Trace Evidence: Proof of Our Everyday Interactions

Trace evidence is the term applied to evidence left behind when an interaction between the perpetrator of a crime and the crime scene. Often this type of evidence is not seen with the naked eye or is not the first thing noticed about the crime scene. Types of trace evidence include:

• Fingerprints on a door frame
• Saliva on the rim of a drinking glass
• Strands of hair on a victims' clothing
• Gun residue on the criminals' hands
• Skin cells on lipstick
• A strand of thread on a broken piece of glass.

Collecting trace evidence requires the investigator to examine the evidence with close scrutiny and often involves the use of a microscope. Depending on the type of evidence the investigator suspects to be present, they may also spray the surface with chemicals or use other extraction processes to reveal the evidence.

One extraction process that you commonly see on popular crime shows is the use of superglue fumes to reveal latent fingerprints. The fumes react to oils that are commonly on our skin and particles from the fumes bond to the oil and form a fingerprint. Another common method of collecting fingerprints is dusting with powder. Once the fingerprint is revealed, it is collected using special adhesive tape that allows the print to be preserved rather than damaged or destroyed during the collection process.

One of the most popular methods of revealing trace evidence that isn't seen by the naked eye is to spray an area with a Chemiluminescent substance, such as Luminol. The Chemiluminescent substance reacts with the hemoglobin in the blood and produces a distinct glow when viewed in the correct lighting conditions. This requires complete darkness in the room and the blood will not glow for long. The hemoglobin in the blood cannot be cleaned off with ordinary household cleaning products.

Trace evidence collection is achieved through the use of special vacuum equipment, cotton swabs and tweezers among other methods. In the lab evidence is examined through the use of special microscope equipment. This equipment reveals finer particles of evidence as well as specifics about the evidence. Through the use of microscopes, thin layer chromatography and infrared spectroscopy procedures examiners can determine the thread count of fabric, the size and color of a grain of powder and reveal clues as to the type of animal a strand of hair came from. There are kits available on the market to let you try your hand at finding trace evidence. A CSI Crime Scene Investigation Kit would be wonderful for your next crime solving party or just to test your skills as an aspiring forensic examiner.

Understanding Slack Space

To understand slack space you must first understand how a computer manages files. This is quite simple. When you create a file, such as a word document, your computer assigns it a place in the File Allocation Table (FAT), creates a directory entry and saves the file to a cluster on the hard drive. For now we will call the file "forensics.docx" and we are going to pretend the document was 3 pages long with approximately 900 words and 7100 characters. (Characters include each letter of a word and the spaces in between. They are basically each stroke of the keyboard that is recorded by the computer.)

To further simplify that it basically files the document away using the computers storage system. The equivalent of that in the real world is the same as a doctor's office labeling a manila folder with your name and a unique identifying number (this is like using the FAT on a computer) so they can find you easier when you return and then placing that file into their records room (this is like the hard drive). The directory in an office setting is the nurse's knowledge of the offices record keeping. For example, they may assign all the patients by birth date and an initial for their last name resulting in a number such as 19841201B. On a computer you would see the directory as something like "C://User/Documents/forensics.docx" while logged into your user account.

When you delete a document or send it to the recycle bin on newer Window's operating systems, the file is not actually deleted. The first letter of the file name is changed by the system and the FAT entry is voided to indicate that the file can be ignored. The document is still there in the same place, but it cannot be seen any longer because the computer is ignoring it.

Now you have a new document to save. Let's consider that you name the new document the exact same name as the original document. This forensics.docx is only two pages long and less than 600 words. The computer completes the same activities when you save it. However, it may not have saved the file in the exact same place as the original. (Going back to the doctor's office example, the files would not have the same birth date and therefore may not be in the same location.)

If by chance the computer does save the file to the exact same location, it would only save the new document over part of the old document because the new document is smaller and does not need as much space. This leaves the remaining 300+ words of space that the original document used still visible to forensic software. This additional space is called "slack space" and is one of the first places a computer forensics examiner would look.

Now, let's consider one more possibility. You want to make sure the document is deleted and that no evidence remains that you created it. So you open the document instead of using the delete button on your keyboard. You highlight all 900 words in the document and you press the backspace key. Then you paste in some other words and save the document using the original name. The document has changed, those words are no longer there and you think you've beaten the system. You haven't! Unless you replace all 900 words and 7100 characters, there will still be remnants of the old information still in your slack space.

Then there is also the possibility that once upon a time your computer shut down while you were working on the document and there is an auto save copy on the hard drive you didn't know existed. If you printed it, there is the copy of the file that was spooled for printing still on the hard drive. Your best option -- don't save incriminating documents on your hard drive in the first place. Electronic evidence is often harder to dispute than real life evidence in a court of law.

Commercial Vacuum Products for Forensic Use

Commercial grade vacuum products can be used to simplify forensic tasks like collection of evidence and processing of evidence. Some vacuums are used in the field while others are used in the laboratory. There are a wide variety of vacuum products available for forensic use to suit the needs of any laboratory or collection need.
 
3M Trace Evidence Vacuum
The 3M Trace Evidence Vacuum is a toolbox style particle vacuum capable of suctioning evidence as small as 0.1 micron. Each filter nozzle is individually wrapped and cleanroom sealed and has its own collection bag. Each filter bag is only used once which also helps eliminate any chance of cross contamination.

VACUU-LAN Networked Vacuum
The VACCU-LAN is an integrated networked vacuum system allowing connection of multiple smaller diaphragm vacuums and easier relocation. The system operates like a central vacuum with multiple ports and is quieter and more cost efficient than having multiple machines. Using multiple ports can allow for collection of multiple sites of evidence at the same time, for example all areas of a vehicle could be vacuumed simultaneously.

PC3012 VARIO Self Adjusting Vacuum System
The PC3012 is a low noise, solvent vapor resistant diaphragm pump used for extracting evidence. The vacuum can evaporate up to 30% faster without fluctuations in vacuum strength. This system continually adapts pumping speed based on application conditions and has integrated solvent recovery as well as evaporation control for maximum efficiency.

TED Collection System
The TED vacuum collection system is designed for collecting trace evidence, DNA evidence, physical evidence and more. The system comes with attachments designed specifically for each type of evidence to be collected and evidence is deposited directly into vials for easier processing at the lab.

To learn more about Forencis practice protocols, check out this great resource!