| |
Published by the Drug Enforcement Administration
Office of Forensic Sciences Washington, D.C. 20537
The U. S. Attorney General
has determined that the publication of this periodical is necessary in
the transaction of the public business required by the Department of Justice.
Information, instructions, and disclaimers are published in the January
issues.
- INTELLIGENCE ALERT-
 |
Photo 1 |
LSD BLOTTER ACID MIMICS (CONTAINING 2,5-DIMETHOXYAMPHETAMINE
(DMA)) IN HIGHTSTOWN, NEW JERSEY
The New Jersey State Police Office of Forensic Sciences, Central Laboratory (Hamilton) recently received three blotter paper rectangles, one plain, two with a black, multi-stripe pattern, suspected LSD “blotter acid” (see Photo 1; scale is in inches). The exhibits were part of a polydrug seizure by the Hightstown Police Department, pursuant to a vehicle stop for DWI (Hightstown is located just off the New Jersey Turnpike about midway between Trenton and New Brunswick). The other exhibits in the case included marijuana, clonazepam, and several prescription tablets (not further specified). Analysis of an extract of the blotter paper squares by GC/MS, however, indicated not LSD but rather 2,5-dimethoxyamphetamine (commonly abbreviated as DMA or sometimes as 2,5-DMA; not formally quantitated, but a relatively low loading in all three pieces). This is the first time that DMA has been submitted to the laboratory in any form.
* * * * *
- INTELLIGENCE ALERT -
ECSTASY MIMIC TABLETS (CONTAINING CAFFEINE, METHAMPHETAMINE, LIDOCAINE,
AND AN UNKNOWN PHENETHYLAMINE) IN BROWARD COUNTY, FLORIDA
 |
Photo 2 |
The Broward Sheriff's Office Crime Laboratory (Fort Lauderdale, Florida) recently received five bags containing in total approximately 500 green tablets, each with a Nike “swoosh” logo, alleged MDMA (see Photo 2). The exhibits were acquired in an undercover operation in Broward County by the Broward Sheriff’s Office. Analysis of the tablets (total net mass 150.8 grams) by GC/MS and also by GC/MS after chemical derivatization with heptafluorobutyric anhydride (HFBA) indicated a mixture of caffeine, methamphetamine, lidocaine, trace MDMA, and an unknown phenethylamine, possibly 3,4-methylenedioxydimethylamphetamine (MDDMA). The primary component was caffeine; the methamphetamine and the unknown phenethylamine were present at about 3 percent, and the lidocaine at about 4 percent, relative to the caffeine. This was the first submission of these type Ecstasy mimic tablets to the laboratory. Of interest, the suspect also had a methamphetamine smoking pipe and Seroquel 200 tablets (quetiapine fumarate, a prescription antipsychotic) in his possession.
* * * * *
- INTELLIGENCE ALERT -
 |
Photo 3 |
ECSTASY MIMIC TABLETS (CONTAINING 1-(4-CHLOROPHENYL)-
PIPERAZINE (cPP)) IN NAPLES, ITALY
The Laboratorio Indagini Chimiche of the Gabinetto Interregionale di Polizia Scientifica per Campania e Molise (Naples, Italy) recently received 92 mottled turquoise tablets, 9 x 3.6 millimeters, no logo, suspected MDMA (see Photo 3). The exhibits were seized by the Railway Police of Naples (details not available). Analysis of the tablets (total net mass 26.86 grams) by color tests and GC/MS, however, indicated not MDMA but rather 1-(4-chlorophenyl)piperazine (commonly abbreviated as cPP; not formally quantitated, but roughly 5 - 10 percent). cPP is not currently scheduled under Italian law. This was the first submission of cPP-containing tablets to the Polizia Scientifica Laboratory system.
* * * * *
- INTELLIGENCE ALERT -
COCAINE IN PAINTED WICKER BASKETS
AT MIAMI INTERNATIONAL AIRPORT
 |
 |
Photo 3 |
Photo 4 |
The DEA Southeast Laboratory (Miami, Florida) recently received 23 brightly colored wicker baskets containing a white powder, suspected cocaine (see Photo 3). The exhibits were seized by Immigration and Customs Enforcement (ICE) from a passenger arriving at Miami International Airport on a flight from Haiti. The powder was contained inside plastic sleeves (see Photo 4; displayed oversize to show detail), which were inside hollow, very thin-walled wooden tubes, which were in turn wrapped with brightly colored cloths; the resulting “wickers” were then assembled into the baskets. Analysis of the powder (total net mass 14.80 kilograms) by GC/MS and FTIR confirmed 82 percent cocaine hydrochloride. This is the first submission of this type to the Southeast Laboratory.
- INTELLIGENCE ALERT -
 |
Photo 5 |
|
Photo 6 |
PHARMACEUTICAL MORPHINE SULPHATE TABLET MIMICS (CONTAINING HEROIN) IN NEW YORK
The DEA Northeast Laboratory (New York, New York) recently received a submission of 900 white tablets contained in apparently commercial blister packs, labeled in part as: “Each uncoated tablet contains morphine sulphate USP 30 mg.” (see Photo 5). However, the labeling had no manufacturer’s logo, or place of manufacture. The exhibit was seized in New York by the DEA New York Field Division pursuant to an Internet pharmacy investigation, along with other blister-packed pharmaceuticals. The tablets were half scored, weighed 204 milligrams each, and had a somewhat degraded appearing surface coating. Scraping off the surface layer revealed a brown and white granular interior, not consistent with a pharmaceutical preparation (see Photo 6). Analysis of the tablets (total net mass 184.3 grams) by TLC, GC/FID, GC/MS, and FTIR/ATR indicated not morphine sulfate but rather 15 milligrams of heroin base per tablet. This is the first submission of morphine sulfate tablet mimics containing heroin to the Northeast Laboratory.
* * * * *
- INTELLIGENCE BRIEF -
TEN YEAR OLD BLACK TAR HEROIN ANALYZED
AT THE DEA SOUTHWEST LABORATORY
 |
Photo 7 |
The DEA Southwest Laboratory (Vista, California) recently received a request for an analysis on a ten year old black tar heroin exhibit. The original seizure was made in late 1995 by U.S. Customs Service (USCS) personnel at the Nogales, Arizona Point of Entry, but was not analyzed at that time because the suspect escaped back into Mexico (he recently returned to the United States and was apprehended). The evidence originally consisted of a single package of suspected black tar heroin, wrapped in clear plastic and black electrical tape. USCS agents opened the package (in 1995) to conduct field testing (positive for heroin) and the evidence was re-packaged in two portions: Most of the sample was left in its original wrapping, but the small portion that was removed for field testing was re-packaged in a separate evidence envelope. Upon submission for analysis (in 2005), the two portions were analyzed as separate exhibits. The smaller portion (total net mass 6.4 grams (see Photo 7)) had a dry texture; analysis by GC/MS and GC/FID confirmed 22 percent heroin and 51 percent O6-monoacetyl-morphine (both calculated as the hydrochlorides). The larger portion (total net mass 204.7 grams) was still gummy and moist from being sealed in its original plastic packaging; analysis (same techniques) confirmed 4.1 percent heroin and 63 percent O6-monoacetylmorphine (again, both calculated as the hydrochlorides). This is believed to be the first analyses of ten year old black tar heroin exhibits by the Southwest Laboratory.
* * * * *
- INTELLIGENCE BRIEF -
OPIUM IN ISTANBUL, TURKEY
 |
Photo 8 |
The DEA South Central Laboratory (Dallas, Texas) recently received a submission of alleged opium from the DEA Houston Field Division (see Photo 8). The exhibit was originally seized by the Turkish National Police in Istanbul, and was transferred to DEA custody for a controlled delivery in the United States (circumstances withheld). The dark-colored, gummy sample was 12 x 6.5 x 3.5 inches, was wrapped in both clear and dark colored plastic, and was transported inside a suitcase. Analysis of the material (total net mass 3,857 grams) by GC/MS and GC/IR identified morphine, codeine, thebaine, papaverine, and noscapine, confirming opium (alkaloids not quantitated). Submissions of opium to the South Central Laboratory are not uncommon, but the amount in this case was unusually large.
* * * * |
* * * * |
* * * * |
* * * * |
* * * * |
[Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. Listed mailing address information (which is sometimes cryptic or incomplete) exactly duplicates that provided by the abstracting service. Patents are reported only by their Chemical Abstracts citation number.]
1. Idoine FA, Carter JF, Sleeman R. Bulk and compound-specific isotopic characterisation of illicit heroin and cling film. Rapid Communications in Mass Spectrometry 2005;19:3207. [Editor’s Notes: Used a variety of isotope ratio mass spectrometric techniques on heroin, caffeine (cutting agent), and plastic films in an effort to tie together heroin samples of common origin by orthogonal but complementary analyses. Contact: Mass Spec Analytical Ltd., Building 20F, Golf Course Lane, P.O. Box 77, Filton, Bristol BS99 7AR, UK.]
3. Ilias Y, Rudaz S, Mathieu P, Christen P, Veuthey J-L. Extraction and analysis of different Cannabis samples by headspace solid-phase microextraction combined with gas chromatography-mass spectrometry. Journal of Separation Science 2005;28:2293. [Editor’s Notes: The title methodology was applied to the analysis of cannabinoids in marijuana, for the purposes of discriminating marijuana from different regions of Switzerland. Contact: Laboratory of Pharmaceutical Analytical Chemistry, School of Pharmaceutical Sciences, EPGL, University of Geneva, Geneva, Switzerland.]
4. Kanamori T, Tsujikawa K, Iwata YT, Inoue H, Ohtsuru O, Kishi T, Hoshina H, Otani C, Kawase K. Application of terahertz spectroscopy to abused drug analysis. Chemical Abstracts 2005:1273198. [Editor’s Notes: Meeting Proceedings. The title technique can differentiate between different types of abused drugs (not specified in the abstract). Contact: National Research Institute of Police Science, 6-3-1 Kashiwanoba, Kashiwa, Chiba 277-0882, Japan.]
5. Kishi T, Kanamori T, Tsujikawa K, Iwata YT, Inoue H, Ohtsuru O, Hoshina H, Otani C, Kawase K. Differentiation of optical active form and racemic form of amphetamine-type stimulants by terahertz spectroscopy. Chemical Abstracts 2005;1273200. [Editor’s Notes: Meeting Proceedings. The title technique can differentiate the solid phase forms of (+) or (-) from (+/-). Contact: National Research Institute of Police Science, 6-3-1 Kashiwanoha, Kashiwa, Chiba 277-0882, Japan.]
6. Tsai C-C, Liu J-T, Shu Y-R, Chan P-H, Lin C-H. Optimization of the separation and on-line sample concentration of phenethylamine designer drugs with capillary electrophoresis-fluorescence detection. Journal of Chromatography A 2006;1101:319. [Editor’s Notes: Focus is on five PEA drugs in the “2C” series: 2C-T-2, 2C-T-7, 2C-C, 2C-B, and 2C-I. Contact: Department of Chemistry, National Taiwan Normal University, 88 Sec. 4, Tingchow Road, Taipei, Taiwan.]
Additional References of Possible Interest:
1. Petrisor I. Sampling and analyses - Key steps of a forensics investigation. Environmental Forensics 2005;6(1):1. [Editor’s Notes: A review. Focus is on environmental forensics, with an emphasis on representativeness of sampling. Contact: USA (no further addressing information was provided).]
* * * * |
* * * * |
* * * * |
* * * * |
* * * * |
Computer Corner
Hard Drive Write Blocking |
#203
by Walter Aponte
Group Supervisor
DEA Digital Evidence Laboratory
|
The proper collection and preservation of original digital evidence is the most important issue facing today's Digital Evidence and Computer Forensic programs, whether at the federal, state, or local level. Failure to protect evidence can result in the discrediting of examiners, impeachment of findings, and failed prosecutions.
Over the past 15 years, significant technological advances have been made in the area of hard drive write blocking technology. Current technologies allow computer forensic examiners to write block the original evidence utilizing either a software or hardware based approach.
Software-Based Write Blocking Technology
In technical terms, these tools work by preventing access to the hard drive through the Interrupt 0X13 BIOS interface of a PC. In layman’s terms, they monitor I/O commands sent from the PC to the hard drive, and block any commands that could modify the data on the hard drive. They are effective regardless of the type of hard drive.
Software-based write blocking started during the DOS and Unix era, and has evolved into the (current) Graphical User Interface (GUI) era. Many of the companies that developed digital evidence examination software have stayed with software-based tools for hard drive write blocking (rather than developing hardware to do the job). One of the advantages of this approach is that the tool(s) could be developed as part of the complete computer forensic examination software suite. Doing so not only saved money and development time for the software company, but also saved money and time for the computer forensic/digital evidence programs (no need to purchase additional hardware, and a gentler learning curve).
Hardware-Based Write Blocking Technology
At present, hardware-based approaches are the preferred method for hard drive write blocking. This technology uses a combination of hardware and firmware to prevent a PC’s operating system to write to a hard drive. The hardware currently come in many different configurations. One of the most popular and preferred configuration is Integrated Development Environment (IDE). The second most popular and also one of the most reliable configurations is Small Computer System Interface (SCSI). Other recently developed configurations are FireWire, Universal Serial Bus (USB), and the newest form Serial ATA (also known as SATA).
Testing
The U.S. Department of Commerce, National Institute of Standards and Technology (NIST) and the U.S. Department of Justice, Office of Justice Programs, National Institute of Justice (NIJ) have conducted extensive testing of both forms of hard drive write blocking technologies. With increasing numbers of available hardware and software technologies, both NIST and NIJ have posted their testing results on their respective websites, so that computer forensic organizations and laboratories can make educated decisions on which type to utilize for acquisition and examination of original evidence.
This information is also useful in court proceedings, to demonstrate that the methods and tools utilized during the collection and examination of original evidence were sound, and have been proven to work.
Conclusions
Failure to protect original evidence can enable a defense attorney to assert that the evidence was subject to changes by the examiner or any other person(s) with access. There are a variety of tested and reliable hard drive write blocking technologies currently available to the computer forensic examiner. Protecting original evidence by write blocking must be a standard operating procedure for all computer forensic examiners.
Questions or comments? E-mail: Walter.Aponte -at- usdoj.gov
|
