Evidence Bags Research Articles

ECo-Bag: An elastic container based on merkle tree as a universal digital evidence bag

Unique traits generated automatically or artificially, such as firewall logs, OS event logs, and various metadata, are well hidden in the digital evidence that cannot be easily perceived by the investigator in some cases. Digital data is invisible, and it is necessary that attention is focused on traditional management with integrity because of the involvement of various stakeholders in the secure preservation and analysis of the forensic process. Similar to file formats, digital evidence bags (DEB), such as E01 and L01, are widely used to contain digital data for certain facilities in a raw format, which also include metadata. The DEB can provide a way to obtain data through selective imaging, extracting and collecting only the parts necessary from the extensive data for proof. However, it cannot flexibly handle information obtained from large amounts of data or when sensitive data is involved or destroy superfluous materials that must be protected. Therefore, in this study, we propose a new container format based on the Merkle tree, which is used as a universal DEB. The proposed ECo-Bag can store physical and logical images from the storage medium, bit streams transmitted over networks, file segments in the cloud or distributed system, secondary outcomes, and metadata. Furthermore, it can support operations to destruct or seal the data initially collected while verifying the data integrity and tracking the provenance within the chain of custody. Thus, it is expected to contribute to the elastic management of addition and deletion of evidence in digital investigation and e-discovery.

DNA transfer between worn clothing and flooring surfaces with known histories of use

DNA samples recovered from items of clothing are often attributed to the wearer and one or more individuals who may have contacted the item during an alleged criminal activity. Another scenario often proposed by defence counsel is that DNA was transferred from a previously contacted item/surface unrelated to the activity of interest onto the item of clothing. Under such scenarios, DNA may also be transferred from the clothing to the item/surface with which it comes into contact. One such surface is flooring, upon which clothing may be placed while not being worn or may be contacted during wearing, such as falling or being forced to the ground. This study investigates the transfer of DNA to and from clothing and flooring when different contacts are applied between the two surfaces in an environment representative of what investigators would encounter in routine casework, a residential environment. Participants were provided with two sets of new and unused upper and lower garments to wash then wear for ~8 h inside their own home before storing them in paper evidence bags. The two sets of clothing were taken to a home occupied by unrelated individuals, where one set was placed on the floor (‘passive’) by the researcher while the other was worn by the participant who laid with their back on the floor, rolled to one side and back, then stood up (‘active’). Within the houses sampled, the main bedroom was targeted as flooring types and histories of use were more consistent across houses and less variation in DNA profile composition was previously observed for samples collected in the same room. Samples were collected from predetermined areas of the clothing and flooring where contact did and did not occur. Reference profiles were obtained from wearers and individuals they lived with, as well as occupants of the home. DNA transfer was observed from clothing to flooring and from flooring to clothing in both ‘active’ and ‘passive’ situations, though greater where a situation involved the application of pressure and friction (‘active’), and only where contact between clothing and flooring occurred. Results from this study inform on the composition of DNA profiles one is likely to obtain from an item of clothing or a flooring surface following a similar contact event between the two substrates and will aid investigators when interpreting DNA evidence recovered in a domestic environment and the activities leading to its transfer and subsequent recovery.

What’s on the bag? The DNA composition of evidence bags pre- and post-exhibit examination

Current forensic DNA profiling kits and techniques enable the detection of trace amounts of DNA. With advancements in kit sensitivity, there is an increased probability of detecting DNA from contamination. Research into DNA transfer within operational forensic laboratories provides insight into the possible mechanisms that may lead to exhibit contamination. To gain a greater understanding of the potential for evidence bags to act as DNA transfer vectors, the level of DNA accumulating on the exterior of evidence bags during the exhibit examination process was investigated. The exterior of 60 evidence bags were tapelifted before and after the examination of the exhibit inside of the bag resulting in 120 DNA profiles. These DNA profiles were compared to DNA profiles of staff working within the building and samples taken from the exhibit inside the bag. Common DNA profile contributors from each sample were also identified through STRmix™ mixture to mixture analysis. The average DNA quantity and number of profile contributors was higher in samples taken from the bag before exhibit examination than after examination. Fifty six percent of all samples taken identified a match between DNA recovered from the evidence bag and at least one staff member. On 11 bags, a common contributor was identified between the exhibit in the bag and the exhibit package post-examination. In one instance a DNA profile, matching that of a donor, on the exhibit bag before examination was also detected on a sample taken from the exhibit, raising the possibility of outer bag-to-exhibit DNA contamination. This study demonstrates that operational forensic laboratories must consider exhibit packages as a potential source of DNA contamination and evaluate their exhibit handling and storage procedures accordingly.

DNA transfer between evidence bags: is it a means for incidental contamination of items?

ABSTRACT With the increasing sensitivity of DNA profiling systems, the opportunity to detect incidental DNA transferred between evidential items has increased. Evidence bags are assumed to be DNA transfer vectors which can cause an inadvertent transfer of DNA between items, yet little has been studied to indicate the extent of this transfer. This study aimed to provide insight into the levels of DNA accumulating on evidence bags through exhibit handling and storage. Casework exhibit bags were sampled during storage and mock exhibit bags were sampled after replicating exhibit handling protocols. DNA concentrations recovered from casework exhibit packages were highly variable and produced profiles containing up to at least seven contributors. The DNA concentration and profile complexity was higher in samples taken from packages after exhibit examination. It was observed that DNA from the exhibit can be transferred to the exterior of the bag during the process of packaging and un-packing the item. Profile complexity from mock exhibit packages increased with time spent in the exhibit storeroom. With the introduction of highly sensitive DNA profiling systems, procedures involving the handling, transport and storage of exhibits should be assessed to ensure that best-practice contamination minimization procedures are being utilized.

The mechanical properties of plastic evidence bags used for collection and storage of drug chemicals relevant to clandestine laboratory investigations

ABSTRACTThe effectiveness of three types of plastic bags used by the New South Wales Police Force for the storage of clandestine drug evidence has been investigated through a comparison of mechanical properties. The tensile and tear properties of “as received” low-density polyethylene (LDPE) and poly(vinyl chloride) (PVC) bags do not show major differences such that one type would be favoured over the other. However, the mechanical properties of the bags once exposed to a range of chemicals routinely collected as drug evidence have been shown to be influenced as a result of different chemical interactions. Although an interaction of reagents/solvents with an additive within the LDPE bags is proposed to influence the mechanical properties of the bags, the change in properties has been shown to be less severe than that observed for the PVC bag, where softening and damage of the bags results due to absorption of reagents.

Contamination during criminal investigation: Detecting police contamination and secondary DNA transfer from evidence bags

As the profiling systems used in forensic analyses have become more sensitive in recent years, the risk of detecting a contamination in a DNA sample has increased proportionally. This requires more stringent work protocols and awareness to minimize the chance of contamination. Although there is high consciousness on contamination and best practice procedures in forensic labs, the same requirements are not always applied by the police. In this study we have investigated the risk of contamination from police staff. Environmental DNA was monitored by performing wipe tests (sampling of hot spots) at two large police units (scenes of crime departments). Additionally, the DNA profiles of the scenes of crime officers were compared to casework samples that their own unit had investigated in the period of 2009–2015. Furthermore, a pilot study to assess whether DNA from the outside package of an exhibit could be transferred to a DNA sample was carried out. Environmental DNA was detected in various samples from hot spots. Furthermore, 16 incidences of previously undetected police-staff contamination were found in casework that had been submitted between 2009 and 2015. In 6 cases the police officers with a matching DNA profile reported that they had not been involved with the case. We have demonstrated that DNA from the outside package can be transferred to an exhibit during examination. This experience demonstrates that when implementing the new multiplex systems, it is important to ensure that ‘best practice’ procedures are upgraded, and appropriate training is provided in order to ensure that police are aware of the increased contamination risks.

Application of Raman spectroscopy for the differentiation of lipstick traces

This study demonstrates that Raman spectroscopy is a valuable tool for discriminating between lipstick samples under a range of forensically relevant situations. Trace amounts of lipstick smears deposited on textile fibres, cigarette butts and paper tissues were analysed. Differentiation of lipstick smears could be achieved with little or no interference from the underlying medium. Lipstick smears on glass slides, cigarette butts and tissues could also be analysed and identified in situ through evidence bags. Using a range of excitation frequencies (473, 633 and 784 nm) was effective in overcoming problems with fluorescent lipstick samples. The majority of the spectra of deposited lipstick samples remained unchanged over a period of up to two years. In some of the aged lipstick spectra, the (CC) band at 1655 cm−1 and the (CH) band at 3011 cm−1 were found to decrease in intensity and disappear over time. The use of chemometrics for the characterisation of large numbers of lipstick spectra was explored. Thirty spectra each from ten different lipsticks were analysed by Principal Components Analysis (PCA) and classified using the k-Nearest Neighbours (kNN) classifier. Up to 98.7% correct classification was achieved. Spectra from trace amounts of lipstick smears deposited on fibres were also analysed and classified using the same technique. 100% correct classification of these samples was achieved.

The migration of fragments of glass from the pockets to the surfaces of clothing

During the last decade or so there has been some discussion in the forensic community in the United Kingdom concerning whether it is necessary to search the pockets for glass particles in garments attributed to suspects arrested for glass breaking crimes. The removal of this practice would help expedite the searching and recovery process since examining only the surfaces of clothing would reduce the cost of recovering glass evidence. However, it is believed by many scientists that some glass fragments originally acquired in pockets can migrate to the surfaces of clothing prior to examination by the forensic scientist. As glass fragments have been encountered in the pockets of garments during examinations of casework items in the LGC Laboratories, the implications of this change in practice needs to be assessed. Hence, the aim of this study was to investigate this possibility that fragments of glass migrate from a pocket of a garment to its surfaces during police and laboratory handling after a person is suspected of breaking glass during an offence. If this occurs to a significant extent then it could affect the evaluation of the glass evidence when using a Bayesian approach. Sixty fragments of glass were seeded into a pocket of a fleece jacket and a pair of denim jeans. Three experiments were performed; one examined a searching, recovery and blanking procedure, another examined the pre-laboratory 'handling' process of an item in an evidence bag, and the third experiment looked at the removal of an object from a pocket laden with glass and subsequent removal and packaging of the garment. Up to two (3.3%) fragments were recovered from the surfaces of the fleece jacket and the denim jeans via the searching, recovery and blanking procedure. Similar numbers were also recovered from the insides of the evidence bags. Up to four (6.7%) fragments were recovered from the surface of the fleece jacket and up to five (8.3%) fragments were recovered from the surface of the denim jeans after pre-laboratory 'handling'. Again similar numbers were recovered from the insides of the evidence bags. Comparable numbers to those from searching/recovery experiments were observed when garments were removed after taking an object from a pocket. In addition, up to two (3.3%) fragments were recovered from the object (a mobile phone). The findings show that some migration can occur particularly in the second experiment and therefore modification of the evaluation strategy may be required.

The spectroscopic detection of drugs of abuse on textile fibres after recovery with adhesive lifters

Fibres are one of the most common forms of evidence associated with forensic investigations. The use of adhesive lifters to recover fibres from crime scene samples has long been established as an effective method to recover such items of evidence. Once fibres have been lifted they are transferred to evidence bags for storage, safe transport and to preserve the chain of evidence. This study shows that when fibres are tape lifted particles of substances present trapped within those fibres are also lifted. Cotton, linen and wool fibres were examined in colours ranging from white to black. Samples of seized ecstasy, cocaine, ketamine and amphetamine were supplied by East Sussex Police and by the TICTAC unit at St Georges Hospital Tooting. The Raman spectra obtained showed that it is possible to identify drugs of abuse from particles trapped within fibres without interference from the fibre itself. It was also possible to obtain spectra after fibres were lifted with adhesive tapes without the detection process being compromised. Raman spectra from particles of drugs of abuse within fibres following tape lifting were also recorded through evidence bags. Again the detection process was not compromised. This initial study has shown that fibres have the potential to provide even more evidence than they do currently. Individuals that have had drugs of abuse about their person may have trace amounts of these substances trapped within the fibres of their clothing. This may be of particular importance if drugs have been carried in pockets of a garment. This technique has the advantage of being non-destructive, allows for re-testing, requires no sample preparation and also can be performed on samples without removal from the evidence bag thus removing any potential risk of contamination. It is important however to remember that when dealing with trace amounts of drugs of abuse the presence of such particles may be due to innocent transfer of such particles. Detection of particles of drugs of abuse on clothing does not necessarily indicate criminal activity in the absence of other evidence.

The spectroscopic detection of drugs of abuse in fingerprints after development with powders and recovery with adhesive lifters

The application of powders to fingerprints has long been established as an effective and reliable method for developing latent fingerprints. Fingerprints developed in situ at a crime scene routinely undergo lifting with specialist tapes and are then stored in evidence bags to allow secure transit and also to preserve the chain of evidence. In a previous study we have shown that exogenous material within a fingerprint can be detected using Raman spectroscopy following development with powders and lifting with adhesive tapes. Other reports have detailed the use of Raman spectroscopy to the detection of drugs of abuse in latent fingerprints including cyanoacrylate-fumed fingerprints. This study involves the application of Raman spectroscopy for the analysis of drugs of abuse in latent fingerprints for fingerprints that had been treated with powders and also subsequently lifted with adhesive tapes. Samples of seized ecstasy, cocaine, ketamine and amphetamine were supplied by East Sussex Police and by the TICTAC unit at St. Georges Hospital Tooting. Contaminated fingerprints were deposited on clean glass slides. The application of aluminium or iron based powders to contaminated fingerprints did not interfere with the Raman spectra obtained for the contaminants. Contaminated fingerprints developed with powders and then lifted with lifting tapes were also examined. The combination of these two techniques did not interfere with the successful analysis. The lifting process was repeated using hinge lifters. As the hinge lifters exhibited strong Raman bands the spectroscopic analysis was more complex and an increase in the number of exposures to the detector allowed for improved clarification. Spectral subtraction was performed to remove peaks due to the hinge lifters using OMNIC software. Raman spectra of developed and lifted fingerprints recorded through evidence bags were obtained and it was found that the detection process was not compromised. Although the application of powders did not interfere with the detection process the time taken to locate the contaminant was increased due to the physical presence of more material within the fingerprint.

Forensic data recovery and examination of magnetic swipe card cloning devices

Magnetic swipe card technology is used for many purposes including credit, debit, store loyalty, mobile phone top-up and security identification cards. These types of cards and the details contained on them are often relied upon as a form of identification and personal authentication. As such reliance is placed upon them it is surprising that they do not incorporate more stringent security features, and because of this lack of features it is not surprising that they attract the attention of people who wish to exploit them for illegal gain. The paper introduces the type of technology, and range of devices available for manipulating magnetic swipe card data. It proposes the use of Digital Evidence Bags as a suitable format for the evidential storage of information obtained from them, thus further illustrating the flexibility of the format and demonstrating the diverse range of devices that have to be handled within the digital investigation and law enforcement community.

The spectroscopic detection of exogenous material in fingerprints after development with powders and recovery with adhesive lifters

The application of powders to fingerprints has long been established as an effective and reliable method for developing latent fingerprints. The powders adhere to the ridge pattern of the fingerprint only, thus allowing the image to be visualised. Fingerprints developed in situ at a crime scene routinely undergo lifting with specialist tapes to facilitate subsequent laboratory analysis. As with all recovered evidence these samples would be stored in evidence bags to allow secure transit from the scene to the laboratory and also to preserve the chain of evidence. In this paper, the application of Raman spectroscopy for the analysis of exogenous material in latent fingerprints is reported for contaminated fingerprints that had been treated with powders and also subsequently lifted with adhesive tapes. A selection of over the counter (OTC) analgesics were used as samples for the analysis and contaminated fingerprints were deposited on clean glass slides. The application of aluminium or iron based powders to contaminated fingerprints did not interfere with the Raman spectra obtained for the contaminants. In most cases background fluorescence attributed to the sebaceous content of the latent fingerprint was reduced by the application of the powder thus reducing spectral interference. Contaminated fingerprints developed with powders and then lifted with lifting tapes were also examined. The combination of these two techniques did not interfere with the successful analysis of exogenous contaminants by Raman spectroscopy. The lifting process was repeated using hinge lifters. As the hinge lifters exhibited strong Raman bands the spectroscopic analysis was more complex and an increase in the number of exposures to the detector allowed for improved clarification. Raman spectra of developed and lifted fingerprints recorded through evidence bags were obtained and it was found that the detection process was not compromised in any way. Although the application of powders did not interfere with the detection process the time taken to locate the contaminant was increased due to the physical presence of more material within the fingerprint. The presence of interfering Raman bands from lifting tapes is another potential complication. This, however, could be removed by spectral subtraction or by the choice of lifting tapes that have only weak Raman bands.

Applying a forensic approach to incident response, network investigation and system administration using Digital Evidence Bags

This paper questions the current approach to forensic incident response and network investigations. Although claiming to be ‘forensic’ in nature it shows that the basic processes and mechanisms used in traditional computer forensics are rarely applied in the live incident investigation arena. This paper demonstrates how the newly proposed Digital Evidence Bag (DEB) storage format can be applied to a dynamic environment. A DEB is a universal container for digital evidence from any source. It allows the provenance to be recorded and continuity to be maintained throughout the life of the investigation. With a small amount of forethought a forensically rigorous approach can be applied to incident response, network investigations and system administration with minimal overhead.

Selective and intelligent imaging using digital evidence bags

This paper defines what selective imaging is, and the types of selective imaging that can be performed. This is contrasted with intelligent imaging and the additional capabilities that have to be built into an imager for it to be ‘intelligent’. A selective information capture scenario is demonstrated using the digital evidence bag (DEB) storage format. A DEB is a universal container for digital evidence from any source that allows the provenance to be recorded and continuity to be maintained throughout the life of the investigation. The paper concludes by defining the ‘ultimate test’ for an intelligent and selective imager approach.

Digital evidence bag

Digital evidence bag

Unification of digital evidence from disparate sources (Digital Evidence Bags)

This paper outlines a new approach to the acquisition and processing of digital evidence obtained from disparate digital devices and sources. To date the capture of digital based evidence has always been in its entirety from the source device and different methods and containers (file types) are used for different types of digital device (e.g. computer, PDA, mobile phone). This paper defines a new approach called a Digital Evidence Bag (DEB) that is a universal container for the capture of digital evidence. Furthermore, the Digital Evidence Bag concept could be used to permit the streamlining of data capture and allow multiple sources of evidence to be processed in a multiprocessor distributed environment and thereby maximizing the use of available processing power. The approach described in this paper allows for the first time the forensic process to be extended beyond the traditional static forensic capture of evidence into the real-time ‘live’ capture of evidence. In addition to this the Digital Evidence Bag can be used to provide an audit trail of processes performed upon the evidence as well as integrated integrity checking.

Setting up an electronic evidence forensics laboratory

In our last column we took a look at being an expert witness and giving forensic evidence testimony. An added word of cautionary advice for private practitioners: CHARGE A LOT for expert testimony! If you are involved in a high-profile case that drags on and on and you must testify as an expert witness repeatedly at the whim and caprice of the various attorneys, it could disrupt your private practice and cause potential loss of current and future earnings. Your current case load could be seriously delayed and your credibility for future work may also be damaged. The previous discussion, by nature, was very general, however each jurisdiction has a formal set of directives and guidelines specifically to assist expert witnesses so you must also refer to these for more details. The following discussion will be focused on setting up an electronic evidence forensics laboratory and the various parts that make up a professional facility. The many parts also include the portable forensics kit(s), which includes documentation forms, evidence bags, tags, labels, etc, as well as portable hardware and associated software for undertaking an evidentiary acquisition on site. Not all such activities may be performed in the lab, but the mobile forensics toolkit must be fully compatible and in sync with the laboratory acquisition equipment and software at all times. There may be accreditation for such laboratories, depending on the jurisdiction. For example, in the US one such accreditation may be sought from the American Society of Crime Laboratory Directors. If accreditation is possible in your jurisdiction, it may be advisable to explore the criteria for achieving it. While there may be differing views as to the value of accreditation, it is my opinion that having it is one more stone in the foundation of credibility, and therefore it should be viewed in a positive light.

A new method to monitor drugs at dance venues

Information on the use of illicit drugs depends heavily on users' recall—what they remember, or think, that they have purchased—and on seizures by law enforcement agencies. Neither method may be...

An Evaluation of Different Evidence Bags Used for Sampling and Storage of Fire Debris

Many investigators use evidence bags as storage containers for fire debris samples collected for accelerant determinations. This study deals with an evaluation of the bags available to this laboratory to compare them for storage of fire debris exhibits. Six brands of bags were tested based on six parameters: size, thickness, background (volatile), composition, tearing strength and puncturing strength.