Digital evidence management in 2015
The advent of digital cameras, digital video cameras, and digital data in general has been a huge leap forward to the Law Enforcement community. It allows us to have everything immediately available for viewing for ourselves and for the investigators. However, many of us have not done a great job of managing this type of evidence. We all know that we must treat physical evidence in a manner that maintains a proper chain of custody, or audit trail, so that we have the complete history of the item to know where it has been and who has had access to it. Yet, many departments do not apply this same rule to digital evidence. When pictures are taken on a crime scene, what do you do with the images? Do you burn them to DVD? If so, how do you track the chain of custody of the DVD or individual images? What about copies that are given to Investigators? How do you provide them and how are they tracked? Do you give them an uncontrolled copy? What about examination quality photographs of friction ridge detail or footwear impressions? Many times these types of images need to be enhanced for examination. How do you get them to your Examiners and document the enhancement histories of each individual image?
It is important to change the thought process of how we, as the Law Enforcement community, and specifically the Forensic community, think about digital evidence because you can be sure that defense attorneys are thinking about these issues. It is critical to be able to present a true original image in court and know the entire history of that image. This means using digital evidence software so you can show who has viewed the image, who has obtained a copy for use outside of the digital evidence management software, who has enhanced images, when and what they did to enhance the images so that the process is repeatable and accepted within the Law Enforcement and Forensic Community, and the entire chain of custody is clear and concise.
Imagine having a photograph of a fingerprint in blood from a murder scene that is brought back and enhanced in Photoshop and then submitted to a Latent Print Examiner. The Examiner subsequently identifies an individual based on the submitted finger print and that is the basis for the probable cause that moves the case forward. The photograph of that print, and specifically, the chain of custody, will be in the cross hairs from the defense. Are your current policies and procedures robust enough to stand up to that coming assault from the defense? Do you have digital evidence software that can provide a full chain of custody for the image from the time it was taken through presentation in court with all intermediary steps documented along the way. Is your enhancement history clearly documented as to who did the enhancement, when the enhancement was done, and what exact steps were completed? If your answer is not an emphatic yes to these questions, you may have some work to do to raise the bar before the bar is raised for you.
It is possible to authenticate an original image from the time of capture in the camera through presentation in court with a digital evidence tracking software. This is accomplished through verification of metadata that is embedded in the image and then grabbed into the history of that image within the digital evidence software. It is then further protected by determining the hash value of the individual image. If a single pixel is changed, this changes the hash value and the image can be proven to have been modified. Therefore, digital evidence management software allows you and your co-workers to testify that the image is a true original image. Digital evidence software also allows for you to see who has accessed any particular digital file, when they accessed it, and from what computer they accessed it. If you were to have a critical crime scene image show up on Facebook or the local news, how would you begin your internal investigation to determine who could have been the source of the leak? If you have a proper chain of custody and audit trail on each image or digital file, you will know who had access to the images or data. In fact, the data can even be limited to individual users or groups of users on high profile or sensitive cases thereby limiting your exposure.
If your Department has not yet arrived fully into the digital age, it is time to move in the direction of a digital evidence management software that will safeguard the integrity and chain of custody of your digital evidence.
