View
1
Download
0
Category
Preview:
Citation preview
Jamie Walsh has only been a Digital Evidence Exam-
iner with the Lake County Crime Laboratory since No-
vember 2011, but he is an old hand when it comes to ex-
amining computers and mobile devices.
As cell phones and computers are used more often in
cyber crime, Walsh’s experience is invaluable in helping
catch criminals.
Walsh worked for the Wickliffe Police Department for
32 years before joining the Lake County Crime Laborato-
ry full-time.
From 1998 through 2011, he served as a detective for
the department and his interest in electronics became
part of his casework.
“I have always had an interest in computers. When I
was assigned to the detective bureau at the Wickliffe
PD, I was able to use those skills and started doing my
own computer and mobile device forensics,” Walsh said.
Walsh began working in digital forensics before there
were degrees available in that field. Instead, he studied
in specialized classes and (CONTINUED ON PAGE 3)
Jamie Walsh: On the Cutting Edge of Cyber Crime
No witness saw Michael Aquila peer through JoAn-
ne’s bedroom window at 4 a.m. on Aug. 17, 1995. No one
observed Aquila sneak into JoAnne’s Willoughby apart-
ment. No one heard Aquila attempt to rape the sleeping
JoAnne and then cut her throat. The sound of the strug-
gle did not wake her neighbors or even her family, who
were sleeping in another bedroom. Aquila fled, leaving
JoAnne mortally wounded. But JoAnne managed to call
911.
When a paramedic asked 27-year-old JoAnne who did
this to her, she could only groan, “I don’t know” and “I
want to live.” Then JoAnne died.
Upon arrival at the crime scene, the police and the
Crime Laboratory scientists (CONTINUED ON PAGE 5)
Caught by Science
WIN
TE
R 2
01
4
PAGE 1
THE
CRIMESCENE NEWSLETTER OF THE LAKE COUNTY CRIME LABORATORY
Jamie Walsh
PAGE 2
Frequently Asked Questions
Q: Two kids smoked marihuana from the bong tested
by the LCCL. It was later discovered that the kids be-
came extremely sick after using the bong, and they be-
lieved the marihuana was mixed with something else.
The report shows that the bong was tested and the pres-
ence of marihuana was located, but the police now sus-
pect the presence of another narcotic.
Do you think that the bong should be retested be-
cause of the new suspicions of another narcotic?
A: No. When evidence is sampled and analyzed, any
controlled substances that are present in that sample
will be separated from one another and identified. With
a few exceptions (Khat, LSD, mushrooms, steroids),
multiple tests do not need to be run to identify each sep-
arate drug that may be present in a sample.
When controlled substance evidence is submitted to
the laboratory, a representative sample of that evidence
is removed, whether it is a small amount from a larger
population or a swab of a residue. The sample is then
analyzed utilizing Gas Chromatography/Mass Spec-
trometry (GC/MS). This method allows for different
drugs and other components that may be present in a
sample to be separated based on their individual molec-
ular weights (size).
The representative sample is dissolved in an organic
solvent then vaporized at high temperature into a gas.
The vaporized sample then passes through the Gas
Chromatography (GC) instrument, and any components
in that sample will separate from one another over
time. Larger molecular weight components pass
through at a slower rate than smaller components.
The identification of individual sample components
is confirmed using the Mass Spectrometery (MS) instru-
ment. The separated components pass through the GC
into the MS where the component molecules are bom-
barded with electrons to produce a unique molecular
fragmentation pattern, much like a chemical finger-
print. This chemical fingerprint is used to identify what
the component is, whether it be a drug or some other
substance. Therefore, when evidence is tested, the sci-
entists are able to identify all controlled substances pre-
sent in the sample by performing one test.
For more information, please contact Kimberly Gil-
son, Forensic Chemist, at (440) 350-2793 or Kimber-
ly.Gilson@lakecountyohio.gov. You may also contact
Douglas Rohde, Supervisor of Chemistry and Toxicolo-
g y , a t ( 4 4 0 ) 3 5 0 - 2 7 9 3 o r D o u g -
las.Rohde@lakecountyohio.gov.
ANSWERED BY SCIENTIST KIMBERLY GILSON EXPERT IN FORENSIC CHEMISTRY
This Column
Answers
Questions
Commonly
Asked of our
Scientists
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
The Gas Chromatograph/Mass Spectrometer sepa-
rates and identifies the drugs present within the evi-
dence.
PAGE 3
has received more than 500 hours of
training in the field of digital evidence
examination.
“I obtained my training through
spending hundreds of hours in special-
ized computer and mobile device train-
ing classes,” Walsh said. Walsh contin-
ues to take classes to stay current. His
area of expertise is constantly evolving:
as technology advances, so do the chal-
lenges Walsh faces. He is constantly
learning more, updating his information,
reviewing his skills and adding to his
experience.
Walsh’s job does not just keep him up
-to-date with current technological de-
velopments; he also has to be familiar
with antiquated technology that is no
longer common but might become part of
an investigation.
While keeping up with the technolog-
ical world can be overwhelming, Walsh
takes a lot of pride and joy in being able
to help law enforcement.
“I am always happy to know I helped
one of our agencies obtain a conviction,
especially when it is a crime involving
child exploitation,” Walsh said.
Walsh has been examining digital
evidence since before cell phones were
smart phones and before laptops were
commonplace.
Digital evidence examination is a lot
more complicated than searching a sus-
pect’s internet history. Walsh can even
find damaged, encrypted, and deleted
files in a computer.
Likewise, Walsh can find text mes-
sages and call information in a cell
phone’s memory. That information can,
in turn, be used to establish a connec-
tion between people who are involved in
a crime.
Practically anything with digital in-
formation may potentially yield evi-
dence, even video game systems or GPS
units.
For example, a car’s GPS unit might
give Walsh information about the car’s
movement, location, and speed. This evi-
dence can aid an investigation by either
coinciding with or contradicting a per-
son’s story.
In August 2010, Walsh began work-
ing with the Lake County Crime Labora-
tory as a volunteer. He performed volun-
tary technical reviews for the Digital
Evidence section when it first began.
When Walsh’s predecessor left for the
corporate world, Lake County Prosecu-
tor Charles Coulson offered Walsh a job,
and he accepted.
Walsh was also an instructor at the
Cuyahoga Community College Police
Academy (CONTINUED ON PAGE 4)
Jamie Walsh: On the Cutting Edge of
Cyber Crime
Continued from Page 1
HIGHLIGHTS
Certified Forensic Com-
puter Examiner (CFCE),
IACIS (International Asso-
ciation of Computer Inves-
tigative Specialists)
AccessData Certified Ex-
aminer (ACE), AccessData
Past President and found-
ing member of the High
Technology Crime Investi-
gation Association, Ohio
Chapter
2009 Hall of Fame Award
for the High Technology
Crime Investigation Asso-
ciation, Ohio Chapter
Contact Info:
(440) 350-2793
jwalsh@lakecountyohio.gov
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
Jamie Walsh: On the Cutting Edge of Cyber Crime Continued from Page 3
PAGE 4
from 1992 to 2007. His experience as a police officer also
allows Walsh to assist in the Firearms section and serve
on its Crime Scene Response Team.
Walsh is a founding member, former president, and
2009 Hall of Fame inductee of the High Technology
Crime Investigation Association Ohio Chapter. He is
also a member of such professional organizations as
High Technology Crime Consortium, FBI Infragard
Northern Ohio Chapter, Ohio Identification Officers As-
sociation and the International Association of Computer
Investigative Specialists.
In his free time, Walsh still enjoys working on com-
puters and all the challenges that come along with it. “I
also enjoy home improvement projects and traveling,”
Walsh added. Most importantly, Walsh is a family man.
He and his wife have two adult sons.
The more prevalent technology is, the more valuable
Walsh’s knowledge and experience become. “Not every-
one has a computer, but everyone has at least one cell
phone, if not more,” Walsh said. “Cyber instruments are
involved in every aspect of life now. They always leave a
digital trail. I can examine that digital trail, obtaining
the data that may be needed to break open a case.”
In the hands of Jamie Walsh, a cell phone memory chip
less than one square inch in size has the potential to
produce enormous quantities of evidence.
The 3D Laser Crime Scene Scanner has Arrived
In early December, the crime scene responders
from the Lake County Crime Laboratory and the
investigators from the Lake County Prosecutor’s
Office were trained in the use of the Crime Labora-
tory’s newly acquired 360° 3D laser crime scene
scanner.
The crime scene responders are now available to
deploy this device on any crime scene where it may
be useful.
This camera will create, a perfectly to scale, 3D,
virtual-reality replication of a crime scene. Both
laser light and natural light are used by the cam-
era. In most situations, the camera can produce
high-resolution color images. In situations such as
arson scenes, where there is not much natural light
and the scene material is blackened, the laser can
render very detailed, high-resolution, greyscale
images.
For questions please contact Chief Investigator
Tom Walsh at (440) 350-2683 or Laboratory Direc-
tor Linda Erdei at (440) 350-2793.
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
Caught by Science Continued from Page 1
PAGE 5
had no suspects or murder weapon. In fact, the knife
that was used to repeatedly cut JoAnne’s neck was nev-
er recovered. But the killer did leave a clue behind: his
fingerprints. He also carried away two important pieces
of evidence: a carpet fiber from the apartment and the
victim’s blood on his shoes.
These clues—almost invisible to the naked eye and
practically indiscernible to the layperson—were all that
law enforcement needed to identify a suspect and get a
conviction.
In the hands of qualified analysts and examiners, a
carpet strand, a blood speck, and a fingerprint can be
every bit as conclusive (if not more) as an eyewitness or
even a murder weapon.
THE PRINTS About a year before JoAnne’s murder, Aquila had
been arrested for having a loaded gun in his car. Aquila
ended up pleading no contest to a charge of improperly
handling a firearm in Willoughby Municipal Court.
Aquila served no jail time for the firearm charge, but
authorities did put his fingerprints into the Lake Coun-
ty Crime Laboratory’s newly computerized Automated
Fingerprint Identification System (AFIS). Those finger-
prints were the first clue that led to his murder convic-
tion. Aquila’s prints joined the 1994 database that al-
ready included 13,000 fingerprints from suspects in
Lake County. At the time, it was one of only four data-
bases of its kind in the state.
When the LCCL Crime Scene Examiners searched
JoAnne’s apartment for clues, they found latent prints
on the outside of her bedroom window. The Fingerprint
Examiner took the latent prints back to the laboratory
and entered them into AFIS. After ten minutes of com-
puting, the AFIS computer printed out a list of ten
names that were the closest matches.
AFIS is a valuable piece of equipment,
but it does not catch killers by itself.
Comparing fingerprints is not a matter of
simply putting a print into a database
and the computer spitting out a suspect’s
name. AFIS could help the fingerprint
examiners navigate its haystack, but it
still takes an expert to find the needle.
Fingerprint expert Mitch Wisniewski
took the list of ten suspects offered by
AFIS and began manual comparisons of
each suggested print to see if a valid
match existed. An identification was
made. The latent prints matched exactly
to Aquila. Investigators now knew that
Aquila had touched the outside of the
bedroom window at some point in time.
(CONTINUED ON PAGE 6)
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
The window of JoAnne’s apartment where Aqui-
la’s fingerprints were found.
The current AFIS terminal that gives the Lake County
Crime Laboratory full access to a nationwide network
of fingerprint databases.
PAGE 6
This evidence did not place him in-
side the apartment, but it was
enough to start questioning Aquila.
At about 7:30 p.m., approximately
13 hours after the murder, police of-
ficers saw Aquila drive his car to his
mother’s home in Wickliffe. When the
police approached, Aquila fled, lead-
ing to a high-speed chase through
several communities. He eluded the
police but soon turned himself in af-
ter family members urged him to sur-
render. When arrested, Aquila said
he only fled because he was driving
with a suspended license. He denied
any knowledge of the murder.
THE CARPET The fingerprints showed that Aq-
uila had once been outside JoAnne’s
apartment window. While pertinent,
that piece of information would not
be enough to get a conviction.
Knowing they needed more evidence, au-
thorities confiscated everything Aquila had
on him when he was arrested, including his
pager, gold chain, clothes, and shoes. Those
shoes—a Nike Air Diamond Fury “Ken
Griffey, Jr.” signature model—contained the
next pieces of evidence.
Authorities would later learn that Aquila
threw away his clothes and washed the blood
off himself in a nearby pond after he stabbed
JoAnne. However, Aquila was a huge Ken
Griffey, Jr., fan, and he could not bring him-
self to part with his Griffey-endorsed sneak-
ers.
It was on these sneakers that Trace Evi-
dence Examiner David Green found the evi-
dence that proved Aquila had been inside
JoAnne’s apartment.
While picking particles off the shoes with
tape and tweezers, Green spotted a single
strand of carpet in the sole of one of the
shoes. The strand was only the size of a pin-
prick. But when it was placed on a slide next
to a piece of carpet cut from JoAnne’s bed-
room and (CONTINUED ON PAGE 7)
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
The fiber found on Aquila’s shoe, magnified 500 times under a com-
parison microscope, was a match to the fibers of the carpet in
JoAnne’s apartment.
The tread, shown above, from Aquila’s shoe yielded a fiber (about the
size of a period on this page) from JoAnne’s bedroom carpet. Arrows
point to circles marking minute blood spots found
on Aquila’s shoes.
Caught by Science Continued from Page 5
PAGE 7
magnified 500 times under a comparison microscope, it
was found to be a perfect match for the carpet in JoAn-
ne’s bedroom.
But, carpets are not like fingerprints. Different
homes, especially in an apartment complex, can have
the same type of carpet. So, Green and Willoughby Po-
lice researched the history of JoAnne’s carpet until they
were certain that it was unlike any other of the hun-
dreds of carpets in the apartment complex. The authori-
ties now had Aquila in JoAnne’s bedroom, but they still
did not necessarily have him present at the time of the
murder.
THE BLOOD Authorities now knew that at some point in time Aq-
uila had been both outside and inside JoAnne’s apart-
ment. But that still was not conclusive evidence. To be
certain of Aquila’s role in JoAnne’s murder, the Crime
Laboratory would have to prove that Aquila was there
when she was attacked. Once again, the shoes provided
the clues.
Serologist Linda Erdei (now the Director of the
Crime Laboratory), found several spots of blood on Aqui-
la’s sneakers. The spots were minute: so small that a
layperson would not have recognized their significance.
Portions of the DNA from this minute sample were
faithfully replicated millions of times to determine a
match to JoAnne’s blood.
The DNA test provided the strongest evidence yet of
Aquila’s guilt. It proved with certainty that the blood on
Aquila’s shoes came from JoAnne. Authorities now
knew that, not only had Aquila been in her apartment,
he was there while she was bleeding.
While the carpet strand and blood spot provided vital
evidence, it all began with the fingerprints. Had the fin-
gerprint examiners not identified Aquila so quickly, the
evidence on his shoes might have brushed off and been
lost forever.
The Crime Laboratory had worked quickly. JoAnne
was murdered on August 17. That same day, the finger-
print examiners matched Aquila’s prints to those they
found at JoAnne’s apartment.
By August 21, Green had found JoAnne’s carpet
strand in the sole of Aquila’s sneaker. On August 22,
Erdei matched blood on Aquila’s shoes with the victim.
From fingerprints to a DNA identification in six
days, the authorities had their suspect.
THE CONVICTION Confronted with the scientific evidence, Aquila final-
ly confessed to the murder. Aquila told police that he
had been wandering the apartment complex parking lot,
looking for cars to break into. Then he saw JoAnne
sleeping in her bedroom and decided to rape her.
Aquila said he failed to force open the bedroom win-
dow, so he pried open a patio door with his knife. Then
he walked into JoAnne’s room. Aquila claimed that
when he touched her, JoAnne awoke and lunged at him.
He said the two struggled, and he stabbed her several
times before he ran away.
Aquila pleaded guilty to aggravated murder, aggra-
vated robbery, aggravated burglary, kidnapping, and
fleeing in the Lake County Court of Common Pleas on
Dec. 19, 1995. He was 20 years old at the time. He is
now 38, imprisoned in the Trumbull Correctional Insti-
tution, and serving a sentence of 51 and one-half years
to life imprisonment.
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
Aquila, standing in front of Prosecuting Attorney Charles
Coulson, appeared in court for his sentencing hearing,
where he received a prison sentence of 51 and one-half
years to life.
Photo courtesy of the Cleveland Plain Dealer.
Caught by Science Continued from Page 6
PAGE 8
LAKE COUNTY CRIME LABORATORY 235 Fairgrounds Road • Painesville, OH 44077
(440) 350-2793 • fax (440) 350-2731
An ASCLD/LAB-International Accredited Laboratory since 2009
An ASCLD/LAB-Legacy Accredited Laboratory 2000-2009
The CRIMESCENE
A quarterly publication of the Office of the Lake County Prosecuting
Attorney, www.LakeCountyProsecutor.org. For questions, comments,
or to receive an electronic copy of this newsletter, please contact us
at:
(440) 350-2793
or
CrimeLabNews@lakecountyohio.gov
© 2014
TH
E C
RIM
ES
CE
NE
WIN
TE
R 2
01
4
With the acquisition of new equipment and training,
Digital Evidence Examiner Jamie Walsh can now em-
ploy the “chip-off” technique to recover data from mo-
bile devices that are password-protected or physically
damaged.
The chip-off technique involves the careful removal of
a memory chip from a mobile device. Specialized equip-
ment is then used to obtain a memory dump of the chip.
The memory dump is then examined using convention-
al forensic software techniques.
The chip-off technique has the potential to allow ac-
cess to an area of mobile device forensics that until just
recently was unobtainable with available forensic tools.
Another New Tool for Cell Phone Evidence
Memory reading hardware and adapter allows a
digital evidence expert access to a memory chip
removed from a mobile device.
Recommended