Essay on Uncovering Invisible Alterations in Pen Inks With Document Examiners

Techniques Document Examiners Use to Uncover Alterations, Erasures, Obliterations and Variations in Pen Inks

Obliterations, alterations and erasures are invisible to the human eye but can be detected by the use of photography and various imaging devices which make use of ultraviolet and infrared wavelengths of light (Mohammed 2009). Video spectral comparator (VSC) is an imaging instrument which can be used to reveal additional writing that has been added by a different pen ink, removed or altered. This is done by use of filtered radiations at various wavelengths (Mohammed 2009). The technique exploits the variations in the manner in which ink variations responds differently to the light wavelengths.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Save 25%

Erasure involves the removal of typewriting, writing as well as printing that exists in a document. Abrasive instruments or chemical methods might be used when doing these erasures. In most cases, documents are often changed and altered after being prepared (Mohammed, 2009). This is done to hide their intentions or to aid in the penetration of forgery. Because there exist several ways of changing documents, different special discovery techniques are applied for each change (Mohammed 2009). Typical forms of alterations are erasing some of the documents by use of rubber eraser, razor blade, sandpaper, or use of a knife in the removal of type or writings by scratching and abrading surfaces of a paper (Mohammed 2009). The mentioned attempts of erasures result in the disturbance of the upper paper fibres.

The changes made become apparent when suspects area is examined under a microscope either by use of direct light or allowing the light to strike the suspect paper obliquely from one side (Mohammed 2009). However, microscopy can only help in the identification of whether an erasure has been made and not the original words or letters that were present. Identification of the original contents becomes impossible since most of the contents are removed.

Obliteration involves smearing or blotting out over the printing or writing to make the original documents unreadable (Mohammed 2009). Perpetrators often use chemicals to obliterate words (Mohammed, 2009). In this case, strong oxidizing agents are put on the ink to produce a colourless reaction element. The attempts may not be visible by the use of naked eyes; the microscopic examination will reveal the discolouration on the paper that has been treated.

Portions of the paper that has been chemically treated can be revealed by being examined under ultraviolet lightings (Mohammed 2009). This technique is interestingly effective since the examination of documents using ultraviolet lights shows fluorescent markings of ink which will be unnoticeable under room light.

Application and Critical Thinking Section

Q 1. 24,576 bits of information will be stored on each cluster.

A bit is the smallest unit of data and is usually represented by zero or one. One byte consists of eight bits (Saferstein, 2015). Often, in a sector, there are 512 bytes. In our case, a file system defines a cluster as six sectors (Saferstein 2015). Since each sector holds 512 bytes, a cluster will hold 512 bytes' times 6. A six sector cluster will thus store 3,072 bytes of information. To get the number of bits we multiply 3072 bytes by eight since there are eight bits in one byte to get 24, 576 bits of information.

Q2. The mistake Tom made is failing to contact with other detectives to carry out the scene processing services together. The first thing he could also have done after getting to the crime scene would have been securing and isolating the crime scene even before collecting any physical evidence.

Q3. I would start by looking at the browser cache files, browser history files, bookmarks and favourites (Saferstein 2015). This is because latent data are areas which are not apparent to neither the user nor the operating system but still contain essential data.

Q4. For the computer using Microsoft Outlook as an email client, I would highlight the email message, click the action menu represented by three dots in the Outlook.com menu and then choose "view message source" to look for the IP address (Saferstein 2015). For the computer using web-based email, the first place to look for the IP address of the received email will be at the email headers.

Four Places Where a Forensic Computer Examiner Might Look to Determine What Websites a Computer User Has Visited Recently.

Forensic computer science is one of the growing modern areas, and it involves; identifying, collecting, preserving and examining information originating from computers as well as other digital devices like mobile phones and laptops (Saferstein 2015). Aspects of the enforced law in the field of computer science involves recovering overwritten or deleted data from hard drives as well as tracking hacking undertakings in a system that has been compromised (Saferstein 2015). Investigators should be familiar with what has been left when after some internet activities (Saferstein 2015). Forensic examinations usually reveal internet data regarding user internet activities. Places, where a forensic computer examiner might look to determine the websites computer user, has visited recently include;

Internet Cache. Web browsing evidence of a user exists in the computer. Existing browsers such as the Mozilla Firefox and the Internet Explorer make use of a caching system to advance browsing of the web and make it efficient (Saferstein 2015). Web browsers cache portions of the visited pages on the local hard disks. This speeds up a second visit to the websites due to easier reconstructions.

Internet cookies. This is another area where evidence can be derived (Saferstein, 2015). They are placed in the local hard disks by the websites you visit only if the settings allow this to happen. Cookies files are a reliable and valuable source of evidence. Internet history. Almost all web browsers will track the history of the web pages visited by the computer user (Saferstein 2015). History stored ranges from the most recent to several weeks by some browsers.

Favourite places and bookmarks. Bookmarks allow fast and easy access to designated favourite sites. Websites stored in the bookmarks can be easily accessed (Saferstein 2015). Bookmarks may be organized in subfolders and can be stored in a document by the name Hypertext Markup Language (HTML) (Saferstein 2015).

Kind of Leads the Information Provide to the Investigator.

Internet cache can be a source of evidence for the computer investigator. Visited web pages can be partially or entirely reconstructed. Computer investigators search the data in particular browsers used by suspects (Saferstein 2015). Information about the visitors can be tracked by websites using cookies (Saferstein 2015). Examples of such information include; purchasing behaviour, passwords, personal information and history of visits made.

Internet history can be located and read with popular computer forensic software packages (Saferstein 2015). Internet history will not only display the web browsing activities but sometimes the documents and the pictures accessed on certain days. Bookmarked sites can reveal necessary information about a user such as hacking sites which have been bookmarked.

The Process of Using Each Generation of Mobile Device to Create a Timeline and Correlate Events on the Device.

Forensic analysis on smartphones and other mobile phone devices has risen. The reason behind this is the fact that criminals have been using these devices to perform criminal activities more than before (Kasiaras et al. 2014). A lot of private and valuable data is often stored in mobile devices, and this can be so helpful in resolving criminal cases. In the resolving of a case, automatic and semi-automatic correlation of end-user events which are recorded in mobile phones is of great value to investigators (Kasiaras et al. 2014).

Normalization process involves the collection of data along attack paths (Bignell & Gilbert, 2013). The data is essential for both deconflicted and atomic state. Data is normalized into consistent vocabulary using a rich vocabulary or selection of one of the existing vocabularies within the data collected.

Event deconfliction involves the viewing of multiple instances of one event as a representative of a single event. After normalization of events into a single vocabulary, there are multiple representations of the same event from multiple sources (Bignell & Gilbert, 2013). Synthetization of all data into one representation output, for example, the timeline requires working with single cases of unique events.

In the process of determining the events comprising primary and secondary events as well as data which is of limited or useless, events should be seen at their simplest form possible.

References

Bignell, J., & Gilbert, K. (2013). Investigating Computer-Related Crime. doi:10.1201/b14664

Kasiaras, D., Zafeiropoulos, T., Clarke, N., & Kambourakis, G. (2014). Android Forensic Data Analyzer (AFDA): An Opensource Tool to Automatize Event Correlation Analysis on Android Devices. International Journal for Information Security Research, 4(4), 501-509. doi:10.20533/ijisr.2042.4639.2014.0057

Mohammed, L. A. (2009). Alterations: Erasures and Obliterations of Documents. Wiley Encyclopedia of Forensic Science. doi:10.1002/9780470061589.fsa329

Saferstein, E. R. (2015). Criminalistics: An introduction to forensic science (12th edition). Forensic Science International, 19(3), 287-288. doi:10.1016/0379-0738(82)90092-5