Digital & Multimedia Evidence in Forensics

Digital & Multimedia Evidence

• The Virginia Department of Forensic Science (DFS) Digital & Multimedia Evidence (DME) Section provides examination services for information stored in analog or digital formats.

• The DME Section is divided into three sub-disciplines:

  • Computer Device Analysis
  • Mobile Device Analysis
  • Video & Image Analysis

• The DME Section has capabilities that include preservation, repair, acquisition, processing/identification, analysis/verification, clarification, and reporting.

• The DME Section can analyze information from devices including:

  • Computers: servers, desktops, laptops, game systems, magnetic card skimmers, and "Internet of Things" (IoT) devices
  • Mobile Devices: cellular telephones, tablets, and GPS navigation devices
  • Digital Storage Devices: hard disk drives, flash memory, and optical discs

• DME Section has the capability to acquire decrypted physical and logical data from a variety of devices.

Computer and Mobile Device Analysis

• Computer and Mobile Device Analysis involve examining electronically stored information originating from a wide variety of devices.
• Analysis of devices can result in the identification and recovery of a wide variety of information, including:
  • Existing and previously-existing (deleted) data
  • Data decryption and security measure identification or circumvention
  • Electronic communications such as email, chat, text/multimedia messages, call logs, and contacts
  • Multimedia files such as pictures, audio recordings, and video recordings
  • Documents and spreadsheets
  • User activity or usage patterns, such as web-browser activity, location information, device or application usage, file activity, timeline of events, and activity attribution.

Video & Image Analysis

• Video & Image Analysis involves the scientific examination of analog or digital video recordings, and print or digital still images.
• Devices analyzed include:
  • Cellular telephones
  • Hand-held video cameras
  • Body-worn cameras
  • Security/surveillance systems
  • Dashboard cameras
  • Home videos or digital cameras
• Analysis of video recordings or still images can result in:
  • Existing and previously-existing (deleted) recordings and still images
  • Confirmation of correct visual display
  • Clarification (enhancement) of specific details of a person or object
• Clarification techniques include:
  • Image deblurring
  • Magnification (aka Zoom)
  • Frame Averaging
  • Reduction in playback speed
  • Demultiplexing
  • Redaction of sensitive information or material

Collection Guidelines

• Evidence descriptions should be listed on the Request for Laboratory Examination (RFLE).
• The Area of Interest (AOI) (i.e., requested information and/or time frame) being sought should be indicated on the DME Submission Supplement form.

Computer or Digital Storage Devices

• Evidence should be in a rigid container protected from extreme temperature and strong magnetic sources.
• Only submit relevant items to be analyzed.
• Provide this information on the DME Submission Supplement form:
  • The area(s) of interest to be identified/recovered
  • Any removable storage devices
  • Any power cables/adapters/manuals
  • Any required passcodes
  • Any damage present
  • Any access to or modifications made
  • Authorization to utilize potentially destructive processes
• Unless otherwise directed, a date/time filter may be applied to parsed data encompassing a time frame beginning (at most) six (6) months prior to the offense date listed on the RFLE, and ending with the most recent date/time of activity identified within the parsed data.

Mobile Device Analysis

• Ensure the device stays powered on and is sufficiently charged – DO NOT ALLOW THE DEVICE TO POWER OFF OR REBOOT
• Shield the device from communication networks by putting the device into Airplane Mode, removing its UICC, and/or placing it in a shielded enclosure.
• Submit the device to the Central laboratory as soon as possible.

Mobile Device Seizure

• Power down the device via its interface or by long-pressing its power button and, if applicable, remove its battery.
• If the device is seized powered off, remove its battery and UICC (if applicable).

UICC and Flash Memory Cards

• It is important to determine if the device contains a UICC or flash memory card such as a microSD card.
• These storage devices should be indicated on the RFLE as additional items of evidence, typically as sub-items to the handset.

Mobile Device Packaging

• Place in an anti-static container (e.g., paper envelope).
• Place in a >3 mil thick shielded enclosure (e.g., "Faraday" bag) or wrap in aluminum foil (5 times with heavy duty or 10 times with standard thickness).
• Place in an outer storage bag (container) and seal
• Packaging kits may be available from a third party vendor for purchase.

Mobile Devices Continued

• Provide this information on the DME Submission Supplement form:
  • The area(s) of interest to be identified/recovered
  • Any removable storage devices
  • Any power cables/adapters
  • Any required passcodes
  • Any damage present
  • Any access to or modifications made
  • Authorization to utilize potentially destructive processes
• Unless otherwise directed, a date/time filter may be applied to parsed data encompassing a time frame beginning (at most) six (6) months prior to the offense date listed on the RFLE, and ending with the most recent date/time of activity identified within the parsed data.