Featured Post

Welcome to the Forensic Multimedia Analysis blog (formerly the Forensic Photoshop blog). With the latest developments in the analysis of m...

Friday, December 30, 2011

Ill. Supreme Court: Police must preserve video evidence even in misdemeanor cases

From the Chicago Tribune: "The Illinois Supreme Court says video has become so common in law enforcement that police must preserve it as evidence even in misdemeanor cases.

The court upheld sanctions Friday in a case where police erased video of a drunken driving arrest. The defendant told prosecutors she intended to fight the charges and wanted the video, but police still followed their policy of destroying videos after 30 days.

As punishment, the trial judge barred the arresting officer from testifying about anything that took place when his squad-car camera was running.

Cook County prosecutors appealed, saying that would cripple their case.

But the Supreme Court says the video should have been saved and the judge was within his rights to limit testimony when that didn't happen."


Thursday, December 29, 2011

JPEG Snoop

I posted this to ImpulseAdventure's site to ask a question about JPEGSnoop: "Take a photo with your camera. Upload it to Facebook. Download it from Facebook. Run the downloaded image through JPEGSnoop.

The software will show it as edited. Essentially, Facebook recompresses the image on your computer before it uploads it to their servers. Gone are the markers from your camera.

Other than the recompress - there's no actual "editing" as most people use the term. Nothing added or deleted to the photo.

What are your thoughts on this? Is it possible to refine the terms? Something like this could be listed as double quantization - resaved? How about a DCT histogram to point to the integrity of the image in spite of the double quantization?

Here's their response:
"You're absolutely right Jim... The term "edited" is used very loosely. Really, all that is meant is "not-original". As it is incredibly hard to differentiate simple resaving (recompression) from an edit+resaving, I haven't made any efforts to report "double quantization". I'm definitely open to ideas on suitable terminology. Of course most people are interested in determining if an image has been altered in the more general sense of the word (ie. modified to misrepresent reality), rather than simple resaving, resizing, etc. Regarding the DCT histogram, what type of data were you thinking could be interesting from a histogram perspective? Thanks!"

Wednesday, December 28, 2011

From North Korea, an Altered Procession

Here's an interesting piece of photo editing from North Korea courtesy of the NY Times.


Friday, December 23, 2011

Merry Christmas

I want to take the opportunity to thank everyone for their support over the years.

Here's to you. Happy Holidays!


Wednesday, December 14, 2011

Stanley Cup riot suspects await first day in court Wednesday Read it on Global News: Stanley Cup riot suspects await first day in court Wednesday

This just in from GlobalBC: "...Looters stole $424,000 worth of merchandise from the store once the heavy-duty glass and security gate was smashed by the mob. Damage to the store was $225,000 and Powell said they are still working with the company’s insurers to see what will be covered under their policies.

He said they have passed on their state-of-the-art security video footage to police, who took over 5,000 hours of riot footage to a special lab in Indianapolis, and will have the company’s security experts ready to appear in court if needed.

Powell said they have clear video of the first looters coming in to the store after the doors and windows were destroyed.

“They had a shopping list,” Powell said, adding they hope to recover some of the stolen items. “They were stealing specific products, specific brands. It was like a boxing day sale with no cash register.”

Powell said London Drugs has been careful to provide footage they believe will stand up to any defence lawyers’ challenges.

“Our track record is over 90 per cent conviction rate once we show the video,” he said past shoplifting cases. “I have great faith in the justice system.”

Click here to read the rest of the story.


Tuesday, December 13, 2011

The murder of Police Officer Peter Figoski

Here are a few stories about the senseless murder of Police Officer Peter Figoski:

Why was he freed to kill? - NY Post editorial.

Fallen Finest - NY Post.


Post launches fund for hero cop’s daughters - NY Post

Please keep the Figoski family in your thoughts and prayers.

Monday, December 12, 2011

New School Puts Modern Forensics at Afghan Police Fingertips

From DVIDS Spc. Ken Scar: "Afghanistan took another big step toward autonomy Nov. 29 with the opening of the Afghan Criminal Techniques Academy and Laboratory.

The ACTA will train Afghan law enforcement officers in the forensic disciplines, which to this point have not been widely practiced in the Afghan justice system.

Figure 1: Afghan National Police member Mohammad Shafiq (right), an instructor-in-training at the new Afghan Criminal Techniques Academy and Laboratory on Bagram Air Field, shows fellow policemen and students Eqeban (left), and Habiburahman how to gauge a bullet casing with digital calipers in one of their brand-new classrooms.

The ACTA will teach essential techniques like fingerprinting, forensic photography, and firearms/tool marking and will eventually include instruction in the most modern technological and chemical evidence testing such as DNA processing.

“We will be able to find criminals and bring them to justice [with this forensic capability],” said Mohammad Shafiq, a member of the Afghan National Police who will be an instructor at the ACTA. “It will also help [Afghan citizens] be more confident in their police system.”

Initially, the academy’s instructors will be from the U.S., but over time Afghan law enforcement professionals will work as assistant instructors.

To make that transition as trouble-free as possible, the 10-week program at the ACTA will be supplemented by American experts embedded in Afghan National Police offices in each region of the country, guiding ACTA graduates through their first year of work.

“We’ll mentor these guys and make sure there aren’t any mistakes being made and that the product going out is accurate,” said Jon Eizinger, a U.S. civilian forensic specialist who will train instructors for the ACTA. “It’s a safety net that’s built in to make sure this goes smoothly and that these guys develop until they are able to be self-sufficient.”

The technology and knowledge provided by the new academy will greatly improve the credibility of Afghanistan’s criminal justice system, said Afghan National Army Col. Said Rahmatullah Quraishi, who is the ANP Assistant Director of Criminal Technique.

“In the old system the judges projected their opinion on cases because we didn’t have [forensic] technology,” said Quaraishi. “With this new ability [to present hard evidence] they will not be able to do that.”

The ACTA will play a pivotal part in Afghanistan’s transition from a judicial system where the burden of proof lies on the accused to one where a person is considered innocent until proven guilty.

Many Afghan citizens have been skeptical of their new government’s justice system, said Shafiq, but the new abilities to present evidence at trials, provided by ACTA schooling, will go a long way toward turning the tide of opinion.

“Now the people can have a lot more trust in us,” he said."


Monday, December 5, 2011

Subjecting forensic analysts to cross-examination is good policy.

From the NY Times: "ON Tuesday, the Supreme Court will hear oral arguments in Williams v. Illinois, the latest in a string of cases addressing whether the Sixth Amendment’s confrontation clause — which gives the accused in a criminal case the right “to be confronted with the witnesses against him” — applies to forensic analysts who produce reports for law enforcement. In other words, should an analyst responsible for, say, a fingerprint report have to show up at trial to face questions about the report?

A logical application of the law produces an easy answer: Yes. The court has defined a “witness against” a defendant as a person who provides information to law enforcement to aid a criminal investigation. That is exactly what forensic analysts do.

Subjecting forensic analysts to cross-examination is also good policy. According to a recent National Academy of Sciences study, forensic science is not nearly as reliable as it is perceived to be. DNA specimens, for instance, are sometimes contaminated; fingerprint, ballistics and even run-of-the-mill drug and alcohol analyses depend on human interpretation and thus are subject to error. Worse, investigations over the past decade have revealed outright incompetence and fraud in many crime labs. So it makes sense to subject the authors of lab reports to cross-examination — a procedure the court has called “the greatest legal engine ever invented for the discovery of truth.”

Despite all this, the Supreme Court has been sharply divided on the issue. In similar cases in 2009 and earlier this year, in which I represented the defendants, Chief Justice John G. Roberts Jr. and Justices Anthony M. Kennedy, Stephen G. Breyer and Samuel A. Alito Jr. accepted claims by state governments that, simply put, confrontation in this context costs too much. It is far more efficient, these justices contend, to let analysts simply mail their reports to court. Having to appear at trials pulls them away from their labs, and only occasionally proves more revealing than their written testimony. Hence, these justices maintain, “scarce state resources” are better committed elsewhere.

Given that several states have long required forensic analysts to come to court, one might think that this financial argument would not have gained much traction. Justice Antonin Scalia, in fact, called the argument a “bogeyman.” But the four dissenting justices not only accepted it but deemed it powerful enough to trump the commands of constitutional text and precedent.

The same battle lines are being drawn again in the case to be heard next week (for which I have signed a friend-of-the-court brief in support of the defendant). In Williams v. Illinois, the defendant contends that he should have been given the right to confront an analyst in the lab that generated a DNA profile from the crime scene. Yet the State of Illinois argues that the extra cost of bringing that witness into court was unnecessary, because the defendant had an opportunity to question a different analyst who compared that profile to the defendant’s and concluded that it was a match.

A friend-of-the-court brief by the Manhattan district attorney’s office pushes the state’s argument one step further, warning that a ruling in the defendant’s favor would prove so costly that it would “force prosecutors to forgo forensic DNA analysis” in future cases. Consequently, the brief continues, defendants in rape and murder cases “might well be prosecuted solely on the basis of eyewitness testimony,” which is notoriously unreliable and could lead to convictions of many “innocent individuals.”

This is an outrageous assertion. Nothing in the outcome of the Williams case, which deals only with the admissibility of evidence, will preclude prosecutors from using DNA testing to determine whether they have the right guy. Presumably, prosecutors concerned about whether they imprison (or, in some states, execute) innocent people will continue to do such testing whenever possible, no matter how much it will cost to enter the results as evidence.

But the assertion in the Manhattan district attorney’s brief reflects — in a particularly dramatic way — some prosecutors’ belief that they can bully the court into refusing to enforce a constitutional guarantee simply by arguing that such enforcement would be an administrative and financial burden.

There’s nothing new here. In the 1963 case of Gideon v. Wainwright, Alabama and several other states filed a brief urging the court to refrain from interpreting the Sixth Amendment’s guarantee of the “assistance of counsel” to require states to provide lawyers to poor defendants accused of felonies. The brief said such a rule would impose on states “an unbearably onerous financial burden to pay the fees of attorneys.”

The court, of course, was not moved. States have adapted. And the Gideon case has become a cornerstone of American jurisprudence. It’s almost impossible now to imagine how a trial could be considered fair without that basic procedural guarantee.

The court should follow this lesson in Williams and refuse to be cowed by prosecutorial bogeymen. It unquestionably costs money to deliver the fundamental demands of justice. But the price is not nearly so high as the states usually claim. And the price of failing to enforce basic procedural rights is, in the long run, much higher ..."

Click here to read the whole article at the New York Times.


Friday, December 2, 2011


I was recently testifying about my work in downloading the contents of a cell phone's memory card. In these types of cases, the investigator will request certain actions be performed and (usually) a search warrant will grant me the authority to search ... as well as to define the parameters of the search. As the investigator is usually responsible for the warrant, (usually) the request terms and the warrant terms are one and the same. Usually.

Many times, these downloads take place before an attorney is assigned to the case ... or even before there's a case. It may be a witnesses' device, or the suspect may be questioned and released. Once we give the phone back ...

As an analyst, I'm limited in searching a device by the terms of the warrant or consent letter. As I'm not the investigator, I can only advise, then do what I am ordered to do by the court or investigator.

So ... back on the stand, I'm asked if I did an analysis, looked for certain items, etc. Answer ... no. The request was only for a download of the contents. No time (or request) was given for analysis.

Part of teamwork is anticipating what each member of the team will want/need. Part of that is communication. "Just dump the contents and we'll worry about the rest later ..." works great when later actually happens. But, when I'm subpoenaed 2 years later, with no further communication happening, there's not much I can do to help ... other than state and affirm that I did perform a download, using write blockers, etc.

Part of the solution to this problem is coming soon. I'm working on "boiler plate" warrant language for a variety of scenarios and jurisdictions. I'm also working on some forms that can be modified for use at your agency. We may only get one shot at the evidence. I'll do what I can to help you get the most out of that one shot. When it's done, it'll be up on the book's web site. Stay tuned for more on this.

Thursday, December 1, 2011

Busy Busy Busy

It's the busy season. School's wrapping up for the year, investigations are being finalized, and there's so much to do. On my to-do list for the month is a thorough testing of Kinesense, along with a review. I'm also working on a new set of give-aways for owners of my book. More on that later.

In the mean time, enjoy the winter season.