Microgram Bulletin

 

Published by the Drug Enforcement Administration 
Office of Forensic Sciences Washington, D.C. 20537 

The U. S. Attorney General has determined that the publication of this periodical is necessary in the transaction of the public business required by the Department of Justice. Information, instructions, and disclaimers are published in the January issues.



VOL. XXXVII, NO. 10                                                              October 2004

 

- INTELLIGENCE ALERT -

COCAINE IN LARGE ALUMINUM MEDALLIONS FROM GUATEMALA
AT JFK AIRPORT

photo of aluminum medallions
Photo 1

The DEA Northeast Laboratory (New York, NY) recently received two large aluminum medallions containing a white powder, suspected cocaine (see Photo 1). The medallions were seized by U.S. Customs and Border Protection agents from the luggage of a passenger arriving on a flight from Guatemala to JFK Airport. Each medallion was made of cast aluminum, weighted 7.3 kilograms, and was approximately 17 inches in diameter and one inch thick. The front of each medallion had a depiction of a 25 Centavo coin (unknown if a "correct" depiction of any actual coinage), while the back was blank. Initial access to the contents was achieved by drilling a small hole in the back; after field testing indicated cocaine, the internal cavities were accessed to recover all of the remaining powder. Analysis of the powder (total net mass 1.94 kilograms) by microscopy, FT IR, GC/FID, and GC/MS confirmed 65 percent cocaine hydrochloride and phenacetin. The Northeast Laboratory routinely receives a variety of exhibits with different concealment techniques, but this is the first time that cocaine was encountered within large aluminum medallions.

- - - - - - - - - -

- INTELLIGENCE ALERT -

HEROIN SATURATED CARDBOARD SHEETS IN LUGGAGE
FROM CALI, COLOMBIA IN MIAMI AIRPORT

photo of luggage
Photo 2

The DEA Southeast Laboratory (Miami, Florida) recently received two black leather, soft sided suitcases, each containing two cardboard baffles with some adhering tan powder, suspected heroin (see Photo 2). The suitcases were seized by the U.S. Immigration and Customs Enforcement, Miami Airport Narcotics Group from a flight arriving from Cali, Colombia. The cardboard sheets measured approximately 3 x 2 feet, and were hidden in false sides in the suitcases (total net mass of Exhibit 1: 2359 grams; total net mass of Exhibit 2: 1724 grams). Analysis by GC, GC/MS, and FTIR ATR confirmed 72 and 69 percent heroin hydrochloride, respectively, in the two exhibits. The laboratory routinely receives absorbent materials laced with controlled substances.


- - - - - - - - - -

- INTELLIGENCE ALERT -

METHAMPHETAMINE WITH PROCAINE IN BEAUMONT, TEXAS

photo of cigarette pack and methamphetamine
Photo 3

The DEA South Central Laboratory (Dallas, Texas) recently received a commercial cigarette pack containing a zip lock plastic bag containing 26.5 grams of a white powder, suspected methamphetamine (see Photo 3, next page). The exhibit was acquired by DEA agents from the Beaumont (Texas) Resident Office. Analysis of the powder (total net mass was 26.5 grams) by FTIR, GC/MS, and HPLC confirmed 68 percent d methamphetamine hydrochloride, approximately 20 percent procaine hydrochloride, and dimethyl sulfone. This is one of only a dozen times this laboratory has seen procaine HCl mixed with methamphetamine since 1970. In the analyst’s experience, this concealment technique (that is, inside a cigarette pack) is more commonly associated with marijuana, not methamphetamine.


- - - - - - - - - -

- INTELLIGENCE ALERT -

METHAMPHETAMINE IN AN ANTIPERSPIRANT ROLL ON
AND A PHOTO GLOBE IN GUAM

photo of roll on
Photo 4

The DEA Southwest Laboratory (Vista, California) recently received a commercial antiperspirant roll on with dried white crystals around the cap threads and a photo globe, both suspected to contain methamphetamine (see Photos 4, right, and Photo 5, next page). The exhibits were seized by agents from the DEA Guam Field Office from a passenger arriving at the Guam airport on a flight from the Phillipines. The dried crystals in the cap threads of the roll-on (see Photo 4) field tested positive for methamphetamine. The roll on (4.5 inches tall with its cap on) contained 30 milliliters of a clear, colorless liquid with a pH of 7 and a blue reaction with Watesmo paper (positive for water); the liquid had a strong perfume odor. Analysis by GC, FTIR ATR, and LC confirmed 616 milligrams per milliliter of methamphetamine hydrochloride. The photo globe (4 x 3.5 inches) contained 210 milliliters of a clear, colorless liquid with a pH of 7 and a blue reaction with Watesmo. Analysis by FTIR ATR and LC confirmed 611 milligrams per milliliter of methamphetamine hydrochloride. These are believed to be the first exhibits of these types submitted to the laboratory.


photo of photo globe
Photo 5

- - - - - - - - - -

- INTELLIGENCE ALERT -

INVESTIGATORS SEIZE THREE LEAFED CANNABIS PLANTS
IN BEEKMANTOWN, NEW YORK

[From the NDIC Narcotics Digest Weekly 2004;3(37):2
Unclassified, Reprinted with Permission.]

On August 24, 2004, investigators from the Adirondack Drug Task Force seized 13 cannabis plants that had three fingered leaves instead of the traditional five. Investigators found the plants in a Beekmantown (Clinton County) field growing in crates that were concealed among blackberry bushes. The plants were approximately 4 feet tall, and buds were developing on many of the plants. Investigators found the plants after an individual provided them with a tip. No arrests were made at the time of the seizure, and the plants have not been analyzed in a laboratory. Task force investigators report that over the past 3 to 4 years there have been several seizures in Clinton County of three fingered leaf cannabis plants as well as one seizure of single fingered leaf cannabis plants. Agencies participating in the Adirondack Drug Task Force include the Clinton County Sheriff's Department, Plattsburgh Police Department, New York State Police, DEA, and U.S. Border Patrol (USBP).

NDIC Comment: Traditionally, cannabis plants are thought of as having five leaves; however, the number of leaves on a cannabis plant can vary (although it usually has an odd number of leaves such as three or seven). This seizure follows a widely publicized April 2004 seizure of four immature cannabis plants with three fingered leaves from an indoor grow in Thunder Bay, Ontario. The plants seized in Thunder Bay were atypical in appearance, however, having twig like stalks and broad, rounded leaves, which led to reports of the discovery of a new strain of cannabis. What may be more likely in both of these seizures is that it is an unintentional occurrence of whorled phyllotaxy. In botany, leaf phyllotaxy describes how leaves are arranged on a stem and in relation to one another. Whorled phyllotaxy means three or more leaves at one node of a stem. Information gained through online canvassing reveals that this may be a somewhat common occurrence when growing cannabis. The limited information also suggests that whorled phyllotaxy occurred in plants cultivated from clones of normal plants, and many incidents involved indica varieties, which typically have broader leaves than sativa varieties. Whether whorled phyllotaxy has an effect on plant yield or potency is uncertain. Some growers hopefully suggest that the THC levels of such plants will be higher, while others report that this leaf arrangement previously manifested in plants found to be inferior or male (no buds). The plants seized in Thunder Bay had not yet developed buds and tested at only 1.8 to 2.6 percent THC.

- - - - - - - - - -

- INTELLIGENCE ALERT -

COMPANY ANNOUNCES NEW ANHYDROUS AMMONIA ADDITIVE
DESIGNED TO DETER THEFT

[From the NDIC Narcotics Digest Weekly 2004;3(37):4
Unclassified, Reprinted with Permission.]

Royster Clark Inc. announced that on September 15, 2004, it will begin marketing a chemical additive designed to reduce the incidence of thefts of anhydrous ammonia (a common agricultural fertilizer that also is used in illicit methamphetamine production). According to company representatives the additive, named GloTell™, works by dying anhydrous ammonia fluorescent pink. If thieves handle the fertilizer, the additive leaves a visible fluorescent pink stain on their skin and clothing. The highly visible stains, even if washed off, are still detectable under ultraviolet light for 24 to 72 hours. The fluorescent pink color also can alert farmers to valves, hoses, or tanks that have been tampered with or are leaking the potentially deadly gas. Additionally, company representatives assert that methamphetamine produced with anhydrous ammonia containing the additive becomes an unbleachable pink color, and the methamphetamine takes longer to dry (24 to 48 hours) because of the additive's water retention properties. Moreover, methamphetamine produced with GloTell™ may leave telltale pink marks on an abuser's nose if snorted or arms if injected. Company representatives state that the additive, which can withstand the cold, corrosive nature of anhydrous ammonia, will not harm the environment, crops, or humans. GloTell™ will be sold in 30 ounce jugs through 250 outlets nationwide. Approximately 1.5 ounces of the additive are needed to treat 1 ton of anhydrous ammonia and will add approximately $9 per ton to the chemical's current cost of approximately $240 per ton.

[Editor’s Notes: This Alert is provided for informational purposes only, and should not be regarded as an endorsement by the U.S. Government. The DEA cannot comment on the efficacy or usefulness of this product.]

- - - - - - - - - -

- INTELLIGENCE ALERT -

LARGE SHIPMENT OF MARIJUANA CONCEALED IN PIECES OF POTTERY
IN INMAN, SOUTH CAROLINA

[From the NDIC Narcotics Digest Weekly 2004;3(39):2
Unclassified, Reprinted with Permission.]

On September 1, 2004, investigators for U.S. Immigration and Customs Enforcement (ICE), Spartanburg County Sheriff's Office, and South Carolina State Transport (STAR) Team seized more than 1,600 pounds of marijuana and arrested four individuals. Investigators made the seizure while conducting a joint investigation on suspicious activity occurring at an Inman "nightclub and pottery business." On the afternoon of September 1, investigators observed a tractor trailer arrive at the business. Three men immediately began unloading large pieces of pottery from the trailer and continued unloading the trailer, even through pouring rain, for approximately 6 hours. After dark, the three men left in a different truck and were stopped by STAR officers. During an inspection of the truck, STAR officers discovered two multipound "bricks" of marijuana in the vehicle. The three men were arrested for possession of marijuana, and county investigators obtained a search warrant for the Inman business. Upon executing the search warrant, investigators discovered approximately 1,600 pounds of marijuana concealed in 3 foot tall clay pedestals. Investigators also arrested a fourth man found inside the business during the search. All four defendants are believed to be Mexican nationals, and investigators suspect that the shipment was smuggled over the Southwest Border. ICE officials report that the case will be presented to the U.S. Attorney's Office for the District of South Carolina for federal prosecution.

NDIC Comment: Law enforcement reporting indicates that over the past few years Mexican drug traffickers have been increasingly using locations in the Carolinas to break down large shipments (over 1,000 lb) of Mexico produced marijuana that were smuggled across the Southwest Border. A similar seizure occurred in November 2003 when officers in York County which is approximately 30 miles from Spartanburg County seized over 2,000 pounds of marijuana that was being offloaded from a tractor trailer into other vehicles. Much of the marijuana transported to the area likely is destined for distribution in areas of South Carolina and North Carolina (particularly the Charlotte metropolitan area); however, some is probably destined for other areas in the Southeast and Mid Atlantic regions.

- - - - - - - - - -

- INTELLIGENCE ALERT -

VERY LARGE METHADONE LABORATORY SEIZED
NEAR ST. PETERSBURG, RUSSIA

The Organized Crime Control Section of the St. Petersburg (Russia) Police recently seized a clandestine methadone production laboratory in the Kirov District (located east-southeast of St. Petersburg). The seizure culminated a long term investigation of illicit methadone trafficking and abuse in the St. Petersburg area. The total amount of methadone seized was 18.7 kilograms, by far the largest ever seizure of methdone in Russia. According to the local authorities, the methadone had a street value of between four and four and a half million (U.S.) dollars. Three suspects were arrested (further details unavailable).

- - - - - - - - - -

- INTELLIGENCE ALERT -

ECSTASY MIMIC TABLETS WITH A SUNFLOWER LOGO CONTAINING
COCAINE IN NEW YORK CITY

photo - sunflower tablets
Photo 6

The DEA Northeast Laboratory (New York, NY) recently received 790 round, off white tablets with a sunflower logo, suspected ecstasy (see Photo 6). The tablets were acquired in New York City by agents from the DEA New York Division. Analysis of the tablets (total net mass 215.8 grams) by GC/FID and GC/MS, however, indicated not MDMA but rather 7.6 percent cocaine calculated as the hydrochloride salt (20 milligrams per tablet), along with acetaminophen, caffeine, and a small amount of propoxyphene (salt form and isomer of propoxyphene not determined). This was the first submission of cocaine in tablet form to the Northeast Laboratory, and is believed to be the first submission of tablets with a sunflower logo.

- - - - - - - - - -

- INTELLIGENCE BRIEF -

INTERNET BASED DISTRIBUTORS OF 2C-T-21 CHARGED IN CONNECTION
WITH THE DEATH OF A LOUISIANA MAN

[From the NDIC Narcotics Digest Weekly 2004;3(39):4
Unclassified, Reprinted with Permission.]

Federal agents in Baton Rouge, Louisiana, report that the owner of an Internet based company has been indicted for illegally using the company to distribute controlled substances. One of the charges alleges that a 22 year old man from St. Francisville, Louisiana, died after abusing 2C-T-21 that he purchased through the company's web site. Two 25 year old men operated the company, which sold the drug with a disclaimer that it was for research and not for human consumption. The charges resulted from a federal investigation called Operation Web Tryp that culminated in July 2004. The Las Vegas based owner of the Internet based company was indicted on July 14, 2004, in the U.S. District Court for the Middle District of Louisiana and was arrested on July 21, 2004, at his Las Vegas home. At the time of the owner's arrest, federal agents also found evidence that implicated the owner's roommate. The roommate was subsequently charged with four counts of distribution of analogs of controlled substances.

NDIC Comment: 2C-T-21 is a common name for the synthetic drug 2,5-dimethoxy-4-(2-fluoroethylthio)phenethylamine. 2C-T-21 belongs to a category of hallucinogens called phenethylamines and is an analog of the Schedule I controlled substance 2C-T-7.

* * * * *        * * * * *       * * * * *        * * * * *         * * * * *

SELECTED REFERENCES

[Notes: Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. If available, the email address for the primary author is provided as the contact information. Listed mailing address information (which is sometimes cryptic or incomplete) exactly duplicates that provided by the abstracting services. In addition, in order to prevent automated theft of email addresses off the Internet postings of Microgram Bulletin, unless otherwise requested by the corresponding author, all email addresses reported in the Bulletin have had the “@” character replaced by “ -at- ”; this will need to be converted back (by hand) before the address can be used.]

  1. Aalberg L, DeRuiter J, Sippola E, Clark CR. Gas chromatographic optimization studies on the side chain and ring regioisomers of methylenedioxymethamphetamine. Journal of Chromatographic Science 2004;42(6):293. [Editor's Notes: Abstract not available. Contact: Auburn Univ, Dept Pharmacol Sci, Sch Pharm, Auburn, AL 36849.]

  2. Amundsen LK, Kokkonen JT, Rovio S, Siren H. Analysis of anabolic steroids by partial filling micellar electrokinetic capillary chromatography and electrospray mass spectrometry. Journal of Chromatography A 2004;1040(1):123. [Editor's Notes: Presents the title analysis on six steroids (androstenedione, metandienone, fluoxymesterone, methyltestosterone, 17-epimetandienone, and testosterone). Contact: VTT Processes, FIN 02044 Espoo, Finland.]

  3. Blinc R, Apih T, Seliger J. Nuclear quadrupole double resonance techniques for the detection of explosives and drugs. Applied Magnetic Resonance 2003;25(3 4):523. [Editor's Notes: Drugs not specified in the abstract. Contact: J. Stefan Institute, Ljubljana, Slovenia.]

  4. Dayrit FM, Dumlao MC. Impurity profiling of methamphetamine hydrochloride drugs seized in the Phillipines. Forensic Science International 2004;144(1):29. [Editor's Notes: Presents a cluster analysis study of trace impurities in seized methamphetamine samples. Contact: Chemistry Department, Ateneo de Manila University, Loyola Heights, Quezon City, Phillipines.]

  5. Fitsev IM, Blokhin VK, Budnikov GK, Fitseva NA. Chemical analytical diagnostics in criminalistic examination of materials, substances, and products. Zavodskaya Laboratoriya, Diagnostika Materialov 2004;70(4):3. [Editor's Notes: Includes discussion of (unspecified) drugs and psychotropic substances. This article is written in Russian. Contact: Russia (no further addressing information was provided).]

  6. Iqbal R, Rizvi SAA, Akbay C, Shamsi SA. Chiral separations in microemulsion electrokinetic chromatography Use of micelle polymers and microemulsion polymers. Journal of Chromatography A 2004;1043(2):291. [Editor's Notes: Presents the title analysis on a series of barbiturates (drugs and matrices not specified in the abstract). Contact: Georgia State Univ, Ctr Biotechnol & Drug Design, Dept Chem, Atlanta, GA 30303.]

  7. Kala M, Adamowicz P. Pemoline tablets from the Polish drug market. Z Zadgadnien Nauk Sadowych 2003;53:38. [Editor's Notes: Reports the results of GC/MS analyses of three separate seizures of illicitly prepared tablets. Contact: Institute of Forensic Research, Cracow, Poland (no further addressing information was provided).]

  8. Macchia M, Bertini S, Mori C, Orlando C, Papi C, Placanica G. Efficient application of monolithic silica column to determination of illicit heroin street sample by HPLC. Farmaco 2004;59(3):237. [Editor's Notes: Presents the title analysis (complete in 7 minutes). Contact: Department of Pharmaceutical Sciences, University of Pisa, 56126 Pisa, Italy.]

  9. Ohyama K, Shirasawa Y, Wada M, Kishikawa N, Ohba Y, Nakashima K, Kuroda N. Investigation of the novel mixed mode stationary phase for capillary electrochromatography I. Preparation and characterization of sulfonated naphthalimido modified silyl silica gel. Journal of Chromatography A 2004;1042(1 2):189. [Editor's Notes: Presents the title analysis on a series of barbiturates and benzodiazepines (drugs and matrices not specified in the abstract). Contact: Nagasaki Univ, Course Pharmaceut Sci, Grad Sch Biomed Sci, Analyt Chem, 1 14 Bunkyo Machi, Nagasaki 8528521, Japan.]

  10. Roesner P. Mass spectra of designer drugs. Wiley: 2003. [Editor’s Notes: This is a CD compilation. The abstract indicates 1,400 compounds and 1,700 mass spectra, and claims to be current with all designer drugs encountered up to February, 2003. Contact: No contact information was provided.]

  11. Song SM, Marriott P, Kotsos A, Drummer OH, Wynne P. Comprehensive two dimensional gas chromatography with time of flight mass spectrometry (GC x GC TOFMS) for drug screening and confirmation. Forensic Science International 2004;143(2 3):87. [Editor's Notes: 78 drugs of interest were analyzed; some forensic samples were also analyzed satisfactorily. Contact: Department of Applied Chemistry, Australian Centre for Research on Separation Science, Building 3, Bowen St., 124 Latrobe St., Rmit University, GPO Box 2476 V, Melbourne 3001, Australia.]

Additional Reference of Possible Interest:

  1. Ghosh P, Reddy MM, Rao BS, Sarin RK. Determination of diazepam in cream biscuits by liquid chromatography. JAOAC International 2004;87(3):569. [Editor's Notes: Presents the title analysis, for detection of criminal adulteration. Contact: Directorate of Forensic Science, Central Forensic Science Laboratory, Ministry of Home Affairs, Hyderabad 500 013, India.]
* * * * *        * * * * *       * * * * *        * * * * *         * * * * *

THE JOURNAL/TEXTBOOK COLLECTION EXCHANGE

The following reference text (occasionally useful for identifying obscure seizure locations) is offered:

National Geographic Atlas of the World, 6th Edition; National Geographic Society: Washington, DC, 1990.

Libraries have precedence over individual subscribers in requesting items. In this case, postage will be covered by the DEA Office of Forensic Sciences.

There were no other offerings of journals or textbooks made over the past quarter.

Subscribers are encouraged to donate surplus or unwanted items or collections; if interested, please consult the Microgram website or contact the Microgram Editor for further instructions.

The next offering of journals and textbooks will be in the January 2005 issue of Microgram Bulletin.

* * * * *        * * * * *       * * * * *        * * * * *         * * * * *

THE DEA FY - 2005 STATE AND LOCAL
FORENSIC CHEMISTS SEMINAR SCHEDULE

The remaining FY - 2005 schedule for the DEA’s State and Local Forensic Chemists Seminar is as follows:

February 7 - 11, 2005
May 9 - 13, 2005
July 11 - 15, 2005
September 19 - 23, 2005

Note that the school is open only to forensic chemists working for law enforcement agencies, and is intended for chemists who have completed their agency’s internal training program and have also been working on the bench for at least one year. There is no tuition charge for this course. The course is held at the AmeriSuites Hotel in Sterling, Virginia (near the Washington/Dulles International Airport). A copy of the application form is reproduced on the last page of the August 2004 issue of Microgram Bulletin. Completed applications should be mailed to the Special Testing and Research Laboratory (Attention: Pam Smith or Jennifer Kerlavage) at: 22624 Dulles Summit Court, Dulles, VA 20166. For additional information, call 703/668-3337.

* * * * *     * * * * *     * * * * *     * * * * *     * * * * *

SCIENTIFIC MEETINGS

1. Title: AAFS 57th Annual Meeting (Third Posting)
Sponsoring Organization: American Academy of Forensic Sciences
Inclusive Dates: February 21 - 26, 2005
Location: New Orleans, LA
Contact Information: See Website
Website: www.aafs.org

* * * * *    * * * * *    * * * * *    * * * * *    * * * * *

EMPLOYMENT OPPORTUNITIES

1. Title: University of Massachusetts Medical School (Third and Final Posting)
Position: Laboratory Analyst II (Two Positions)
Location: Worcester, Massachusetts
Salary Range: $32,032 - $39,915, Commensurate with Experience
Application Deadline:: Open Until Filled

Duties: Performs analytical analysis of evidence for identification and/or quantitation, records information. Performs and documents routine maintenance of equipment. Develops new essays and evaluates new equipment. Trains new personnel.

Provides testimony in court when necessary. Advises and aides DAL Evidence Officer on identification, classification, and handling of evidence.

Qualifications: B.S. in Chemistry or equivalent (requires strong emphasis on Chemistry) plus 3 years relevant experience or Master’s Degree in Chemistry Forensic Science or equivalent and two years of relevant experience. Strong oral and written communicative skills necessary for interaction with other medical center staff as well as outside agencies.

Application Procedures: Apply on-line at: www.umassmed.edu. Search keyword: 04-1360. Or mail/fax a resume to: University of Massachusetts Medical School, Human Resources, 419 Belmont Street, Worcester MA 01604; fax 508-856-2390

2. Dupage County Crime Laboratory (Third and Final Posting)
Position: Forensic Scientist II (Drug Chemistry)
Location: Wheaton, Illinois
Salary Range: $37,700 - $56,500
Application Deadline: Open Until Filled

Duties: Under immediate supervision, performs work in the examination, analysis and evaluation of physical evidence and unknown substances. Performs microscopical, chemical, chromatographic, and spectrophotometric analysis of unknown substances. Writes reports detailing the results of analysis and testifies as an expert witness in judicial proceedings. This is not an exhaustive list of responsibilities and other associated tasks may be expected.

Qualifications: Must have a bachelor’s degree and two years full time drug analysis experience. It is preferred that the applicant has court-testimony experience (been accepted as an expert witness in the drug chemistry discipline). Trainees will not be considered for this position. Hired applicant will be required to successfully complete a competency test prior to assuming independent casework.

Application Procedures: If you meet the minimum qualifications and want to be considered for this position, please mail or email a resume or CV to:

Director John Collins
Crime Laboratory Director
DuPage County Sheriff's Office Crime Laboratory
501 N. County Farm Road
Wheaton, IL 60187
jcollins -at- dupageco.org

Additional Information: Please contact Supervisor Carina Thomas at (630) 407-2096, or cthomas -at- dupageco.org

Equal Opportunity Employer

* * * * *    * * * * *    * * * * *    * * * * *    * * * * *

COMPUTER CORNER
#187
Digital Evidence - Origin of Species by: Michael J. Phelan
DEA Digital Evidence Laboratory


Over the past ten years, the Computer Forensics community has generated a variety of examination specializations. Examples include the traditional sub disciplines of computer, digital audio, and digital video forensics, as well as newer sub disciplines such as computer server, network intrusion, and embedded technologies forensics. These emerging specializations demonstrate that the Computer Forensics discipline is differentiating to accommodate the rapid changes in information technologies. However, both the traditional and the new sub disciplines share a common technical and procedural foundation, and function properly and effectively using standard best practices. This commonality of origin, and use of standardized best practices, is important to digital evidence laboratory managers, academia, and consumers (investigators, prosecutors, and courts), because it defines the essence of the digital evidence discipline. Understanding the nature of digital evidence helps explain the past and, to a certain extent, helps define the future.

A Biological Model
In the classic view, Computer Forensics derived from the forensic, legal, law enforcement, and information technology communities. These are valid, legitimate perspectives on digital evidence. However, a more complete understanding of the nature of digital evidence can be better accomplished by stepping outside these communities and looking at the field from a non traditional perspective. Two widely known theories from biology that are applicable to Computer Forensics are the concepts of evolutionary adaptation and parallel evolution. Evolution adaptation is the continual process of differentiation from a common origin in response to external stimuli. Parallel evolution is a developmental process that results in the simultaneous development or specialization at two or more unrelated locations in reaction to the same set of stimuli. Both of these models are useful in cataloging the varied and on going dynamics in the digital evidence field.

Evolutionary Adaptation
There are many examples of evolution adaptation in Computer Forensics. For example, the legal and forensic communities have adapted their cornerstone “best practices” to accommodate digital evidence, without incident. The legal community has effectively and seamlessly applied traditional rules of evidence concepts, such as original, duplicate, and best evidence, to adapt to the digital evidence world. Additionally, the broader constitutional concepts of search and seizure, and privacy, have not resulted in an inordinate amount of negative case law. Digital evidence, in the most fundamental sense, is just another form of evidence that must be tested, authenticated, and accepted by the judicial process.

Similarly, the forensic science community has successfully adapted digital evidence into its forensic accreditation practices. The American Society of Crime Laboratory Directors/Laboratory Accreditation Board (ASCLD/LAB) now recognizes and accredits digital evidence laboratories. The adaptation of their basic crime laboratory standards to digital evidence laboratories has successfully resulted in several organizations becoming accredited. The success of the legal and forensic communities in adapting to digital evidence examination is in large part due to the mutual agreement on the underlying principals and common origin(s). This common ancestry is based in a structural procedural approach to information that is accurate, replicable, and non reputable. In the Federal legal realm, this process is known as the Federal Rules of Evidence. In the forensic community, the same procedural process is known as the scientific method.

Parallel Evolution
There are also several examples of parallel evolution in Computer Forensics. For example, the concept of information assurance has simultaneously evolved in information technology and in digital evidence ? because both disciplines are highly concerned with information integrity. Information Assurance was first defined in the 1996 Department of Defense’s S 3600 directive as “information operations that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non repudiation. This includes providing for the restoration of information systems by incorporating protection, detection, and reaction capabilities.”

Another example is the crime laboratory accreditation process. The ASCLD/LAB standards and the International Standards Organization’s standards for “testing and calibration laboratories” (ISO 17025) have evolved in parallel. ASCLD/LAB originated with the specific intent to professionalize and standardize domestic crime laboratory operations with best practices, whereas ISO originated with the broader intent of establishing international best practices for a wider range of technical testing and calibration laboratories. In essence, crime laboratories are just another type of testing laboratory. Presently, ASCLD/LAB and ISO standards have merged under the new accreditation designation of

ASCLD/LAB International, and domestic crime laboratories now can meet the combined sets of standards for accreditation. All DEA laboratories, including its Digital Evidence Laboratory, underwent an ASCLD/LAB International review in September 2004, using a combination of approximately 300 ASCLD/LAB and ISO standards.

A third example of parallel evolution is the origination of digital evidence best practices among several different professional technical organizations. There are several widely published digital evidence examination best practices documents. Some of the better known sources are: 1) the International Association of Computer Investigative Specialists (IACIS); 2) the Scientific Working Group on Digital Evidence (SWGDE); 3) the International Organization of Computer Evidence (IOCE); and 4) the National Institute of Justice’s Best Practices Guide. These guidelines have a commonality of opinion concerning evidence preservation and authentication, despite differing group membership and initial authorship spanning almost a decade of time. Some of the more striking similarities are: 1) almost universal agreement that examinations should be conducted on a copy whenever possible; 2) digital evidence should be authenticated prior to examination; and 3) original or best evidence should not be changed.

The Origin of Species
Digital evidence shares a common evolutionary history with many established fields such as information technology, forensics, law enforcement, and legal. It is important for managers, trainers, academics, and practitioners to recognize and understand this commonality of origin. The true nature of the digital evidence business is based in the more abstract idea that the end goal of the digital evidence examination process is “information accuracy”, and that the means to that goal is a non reputable process. This is important, because narrowly focusing on only one functional aspect of the digital evidence business (e.g., information technology, forensics, law enforcement, or legal) will likely result in unbalanced understanding of the nature of digital evidence. This knowledge is important both for understanding the past and for managing the future.

Questions or comments?

e-mail: Michael.J.Phelan-at-usdoj.gov

 
www.dea.gov