Month: October 2015

by

Interview with Forensic Accountant Sundaraparipurnan Narayanan

SN FA

What is your current job role and what does this involve?

I handle the forensic service line for SKP Business Consulting LLP, in India. I advise clients/corporates on fraud management/prevention strategy in the nature of setting up an in-house fraud control unit or support with operational fraud matrices in the nature of fraud analytics or fraud risk assessments, and assist in ethics or compliance investigations. With the increase in fraud, corporates are increasingly setting up in-house fraud control units to manage the risk of frauds. This includes defining the roles & responsibilities of the unit, exhibiting independence, developing a robust concern handling process and measuring effectiveness of the operations at appropriate intervals. Operational fraud management includes supporting corporates with fraud risk assessments and specific dashboards on fraud control. Supporting ethics and compliance investigations is primarily focussed towards gathering evidence from digital and documentary sources and conducting interviews of identified individuals (employees and third parties) with reference to the issue in question.

What kind of education/training do you need to work in this area?

You need to have an eye for details and you need to develop the capability of noticing inconsistencies and identifying patterns. These are enablers in this field. At the base, for the given nature of job, one should have a strong background in accounting and internal controls. Certified Fraud Examiner is a certification offered by ACFE, a non-profit working towards enhancing education relating to fraud. This certification helps resources to understand the essentials better.

How did you end up working in forensic accounting?

I was influenced by the way my mentor (Mr. Shanmuga Sundaram) worked on internal audit/internal control reviews, where he was able to spot complex frauds based on his unorthodox approach. Over time I realized that I had an interest in fraud investigations and wanted to explore that as a career. I joined Ernst & Young in their fraud investigation service line to learn and over a period the work experience supported by subsidiary reading has helped me in this field.

What are some of the most challenging aspects of this kind of work?

Gathering evidence is always challenging. In one of the reviews that I led, the issue in question was on the fraudulent manipulation of IT application data at the backend. The review involved gathering of specific traces of evidence from the logs and identifying inconsistencies. It also required exploring newer tools/techniques including wireshark attack or specific backup protocols to ensure that evidence was secured for subsequent analysis. These measures helped in concluding the investigation.

Similarly in another review, the instance of fraudulent conduct was identified in Japan. Investigation in Japan with known language constraints was challenging. We had to conduct interviews of the suspects with translators around.

How do you think this field of work could be improved?

Currently the technology is maturing in this field with digital forensics and analytics becoming more prominent than before. I believe that technological influence can change the playing field for the service in the decade to come. A move from service to solutions on fraud management also will be a game changer in the years to come.

Finally, do you have any advice for those seeking a career in forensic accounting?

My 3 points of suggestions to people joining forensic accounting are:

  1. Remember you are not a super human. You can gather only those evidences that are available, extractable and representable at the court of law. Hence be clear with the evidence that you can gather.
  2. Spend time learning. Learning gives a broader perspective of gathering evidence.
  3. Embrace technology. It will help you, add value to the field of work over time and bring in a change.

If you’re a forensic scientist (academic or industry) or a crime scene investigator and would like to be part of this series of interviews, get in touch by emailing locardslabblog[at]gmail.com.

This is Part 6 of our series of interviews with forensic professionals.

Interview Series Part 1 – Interview with Forensic Identification Scientist Alexandre Beaudoin

Interview Series Part 2 – Interview with Forensic Expert Robert Green OBE

Interview Series Part 3 – Interview with Forensic Expert & Consultant Gareth Bryon

Interview Series Part 4 – Interview with Forensic Identification Specialist Donna Brandelli

Interview Series Part 5 – Interview with Forensic Video Analyst David Spreadborough

by

Interview with Forensic Video Analyst David Spreadborough

DS

What is your field of expertise and what does working in this area involve?

I am a Forensic Video Analyst. In short, the forensic analysis of video involves the scientific examination, comparison and/or evaluation of video in legal matters. That though really only tells half the story. Video now comes from a multitude of sources and probably only a quarter of those could be classed as standardized. Most have some sort of proprietary nature, designed by the brand or manufacturer of a specific product. You probably think immediately of Video from surveillance systems; CCTV. However, there is also personal recording devices such as smart phones, digital cameras, body worn video and dash-cams. The majority of these are now digital and sit within the category of Digital Multimedia Evidence (DME). With CCTV, most still actually start off as an analogue video signal from an analogue camera and then the digitization gets done further down the line.

Many people have attempted to guess how many different types of digital video there are, with figures stretching from 3000 – 5000! As you can imagine, this then means that every job starts as research. Manufacturers of CCTV systems can change the format of their recording every time they upgrade that model of Digital Video Recorder. Same make and model number, but who knows how the digital video is encoded, stored and then decoded for playback.

It is imperative that the digital data is dealt with correctly. If not, it’s like the contamination of a piece of traditional evidence. If it is contaminated, any interpretation and/or enhancement of that footage could be questioned. Acquisition of the media comes first and this can be the most challenging part when it is stored inside a proprietary Digital Video Recorder. You can’t just ‘pull the drive’ and extract the data like Computer Forensics. Many machines don’t even store the data in a standard way. Then after acquisition, the playback and processing of that data is a minefield of contamination opportunities. If the video is processed incorrectly then the possibilities could be limited.

Identifying the correct method of acquisition, in order to preserve the integrity of the digital data is the start of my job. I can then ensure that it can be used effectively. From here comes the interpretation but I need to understand how it was originally captured and encoded. If I am to make a decisions based on what was recorded, I have to take these factors into consideration. To assist in my analysis I may need to conduct restoration and/or enhancement of the footage using digital image processing techniques. When the video has been understood and processed within a forensic workflow, I am able to prepare that footage for comparative analysis or presentation. All of this has to be conducted in a manner that is repeatable and acknowledged by the community.

How did you come to be involved in this line of work?

I had been a Police Officer for 12 years, 6 in the Met and then 6 in Cheshire. As a tutor constable, I became frustrated over the methods and processes involved when dealing with CCTV evidence. As a result I put forward a suggestion to my Divisional DI with a solution of how CCTV could be dealt with, not only more effectively, but with higher evidential integrity. I already had some understanding of digital video so the initial stages were made a little easier. Within a few weeks, one of the first Divisional CCTV Units in the Country was started. That was back in 2003, and although technology has brought about huge change and increased our capabilities, the reasons why I started that unit remain. With the increased reliance on video evidence, but with limited budget and resources, those reasons are actually more important today.

What do you think is the most common misconception about your field of work?

“It’s just a Video”.

“Don’t do it that way, it takes too long”.

“Don’t worry about it, it’s only a DVD”.

“Just press, ‘Print Screen'”.

Senior Officers and Managers see how easy it is to stick a dancing cat on YouTube and then, for some unknown reason, apply that logic to evidence. Evidence that is controlled by guidelines and law. You can’t cut corners with evidence. The misconception comes from how easily video and images can be manipulated. It is the analyst’s responsibility however to ensure that the media is interpreted correctly and all processing is completed adhering to the rules of evidence. When corners are cut in order to speed things up and balance the spreadsheet, that’s when things can go wrong. It’s not just a picture or a video. It is evidence and should be treated as such.

When CCTV is dealt with correctly, the value stretches throughout the Criminal Justice System. From recognition intelligence through to impactive evidence used to exonerate or convict. I have heard some managers class CCTV as ‘Low Yield’, referring to the fact that they regard the expense of a Forensic Imaging Unit as needless. It’s a classic case of ‘you get out what you put in’. If you don’t invest and use the full capabilities available, it’s common sense that you won’t see the results.

Do you think the field of forensic video analysis in the UK has been affected by the recent changes to forensic science services?

It was a really tough decision to leave the Police after 24 years of service. I did so though because I care. I cared about the quality of my work. I cared about doing it right. I cared about making the right decision. It’s only been a few months so it’s a little difficult for me to answer with personal experience.

What I can say though, is that in both the Police and private sector there is pressure now to ‘dumb it down’. Ensuring that more can be done for less. Rather than understanding what the evidence is, and how it should be processed, pressure is put on technicians to get the jobs done. I have seen countless examples where incorrect processing has been completed, resulting in images and video being presented that are not a true and accurate representation of the events captured by that camera. I have seen many comparative analysis reports where the images being used have not been created correctly according to the Digital Imaging Procedure. I have seen Video presented that has been acquired by methods not even mentioned in the Home Office Guidelines for Retrieval of CCTV.

Some of these issues end up causing further delays to an investigation. If I receive a disk from a solicitor, and am under instruction to analyze the footage, there is often disbelief when I re-contact to state that it is not the original evidence. They then have to request the original evidence and the whole process starts again. The introduction of standards in Forensic Video Analysis through ISO will help, but we are a long way off.

The majority of Forces invested when the FSS closed, ensuring that only the most complex or time consuming tasks required out-sourcing to the private sector. A few of the Forces, with experts in-house, were also able to make the correct decisions on out-sourcing as they knew the technical possibilities involved and the expected results. With current budgetary restraints within the legal system, this is reversing. Forces just have not got the money or the staff do the jobs anymore.

Do you think the specialty of forensic video analysis is currently being utilised to its full potential?

Not at all. Well, actually there are one or two places in the UK where it is given the respect, and then the funding, that it requires but there are many places where it is simply not possible to develop, due to a lack of joined up thinking. There are many facets to DME and Forensic Video Analysis. When a number of these get linked, then everybody wins. From reviewing CCTV during a major incident, the recovery of data, the use of Social media for intelligence… I could go on.

I go back to my answer earlier, when I stated that I have heard it called ‘Low Yield’. Think of a field of Barley. Left alone, it will produce a bad crop with a low yield. Invest the time and effort and you will get a good crop, with a high yield. To fully reach its potential, you need someone who knows what they are doing and is prepared to invest.

Do you have any advice for those wishing to follow your career path?

It’s an unknown world to most! People often think that video is just moved magically across networks and ‘it is what it is’. As a result, it’s one of those jobs that you don’t really know exist. It is also a very small, niche sector of Digital Forensics. All the kudos and media navigate to anything with Cyber and Security in the title… Forensic Video Analysis is tucked away! You do see the jobs advertised every now and again, within Police Forces and also within the Private Sector Forensic services.

Enthusiasm, a willingness to learn… and then learn some more, along with a ‘never give up’ attitude. Investigating proprietary video can be extremely frustrating. That was one of the reasons why I started my blog over 6 years ago. I needed a way to document some rather lengthy processes and in doing so help others. I strategically left the comments enabled so people could add in their solutions to problems. I quite often have to go back and carry on research with a file first encountered three years ago!

Always ask questions of the video. Look beyond the image to understand how that video was constructed. Only then will you be able to interpret that video correctly. Will the compression affect enhancement? If you don’t understand the compression – are you enhancing artefacts that were never present in the scene? A lot of young people now come to it through traditional computer forensics. Some people through digital imaging and photography. Whatever route is taken, never be afraid to ask for help. The worldwide community is pretty small but with some very great people. It is rare to come across something that someone else has not encountered before.

The career will take you from just attempting to get a video to play (easier said than done sometimes), through a multitude of tasks and requirements. You could end up doing 3D Laser scanning of scenes and overlaying the CCTV Footage with aerial footage from a drone. You could end up data carving huge amounts of video and reverse engineering the embedded timecodes. You could end up conducting advanced Digital Imaging techniques to enhance details in a video not originally view-able.

If you enjoy working with digital media and want to be challenged every day, then Forensic Video Analysis may be something to look at… (excuse the pun!).

Is there anything else you’d like to add?

FVA is now part of me. It’s who I am. It’s not just a job or a career…. it’s my passion. Every case is different and requires thinking. This is not in the ‘Push Button Forensics’ domain.  It’s been a pleasure being interviewed and I hope that it has opened up a few people’s eyes to the world of FVA.

Website: www.spreadys.com

Twitter: https://twitter.com/spreadys

 

If you’re a forensic scientist (academic or industry) or a crime scene investigator and would like to be part of this series of interviews, get in touch by emailing locardslabblog[at]gmail.com.

This is Part 5 of our series of interviews with forensic professionals.

Interview Series Part 1 – Interview with Forensic Identification Scientist Alexandre Beaudoin

Interview Series Part 2 – Interview with Forensic Expert Robert Green OBE

Interview Series Part 3 – Interview with Forensic Expert & Consultant Gareth Bryon

Interview Series Part 4 – Interview with Forensic Identification Specialist Donna Brandelli

Determining the Age of a Fingerprint: Is It Possible?
by

Determining the Age of a Fingerprint: Is It Possible?

During the scrutinising examination of a crime scene, it is entirely plausible for dozens or more fingerprints and fragments of fingerprints to be recovered. Not at all surprising considering how often we touch endless surfaces in our day-to-day lives. Consider how many people might grasp the handle of a shop door in an average day. If that shop were to become a crime scene, how could one possibly distinguish between prints that had originated on the day of the crime and those deposited weeks or months ago? Is it possible to estimate the age of a fingerprint?

Firstly, a quick review of just what a fingerprint is. We all know fingerprints are a series of unique arches, loops and whorls left behind when we touch a surface. But people may be slightly less sure of what these deposits are actually composed of.

Although the composition of a fingerprint is somewhat complex, 95-99% of the deposit is simply water, which will typically readily evaporate. The remaining 1-5% is an intricate mixture of organic and inorganic compounds ranging from amino acids and fatty acids to trace metals. Chloride, potassium, sodium, calcium, hydrocarbons, sterols – the list goes on. A vast concoction of chemicals emitted through our skin and deposited whenever our fingertips touch a surface.

But what we didn’t know until recently, is that these deposited chemicals gradually move with time, and that this movement can be used to determine how long a fingerprint has been on a particular surface. Researchers from the National Institute of Standards and Technology recently stumbled upon this very fact (Muramoto & Sisco, 2015).

Fingerprint when freshly deposited (left) and after 72 hours (right). Credit: Muramoto/NIST

Fingerprint when freshly deposited (left) and after 72 hours (right).
Credit: Muramoto/NIST

Like many discoveries, the research itself was something of an accident. The NIST researchers were initially using analytical techniques to detect trace amounts of illicit substances present in fingerprints. In the process of this investigation, they noticed the movement of chemicals within the fingerprint over time. Fingerprints are made up of ridges and valleys forming unique patterns, the characteristic features that allow investigators to distinguish between prints deposited by different people. These features are imprinted in various chemicals when an individual leaves a print behind. However over time the chemicals composing the fingerprint begin to migrate, moving from the defined ridges of the fingerprint into the valleys, essentially blurring the details of the print.

The researchers focused on particular biomolecules, namely fatty acids such as palmitic acid. By depositing fingerprints on sterile silicon wafers and storing the samples under strictly controlled conditions for a period of time, scientists were able to clearly observe the migration of molecules using a technique known as time-of-flight secondary ion mass spectrometry (TOF-SIMS). After a period of only 1 hour after fingerprint deposition, the friction ridge patterns of the fingerprint were clearly visible with the fatty acid molecules under observation residing along the ridges of the print. However within 24 hours the molecules had diffused into the valleys, blurring the patterns of the fingerprint.

The research thus far has simply been conducted to prove the concept of fingerprint component migration for ageing fingerprints, but further work could investigate time effects on a greater scale and even differences in the migration of different molecules. Although the method is advantageous in that it does not depend on chemical changes in fingerprints, which can be very dependent on individual circumstances, further work would be warranted to establish how environmental differences could affect the rate at which this molecular movement occurs, including temperature and humidity effects as well as those caused by the deposition surface.

As intriguing as this research is, this is not the first time scientists have tried to devise a method of ageing fingerprints using chemistry. In fact, researchers have been attempting to accurately age fingerprints for decades. Research has focussed on the changes in the chemical composition of fingerprints over time. For instance, concentrating on a particular compound, such as cholesterol, and establishing the rate at which the concentration of that compound changes over time (Weyermann et al, 2011). Unfortunately many such studies have found changes in the chemical composition of fingerprints to be too variable and unpredictable, particularly when taking into account the differences between donors and the effects of different conditions. Other studies have attempted to determine the age of a fingerprint based on how well powder adheres to the ridges (Wertheim, 2003), by changes in fluorescence wavelength over time (Duff & Menzel, 1978), and changes in electrostatic charge with time (Watson et al, 2010). A vast array of scenarios have been studied intently.

A method of establishing the age of a deposited fingerprint has been at the forefront of latent print research for a long time, and is likely to continue. Although fascinating advances have been made, scientists are a long way from catching criminals by the age of a fingerprint.

References

Cadd, S. Islam, M. Manson, P. Bleay, S. Fingerprint composition and aging: A literature review. Sci Justice. 2015(55) pp. 219-238.

Duff, J. Menzel, E. Laser assisted thin-layer chromatography and luminescence of fingerprints: an approach to fingerprint age determination. J. Forensic Sci. 1978(23), pp 129-134.

Muramoto, S. Sisco, E. Strategies for Potential Age Dating of Fingerprints through the Diffusion of Sebum Molecules on a Nonporous Surface Analysed Using Time-of-Flight Secondary Ion Mass Spectrometry. Anal Chem. 2015(87) pp. 8035-8038.

National Institute of Standards & Technology. Who, What, When: Determining the Age of Fingerprints. [online] Available: http://www.nist.gov/mml/mmsd/20150824fingerprints.cfm

Watson, P. Prance, R. J. Prance, H. Bearsmore-Rust, S. T. Imaging the time sequence of latent electrostatic fingerprints. Proc. SPIE ‘Optics and photonics for counterterrorism and crime fighting VI, Toulouse, 7838, 783803-1-6, ISBN 9780819483560 (2010).

Wertheim, K. Fingerprint age determination: is there any hope? J. Forensic Identif. 2003(53), pp 42-49.

Weyermann, C. Roux, C. Champod, C. Initial Results on the Composition of Fingerprints and its Evolution as a Function of Time by GC/MS Analysis. J. Forensic Sci. 2011(56), pp 102-108.