Understanding Slack Space

To understand slack space you must first understand how a computer manages files. This is quite simple. When you create a file, such as a word document, your computer assigns it a place in the File Allocation Table (FAT), creates a directory entry and saves the file to a cluster on the hard drive. For now we will call the file "forensics.docx" and we are going to pretend the document was 3 pages long with approximately 900 words and 7100 characters. (Characters include each letter of a word and the spaces in between. They are basically each stroke of the keyboard that is recorded by the computer.)

To further simplify that it basically files the document away using the computers storage system. The equivalent of that in the real world is the same as a doctor's office labeling a manila folder with your name and a unique identifying number (this is like using the FAT on a computer) so they can find you easier when you return and then placing that file into their records room (this is like the hard drive). The directory in an office setting is the nurse's knowledge of the offices record keeping. For example, they may assign all the patients by birth date and an initial for their last name resulting in a number such as 19841201B. On a computer you would see the directory as something like "C://User/Documents/forensics.docx" while logged into your user account.

When you delete a document or send it to the recycle bin on newer Window's operating systems, the file is not actually deleted. The first letter of the file name is changed by the system and the FAT entry is voided to indicate that the file can be ignored. The document is still there in the same place, but it cannot be seen any longer because the computer is ignoring it.

Now you have a new document to save. Let's consider that you name the new document the exact same name as the original document. This forensics.docx is only two pages long and less than 600 words. The computer completes the same activities when you save it. However, it may not have saved the file in the exact same place as the original. (Going back to the doctor's office example, the files would not have the same birth date and therefore may not be in the same location.)

If by chance the computer does save the file to the exact same location, it would only save the new document over part of the old document because the new document is smaller and does not need as much space. This leaves the remaining 300+ words of space that the original document used still visible to forensic software. This additional space is called "slack space" and is one of the first places a computer forensics examiner would look.

Now, let's consider one more possibility. You want to make sure the document is deleted and that no evidence remains that you created it. So you open the document instead of using the delete button on your keyboard. You highlight all 900 words in the document and you press the backspace key. Then you paste in some other words and save the document using the original name. The document has changed, those words are no longer there and you think you've beaten the system. You haven't! Unless you replace all 900 words and 7100 characters, there will still be remnants of the old information still in your slack space.

Then there is also the possibility that once upon a time your computer shut down while you were working on the document and there is an auto save copy on the hard drive you didn't know existed. If you printed it, there is the copy of the file that was spooled for printing still on the hard drive. Your best option -- don't save incriminating documents on your hard drive in the first place. Electronic evidence is often harder to dispute than real life evidence in a court of law.

Legal Considerations for Moving Abroad

It's known but rarely thought of that the laws in other countries will be different from those of your home country. Much to the dismay of immigrants the world over, they arrive and live in the new country for long periods of time only to find out something that was common in their own culture will get them arrested, their children taken away or worse in their new country. A 2012 article spawned a significant debate among the immigrant and expat communities that highlights just how drastic some of the legal differences can be.

If you haven't seen it, the article is told from the perspective of two Indian parents who had their children taken away from them while they were living in Norway. In the article the parents mention that they were taken because the children were being hand fed and slept in the parent's bed. While I attempt to make no determination of their guilt or innocence, this highlighted a very real threat faced by individuals and parents who move abroad.

In this particular instance, let's first discuss the law in Norway. Under the Children Act: Chapter 5 Parental responsibility and where the child shall live permanently. Section 30 Meaning of parental responsibility. The child is entitled to care and consideration from those who have parental responsibility. These persons have the right and the duty to make decisions for the child in personal matters within the limits set by sections 31 and 33. Parental responsibility shall be exercised on the basis of the child's interests and needs.

Those who have parental responsibility are under obligation to bring up and maintain the child properly. They shall ensure that the child receives an education according to his or her ability and aptitude.

The child must not be subjected to violence or in any other way be treated so as to harm or endanger his or her mental or physical health. This shall also apply when violence is carried out in connection with upbringing of the child. Use of violence and frightening or annoying behavior or other inconsiderate conduct toward the child is prohibited.

Regarding the right to make decisions on behalf of the child in financial matters, the provisions of Act No. 3 of 22 April 1927 on Guardianship shall apply.

And further, this passage comes directly from a brochure provided by the Welfare Association: "Parental responsibility involves an obligation to care for the child. Parents must give their children love, safety and attention, care. Child care also involves the important task of stimulating and social contact. Parents are prohibited by law from using any form of violence (including light smacks and slaps) in connection with upbringing. Nor shall children be subjected to frightening or annoying behaviour or other inconsiderate conduct."

Both apply to this case. If you consider the details about there being absolutely no harm to the child physically or mentally, it is possible someone could have legitimately felt that the children were in danger. As we all know too well that some individuals are very easily offended and overreact even in safe environments all because of their own misunderstanding.

The article mentions that the welfare association was calling the feeding of the children by hand "force feeding." I think this throws up a red flag on both sides of the argument. Since neither of the children in the pictures appear to be morbidly obese or even just obese for that matter, it stands to reason that this scenario is likely being overplayed. Yes, parents can force-feed children but the reality is that doesn't mean the child will eat it, swallow it, or keep it down. There was no eating disorders mentioned in any of the online articles revolving around this story. Children are notoriously picky when it comes to food and it's more likely that maybe the child didn't like a food, mom made him eat it anyway for the health benefits and someone wasn't happy that she did it and turned them in. I think most of us have had similar experiences with foods like broccoli or spinach and mom insisted we eat it no matter how bad it tasted to us.

Feeding with the hands would be an absurd reason to remove children from a home from a legal standpoint and there is no indication in Norway law that says it is illegal to feed children in this manner. After all, you don't need a spoon for french fries or other finger foods and playing airplane can be quite an effective technique to lure a picky eater into eating.

Co-sleeping has long been controversial in many countries. Yes, it has the potential to be dangerous, but it is also scientifically proven to benefit babies as well. So this keeps most countries from banning the practice. Not to mention many cultures still practice this as a means of survival. Not every culture in the world has standard indoor heating during the winter months and body heat is crucial to life during harsh months. Co-sleeping is also not mentioned in Norway law as being considered detrimental to children. In my research I was unable to find any reference to other cases of children being removed from the home for co-sleeping

In Indian culture, both of these practices are common, everyday practices. Children sleep with their parents well into their teen years due to the limited space, comfort it provides the child, cultural and for many other reasons. So it would not been out of character for these parents to feed their child with the hands or allow them to sleep in the same room. These same behaviors, though not as common, occur in most of the countries in the world -- including the U.S. and UK. What child hasn't had a nightmare and ran from their own room to mom and dads when they can?

Regardless of what is happening to this specific couple, there are other immigrants facing the same dilemmas. There is no excuse for not knowing the law, and I doubt any country includes a disclaimer for ignorance of the law. It is important to research and understand how moving to a new country will require changes in your normal behavior. This includes downloading torrents, swatting babies on their diaper, making children stand in the corner, slapping an unruly suitor and more. No one wants to land themselves in jail abroad.

Top 10 Tips for How Not To Stand Out in the Crowd

Mobile surveillance is one of the most exciting parts of being a private investigator. You might be curious how to record evidence of a person while they are in a public place. Obviously you can't take your handy cam and follow them around but you can still follow them on foot and get some great footage using covert cameras. I won't get into these in this post but I will address some ways to watch your suspect/claimant while in plain sight without being burned.

Make sure you test your covert camera before you go on surveillance for the day. Make sure the camera fits the scene you're going to. You wouldn't want to take a cell phone into a gym and expect to get good video. It will stand out whereas an iPod or watch would not.

1. Dress for the place you're going to be. I wouldn't walk around downtown D.C. in redneck camouflage for example. Do a little research if you're not familiar with the town and you'll have a good idea of how to dress. 
2. Avoid wearing bright colors or trigger colors. Trigger colors are things like red, purple and yellow. While they can be common, they also tend to stand out more to people than colors like black, blue, white or dark green. 
3. Stay with the crowd if there is one. One lone man sticks out much more than a crowd of people. If you can make it work without arousing suspicion, walk close enough to someone that it looks like you're with them. If you must walk alone, break out your cell phone and look like you're texting or making a phone call. These behaviors are ones that people tend not to want to watch. 
4. Avoid physical contact with anyone. You don't want to accidentally bump into someone, have to say excuse me and risk your suspect/claimant hearing your voice and noticing you. So be careful of where you're walking. 
5. In stores, stand just behind the shelves. Most of the time there is a gap you can see through and watch your suspect and no one will notice you. If anyone else walks by, pretend you're looking at whatever is on the shelf in front of you. It's sometimes helpful to hold an item in your hand and angle it so it looks like you're reading it when you're really watching your covert camera. 
6. Walk at least 1 aisle away from your suspect/claimant when in the stores. They're not watching the gaps in the aisles to see if someone else is there, they're on a mission to find their products. Use that to your advantage and follow them without being in sight. 
7. Keep your head up (unless pretending to text or look at products) and be confident that you know where you're going - even if you don't. You'll draw more attention if you look lost. Walk straight and at a steady pace. If you're at risk of losing your suspect/claimant, then speed up your walk only when you're not in the crowd. Trying to run over the crowd and get through them will get you noticed but walking fast while alone is completely normal. 
8. Look in the direction of your suspect/claimant but never directly at their face. Making eye contact is one of the worst things you can do so try to look just behind them or beside them. If they look at you, shift your eyes as if they're in your way and you're trying to look around them. That will take the focus off of them suspecting you're watching them.
9. Change your clothes between stops. If you follow someone to more than one store, change your clothes in between. If they saw you at the last store, they won't recognize you in a different outfit. If you're a girl, you can also put your hair up or take it down to really throw them off your trail. 
10. Keep your emotions at bay. If something funny happens, laugh on the inside and only smile on the outside. It's best to laugh without sound if you can. Just don't let your voice stand out. If you stump your toe, hold it in. Making any noise could get you too much attention from your suspect/claimant.

Searching Court Records

I first got interested in becoming a private investigator years ago. I'm not sure exactly what led me to think this was the job for me but I know I was spending a considerable amount of time researching my families genealogy and as such, countless hours in courthouse record rooms.

Here in Virginia there are several types of records rooms. Each court is different. some have open access rooms in which you just walk in and never encounter a worker unless you want to. Others have rooms you must bypass the counter so they know you're there. A few I've been too had the books behind glass windows and you had to know what you were looking for and ask for it specifically.

Regardless of how you get to the indexes and records, there are many common elements in what you will find while searching.

Always start with the indexes. Not just one because then you'll be missing half of the information. Start with the index that has information you're certain about first. So if you were looking to find out who John Doe married in 1974, then you would pick up the index for grooms starting with the letter "D" and covering the year mentioned. Most indexes cover a span of several years.

As you go through the index, you'll notice the headings on the pages are listed 'Da-De' or in some similar fashion. Find the section that covers 'Do' and then scan all the listings. The list on the page will not be alphabetical but is listed by date. So if the page started in 1965, scan the date column until you find 1974.

It's important that if you don't find John Do in 1974 that you search subsequent years. Typos are a fact of human life and maybe he got married in 1973 or 1975. If I were searching and I didn't find him in the right year, I would scan the entire page by name. It takes only a few seconds and could produce the information you are looking for.

Once you find John Doe, make note of the line number his name is listed on. Most indexes span 2 pages and they are not always lined up perfectly. Then slide your finger along the line until you reach the end of that page. Where the book creases, look for the same line number on the second part of the page and continue sliding your finger along that line to see the rest of his information.

Typically in marriage registers you can find the names of the grooms and brides parents, birth dates, city and/or state of birth and age at time of marriage. Sometimes the officiating minister is also listed. Write all the information you find down in your notebook. Even the tiniest piece of data could be useful. Maybe the happy couple still attends the same church and you can find bulletins detailing more information of their lives.

When it comes to deeds you can find when the land was bought and sold and for how much. There should also be a plot number listed. When you have a plot number, you can look in the plat books. These are massive books, so be prepared for some heavy lifting if you need to see the boundaries of a property. Actually, most courthouse books are heavy but these are extra heavy and bulky.

Pay close attention to who bought and sold the land or how it was awarded. This could lead you to a will if the property changed hands from relative to relative. Or there could be evidence of laundering - hiding assets without losing them - via transference to a spouse or relative. These documents could also show that your suspect has more disposable income than they report to have. Deeds almost always list a lien holder if there is one. If there's not, then your suspect paid in full at the time of sale.

This isn't always a red flag. If he purchased the property from a government auction or foreclosure sale, financing may not have been an option or the price may have been low enough he could get it cheap. The answers are all in the details.

Why would you need to know this? There's a variety of reasons. Knowing how a plat is laid out could benefit you if you're going into a rural area for a case. On large plats of land there are likely to be multiple exits. So, you would want to drive around the area and look for all possible exits. If the plat is large, you can determine just how far you need to go and how feasible it is.

Criminal records obviously point to whether or not your suspect has a criminal record. These are a no-brainer. While you're in the room with the criminal records, be sure to check both civil indexes and chancery. These include divorce records, restraining orders and many other complaints that may or may not result in punishment and fines. They also include valuable address information many times and can lead you to validate social connections.

Last but not least, always check the Wills indexes. They may not seem very useful but can lead you to important clues as to property owned by the suspect, as in guns his grandfather may have left him that aren't registered, and family connections.

Often you can find most of these records online and you won't even need to go to the courthouse. Virginia has a healthy online system of records for many of the court systems. It includes criminal, civil, general district, traffic and appeals cases. For wills and chancery you still have to go to the courthouse. Plats can be found at the link below.

Virginia Courts Online Case Information
Virginia GIS Sites

Crowdsourcing in the Criminal World, AKA Crimesourcing

We've all seen them, ads looking for workers to complete odd tasks that we can't imagine why anyone would want them done. Or ads we know they want desperate workers for because no one in their right mind would do all that work. Here is one example:

This job is SUPER EASY - all you have to do is post on youtube and pass the captcha, i will supply words to copy paste. Because of this, i can offer .25 per hour -- 25 cents per hour Almost anyone can do this but i expect you to work for the hour and post the whole time. Write back YOUTUBE in the subject line so i know you have read this.

When we read ads like that, we notice so many things wrong. A first thought may be to question why someone would need a bunch of YouTube captcha's passed. The second would be the astonishingly low rate being offered. With the federal minimum wage in the U.S. being $7.25 an hour, it stands to reason this ad is not targeting U.S. citizen workers. That same .25 cents translates into some fairly good wages in many other countries and all the worker has to do is read and type.

Looking at this job ad from a criminal justice perspective tells us even more. They are seeking international workers to avoid breaking laws. International laws are vastly different in many countries and some don't even have laws related to the internet or illegal use of it yet. The second thought is that passing captcha is a requirement that is meant to ensure the poster is a real human being and not an automated system. To bypass it, someone must type it and the poster of this job has something else taking up his time and he wants these passed quickly. Something obviously is not legal or right.

Ads like this are a major part of what has now been coined crimesourcing. The principle is the same as crowd sourcing where jobs are divided up into small parts enabling the employer to contract more highly specialized services with less overall cost and complete the project faster in most cases. Each person working on a small task submits their work and the final project is completed by project managers. Crowdsourcing is a progression on older concepts such as home envelope stuffing, hiring freelancers and the like. As a modern concept, all of these avenues are exploited to avoid paying health care, benefits and more to staffed workers.

With crimesourcing this means that the small tasks, such as purchasing chemicals to make methamphetamines, may be purchased by some contractor looking to pick up some extra cash. The chemicals are not illegal, the contractor is already making a run to the store and picking up a few more vats of the chemical could net him an easy paycheck without any extra work. The chemicals are picked up, the contract has went well and no laws have been broken. For the criminal, the purchase of the chemicals cannot be tracked back to them or their address, so it lessens any suspicion that may come their way.

As for the captcha's mentioned above, the worker isn't breaking any laws that they know of. However, the captchas being bypassed allow the criminal access to user accounts and provide them an opportunity to gather information using software programs. These ads are frequently used by hackers or organized crime rings to keep the suspicion from coming back to them. Sites like YouTube track IP addresses when captcha is entered so they will not have a record of the actual criminal typing in these captcha codes.

Previously, criminals would not trust someone they don't know. However, in these cases, they don't need to trust the worker very much at all. They never meet the worker and the worker has no idea who they are. In addition to that, the worker doesn't know what the work is being used for and in most cases does not care or there are no legal worries because there are no international laws that will prosecute them. This all leaves law enforcement with a long electronic paper trail that leads them in too many different directions to follow.

The same concept works with recent flash mobs where workers are hired to show up at a set location wearing a specific outfit. Have you seen crimesourcing jobs posted online? Have you applied for any of them? What are some ways you think law enforcement can handle these situations?

Illinois Minors and Alcohol Laws

The State of Illinois strictly prohibits the possession, use and consumption of alcoholic beverages by individuals under the age of 21. Included in the possession law are provisions for individuals who obtain or possess illegal or invalid identification cards. The offender does not need to be driving or in public view to be found guilty under the possession laws.

Possession and Consumption

The state explicitly states that purchasing; accepting, distributing, delivering and consuming alcohol are considered possession under the current state code. The law also states it is prohibited to provide alcohol to minors, even under the supervision of a parent or guardian, under any circumstances or for any occasion. Further prohibited is defacing, altering, transferring or providing false information to obtain a state issued identification card. There are no provisions for medicinal alcohol use or private establishments.
235 Illinois Compiled Statute 5/6-20

Penalties

Infractions under the Illinois possession law are considered class A misdemeanors. Class A misdemeanors carry the potential for several forms of punishment and the judge will determine the best course of action based on the individual case. When multiple infractions of the law are involved, the judge can sentence the offender to concurrent or consecutive sentences. Types of punishment include:

• Incarceration - The juvenile can be sentenced to up to one year in a juvenile facility if under the age of 18 and in an adult incarceration facility if between the ages of 18 and 21.
• Impact Incarceration - This boot camp style program aims at reshaping the offenders' behavior and providing them with the necessary discipline to avoid future incarceration. The offender must be found eligible for the program before sentencing.
• Probation - The judge may order up to two years of probation for the offender along with conditions for the probation and discharge of the sentence.
• Fines - The offender can be ordered to pay a fine up to $2500 in addition to the punishments listed above.
• Restitution - Restitution includes returning property, including stolen alcohol, or paying for the goods taken, damages done to property as a result of the alcohol use and paying for the repairs that must be completed to personal property
• Drug Court - If the judge determines that the offender has a problem with alcohol he may order a course of treatment through drug court. Treatment programs are tailored to the individual and include rehabilitation facilities, medical treatment and mandatory reporting and testing for further alcohol use.
• Electronic Home Detention - Electronic monitoring restricts the offender from leaving their home residence. A monitoring unit is placed on the offenders' body and a monitoring unit is connected to the utilities in the home. If the monitoring device leaves the area an alarm will sound and police will be dispatched.

235 Illinois Compiled Statute 5/5-4.5-55 and 730 Illinois Compiled Statute 5; 166/20

Shortening the Sentence

In some instances, the offenders' sentence can be shortened by the following:

• Home Detention - The offender may be eligible to receive credit for time spent in home detention before and during the trial
• Good Conduct - The offender can receive one day of good behavior allowance for days served before the trial, during the trial and after sentencing if no violent offenses were committed along with the possession of alcohol or while serving the time.

235 Illinois Compiled Statute 5/5-4.5-55 and 730 Illinois Compiled Statute 5/5-4.5-100; 130

Commercial Vacuum Products for Forensic Use

Commercial grade vacuum products can be used to simplify forensic tasks like collection of evidence and processing of evidence. Some vacuums are used in the field while others are used in the laboratory. There are a wide variety of vacuum products available for forensic use to suit the needs of any laboratory or collection need.
 
3M Trace Evidence Vacuum
The 3M Trace Evidence Vacuum is a toolbox style particle vacuum capable of suctioning evidence as small as 0.1 micron. Each filter nozzle is individually wrapped and cleanroom sealed and has its own collection bag. Each filter bag is only used once which also helps eliminate any chance of cross contamination.

VACUU-LAN Networked Vacuum
The VACCU-LAN is an integrated networked vacuum system allowing connection of multiple smaller diaphragm vacuums and easier relocation. The system operates like a central vacuum with multiple ports and is quieter and more cost efficient than having multiple machines. Using multiple ports can allow for collection of multiple sites of evidence at the same time, for example all areas of a vehicle could be vacuumed simultaneously.

PC3012 VARIO Self Adjusting Vacuum System
The PC3012 is a low noise, solvent vapor resistant diaphragm pump used for extracting evidence. The vacuum can evaporate up to 30% faster without fluctuations in vacuum strength. This system continually adapts pumping speed based on application conditions and has integrated solvent recovery as well as evaporation control for maximum efficiency.

TED Collection System
The TED vacuum collection system is designed for collecting trace evidence, DNA evidence, physical evidence and more. The system comes with attachments designed specifically for each type of evidence to be collected and evidence is deposited directly into vials for easier processing at the lab.

To learn more about Forencis practice protocols, check out this great resource!