Georgianna Buffolino

Criminal Investigation
Professor Mathis

Introduction

When dealing with physical and digital evidence it is important to understand the
difference between the two, as there is different procedures to follow, training
needed and when it comes to the collection of the evidence. This evidence is
essential due to it helping to form the case for a crime that was committed and will
essentially help to prove who committed the crime and how it happened. One
essential difference between physical and digital evidence management is the
access to the evidence.

Physical Evidence

While physical and digital evidence are both types of evidence that are used to help
solve crimes, there are some major differences between the two.
“Physical evidence is known are “real” or “material” evidence and can be shown in
the courts as a physical object, can be presented in a “still or moving” image, be
shown in the form of writing or text, audio, or video or in the form of documents.
evidence that is in the form of a tangible object, such as weapons, body fluids, and
markings, is considered to be physical evidence. “ (caseiq.com, n.d.). With physical
evidence there are many different specific types of it whiich can be analyzed
forensically, one of these is digital evidence. Some other forms of physical
evidence are DNA samples which can be found at crime scenes such as hair, body
fluids such as blood, saliva or semen, and skin. This type of physical evidence is
forensic evidence. “DNA evidence is contained in cells throughout the body,
including a host of material potentially found at a crime scene: hair, nails, and skin
cells; bodily fluids (blood, semen, saliva, mucus, perspiration); tissues (teeth, bone,
muscle, and organ material); and excretions (urine and feces). Due to each
individual's DNA being unique except for identical twins, etc., DNA typing or
profiling is an invaluable tool in connecting suspects to crime scenes and victims.
When successful, it raises evidence that would have been class characteristics to
the level of individual characteristic” (Hildebrand, 2021, p. 141). Blood evidence is
the main part of DNA evidence and can help to inform the investigators to what
happened. The residue of blood can help to show important characteristics of a
violent crime scene, these include: the origin of the bloodstain, the amount of
blows or shots, how far the target was from the blood stain, the position and
movement of the victim and the attacker, which way the blood dripped or spattered
and the speed or force of the blood that was left behind.
Even when it may not be seen to the naked eye, there can be the residue of blood
left behind which can be detected, tiny particles of blood can latch on to most
surfaces for several years without being noticed. With the use of luminol (which is
a chemical reagent that gives off a blue luminescence when it encounters blood
under dark conditions). “The luminescence is caused by a chemical reaction with
the iron in hemoglobin, the part of blood which transports oxygen to tissues”
(Hildebrand, 2021, p. 143).
When it comes to the collection of evidence it is essential to do this correctly, it
means the difference between solving the crime and not. There are different ways
that are used to collect evidence: one of the main distinctions is if it is physical
evidence or biological evidence. When the evidence is physical that will pertain to
evidence which comes from a nonliving origin; however biological evidence
pertains to evidence that comes from a living being. The most essential and
important types of physical evidence are fingerprints, tire marks, footprints, fibers,
paint, and building materials while biological evidence consists of bloodstains and
DNA. According to Locard’s Exchange Principle it states that both physical and
biological evidence is to be located at the scene of a crime due to the perpetrator
always leaving something behind by having contact with victims as well as objects
there. Also, the perpetrator will also usually take something away with them, this
can often be found when the individual is searched (their clothes, shoes, etc.) or
where they live and/or the vehicle they may drive, etc. This type of evidence is
typically found in very little amounts and is trace evidence. Regarding physical
trace evidence, there is one essential source of this which is textile fibers which
tend to come from clothing or furniture that was present during the crime. It would
be usually either left there by the perpetrator or the victim may unknowingly pick
it up. Trace evidence is something that the naked eye can’t see and in order to
collect it the use of a brush or vacuum the surface of areas or items. After it is
collected it will be brought back to the laboratory and then will be viewed through
the lens of specific microscopes. A second type of essential physical evidence is
impression marks which would be made from a shoe, or a tire and it will leave a
type of pattern which will exhibit partial or all its surface characteristics which are
known as an impression. In order to collect and analyze impressions there are key
tasks which need to follow and completed. When it comes to any evidence the first
and most important part of the collection of it is having a secure chain of custody,
no matter what kind of crime was committed. A record of the chain of evidence
must be maintained and established in the court whenever presenting evidence as
an exhibit. Otherwise, the evidence may be inadmissible in the court leading to
serious questions regarding its legitmacy , integrity, and the examination rendered
upon it. The chain of custody needs to document every transmission from the
moment the evidence is collected, from one person to another, to establish that
nobody else could have accessed or possessed that evidence without authorization:
(Badiya et al., 2023). A great deal of time and effort is needed for the collection of
evidence, especially those of a more serious nature such as a murder or a rape.
When the crime is, for instance, a burglary the investigators will focus on the entry
and exit points which the perpetrator used to gain entrance and leave. They will
focus on looking for evidence such as fingerprints and tool marks. One of the most
key types of physical evidence is also fingerprints and this pertains to almost all
crimes, and it is essential in tying an individual to a crime and putting them at the
scene of the crime. Everyone has a unique set of fingerprints which no one else can
have and finding this type of evidence at the scene of crime will help to identify
who was present at the crime; this is done by using a database which is stored with
a significant amount of individuals fingerprints which could be in this system due
to prior crimes, a government job, military personnel, etc. This database is known
as CODIS which stands for the FBIs Combined DNA Index System which
contains more than 11 million fingerprints who are suspected of or have been
found guilty of crimes.

Digital Evidence:

“Digital evidence is information and data of a value to an investigation that is

stored on, received on or transmitted by an electronic device” (National Institute of
Justice, NIJ, 2008). It also tends to involve sensitive information both physically
and personally. “Digital evidence is conceptually the same as any other evidence: it
is information leverged in an attempt to place people and events within time and
space to establish causuality for criminal incidents” (Goodison, Davis &
Jackson, ). The types of digital evidence can consist of data found on mobile
devices, computers which include audio, video, and image files along with
software and hardware.The methods which are used to collect digital evidence
consist of critical steps which require special training. According to NIST.gov
there is a project team whom develops tools for testing computer software which
include test criteria and test sets. “ITL also maintains the National Software
Reference Library which is a vast archieve of published software applications that
is an important resource for both criminal investigators and historians. The NSRL
is designed to collect software from various sources and incorporate file profiles
computed from this software into a Refernce Data Set (RDS) of information. The
RDS can be used by law enforcement, government, and industry organizations to
review files on a computer by matching file profiles in the RDS” (NIST.gov, 2022)

Comparison of Collection and Analysis Techniques:

Digital evidence can be found when electronic devices are seized and secured so
they can be analyzed. “Digital evidence is latent (hidden) like finger prints or DNA
evidence, crosses jurisdictional borders quickly and easily, can be altered,
damaged, or destroyed with little effort, and can be time sensitive. There are
several sources of digital evidence, some of these are: internet-based, stand-alone
computers or devices, and mobile devices and each one usually have different
methods for obtaining evidence as well as different types of crimes usually will be
geared toward specific devices (forensicssciencesimplified.com, 2013). The first
computer crime law was enacted by Florida creating the Florida Computer Crimes
Act which states un-authorized use of computing facilities a crime; shortly after
Federal laws were made in 1984. A laptop or desktop is an example of digital
evidence, theyn could have evidence of criminal activity that was done on the web
or the criminal activity could be stored on computers hard drive, such as
pornography, copyright infringemet, extortion, counterfiting, etc. Thisn evidence
could also be located on peripheral equipment,m such as removable media like a
thumb drive or CD-ROM disc.
Surveillance systems are also another form of digital evidence, this can be in the
form of digital cameras and videos
Digital evidence plays a key role in helping to solve crimes and is essential when it
comes to court cases. One of the challenges faced when collecting digital evidence
is the fact that computers and technology itself is always updating to newer and
different versions and it is not the easiest thing to keep up with. It takes time and
training to keep up with the growing abilities of technology. Another challenge is
the amount of time it takes to look for this evidence, there can be thousands of
hours spent reviewing footage and looking for the specific individual or criminal
act that may be on the media. There is also the chances of making mistakes due to
the time it can take to view all the media that is available. Another drawback is the
limited budgets that many law enforcement departments have available as well as
the limited equipment which may be crucial to some investigations and the training
needed for the officers is also limited. “To help address these challenges and
improve the collection and processing of digital evidence, the National Institute of
Justice (NIJ) provided funding to Purdue University and the University of Rhode
Island. Purdue University created the File Toolkit for Selective Analysis
Reconstruction (FileTSAR) for large-scale computer networks, which enables on-
the-scene Acquistion of probative data. FileTSAR then allows detailed forensic
investigation to occur either on site or in a digital forensic laboratory environment,
with the goal of ensuring admissible digital evidence. The University of Rhode
Island developed DeepPatrol, a software tool using machine intelligence and deep
learning algorithms to assist law enforcement agencies in investigating child sexual
abuse materials. Both projects are advancing the field of digital forensics. Deep
Patrol may change the way law enforcement conducts forensic examinations by
accelerating and streamlining efforts to identify children in videos of sexual
exploitation” (Novak, 2021),

Some similarities between digital and physical evidence is that they both need to
have the sae secure chain of custody; although the storage and preservation of the
digital evidence assets brings several specific challenges to the evidence
operations. “Sustainable evidence operations must balance the scope and scale of
digital evidence management and maintain technological currency to accommodate
the changing needs of digital evidence. Almost all sustainable evidence operations
leverage available technologies to increase operational efficiency and
effectiveness.
According to EvidenceManagement.com (2024) the standards of digital evidence:
A secure chain of custody is essential just as it is with physical evidence, the
management of these types of evidence has strict requirements and protocols to
follow. When it comes to the preservation of digital evidence and physical
evidence, they both should be stored in a manner that preserves the integrity of the
original data or the physical evidence and it should be accessible to any future
access while in custody. When it comes to authenticity of digital evidence they
should be stored and preserved in ways that will guarantee or authenticate the
evidence as a true or original copy. The security of digital evidence should only be
accessible to limited users and authorized access of digital evidence should be
tracked to make sure the integrity of the chain of custody is followed for them. The
security measures should prevent unauthorized duplication, deletion, alteration or
export of the original digital evidence.
The best practices for digital evidence:
A) Digital evidence sources:
1. Since technology is evolving faster than policy, the procedures or practices
can keep up with it. Evidence management operations should be made to
manage preservation and storage for current, legacy and emerging digital
evidence sources, depending on digital evidence types in storage as
evidence.
2. Some of the current technology evidence sources can include:
a. Optical media, i.e., CD, DVD, Blu Ray disc
b. Flash drive storage
c. Card storage such as SD, XD
2. Digital evidence preservation practices:
a. since there is a large selection of digital media types, it is advisable to speak
with the media manufacturer about what would be the best storage conditions. As a
rule most digital media types need the following conditions to be met for extended
preservation:
1. protection from heat or extreme fluctuations of temperature
2. protection from high levels of humidity or extreme changes in humidity
3. should avoid direct sunlight
4. should be kept away from dust or other environmental contamination
5. kept away from static electrical charges
6. protection from media surface scratches, breakage or impact
7. kept away from volatile chemicals which include marking pen instruments
8. should not be handled excessively or contact with media surfaces
9. magnetic digital storage media should be kept away from magnetic fields
3. digital evidence storage and scalability:
a. physical types of digital evidence, including storage media and device hardware
containing digital evidence, and should be kept under conditions that will preserve
it the best and it is best to use protective packaging when submitting evidence and
document the evidence packaging, these measures can include:
1. protective sleeves for disc media
2. shielded packaging for electronic evidence devices.
b. electronically stored digital evidence should be kept on secure, redundant
network servers which are capable of only allowing limited access to the
authorized users
c. electronically stored digital evidence servers should allow real time backup
protection of all stored data to help stop evidence loss from a single server failure
d. agencies should have storage capacity that will preserve and store all digital
evidence without data loss until digital evidence assets or items can be removed
from storage for disposition after the needed time of evidence custody and
approval for disposition is obtained for removal
e. scalable storage or server storage plans capable of increasing sorage capacity
utilizing the same storage network is highly recommended as an option for long-
term storage capacity planning

Significance in Criminal Investigations:

Both types of evidence are necessary to solve investigations and are crucial when
the case investigation begins. It is easy to make mistakes, we see this all the time
happening, for instance in some cases there are times that protocol was not
followed during the collection of evidence, whether it was the chain of custody or
if it was not gathered properly/stored properly, etc. When something like this
happens, the case will get thrown out, especially if it is the only evidence that is
proving that the crime was committed by an individual. Especially after all the
hours spent investigating a crime it is a huge downside to see the case get thrown
out due to something as simple as following instructions or having the proper
training not being done and having to watch that individual get away with a crime.
Challenges and Limitations:

Some of the challenges to digital evidence and physical evidence is that both
require proper training of the investigators and to make sure that these
investigators follow what is taught to them. With digital evidence a limitation is
that technology is always being advanced which means the investigators need to be
up to date when these advances and have the required knowledge of this
technology, without it can cause a case to fall apart. All it takes is one simple
mistake that could cause the digital evidence to get deleted and maybe not be able
to be restored. Another limitation to digital evidence is that the criminals can have
certain things put into place into their devices which can wipe them if they get
arrested, it could be something as simple as a single key that they must press to
wipe the device clean. With physical evidence there may not be as many
challenges and limitations as with digital evidence, but there are limitations, and
they mainly center around the investigators being properly trained and taught what
they need to do from the moment they find the evidence. Also, physical evidence
can also be ruined if it is not properly stored.

Conclusion
Both physical evidence and digital evidence are key parts of a forensic
investigation and while there are many similarities and differences to each one of
them, the main key thing is to follow protocols and have proper training in both
types of evidence collection. When it comes to solving the case and finding out
who committed this crime and what happened, this evidence can make a difference
if the case can be solved. While there are times when the investigators may even
know who committed the crime, that is not enough in a court of law, there needs to
be evidence to prove beyond a reasonable doubt that the defendant committed the
crime. When it comes to the point where this evidence comes into play in a court
room; this can make the ultimate difference if the case is found not guilty or guilty.

References

Badiye, A., Kapoor, N., Menezes, R.G., (2023) Chain of Custody, National Library
of Medicine: National Center for Biotechnology Information,
www.ncbi.nlm.nih.gov

Novak, M., (2021) National Institute of Justice: Improving the Collection of

Digital Evidence, www.nij.ojp.gov

Evidence Management Institute (2024) Evidence Management Training,

EvidenceManagement.com

International Association of Chiefs of Police (no date) Law Enforcement Cyber

Center: Understanding Digital Evidence, iacpcybercenter.org

NIST Interagency Report NIST IR 8387, Guttman, White & Walraven (2022)
Digital Evidence Preservationnvlpubs.nist.gov/
https://doi.org/10.6028/NIST.IR.8387