Archive for June, 2009
Dr. Katherine Ramsland has published 34 books and over 900 articles, and is the chair of Social Sciences at DeSales University, where she teaches about forensic psychology, profiling, serial murder, and forensic science. Her latest book is The Devil’s Dozen: How Cutting-edge Forensics Took Down 12 Notorious Serial Killers, and in August, she will publish The Real World of a Forensic Scientist, with and about Henry C. Lee. Recently, she went to Rome to see, among other things, the Criminology Museum there.
Inside the Archives of Rome’s Crime History
In Italy, they urge you to take a vacation with the phrase, “Buy an emotion!” At least, that’s how it translates. I think I bought several when I walked into the Italian Ministry of Justice’s three-story collection of torture instruments, insanity treatments, and evidence exhibits. Before getting on the plane to go, I had researched crime history for Rome and was disappointed to learn that most of the exhibits from the nineteenth-century criminal anthropologist Cesare Lombroso were in Turin. I had included him in several books and had hoped to see his work on degeneracy up close.
Experienced in the methods of phrenology (reading head formations), Lombroso had made numerous measurements and photographs of criminal offenders. He was convinced that certain people were born criminals and could be identified by specific physical traits: bulging or sloping brow, apelike nose, close-set eyes, and disproportionately long arms. In other words, delinquency manifested in someone’s appearance as a physiological abnormality. (Hey, don’t scoff; we still do this with our cinematic bad guys, to set them apart in some recognizable way from the good guys.)
Although the main part of Lombroso’s legacy was too far away, I did discover that about two miles from my temporary Rome abode was the Criminology Museum, so I made a point of looking for it. Few tourist books mention it and even though I had an address on Via del Gonfalone, the terra cotta colored building on a narrow side street near the river was not obvious; compared to other Roman museums it was quite humble and unobtrusive. Nevertheless, I found it and when I made it clear to the staff, who spoke only Italian, that I was a member of the forensic community, I was warmly greeted and ushered inside to the recreated torture chambers. (They didn’t lock me into one, they just wanted me to start in the right place.)
Rome’s penal institutions are much older than anything we have in the U.S., and while many of our laws derived from their legal structure (as well as the word, ‘forensic’), for quite a few centuries they investigated crimes without benefit of forensic analysis. In other words, they relied on “crime logic,” which was often influenced by politics. (Even today, logic alone can get us into trouble.)
The earliest museums devoted to crime and prisons were annexed to scientific laboratories, with the first exhibit of prison products (things made by prisoners) in 1885, for the International Penitentiary Congress in Rome. The museum in which I stood got its start in 1931, with the aim of making the results of criminological research available to the public. Interestingly, the Zanardelli Code of 1889 gave university chairs the right to remove body parts from dead inmates for study. (I should have mentioned that I’m a university chair – maybe I could have taken something home besides a lava vase from Pompeii and some Italian coffee.)
In one area, I did see a display about Lombroso and his work on the criminal degenerate, but by then I’d found other stuff that was far more fascinating. There were exhibits for items related to forgery, espionage, organized crime, illegal weapons, and of course, murder. I even discovered the story about a juvenile serial killer that I had not heard of — the kid was 14 when he killed five people. This museum also contains quite a few torture instruments (iron maidens, spiked collars, gossip bridles), along with clothing that executioners wore (red cloaks) and their implements for execution. I was drawn to the exhibits about the “confraternities” of priests that were dedicated to walking with the prisoners to their executions. Their job was to prepare them for a peaceful death and also to bury the corpse. (Incidentally, the process of torture was referred to as a “penal bath.” Nice euphemism.)
One of the most famous stories from Rome involves the execution of an entire family, which was depicted here in a series of water colors. Francesco Cenci, an unscrupulous man, was found dead at the foot of the cliff below his estate. Overhead, a broken balcony indicated he’d fallen through, hitting his head on the rocks below. However, forensics indicated that his wounds had been made by a sharp implement, not a rock, and bloody sheets in his room bore this out. Cenci’s adult daughter, Beatrice, and his second wife, Lucrezia, had been living at the castle for a few months, victims of his violent moods. The court believed that the family, in cahoots with two servants, plotted together to kill Cenci and stage it as an accident. They were all sentenced to death. One of the servants died under torture and the other was shot trying to escape. That left the family members to go to the gallows in a public procession.
On September 11, 1599, Beatrice’s twelve-year-old brother Barnardo was taken up the scaffold and positioned to watch. Beatrice and Lucrezia were both beheaded with a broadsword, while a bludgeoning ball smashed the head of Giacomo Cenci, Beatrice’s other brother. His body was then quartered and his parts were hung up on butchers hooks on the walls. The bodies remained there in the execution yard until evening, while Bernardo was tossed into a prison cell for life. In the museum, I saw the beheading sword (which looked pretty dull), along with the torture instruments that had extracted the confessions (except for Beatrice, who insisted she was innocent.) Later, I went to see the execution yard, as well as the bridge where Beatrice’s ghost supposedly walks around with her severed head.
I was most intrigued with the exhibit on criminal asylums, since I had written about this in Beating the Devil’s Game. There was a compassionate movement in Europe near the end of the nineteenth century to establish crime as the result of disease, especially in the case of those who were clearly psychotic. Alienists viewed such criminals as deviant people in need of protection, care, and a cure. The first place in Italy given over to this reform was a sixteenth-century monastery, and other asylums sprang up after that in more traditional places, but Italy was the location for numerous international conferences on criminal insanity. The exhibit was small, but intense. In fact, the entire museum was professionally rendered, inviting the visitor to spend hours absorbed in the stories. The murder room was especially riveting, because the evidence from each crime was laid out behind glass, and the stories behind the crime and investigation were tastefully graphic.
For anyone interested in criminology who lives near, or hopes to get to, Rome, the Website is www.museocriminologico.it. It’s definitely worth a trip.
Sheila Lowe is a forensic handwriting expert with more forty years of experience in the field. She holds a Bachelor of Science degree in psychology and is the author of several published books including Handwriting of the Famous & Infamous, and The Complete Idiot’s Guide to Handwriting Analysis, as well as Sheila Lowe’s Handwriting Analyzer software. Her first mystery novel, Poison Pen, received a starred review in Publishers Weekly and introduces forensic handwriting expert, Claudia Rose, who uses her handwriting analysis skills to help solve crimes. Www.sheilalowe.com for information about handwriting analysis. Www.claudiaroseseries.com to read a sample chapter and view a book trailer. Www.superceu.com continuing education for marriage and family therapists and licensed clinical social workers. Sheila@sheilalowe.com
Did You Blink?
If you watched Dateline NBC on June 14th, you might have seen me-but only if you didn’t blink. A lengthy interview I gave translated to about 30 seconds of air time. Well, that’s TV for you. If you blinked and you would like to know what the interview concerned, here’s the story:
In the summer of 2008, a man calling himself Clark Rockefeller was arrested for the kidnaping of his own little daughter. Claiming to be distraught over his recent divorce and his ex-wife’s decision to move with their child to England, he had duped a limo driver into helping him grab the child from a social worker.
While under arrest, information came to light that this man was connected with John and Linda Sohus, a young couple in San Marino, California, who had disappeared in the mid-1980’s. The Sohus’, who knew “Rockefeller” as Chris Chichester, had been renting a guesthouse to him when they disappeared.
A month or so after John and Linda were last seen, some people acquainted with Linda received postcards from Paris signed “John and Linda” and “Linda and John.” The Sohus’ were never heard from again, but a few years later their story was in the news. Their home had been sold and when the new owners began landscaping the backyard, human remains were discovered-male, presumed to be those of John Sohus. The police sprayed the guest house with Luminal and, no big surprise, found copious amounts of blood.
This may not be news to you-it’s been on TV and splashed all over the Internet for the past few weeks while “Rockefeller”, who is really a German national named Christian Karl Gerhartsreiter, was on trial for the kidnaping. Despite pleading insanity, he was convicted on most of the counts against him.
My entry into the case came with a call from Marie Szaniszlo, a reporter at the Boston Herald. She’d acquired some handwriting of Rockefeller’s on an extradition form, and she wanted me, as a forensic handwriting examiner, to tell her what his handwriting revealed about his personality. The writing on the form was printed in all capitals (“block printing”) and there was tremendous variability in the size of the letters. Although the quality of the faxed copy was less than ideal, it was good enough to reveal that Rockefeller appears to have an explosive temper (this was later verified by his ex-wife’s testimony) and is highly impulsive. His signature was illegible, which is often a sign of a desire to hide information about oneself.
I gave Marie my opinion and figured that would be the end of my involvement, but about a month later a call came from Frank Girardot, the managing editor of the Pasadena Star newspaper. He’d obtained a letter and some other items Linda Sohus had written, using her professional name (she was an artist), “Cody,” and he asked me to analyze it. Frank also wanted me to tell him about the handwriting on the Paris postcards, which two other handwriting experts had examined and said did not match Linda’s true, known handwriting.
My first glance at the postcards showed that they did indeed appear to be quite different from Linda’s true, known handwriting. I wrote about Linda/Cody’s writing that she had the easygoing, relaxed quality of a person who wanted to enjoy life and avoid friction whenever possible. There were indications of the type of sensuality that might be expressed by escaping into alcohol, drugs, or sex, which would help her shut out unpleasantness. Another item that caught my attention was that many letters butted up against each other, showing a lack of clear social boundaries, and t-bars that “bowed in,” indicating that she could be coerced.
The writing on the postcards has a tight rhythm, which reveals a need for control. At odds with this characteristic are the wavy lines on some capital letters, which are generally seen in one who smiles a lot and who projects a happy-go-lucky image. The writing is tall but narrow, indicating strong ego needs but reluctance to make demands. Some of the ending strokes curl back over the final letters of words: a need to protect one’s ego. The writer of the postcards came across as friendly and outgoing, but put up barriers between herself and others, revealing little of a personal nature.
Something interesting occurred while I was doing my analyses of these writings. I began to notice important similarities between the writing on the postcards and the known writing of Linda Sohus. Keep in mind, two handwriting experts had already given their opinions that this was not Linda’s handwriting. I personally know and respect one of those experts, but as I continued my own examination I found that I could not agree. One after the other, idiosyncratic features of the handwriting matched up. If only one or two of those features had matched, it would have been less significant, but with about 15 very similar important items in this particular handwriting, it’s unlikely to have been a chance match. I gave my opinions to the Star newspaper that Linda Sohus had written the postcards. Then I pretty much forgot about the case.
Fast forward to earlier this year (2009). A Los Angeles Assistant District Attorney called and said my work on this case was going to be subpoenaed for a grand jury investigation. I explained that I’d never been retained by anyone, but had simply given my opinions to the newspaper. The D.A. said, that’s okay, I would be required to send any findings and reports I had written. So of course, I did.
Since I’d received all the handwritings samples from Frank Girardot at the Star, I called to let him know about the D.A. Before I knew it, he’d written an article about the Grand Jury and within a few hours I’d received calls from several other news outlets, including Dateline NBC. They were preparing a special edition of their show that would be aired following Clark Rockefeller’s trial in Boston, which had just begun. Since, as I’d told the D.A., I wasn’t retained (nobody was paying me for my work), I felt free to discuss my findings with them.
They sent a town car for me and on a Friday afternoon, a charming driver named Marcus took me to the Langham hotel (formerly the Ritz Carlton) in Pasadena. As is usually the case in TV, there were delays and my scheduled 4:00 pm interview actually began around 6:45. It wasn’t tough duty, though, as the person in charge of the production set me up in the fancy-schmancy restaurant and bought me lunch (yummy pumpkin soup and breads to die for, in case you were wondering). Then I went over to the bungalow where they had been taping all the interviews-the place was bigger than my house, cables snaking across the living room floor, bright lights on stands that you don’t see in the finished product.
At their request, I’d prepared a Powerpoint presentation to illustrate my findings. The interview just before mine happened to be with Frank Girardot, and this was the first time we met face-to-face after our phone discussions. I set up my laptop and projector, and met Mike Taibbi, who conducted the interview. Mike is a tall, good-looking guy with a great sense of humor and a non-stop repertoire of fascinating stories about his years with some of the world’s top news reports. In between, he took time to mentor a young intern, encouraging and instructing her in some keys to success in the industry. He was kind enough to comply with my request for a handwriting sample, which will appear in a new non-fiction book I’m writing on handwriting and relationships.
But, blatant self-promotion aside, when I finally got miked up and ready to go, Mike took up the position of Devil’s Advocate and challenged me every step of the way. By the end of my presentation, he seemed to be convinced of my point of view. It was one of the most enjoyable TV interviews I’ve done. In case you blinked, I’ve uploaded my entire Powerpoint presentation to my web site, and welcome you to decide for yourself: Did Linda Sohus write those postcards from Paris?
Let me know what you think: email@example.com
Boston is officially a page in our book of memories. It’s over. Done. No more snow to shovel. Hooray!
Hopefully we’ll be in a new house, in a new city, soon. Until then, our temporary home here in North Carolina is quite peaceful. It’s a quaint little community that takes you back in time, where things are much slower. Traffic almost crawls and people still wave at passing cars. There are no blaring horns and no single-digit hand gestures from irate drivers. In fact, drivers here actually yield the right of way and stop to help stranded motorists.
The family next door even made homemade ice cream on a picnic table while their kids played outside. Yes, you heard me right. The kids actually played outside. I was amazed. They ran and jumped and threw balls. They were sweaty and dirty. They yelled and squealed. They fed bread crumbs to a family of ducks. They had fun – honest to goodness fun. And there wasn’t a single video game or television set in sight.
Enough rambling. Hop in and join me for a brief 45mph trip down a five mile stretch of Hwy 8. Believe me, no one drives any faster on that section of highway. There’s no need to hurry. Where would you go?
Ah, this is truly the life…
Assistant Chief Joey Cannon, 50
Plumerville Arkansas Police Department
On June 19, 2009, Assistant Chief Joey Cannon was shot to death while conducting a traffic stop. He was scheduled to retire in two weeks.
Officer Henry Canales, 42
Houston Police Department
Officer Henry Canales was shot and killed during an undercover operation on June 23, 2009. Officer Canales is survived by his wife and children.
P.K. Dawning is a fifth generation Southerner, and as such, takes great pride in writing Southern Fiction. However, regardless of genre, all of her stories employ elements of romance, mystery, and suspense. During her attendance at Gadsden State where she majored in English, she received the Outstanding Student Award in both English Literature and Speech Writing. While studying Creative Writing with Berkley Prime Crime author, Taffy Cannon, she discovered her love for Crime Fiction and began working extensively with the Fayette County Sheriff’s Department to gain firsthand knowledge in police procedures and the day-to-day occurrences of law enforcement professionals.
Deputy Reserves: The Men and Women Who Hold No Reservations
The first piece of writing advice I ever received was from my college English professor, Dr. Julian Thornton. “Write what you know,” he said. And so I did, but picture books and sappy YA just weren’t enough to sedate my lust to embrace something darker. The longing to create something sinister and deadly -an intricate mystery- still nagged at me, and the storyline for my first thriller immerged. When I began writing PHANTOM INK I had absolutely no intentions of making police procedure a convoluted part of the plot. I thought, I can write a serial killer suspense novel without detailed evolvement of the police. Boy was I wrong.
When I realized there was no way around police procedure in my book, I did what any rational person seeking answers would do. Google! The search engine led me straight to Lee Lofland’s website, where I found his book, Police Procedure and Investigation. I read the book from cover to cover. I was intrigued. Still, I wanted more. I needed to understand the daily routine of police officers on and off duty. My interest peaked, I called local law enforcement agencies and requested interviews. Fayette County Sheriff Rodney Ingle agreed… perhaps a little too readily. In hindsight I recognize his eagerness for what it truly was: a chance to take a bookish college student and thrust her into the middle of the nitty-gritty world of law enforcement- not that I hadn’t ask for it!
I arrived in Fayette early on a chilly December morning. The ominous gray-bellied clouds blotted out any hope of sunshine, but did little to dampen my spirits. In a prim camel pants suit and low-slung heels, I walked with a purpose to the blonde-brick Sheriff’s Office. Sheriff Ingle was waiting. “Get in the truck. You can throw that notebook in the back. Won’t need it where we’re going.”
I did as I was instructed, scrambling into the jacked-up F150 with all the grace of a fish out of water. The unmarked truck thundered to life just as I was strapping the seatbelt across my waist. “Sign this,” he said, thrusting a clipboard into my hands. I slid my reading glasses on, eliciting an eye roll and sigh from the hulk of a man beside me. “It’s a basic release form,” he informed me without a hint of a smile. “Just says that if you die today you won’t sue the department.”
The corners of my mouth inched up into a sardonic half-smile. “If I’m dead, I can’t very well sue you, now can I?”
“Standard procedure,” he said, a ghost of a grin tickling his lips. “Law enforcement would be nothing without procedure.”
As we drove around, making routine traffic stops, the sheriff chatting with neighbors and friends, the small-town atmosphere gave me the impression of being on a set of the Andy Griffith Show, but I quickly learned there was mayhem in Mayberry. The rural, picturesque community is plagued by an ugly meth epidemic. Methamphetamine is a powerful central nervous system stimulant, often created in clandestine “labs” using over-the-counter medicines and household chemicals.
Around eleven the radio crackled and before I knew it we were on our way to bust a suspected underground lab. DHR (Department of Human Resources) had requested assistance in the removal of a child from a potentially harmful residence. My adrenaline kicked up a notch as we sped through town, lights flashing, to the dilapidated house tucked inconspicuously into a copse of live oaks.
“Potentially harmful” did not begin to encompass the filth and utter desolation of the home. My stomach roiled as the sheriff ordered me out of the truck. Three deputies rushed past us, hands hovering above their guns, ready for anything. An icy drizzle broke free as we neared the carport. I hung back with the two apprehensive DHR agents, not sure what to expect as the sheriff beat his meaty fist on the door. Clear plastic covered the windows, but an observant deputy noticed someone inside dumping a container of liquid down the drain. In a dizzying burst of chaos, the door was kicked open and the deputies ran in. The acrid smell of urine, body odor, and excrement wafted from inside, but it smelled different somehow. Like a mixture of cat urine and chemicals… like ammonia. Like sulfur. It was crystal meth.
After a short struggle, the two suspects were wrestled to the ground, cuffed, and stuffed into the back of an awaiting cruiser. The child, who had been lying naked in a puddle of her own urine, was safely removed from the home and taken into state custody. My heart crumbled as I watched them wrap her into a deputy’s jacket and drive away.
“For a moment, I thought I was gonna have to taze one of ‘em,” the sheriff admitted once we were back inside the truck. “That would have knocked him clean on his ass.”
How bad could it hurt? I wondered, and after voicing the question I found out.
A droll grin stretched across his face as I rubbed the tender spot on my thigh where the tazer prongs had been. “Halfway to becoming a reserve already,” Sheriff Ingle said, “Might as well come back and make it official.”
Reserve Deputies are duly sworn law enforcement personnel who work strictly on a volunteer basis to supplement the department and help the community. Although they often perform the same duties as paid deputies, they do not receive payment for their services.
The requirements for becoming a Reserve vary for each department. While some require Reserves to complete the exact same training as fulltime officers, other departments are not so stringent. However, all Reserves are required to go through some form of basic training, which may include: firearms education, physical fitness, a background check, polygraph, psychological evaluation, and a written exam.
While chatting with a psychiatrist about the time you stuffed your neighbor’s cat into the mailbox may seem a bit extreme, the basic qualifications are pretty straight forward and are standard from most departments. You must have a high school diploma or the equivalent G.E.D. certification, must be a U.S. citizen, and at least 18-21 years of age (again this varies.) Any felony convictions and certain misdemeanors involving theft or moral turpitude may result in disqualification.
Being a Reserve Deputy can be a deeply gratifying experience and a great way to give back to the community, not to mention it’s pretty darn exciting. If becoming a Reserve is something you’re interested in, check with your local sheriff’s office for more information and specific requirements.
PHANTOM INK is P.K. Dawning’s first suspense novel, and was written in hopes of captivating readers with its suspenseful and enigmatic story of murderous revenge while immersing them into the often arcane world of law enforcement and providing a sense of Southern culture and history. The manuscript is currently being reviewed by agents. To learn more about P.K. Dawning or her novels visit her at www.myspace.com/pamyd or check out her blog at www.phantomink.blogspot.com.
*Disclaimer – Everyone, please handle firearms responsibly. The images in this blog are strictly for PR. DO NOT copy or imitate the actions/pose of the author. It is truly unsafe and could cause injury or death. The Graveyard Shift (and everyone connected with the site) does not approve of unsafe handling of firearms! The author of this particular post is not affiliated with this site. She is a guest blogger.
Sergeant Josh Moulin supervises the Central Point Police Department’s Technical Services Bureau and is the Commander of the Southern Oregon High-Tech Crimes Task Force. He is one of approximately 470 Certified Forensic Computer Examiner’s worldwide and has been trained by a variety of organizations in digital evidence forensics. Sgt. Moulin has also been qualified as an expert witness in the area of computer forensics and frequently teaches law enforcement, prosecutors, and university students about digital evidence.
Beginning his public safety career in 1993, Josh started in the Fire/EMS field working an assortment of assignments including fire suppression, fire prevention, transport ambulance, and supervision. After eight years Josh left the fire service with the rank of Lieutenant and began his law enforcement career. As a police officer Josh has had the opportunity to work as a patrol officer, field training officer, officer in charge, arson investigator, detective, and sergeant.
For further information about the Central Point Police Department please visit www.centralpointoregon.gov/police_home.aspx, and for the Southern Oregon High-Tech Crimes Task Force visit www.hightechcops.com. To reach Sgt. Moulin you can e-mail him at firstname.lastname@example.org.
Step by step details of how new evidence is handled within a digital evidence forensics laboratory.
If you have ever wondered what exactly happens to a digital device once its been submitted to the forensics lab, you’re about to find out. One of the top questions I receive about digital forensics is just how we get data off of suspect computers and how we do so without changing anything on the original evidence. Hopefully I’ll be able to answer those questions and a few more in this blog.
When a computer, cell phone, external hard drive, digital camera, or any other digital device that can store data arrives within our forensics lab the first step we take is to identify and protect the evidence. Once we make the determination that the device has been made safe and no data destruction will occur we package it by placing it within a sealed evidence bag, barcode it, label it with an individual item number and case number and place it in the secure evidence room. It will stay in the secure evidence room pending forensic examination by an analyst.
Our lab constantly triages the cases within the queue for exam. A homicide case, child abduction case, or active child abuse case will always rise to the top and take precedence over all others. After that criteria several other factors come into play, such as how long the evidence has been in the lab, whether or not the suspects have been identified, when pending court dates may be, and other facts known to the lab.
Once a case is ready for analysis, the forensic examiner will remove the needed evidence from the evidence room and check it out to them. We maintain strict chain-of-custody of all evidence items and any transaction with a piece of evidence is tracked.
The evidence (in this case we’ll assume it is a computer) is photographed in its sealed evidence bag and then the evidence is removed from packaging. All four sides of the computer are photographed and then the inside of the computer is photographed. We look for all internal and external components and document it all in our report. We next remove the hard drive(s) from inside the computer and photograph them, documenting all the necessary nomenclature such as model number, serial number, type, jumper positioning, and size.
Once the hard drive has been removed a keyboard and monitor is connected to the computer and the computer is powered on. The examiner checks the BIOS (Basic Input/Output System) clock to see if the computer’s time is accurate. This is important later during the exam because often the dates and time of a particular event on a computer prove important. Once the date and time is checked the computer is turned back off and everything is disconnected from it. It is important to note that the computer will never be powered on with the hard drive connected because that will make undesirable changes to the hard drive.
In our lab we next connect the hard drive to a device called a hardware write blocker. Hardware write blockers are physical pieces of equipment which sit between the forensic computer and the suspect hard drive and act as a one-way gate. We can get information off of the hard drive, but if we attempt to put anything on the suspect hard drive the device blocks those actions. This device ensures that the information we look at during a forensic examination is exactly how the suspect computer last saw it and it also eliminates any argument that our processes added, deleted, or altered evidence.
After the hard drive has been connected to the write blocker (shown above) then the write blocker is connected to the forensic computer (generally via FireWire or eSata). Power is then applied to the hard drive through the write blocker and the forensic computer recognizes the suspect’s hard drive as an externally attached drive. At this point we use specialized software to create a Message Digest 5 (MD5) and Secure Hash Algorithm 1 (SHA-1) hash value.
Hashing is a process by which the computer basically scans the entire hard drive from beginning to end and based upon the contents of the drive and all the bits and bytes it creates a digital fingerprint. This fingerprint is a very long series of letters and numbers that represents the contents on the hard drive. If even one single bit were changed on the hard drive, the hash value would also change. It can take one or more hours to create a hash value of a standard size home hard drive these days.
Once the hash value is obtained we record that in our report and this is one of the most important steps of our process. We next create what’s called a, “Forensic Image” which is a bit by bit copy of the suspect hard drive. In our lab we store the forensic image on a networked storage device called a SAN (Storage Area Network). The software we use creates a copy of all space on the hard drive, so if the suspect’s hard drive is 250 Gb, so too will be our forensic image.
Once the forensic image is completed (which can take hours depending on the drive size) we hash the forensic image and compare this hash value with the value we originally obtained. If these two values match then we know that we have an exact copy of the suspect drive with absolutely no changes made.
As soon as the imaging and hashing process has finished the original hard drive is disconnected from the write blocker and placed back into the suspect computer. The suspect computer is then packaged back in its sealed evidence container and placed on the appropriate shelf within the evidence room.
Now the forensic examination begins on the forensic image of the hard drive and the original evidence is no longer needed.
*Sgt. Moulin is conducting important police business today, but will be available to answer questions as time permits. Thanks for your patience.