8Investigative Reconstruction with Digital Evidence Dr. John P. Abraham Professor UTPA

Investigative reconstruction Systematic process of piecing together evidence. Only offenders know full story They leave an imprint of thesmselves at the scene

Uses of reconstruction Develop an understanding of case facts Expose important features Locate concealed evidence Prioritize investigation of suspects Establish evidence of insider or intruder knowledge

Caveats Concentrate on the evidence rather than the suspect Resist preconceived theories, or concentrating on one person

Equivocal Forensic Analysis Process of evaluating available evidence objectively Independent of the interpretations of others Identify any errors or oversights that may have already been made. When investigators render opinions in a case they are staking their reputation on the veracity of these opinions. An investigator who does not base conclusions on sound evidence will have a short career.

Basis of fact Known facts and their sources Statement from suspects, victims and witness First responder reports Interviews with those who handled evidence Crime scene documentation Etc. See page 260

Reconstruction Temporal (when), Relational (Who, what, where) and Functional (how). Computers can provide timeline. Log files are rich in behavioral evidence Geographical information may be available Missing items Unusual events or time

Temporal analysis Computer log files give events and timeline. Create a histogram of times can reveal periods of high activity. Graphing can highlight repeated patterns.

Relational Analysis Determining where a person was in relations to other objects See page 263064.

Functional Analysis Consider what conditions were necessary for certain aspects of the crime to be possible. Capabilities of the system available to the suspect Configuration of the computer available to the suspect.

Victimology Study of victim characteristics May lead to understanding why an offender chose that victim Can create a history of attempts to target the victim -rest of the chapter is for reading only. No lecture.