed, the forensic scientist renders a conclusion with respect to the origins.

Prints on porous surfaces

o Latent prints on porous surfaces (e.g., papers, cardboard, and cloth) require treatment with a chemical, such as iodine fuming, ninhydrin, and Physical Developer.

Long guns

o Long guns may be single-shot, repeating, semi-automatic, or automatic. ♣ Rifles • Feature a barrel with lands and grooves • Bullet ammunition is impressed with lands and grooves during firing ♣ Shotguns • Shell ammunition contains numerous ball-shaped projectiles called shot • Narrowing of the smooth barrel, called the choke of the shotgun, can concentrate shot when fired • Unlike rifled firearms, a shotgun has a smooth barrel.

Character of handwriting

o Many factors comprise the total character of a person's writing. o The early stages of learning handwriting are characterized by a conscious effort to copy standard letter forms. o However, as writing skills improve, nerve and motor responses associated with the act of writing become subconscious. o The unconscious handwriting of two different individuals can never be identical. o Variations in the handwritings are expected in angularity, slope, speed, pressure, letter and word spacing, relative dimensions of letters, connections, pen movement, writing skill, and finger dexterity. o Other factors to consider include the arrangement of the writing on the paper, such as margins, spacing, crowding, insertions, and alignment. o Spelling, punctuation, phraseology, and grammar can be personal and help to individualize the writer. o The writing style of one individual may be altered beyond recognition by the influence of drugs or alcohol and illnesses (e.g. Parkinson's, stroke).

Testing for Semen

o Many of the cases sent to a forensic laboratory involve sexual offenses, making it necessary to examine evidence for the presence of semen. o Presence of semen can be identified by testing for: ♣ presence of spermatozoa ♣ presence of seminal protein p30 ♣ prostate specific antigens (PSA) ♣ presence of acid phosphate (AP) ♣ acid phosphatase color test ♣ purple color means semen is present Forensic scientists can successfully link seminal material to an individual by DNA typing

Mobile Forensics

o Mobile devices offer many of the services that are offered by computers and other devices. These devices can provide a vast amount of useful and evidentiary data in an investigation. o Preferred method for preserving data on a mobile device is leaving a mobile device running but placing it in something that will block its communication with the network. ♣ RF/EMI Shielding Pouches block portable electronic devices from accessing active wireless networks. These pouches are manufactured using Silver/Copper/Nickel conductive fabric. o Complications arise in extracting and evaluating data from mobile devices because of the variety of ways that different devices store and manage data.

Rifling process

o Once a manufacturer chooses a rifling process, the class characteristics of the weapon's barrel will remain consistent; each will have the same number of lands and grooves, with the same approximate width and direction of twist.

Latent prints

o Once the finger touches a surface, body perspiration and/or oils present on the finger ridges are transferred to that surface, leaving an impression. o Prints deposited in this manner are invisible to the eye and are commonly referred to as latent fingerprints. •

Paint

o One of the most common types of paint examined in the crime laboratory involves paint from automobiles.

Cartridge case comparison

o Other distinctive markings that may appear on the shell as a result of metal to metal contact are caused by the: o Ejector, which is the mechanism in a firearm that throws the cartridge or fired case from the firearm. o Extractor, which is the mechanism in a firearm by which a cartridge of a fired case is withdrawn from the firing chamber. Magazine or clip, which is the mechanism that in a firearm holds the bullets

Collection and preservation

o Paint chips are most likely found on or near persons or objects involved in hit-and-run incidents. o Glass or plastic vials make excellent containers for paint chips evidence. o Paint smeared or embedded in garments or objects require the whole item to be packaged and sent to the laboratory.

Preserving prints

o Photograph must be taken before any attempts at preservation are made. o If the object is small enough to be transported without destroying the print, it should be preserved in its entirety. o Prints on large immovable objects that have been developed with a powder can be preserved by "lifting" with a broad adhesive tape. o Tape with lifted print is then placed on a properly labeled card that provides a good background contrast with the powder.

Cyber forensics terminology

o Power Supply: Converts the power it gets from the wall outlet to a useable format for the computer and its components. o Computer Case/Chassis: Physical box holding the fixed internal computer components in place. o Motherboard: The main circuit board contained within a electronic device. o System Bus: Contained on the motherboard, the system bus is a vast complex network of wires that serves to carry data from one hardware device to another. o Read-Only Terminology Memory (ROM): ROM chips store programs called firmware, used to start the boot process and configure computer's components. o Random Access Memory (RAM): RAM serves to take the burden off of the computer's processor and Hard Disk Drive (HDD).

Processing the electronic crime scene

o Processing the electronic crime scene has a lot in common with processing a traditional crime scene. ♣ Search warrants ♣ Documentation ♣ Good investigation techniques

limitations to reconstruction

o Reconstruction relies on information from toxicology tests, autopsies, interrogations, and many other sources which may not be available for days, weeks, months, or sometimes years after the incident. o False linkage occurs when an investigator assumes a link between two or more objects of evidence. Simple "yes or no" answer cannot be applied to a complex conclusion

Crime Scene Sketch

o Rough sketch is created at the crime scene and contains an accurate depiction of the dimensions of the scene and shows the location of all pertinent objects and features. Finished sketch is created from the information in rough sketch, but it is drawn to scale with care and concern for appearance.

Shutdown v pulling plug

o Several factors influence the systematic shutdown vs. pulling-the-plug decision. o For example, if encryption is being used, pulling the plug will encrypt the data rendering it unreadable without a password or key. o Similarly, if crucial evidentiary data exists in RAM, and has not been saved to the hard drive, cutting the power to the system will erase the data. o Regardless, the equipment will most likely have to be seized.

Height

o Single drop of blood falling from stationary body part (e.g. fingertip) onto smooth cardboard from various heights. ♣ No change in diameter beyond 7 ft.

Collection of soil

o Soil found on the suspect, such as adhering to a shoe or garments, must not be removed. o Instead, each object should be individually wrapped in paper and transmitted to the laboratory.