Archiving digital evidence

Popular Mechanics magazine has an interesting article on the issues involved in long term digital storage and retrieval. These issues are of particular concern in forensics - how do we safely store evidence in digital format for 20 plus years and also make sense of it when after retrieving it, despite the ravages of time and the march of technology?

To put things in perspective, when I was in high school (years 10-12 for those of you from other countries), we used slide rules in my electronics courses. For the first few years at university, we used punched cards for data and program input (this was how you programmed the venerable workhorse IBM 360/370 computer back then). Computer data storage in those days was either an analog audio cassette tape (for low-end machines, such as the Commodore computer) or tape reels. To move quickly to the present day on this trip down memory lane, now we use thumb drives, memory cards, and RAID systems, to name a few current alternatives.

There is also the issue of possibly needing to maintain the computer operating systems to "address" the data and/or programs - they've changed rapidly too. Add proprietary standards on top of it and you've got the makings of a very big problem.

Some important things to remember on this subject are:

• Use media that is certified to last for at least as long as you are required to retain the data, preferably longer. I advise staying away from tape myself, given the number of cases of dry rot and self-erasure I've encountered. CD and DVD are the current favorites, but don't confuse a short-term cost savings with long term viability - buy "gold" disks. Also see NIST publications, such as this one, for tips on archiving CD and DVD media. The environment in which you store your media matters!
• Render your results into "data" and store the data. Don't (only) store the data as part of a "project" file that will then require running the program to get the data back out. The same goes for the audit trail. Don't rely on (only) a "project" file to store the steps you took in processing the evidence.
  
• Store data in non-proprietary formats, preferably ones with wide support. In the case of audio and video data, I recommend WAV and AVI, respectively. For textual data (reports, audit trails, etc.), .TXT is a good choice.
  
• Periodically perform spot checks to ensure archiving and retrieval procedures are working properly. It only takes one mistake to ruin a lot of evidence!

Please note I am not trying to say that you should never use proprietary data, project files, and such. What I am trying to get across is to not be single-threaded on them. In other words, go ahead and store your report in Microsoft Word (R) but also store a copy in TXT, just in case. Go ahead and store the project in your audio or video software, but also render and store a WAV or AVI. For that matter, you should burn an audio CD (i.e. CDA format) or video DVD too, so that an operating system is not required for playback.

In closing, effective archival of data is a tough problem, but one that has been around for a long time in one form or another - consider cave paintings and hieroglyphics as examples. We won't "solve" the problem even now, but it is our responsibility as professionals and keepers of the public trust to take reasonable and effective steps to maintain the integrity of the evidence.

Robbers steal cash and video evidence

Two armed men robbed a convenience store in Arlington, TN (USA) on November 19th and, after noticing the store's video security system, also took the video tape cassette showing the crime. There were several eyewitnesses and the robbers were not wearing masks when they entered the store. Police have appealed to the community for assistance in solving the crime.

(Hat tip: Eyewitness News 24 and CW30)

US and Canada to share crime scene forensics data

According to this Associated Press (AP) report, the US and Canada have signed an agreement to allow the real-time sharing of crime scene forensics data.

Collection and use of security video evidence after a crime

The Edmonton Sun has a report on the Michael White murder trial. Mr. White is accused of murdering his wife, Liana, and abandoning her body in her white SUV. City police presented evidence consisting of images recovered from a security video camera at a local pub and an analysis thereof. The images, with their timestamps, show a white SUV being driven down the road where the victim's body was found during the relevant time frame and some minutes later a man of similar build to Mr. White jogging back down the road. None of the images are ID (identification) quality to be sure, but the video was apparently analyzed carefully to see if there was a match with the vehicle and to see if the times and distances were consistent with the prosecution's accusations.

Besides not being widely reported (at least as of now), the other reason I am posting this is to point out how the widespread use of security cameras has caused a change in investigation procedures and workload. Now, after a serious crime has occurred, law enforcement personnel perform a sweep of all security cameras within the area and collect the video on them for analysis.

You might not think it so, but the collection itself can be a major task. In the old days, only a few places generally had them and the ones that did recorded to video cassette. Now, with the advent of hard disk based recorders, just getting the video off the recorder in a way that preserves the original quality is challenging. On top of that, coping with the proprietary codec and playback software is an additional challenge.

Aside: "Codec" is short for coder-decoder, which is the algorithm that translates the raw video into a digital format, which is often of much smaller size and contains significantly less detail.

This brings to mind the July 7th bombings in London, UK. Because the bombings occurred at multiple locations spread across the center of London, thousands of recordings had to be collected and analyzed. This required an incredible amount of effort. In the true spirit of international law enforcement cooperation, a colleague of mine from the USA was detailed to the UK for a year to help out with the work load. You've probably seen some of the images that they found. They not only tied the suspects to the bombing but provided other information as to their methods of operation. So, although the explosion of digital security video camera technology has not been without problems and has also increased the workload substantially, there are significant benefits that has come with it - benefits that may include bringing the correct person to justice for the slaying of Mrs. White.

Note: I would like to make it perfectly clear that I am not making any judgments or claims about the quality or validity of evidence against the accused in this case. As is said in the USA, the "accused is innocent until proven guilty". In any case, evidence may be tossed out, an alibi may be presented, or other events may result in the accused being acquitted, either initially or on appeal.

DARPA wants a 10-gram long range IR camera

DARPA has released a broad agency announcement (BAA) for a program with an ultimate goal of a SWIR (Short Wave Infra Red) camera weighing only 10-grams total - that means 10-grams for the camera, lens, detector, and electronics. Fortunately, the winning contractor lab(s) won't have to promise to reach that goal in the first phase!

DARPA has crafted the goals so that they become more and more aggressive as the program goes on (as usual). There are also different requirements for medium and long wave IR camera systems as well as different applications (miniature UAVs and head-mounted).

That being said, the goals are beyond challenging. A report at Defense Tech has a quote saying that "it will take a radically new approach". I'd say that is an accurate assessment myself. It will be very interesting to see what the contractor labs come up with.

The information packet can be found here (PDF download).

(Hat tip: Defense Tech)

Online store

Well, I didn't get it done in the 5 minutes that the review I read suggested was all that was necessary, but after a couple of hours I had Amazon's aStore up and running for this blog. Don't take this move wrongly though - this is not turning into a commercial blog, by any stretch of the imagination. I have no fantasy of this being a get-rich-quick thing. If it helps pay for my broadband bill each month, I'll be more than happy! As things go with me, what it will all probably mean is that I will lose money in the long run - as I find books that I haven't gotten around to buying already. For instance, just today I ordered a copy of Temples of Sound (a book about the famous sound recording studios in the USA).

As part of this exercise, I added in entries for my favorite books in the field of audio and video forensics. Most are not forensic books themselves as there aren't many in this niche discipline, but instead books on recording, biopsychology, filtering/processing, and the like. All in all, I'm not displeased.

That being said, there is room for improvement from my perspective. For instance, it would be much more helpful to either allow more recommendations OR boolean search terms when setting things up for what is displayed (like the OR I just used).

Anyway, feel free to let me know what you think, either online as a comment or offline via email (see the email link at the top of the links section, but don't forget to replace the anti-spam text).

Other blogs of note

I wanted to pass along some links to other blogs worth spending some time with. Two are related to forensics and the other is by the same guys who wrote "Freakonomics", a very interesting and approachable book on economic statistics applied to the everyday world. They are:

• Psychology and Crime News
• Forensic News Blog
• Freakonomics

Enjoy!

Update on DARPA's Automatic Speech Recognition & Translation Project

The AP has a very interesting article about BBN Technologies' work on DARPA's speech recognition and translation project, called Global Autonomous Language Exploitation (GALE).

There are two other companies being funded, along with BBN, for the work - IBM and SRI International. All three are being supported by LDC (Linguistic Data Consortium, University of Pennsylvania), which is an open consortium founded by the USG (United States Government) to create and distribute speech and text databases, as well as other types of resources, for language research.

The AP article is easily understandable by non-specialists, while still being interesting for those who do this for a living.

The researchers are only one year into a five year funded effort, so it is still early days. It will take some significant breakthroughs to accomplish what Dr. Joseph Olive, the DARPA program manager heading it up, has set out for the goals - they are well beyond merely challenging, but that is what DARPA's mission is supposed to be about.

(Hat tip: Ars Technica)

Latest version of Audacity can save multichannel wav files

It is still in beta, but Audacity 1.3.2 is available for download from Sourceforge.net and from an afternoon spent with it on a Windows XP SP2 machine, I can say that I like it better than any other audio editor I have tried (and I have tried many). Plus it is open source and free! Well, I do have one beef with it - it doesn't support DirectX plug-ins.

I upgraded to this version for the simple fact that it now supports saving (exporting, writing, or what ever you might call it) multichannel wav files. All other audio editors these days seem to have been streamlined to support only CDs (i.e. two channel), surround sound (5.1), or similar mass market formats. Of course, if you are messing about with microphone arrays, being able to save multichannel files is more than a convenience. Adobe pulled this feature out of Audition (editor's correction) (formerly Cool Edit), much to my chagrin. Things haven't been easy since.

You do have to configure Audacity properly first, however, as it won't allow it in its default state after installation. To do this, go to Edit/Preferences to pull up the panel for setting the application's preferences. Then select File Formats and tick the radio button labeled Use Advanced Mixing Options. When you get ready to save your multichannel file, simple choose File/Export As/Wav and it will pop up a handy panel to let you select which track gets recorded to which channel. Very nice.

This version also seems to be faster at loading and working with multichannel files. All editors that insist on displaying the time waveform (and that would be just about all of them) go through the entire file at first load. This can take a long time when you are talking about some of my files - 64 channels, 24 bits, and at least 16kHz sample rates.

BTW, you can also select how many channels you wish to record to under the I/O heading in the Preferences Panel. I haven't tried this with an external digitizer yet, but I will do so soon on a MOTU box.

(Notes: "Audacity" is a trademark of Dominic Mazzoni. Audacity is licensed under the Creative Commons Atribution License Version 2.)

Maintenance of audio/video equipment

I will use this news report to highlight a continuing issue in the audio and video forensic community - poor maintenance of equipment and detrimental penny-pinching on electronic media. All too often, equipment gets purchased and installed in interview rooms only to then not be maintained until it breaks. I don't know if this was in fact the case with this particular incident, but the quote "Technical problems caused the tapes to have poor audio quality" seems to point in that direction.

Experience suggests that one or more of the following common occurrences could have happened:

1. the record head was out of alignment, dirty, or magnetized;
2. that someone had tampered with the equipment (suspects brought in for interviews often try to sabotage the recording equipment while the detective is out of the room, such as by jamming a pencil into the microphone, so maybe the microphone had been somewhat damaged previously);
3. that inferior quality tapes were used (just because you can get 100 tapes at the local big box store for $3 doesn't mean they should be used for what could end up being used as evidence);
   
4. that the tape had not been changed recently (if their policy was to reuse tapes);
5. there was an electrical power grounding problem (causing hum);
6. the recorder had some other fault (bad tensioner maybe, but then the video would have been out of sync also); or
7. the suspect was too far from the microphone to pick up clearly (doesn't sound like the case here though).

I'm curious to know if they attempted forensic audio filtering or not. Depending on the nature of the problem, it might be possible to recover the audio, although it may not be important enough to either the defense or prosecution to justify the effort. Welcome to the sometimes messy, but real, world of audio and video evidence.

Complicated forensic case against target using counter-surveillance

Scotland Yard had quite a large, complicated case on its hands when it tried to arrest, charge, and convict Dhiren Barot, 34 and from London, reports the BBC. Barot was apprehended while plotting terrorist attacks against the UK and USA. The following quote will give you a sense of just how involved a case it was:

Codenamed Operation Rhyme, it saw 4,000 garages and lock-ups visited and the seizure of nearly 300 computers and around 1,800 items of discs, CDs and removable storage. The case also involved a wide range of investigative methods, including forensic linguistics, to prove the authorship of documents, facial mapping, computer forensics and handwriting analysis.

Barot also employed counter-surveillance on a routine basis, according to the report. He

rarely stayed anywhere for more than a night, used a variety of different vehicles and hardly ever used mobile phones. He would also perform sudden manoeuvres in heavy traffic or circle roundabouts to make it more difficult to be tailed.

Barot was sentenced to life in prison.

Forensic Positions

I'm passing along the following position announcements posted to the Forensic Linguistics List:

Research Assistant/fellow (2 posts), Eyewitness Memory, University of Aberdeen (UK)
http://www.jobs.ac.uk/jobfiles/KE052.html
Applications are invited for one Research Assistant position and one Research Fellow (two posts, each for 3 years) to work on a research project which aims to develop objective and effective means of assessing the extent to which a particular eyewitness memory report can be relied on as evidence. Closing date 13th November.

Teaching Assistant (0.5fte), University of Leicester
http://www.le.ac.uk/personnel/jobs/e2994a.html
Applications are invited from Psychology graduates with sufficient knowledge in forensic psychology or related areas for a half-time post to support the School's three distance learning Masters courses in Forensic Psychology. There will be an opportunity to register for a higher degree by research. Closing date: 16 November 2006.

Criminal Justice Faculty-Social Sciences, Metropolitan State College of Denver (US)
http://www.academiccareers.com/cgi-win/JobSite/SendJob.exe/ACO/?14535
The successful candidate will teach 12 hours per semester in the Criminal Justice and Criminology Department. Closing date: 7 Jan 2007

Forensic Psychology in the news

First off, let me say that Forensic Psychology is not my specialty. Second, I should point out that politics can come into play in any discussion involving interrogations (and for that matter, surveillance), most particularly when reported on by the news media or commented on by politicians and activists.

Be that as it may, the Cape Cod Times has a report from an on-going trial in which forensic psychology and interrogations are currently front-and-center. It seems to have a leftward bias from my reading ("forewarned is fore-armed", as they say), but is interesting nonetheless.