What is digital evidence? Where can it be found?
Those were questions Butler County Prosecuting Attorney Kacey Proctor and Poplar Bluff Police Detective Danny Hicks answered earlier this month during a presentation on digital evidence at the statewide prosecutors’ annual meeting and statewide training at Lake of the Ozarks.
Having been asked by members of the Missouri Office of Prosecution Services to teach a class on digital evidence, “I thought it would be helpful to have a trained computer forensic examiner to co-teach the class” and be available to answer any technical questions the audience might have, Proctor said.
Hicks is the commander of the SEMO Cyber Crimes Task Force, which is based at the police department.
While digital evidence is a “very broad topic,” Proctor said, the hour-and-a-half session was broken down into several areas.
“The first portion of the presentation focused on what is digital evidence,” Proctor explained.
The 200 prosecutors in attendance were given a “bird’s eye view of several different types of electronic devices,” Proctor said. “Then, there was a section on where (digital evidence) can be found; all the different types of devices that can store and transmit digital evidence.”
Hicks said he spoke about the evidence seizure process and how metadata is obtained from the images contained on those devices.
“There is a lot of information in metadata, like where the photo was taken, the GPS coordinates, the date and time, the make and model of the device,” Hicks explained.
Some details, Hicks said, also were presented regarding virtual private networks (VPNs) and masking of internet protocol (IP) addresses.
There are VPN companies selling applications, which “masks your identity, your IP address,” Hicks said. “ … Your IP address checks to a different location than (where) you’re actually using the IP address from, more than likely a foreign country.”
Hicks said the prosecutors were given information about how to send off subpoenas to identify the actual account holders for those VPNs.
Proctor said he and Hicks also tried to get the prosecutors to think about places to look for digital evidence that are not “necessarily common. For example, a black box in an automobile or a Smartwatch.
“We were trying to get them used to the idea there is digital evidence anywhere you look that might be helpful to the case.”
Hicks described the Smartwatches as the “newest thing” when it comes to obtaining data.
“We are able to tie certain devices that their Smartwatches are connected to,” Hicks said.
Proctor said he and Hicks also talked a “little bit” about cellphones and cellphone location information, commonly referred to as cell tower pings.
“I went into detail about what we can recover from social media accounts, from Facebook, Snapchat, that kind of thing,” Hicks said.
Hicks, Proctor said, also talked about “the forensic process, what he has to do from start to finish after receiving a device.”
In talking about doing forensic examinations on cellphones and laptops, Hicks said, there are different ways that investigators can access devices, which are encrypted or password protected.
“There are ways around passwords on cellphones” now, said Hicks.
While Hicks spoke about what is included in his reports and how to obtain them, he said, Proctor “touched on the court procedures, how we work with prosecutors to make sure we’re on the same page when we present the results of a forensic examination” in court.
During the session, Proctor said, he and Hicks covered a lot of content.
“Usually a class like that would be done in a week’s time, but the point of the presentation was to identify places for prosecutors to look for important kinds of evidence,” said Proctor, who was honored to have been asked to teach the class.