Microgram Bulletin

 

Published by the Drug Enforcement Administration 
Office of Forensic Sciences Washington, D.C. 20537 

The U. S. Attorney General has determined that the publication of this periodical is necessary in the transaction of the public business required by the Department of Justice. Information, instructions, and disclaimers are published in the January issues.


April 2007

- INTELLIGENCE ALERT -

ECSTASY TABLETS WITH GLITTER IN WINONA COUNTY, MINNESOTA

Photo 1
Photo 2
Photo 1
Photo 2

The Minnesota Bureau of Criminal Apprehension Forensic Science Laboratory in St. Paul recently received two separate submissions of apparent Ecstasy tablets, both with a “waving man” logo and containing glitter, suspected MDMA (see Photos 1 and 2). The first submission consisted of one red/pink tablet and one purple tablet, while the second submission consisted of 547 of the red/pink tablets and 1533 of the purple tablets (weights and dimensions not taken for either set). The first set of tablets were seized in Winona County by the Winona Police Department, while the second set of tablets were also seized in Winona County, but by the Bureau of Criminal Apprehension (no further details concerning either seizure); Winona County is located in the southeastern part of the state, approximately 130 southeast of St. Paul. Analysis of the first set of tablets by GC/MS confirmed MDMA and caffeine in the red/pink tablet but only MDMA in the purple tablet. Analysis of the second set of tablets by GC/MS confirmed MDMA (but no caffeine) in the red/pink tablets and again only MDMA in the purple tablets. Trace amounts of methamphetamine (not confirmed) were also indicated in both sets of tablets. None of the exhibits were quantitated, but the MDMA loadings were low to moderate based on their respective TICs. These were the first submissions of Ecstasy tablets containing glitter and with this logo type to the laboratory.

[Editor’s Notes: According to the analyst, other than their colors these tablets were highly similar to those described in March 2007 issue of Microgram Bulletin. Those tablets were seized in Birmingham, Alabama, were yellow and green (5 tablets each color), and contained MDMA, nicotinamide, trace MDP2P, and trace methamphetamine. As previously commented, it is unknown what health effects the presence of glitter in these tablets would have on the users.]

* * * * *

- INTELLIGENCE ALERT -

CAPSULES CONTAINING 2,5-DIMETHOXY-4-ETHYLPHENETHYLAMINE
(2C-E) IN TULSA, OKLAHOMA

Photo 3
Photo 3

The Tulsa Police Department Forensic Laboratory (Oklahoma) recently received a white plastic bottle, labeled “Nortesten,” including 100 clear gelatin capsules (23 x 8 millimeters), each containing approximately 10 milligrams of white powder, that field-tested as an amphetamine-like compound (see Photo 3). The exhibits were seized by the Tulsa Police pursuant to a search warrant in Tulsa (no further details). Analysis by GC/MS and FTIR indicated 2,5-dimethoxy-4-ethylphenethylamine (2C-E; not confirmed due to the lack of an authenticated standard). The capsule material was not quantitated; however, the TIC indicated no other components. 2C-E is not currently scheduled under Oklahoma law. This was the first ever submission of 2C-E to the laboratory.

[Editor’s Notes: An Internet search on Nortesten indicates that it is a “nutritional supplement” intended to boost testosterone levels - and that it has been discontinued by the manufacturer (Muscletech). According to several websites, Nortesten is purported to contain 18 milligrams of norandrostenediol (19-nor-4-androsten-3,17-diol) and 18 milligrams of norandrostenedione (19-nor-4-androsten-3, 17-dione) per capsule, in a time-release formulation.]

 

* * * * *

- INTELLIGENCE ALERT -

ECSTASY MIMIC TABLETS (CONTAINING 1-(3-CHLOROPHENYL)-
PIPERAZINE (mCPP)) IN HAMMOND, INDIANA

Photo 4
Photo 4

The Indiana State Police Lowell Regional Laboratory recently received a poly-drug submission, including marijuana, cocaine, dihydrocodeinone (hydrocodone), hydromorphone, and 11 pink tablets with white specks with a diamond/gemstone logo, suspected Ecstasy (see Photo 4). The exhibits were seized by the Hammond Police Department while executing a search warrant at a local residence. The tablets were 9 millimeters in diameter and 3 millimeters thick, and weighed approximately 280 milligrams each. Analysis by GC/MS and TLC, however, indicated 1-(3-chlorophenyl) piperazine (meta-chlorophenylpiperazine, mCPP) as the major component and only trace MDMA. The tablets were not quantitated, but the mCPP loading was high based on the TIC. mCPP is not currently scheduled under Indiana law. This was the first submission of Ecstasy mimic tablets containing mCPP, and also the first submission of tablets with this logo type, to the laboratory.

 

* * * * *

- INTELLIGENCE ALERT -

ORTHO-METHOXYPHENYLPIPERAZINE (OMPP) IN SEABROOK, TEXAS

Photo 5
Photo 5
(Note: Scale is in Inches)

The Pasadena Regional Crime Laboratory (Texas) recently received a two-exhibit submission including about 0.5 grams of cocaine and 0.8 grams of a compressed green material, similar in appearance to an animal food pellet, submitted as suspected to contain MDMA (see Photo 5). The exhibits were seized by the Seabrook Police Department, pursuant to a traffic stop in Seabrook. A preliminary screen of the second exhibit using ferricyanide indicated the presence of a secondary amine, but the color change was slower than would be expected for MDMA. All other spot tests (including Marquis) were negative (suggesting MDMA was not present). Analysis by GC/MS, FTIR, and UV indicated not MDMA but rather 1-(2-methoxyphenyl)-piperazine (OMPP; not confirmed due to the lack of an authenticated standard). The exhibit was not quantitated, but the OMPP loading was low based on the TIC. This was the laboratory’s first encounter with a piperazine in any form.

 

 

 

* * * * *

- INTELLIGENCE ALERT -

LIQUID LSD IN ANCHORAGE, ALASKA

Photo 6

The State of Alaska, Scientific Crime Detection Laboratory, Anchorage recently received a blue, plastic, 50 milliliter bottle of “Skyy Vodka,” which was wrapped in plastic and Winnie the Pooh wrapping paper, that contained approximately 5 milliliters of yellow liquid with an odor of mint-flavored mouthwash, suspected to be a solution of methamphetamine (see Photo 6, showing the transferred solution). The exhibit was seized by the U.S. Postal Inspection Service at the Anchorage Postal facility (no further details). Analysis of the liquid by Ehrlich’s reagent, TLC, and GC/MS, however, indicated not methamphetamine but rather lysergic acid diethylamide (LSD; not quantitated). The liquid base was not identified. The exhibit was not quantitated, but the LSD loading was high based on the TIC. This is the first submission of liquid LSD to the laboratory.

 

 

 

* * * * *

- INTELLIGENCE ALERT -

BROWN COCAINE SMUGGLED IN A HAMMOCK CHAIR
IN LOUISVILLE, KENTUCKY

Photo 7
Photo 8
Photo 7
Photo 8

The Customs and Border Protection Laboratory at Chicago, Illinois recently received an exhibit of a dark brown, somewhat plastic material that had been concealed in the wooden bar of a hammock chair, submitted as a suspected controlled substance (see Photos 7 and 8). The hammock chair was seized by CBP Inspectors at a parcel service shipping hub in Louisville, Kentucky, and had been in transit from Venezuela to Spain (no further details). The substance (total net mass 592 grams) had an appearance similar to opium or black tar heroin, but did not field-test for any common controlled substance. Preliminary screening at the laboratory gave strong positive results with the Mayers and silver nitrate reagents. The sample also gave a red color with Scott’s reagent - but the color did not change or extract into chloroform. Analysis by FTIR, GC, GC/MS, and HPLC, however, indicated neither opium alkaloids or heroin but rather 49 percent cocaine hydrochloride, along with methyl benzoate and various other cocaine alkaloids. The cause for the dark brown coloration was not determined; however, the dark color and anomalous behavior with field and laboratory color tests suggests that the substance is a sample of so-called “black cocaine.” This is the first submission of black cocaine to the laboratory, and is also believed to be the first seizure of a hammock chair containing a controlled substance at the Louisville shipping hub; however, similar items have been encountered at other CBP facilities.

* * * * *

- INTELLIGENCE ALERT -

FENTANYL IN BLYTHE, CALIFORNIA

Photo 9
Photo 9
(Note: The Inside Legs of the Ruler are 8 cms)

The DEA Southwest Laboratory (Vista, California) recently received two bricks of compressed white powder, suspected fentanyl (see Photo 9). The exhibits were seized in Blythe, California by the Riverside County Sheriff's Department Special Investigation Bureau‑East (no further details). The exhibits were heavily packaged in layers of plastic vacuumed-sealed bags, grease, plastic wrap, and zip‑lock plastic bags. Analysis of the powder (total net mass 1675 grams) by Marquis resulted in a slow-developing orange color (consistent with fentanyl). Further analysis by GC, FTIR, GC/MS, and LC confirmed 9.8 percent fentanyl hydrochloride, cut with lactose; a small amount of 4-anilino-N-phenethylpiperidine (ANPP) was also noted. This is the second such submission to the DEA Southwest Laboratory - a prior submission of 945.1 grams of 83 percent fentanyl hydrochloride was received in March, 2006. The Southwest Laboratory has also assisted in the investigation and seizure of two clandestine fentanyl manufacturing laboratories over the past three years.

* * * * *

- INTELLIGENCE ALERT -

HEROIN-LACED BOLTS OF CLOTH AT THE EL PASO PORT OF ENTRY

Photo 10
Photo 10

The DEA South Central Laboratory (Dallas, Texas) recently received five bolts of cotton cloth laced with a fine light tan powder, suspected heroin (see Photo 10). The exhibits were seized by Immigration and Customs Enforcement personnel from within the clothing of an individual who was entering at the El Paso Port-of-Entry. Analysis of the powder (total net mass 2.4 kilograms) by GC/MS, FTIR, and GC/FID confirmed 80.8 percent heroin hydrochloride. The South Central Laboratory has received similar submissions in the past, but they are not common.

* * * * *

- INTELLIGENCE ALERT -

AQUEOUS SOLUTIONS OF 4-CHLORO-2,5-DIMETHOXYAMPHETAMINE
(DOC) IN TAMPA, FLORIDA

The DEA Southeast Laboratory (Miami, Florida) recently received eight small plastic squeeze bottles, of two different sizes, labelled as breath fresheners and containing small amounts of liquids, submitted as suspected liquid LSD (photos not available). The submissions were seized at a residence in Tampa, Florida by the Tampa Police, pursuant to a date-rape investigation. One of the subexhibits consisted of six squeeze bottles, each containing about 1.3 milliliters of a clear solution; the second subexhibit consisted of two slightly larger squeeze bottles, each containing about 0.25 milliliters of a pink solution. All eight solutions were aqueous and had pH values ranging from 3 - 5. Analysis by GC/FID, GC/MS, FTIR/ATR, and NMR, however, indicated not LSD but rather 4-chloro-2,5-dimethoxyamphetamine (DOC; salt form not determined and quantitation not performed) in seven of the eight bottles - one of the smaller bottles contained no controlled substances. This is the first submission of this type to the Southeast Laboratory.

* * * * *

- INTELLIGENCE ALERT -

HEROIN AND COCAINE SMUGGLED IN TRAILER HITCHES
IN NEW MILFORD, CONNECTICUT

Photo 11
Photo 11
Photo 12
Photo 12

The DEA Northeast Laboratory (New York, New York) recently received four trailer hitches and a heat-sealed evidence envelope containing a plastic bag, all containing white powders, suspected heroin (see Photos 11 and 12 for the hitches). The exhibits were seized in New Milford, Connecticut by Agents from the DEA New England Field Division (Bridgeport, CT) (no further details). Unusually, each hitch consisted of two square metal tubes connected by a metal hitch receiver/coupler, which were further wrapped with a metal chain. The hitches appeared to be functional. Each tube was internally lined with carbon paper, and contained a sleeve filled with white powder. The sleeves were clear plastic wrapped with brown, plastic tape. The ends of the tubes were closed with small metal caps that were epoxied in place. Preliminary screening of the removed powders, however, indicated either heroin or cocaine; 2 tubes contained heroin and 6 tubes contained cocaine. The bag of white powder (which had been removed by the perpetrators from other tubes at the seizure site) contained heroin. Analysis of the heroin samples (total net mass 5.30 kilograms) by GC/FID, GC/MS, NMR, and FTIR/ATR confirmed 88 percent heroin hydrochloride and trace cocaine. Analysis of the cocaine samples (total net mass 10.55 kilograms) using the same analytical techniques confirmed 81 percent cocaine hydrochloride adulterated with diltiazem. This was the first submission of heroin or cocaine concealed in trailer hitches to the Northeast Laboratory. The origin of the hitches was not reported.

* * * * *    * * * * *     * * * * *     * * * * *     * * * * *

SELECTED REFERENCES

[Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. Abbreviated mailing address information duplicates that provided by the abstracting service. Patents and Proceedings are reported only by their Chemical Abstracts citation number.]

1. Anastos N, Barnett NW, Pfeffer FM, Lewis SW. Investigation into the temporal stability of aqueous standard solutions of psilocin and psilocybin using high performance liquid chromatography. Science & Justice 2006;46(2):91. [Editor’s Notes: Psilocin and psilocybin standards were used. The time frame was 14 days. Protection from light significantly prolonged the usefulness life of the standard solutions. Contact: School of Biological and Chemical Sciences, Deakin University, Geelong, VIC, 3217 Australia.]

2. Blackledge RD, Phelan CP. Identification of bufotenine in Yopo seeds via GC/IRD. Microgram Journal 2006;4(1-4):3. [Editor’s Notes: The analysis of seeds from yopo (Anadenanthera peregrina) by GC/IRD and GC/MS is presented. The GC/IRD technique is easily able to discriminate between bufotenine (present in yopo seeds) and its positional isomer psilocin. Contact: U.S. Naval Criminal Investigative Service, Regional Forensic Laboratory ‑ San Diego, 3405 Welles St., Suite 3, San Diego, CA 92136.]

3. Casale JF, Hays PA, Spratley TK, Smith PR. The characterization of 4-methoxy-N-ethyl amphetamine hydrochloride. Microgram Journal 2006;4(1-4):42. [Editor’s Notes: The synthesis, analysis, and characterization of 4-methoxy-N-ethylamphetamine hydrochloride is presented. Analytical data (GC/MS, FTIR, and 1H-NMR) are presented. Contact: U.S. Department of Justice, Drug Enforcement Administration, Special Testing and Research Laboratory, 22624 Dulles Summit Court, Dulles, VA 20166.]

4. Casale JF, Piñero EL, Corbeil EM. Isolation of cis-cinnamoylcocaine from crude illicit cocaine via alumina column chromatography. Microgram Journal 2006;4(1-4):37. [Editor’s Notes: A procedure for isolating gram quantities of reference quality cis-cinnamoylcocaine from crude cocaine base is presented. Isolation was achieved through classical alumina column chromatography and recrystallization. Contact: U.S. Department of Justice, Drug Enforcement Administration, Special Testing and Research Laboratory, 22624 Dulles Summit Court, Dulles, VA 20166.]

5. Chinaka S, Iio R, Takayama N, Kodama S, Hayakawa K. Chiral capillary electrophoresis of amphetamine-type stimulants. Journal of Health Science 2006;52(6):649. [Editor’s Notes: A review (compounds not specified in the abstract). Contact: Forensic Sci. Lab., Ishikawa Prefectural Police Headquarters, Kanazawa, Japan 920-8553.]

6. Edwards NR. Qualitative and quantitative analysis of Ionamin 30 capsules (containing a time‑release formulation of phentermine). Microgram Journal 2006;4(1-4):66. [Editor’s Notes: Analysis of a time‑release formulation of phentermine required sonication in water for 60 minutes, in order to release the active compound from the matrix. Contact: U.S. Department of Justice, Drug Enforcement Administration, Mid‑Atlantic Laboratory, 1440 McCormick Dr., Largo, MD 20774.]

7. Eliasson C, Matousek P. Noninvasive authentication of pharmaceutical products through packaging using spatially offset Raman spectroscopy. Analytical Chemistry 2007;79(4):1696. [Editor’s Notes: The title technique is beneficial in situations where the conventional Raman backscattering method is adversely affected by excessive surface Raman or fluorescence from the packaging, capsule shell, or tablet coating. Contact: Central Laser Facility, CCLRC Rutherford Appleton Laboratory, Didcot Oxfordshire OX11 0QX, UK.]

8. Franckowski RE, Thompson RA. Eszopiclone (Lunesta™): An analytical profile. Microgram Journal 2006;4(1-4):29. [Editor’s Notes: Analytical data (GC, MS, IR, UPLC™, and 1H- and 13C-NMR) for eszopiclone are presented. Contact: U.S. Department of Justice, Drug Enforcement Administration, Special Testing and Research Laboratory, 22624 Dulles Summit Court, Dulles, VA 20166.]

9. Lu M, Shen J, Li N, Zhang Y, Zhang C, Liang L, Xu X. Detection and identification of illicit drugs using terahertz imaging. Journal of Applied Physics 2006;100(10):103104/1-103104/5. [Editor’s Notes: The stated application was for pure drugs hidden in mail envelopes. Drugs determined included ketamine, MDMA, MDA, heroin, acetylcodeine, and morphine. Contact: Department of Physics, Capital Normal University, Beijing, Peop. Rep. China 100037.]

10. Petek MJ, Lucic Vrdoljak A. Qualitative and quantitative gamma-hydroxybutyrate analysis. Arhiv za Higijenu Rada I Toksikologiju 2006;57(4):397. [Editor’s Notes: An overview and review. This article is written in Croatian. Contact: Centar za Kriminalisticka Vjestacenja “Ivan Vucetic,” Ministarstvo Unutarnjih Poslova, Zagreb, Croatia.]

11. Piñero EL, Casale JF. Quantitation of cocaine by gas chromatography‑flame ionization detection utilizing isopropylcocaine as a structurally related internal standard. Microgram Journal 2006;4(1-4):47. [Editor’s Notes: The quantitation of cocaine by GC/FID using isopropylcocaine as a structurally related internal standard is presented. The selectivity, precision, and accuracy of the method are detailed. The facile, multi‑gram synthesis of isopropylcocaine standard from cocaine (via two different routes) is described. Contact: U.S. Department of Justice, Drug Enforcement Administration, Special Testing and Research Laboratory, 22624 Dulles Summit Court, Dulles, VA 20166.]

12. Sarwar M. A new, highly specific color test for ketamine. Microgram Journal 2006;4(1-4):24. [Editor’s Notes: Treatment of ketamine with alkaline gold bromide produces a deep purple color within approximately one minute that changes to dark, blackish‑purple within approximately two minutes. The color, color change, and time frames constitutes a highly specific screening test for ketamine. The test is negative for amphetamine, methamphetamine, MDA, MDMA, and PCP, all of which are occasionally encountered in combination with ketamine. Contact: Forensic Research Laboratory, Center for Excellence in Molecular Biology, University of the Punjab, Lahore, Pakistan.]

13. Tsujikawa K, Kanamori T, Kuwayama K, Miyaguchi H, Iwata Y, Inoue H. Analytical profiles for 3,4,5-, 2,4,5-, and 2,4,6-trimethoxyamphetamine. Microgram Journal 2006;4(1-4):12. [Editor’s Notes: Analytical profiles (Marquis color testing, IR, NMR, TLC, HPLC, and GC/MS) are presented for the three title TMAs. Contact: National Research Institute of Police Science, 6-3-1, Kashiwanoha, Kashiwa, Chiba 277‑0882, Japan.]

14. Wisniewski ES, Hays PA. Dehydrochlormethyltestosterone: An analytical profile. Microgram Journal 2006;4(1-4):54. [Editor’s Notes: Analytical data (GC, GC/MS, FTIR, HPLC, 1H- and 13C- NMR) for the analysis and identification of dehydrochlormethyltestosterone ((17β)-4-chloro-17-hydroxy-17-methylandrosta-1,4-dien-3-one) is presented. Historical background is also included. Contact: U.S. Department of Justice, Drug Enforcement Administration, Mid‑Atlantic Laboratory, 1440 McCormick Dr., Largo, MD 20774.]

15. Zhang S-y, Huang Z-p. A color test for rapid screening of gamma-hydroxybutyric acid (GHB) and gamma-butyrolactone (GBL) in drink and urine. Fayixue Zazhi 2006;22(6):424. [Editor’s Notes: GHB was converted to GBL, then reacted with hydroxylamine to form the hydroxamate. This was reacted with acidic ferric chloride to give a purple complex. The LoD was 0.5 - 2 mg/mL. This article in written in Chinese. Contact: Fujian Public Security Coll., Fuzhou 350007, Peop. Rep. China.]

16. Zhou X-y, Ma D, Bu J, Shen B-h. Evaluation of uncertainty in determination of heroin by GC. Fayixue Zazhi 2006;22(6):421. [Editor’s Notes: The authors concluded that repeated measurements and the GC instrument were the major sources of uncertainty in determining heroin by GC. This article in written in Chinese. Contact: Inst. of Forensic Sci., Ministry of Justice, Shanghai 200063, Peop. Rep. China.]

Additional References of Possible Interest:

1. Bosserhoff A, Hellerbrand C. Capillary electrophoresis. Molecular Diagnostics 2005:67. [Editor’s Notes: A review (unspecified “forensic science applications” are mentioned in the abstract. Contact: Institute of Pathology, University of Regensburg, Regensburg, Germany.]

2. Kintz P. Principles of drug-facilitated crime investigations. Spectra Biologie 2006;25(156):42. [Editor’s Notes: An overview. Focus is toxicology (analysis of biological fluids in cases). This article is written in French. Contact: Laboratoire ChemTox, Illkirch 67400, Fr.]

* * * * *    * * * * *     * * * * *     * * * * *     * * * * *

THE JOURNAL/TEXTBOOK COLLECTION EXCHANGE

The Journal/Textbook Collection Exchange is a service intended to facilitate the transfer of unwanted journals and textbooks to forensic libraries or other Microgram subscribers. At present, this service is offered once a quarter (in January, April, July, and October). There were no donations offered during the past quarter.

All subscribers are encouraged to donate surplus or unwanted items/collections. Reference texts and long runs of forensic/analytical journals are of particular interest; however, even single issues are worthwhile. If interested, please consult the Microgram website or contact the Microgram Editor for further instructions.

The next offering of journals and textbooks will be in the July 2007 issue of Microgram Bulletin.

THE DEA FY 2007 STATE AND LOCAL
FORENSIC CHEMISTS SEMINAR SCHEDULE

The remaining FY - 2007 schedule for the DEA’s State and Local Forensic Chemists Seminar is as follows:

July 9 - 13, 2007
September 10 - 14, 2007

Note that the school is open only to forensic chemists working for law enforcement agencies, and is intended for chemists who have completed their agency’s internal training program and have also been working on the bench for at least one year. There is no tuition charge for this course. The course is held at the AmeriSuites Hotel in Sterling, Virginia (near the Washington/Dulles International Airport). A copy of the application form is reproduced on the last page of the August 2004 issue of Microgram Bulletin. Completed applications should be mailed to the Special Testing and Research Laboratory (Attention: J. Kerlavage) at: 22624 Dulles Summit Court, Dulles, VA 20166. For additional information, call 703/668-3337.

* * * * *    * * * * *     * * * * *     * * * * *     * * * * *

EMPLOYMENT OPPORTUNITIES

Position: Forensic Scientist (Chemist)                                                                         (First Posting)
Location: Montana Forensic Science Division; Missoula, Montana
Salary: $42,931.00 to $53,664.00
Application Deadline: July 15, 2007 (Faxed applications will not be accepted)

Duties and Responsibilities: Independently analyze evidence to identify controlled substances utilizing scientific testing procedures. Perform analyses of chemicals seized in clandestine laboratories to determine methods of manufacture and products produced. Identify adulterants, poisons, and discrepancies in product formulations related to product tampering investigation. Maintain accurate chain of custody records on evidence examined. Prepare written reports, including documentation of analyses performed and final conclusions. Provide expert testimony in courts of law. Experienced in maintaining scientific equipment, including quality control documentation. Provide instruction to law enforcement officers regarding evidence collection and preservation. Review casework for accuracy and adherence to standard operating procedures. The ideal applicant will also be proficient in the application of ASTM methods used in the analysis of fire debris. Performs other duties as assigned.

Qualifications: A minimum of a B.S. in Chemistry or related field with 3 years experience in a forensic laboratory specializing in the analysis of controlled substances. A dditional experience in the analysis of fire debris is preferred.

Contact: Jim Hutchison
             Chemical Analysis Supervisor
             Montana Forensic Science Division
             jhutchison -at- mt.gov
             (406) 329-1114

Applications may be obtained at: http://mt.gov/statejobs/statejobs.asp

Computer Corner

Sufficiency of Examination

#215
by Walter Aponté
Group Supervisor
DEA Digital Evidence Laboratory

“How Much is Enough?”
This is probably the most frequently asked question in computer forensic programs. Examiners and laboratory managers are constantly juggling increasing numbers of cases and “priority” examinations every year. Compounding the numbers crunch are the concurrent increases in the storage capacity and technical complexity of today’s digital devices. With few exceptions, all cases are “priority” and no cases are “routine.” A related issue is the “Scope of the Investigation.” Computer forensic examiners have to stay within the scope of the investigation/warrant, or they risk tainting the evidence or spending excessive amounts of time on useless tangents. In short, complex cases require an intelligent, targeted approach to extract the relevant information in a reasonable time-frame.

“What Information is Needed?”
This is probably the most important question before collecting or analyzing digital evidence (and answers the question of “How Much is Enough?”) In many investigations, the case agents/investigators do not know in advance if or how the information the computer forensic examiner will provide will assist them. In some cases, the case agent/investigator may already have sufficient evidence in order to successfully prosecute the case, and so the computer forensic examination is an afterthought, or a “fishing expedition,” or is declined altogether as “not needed.” However, digital evidence can both corroborate information already obtained during an investigation and identify new leads and/or new co‑conspirators. In addition, the information can assist plea bargaining and/or can impact sentencing.

Technical Challenges
As noted above, case complexity is ever increasing. A common example are cases geared towards dismantling Internet-based pharmacy and Internet-based money laundering organizations. In many such cases, the digital evidence may contain huge, complex databases, extensive email communications, and large amounts of financial information. In addition, the data may be stored on new generation storage devices, or in proprietary formats, or encrypted. These are significant challenges even for experienced examiners.

Also as noted above, storage capacities are also ever increasing. Hard drives are now reaching 750 gigabytes, and will soon reach and surpass 1 terabyte. RAID servers (commonly used by businesses and web host companies) can store 40 terabytes or more. Extracting the pertinent information from such large volumes of data can be a daunting challenge.

The Answer - Communication and Cooperation
Information exchange between the case agent/investigator and the computer forensic examiner is crucial to identify the information relevant to the case, minimize the examination time needed to extract it, and stay within the scope of the warrant and investigation. Establishing a close working relationship will result in faster (and maximum value) results for the case agents/investigators and reduced backlogs for the digital evidence laboratories - a win/win situation.

Questions or comments? E‑mail: Walter.Aponte -at- usdoj.gov

* * * * *