1. 8Investigative Reconstruction with Digital Evidence
Dr. John P. Abraham
Professor
UTPA

2. Investigative reconstruction
Systematic process of piecing together evidence.
Only offenders know full story
They leave an imprint of thesmselves at the scene

3. Uses of reconstruction
Develop an understanding of case facts
Expose important features
Locate concealed evidence
Prioritize investigation of suspects
Establish evidence of insider or intruder knowledge

4. Caveats Concentrate on the evidence rather than the suspect
Resist preconceived theories, or concentrating on one person

5. Equivocal Forensic Analysis
Process of evaluating available evidence objectively
Independent of the interpretations of others
Identify any errors or oversights that may have already been made.
When investigators render opinions in a case they are staking their reputation on the veracity of these opinions.
An investigator who does not base conclusions on sound evidence will have a short career.

6. Basis of fact Known facts and their sources
Statement from suspects, victims and witness
First responder reports
Interviews with those who handled evidence
Crime scene documentation
Etc. See page 260

7. Reconstruction
Temporal (when), Relational (Who, what, where) and Functional (how).
Computers can provide timeline.
Log files are rich in behavioral evidence
Geographical information may be available
Missing items
Unusual events or time

8. Temporal analysis Computer log files give events and timeline.
Create a histogram of times can reveal periods of high activity.
Graphing can highlight repeated patterns.

9. Relational Analysis
Determining where a person was in relations to other objects
See page

10. Functional Analysis
Consider what conditions were necessary for certain aspects of the crime to be possible.
Capabilities of the system available to the suspect
Configuration of the computer available to the suspect.

11. Victimology Study of victim characteristics
May lead to understanding why an offender chose that victim
Can create a history of attempts to target the victim
-rest of the chapter is for reading only. No lecture.