8
Jamie Walsh has only been a Digital Evidence Exam- iner with the Lake County Crime Laboratory since No- vember 2011, but he is an old hand when it comes to ex- amining computers and mobile devices. As cell phones and computers are used more often in cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32 years before joining the Lake County Crime Laborato- ry full-time. From 1998 through 2011, he served as a detective for the department and his interest in electronics became part of his casework. “I have always had an interest in computers. When I was assigned to the detective bureau at the Wickliffe PD, I was able to use those skills and started doing my own computer and mobile device forensics,” Walsh said. Walsh began working in digital forensics before there were degrees available in that field. Instead, he studied in specialized classes and (CONTINUED ON PAGE 3) Jamie Walsh: On the Cutting Edge of Cyber Crime No witness saw Michael Aquila peer through JoAn- ne’s bedroom window at 4 a.m. on Aug. 17, 1995. No one observed Aquila sneak into JoAnne’s Willoughby apart- ment. No one heard Aquila attempt to rape the sleeping JoAnne and then cut her throat. The sound of the strug- gle did not wake her neighbors or even her family, who were sleeping in another bedroom. Aquila fled, leaving JoAnne mortally wounded. But JoAnne managed to call 911. When a paramedic asked 27-year-old JoAnne who did this to her, she could only groan, “I don’t know” and “I want to live.” Then JoAnne died. Upon arrival at the crime scene, the police and the Crime Laboratory scientists (CONTINUED ON PAGE 5) Caught by Science WINTER 2014 PAGE 1 THE CRIMESCENE NEWSLETTER OF THE LAKE COUNTY CRIME LABORATORY Jamie Walsh

THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

  • Upload
    others

  • View
    1

  • Download
    0

Embed Size (px)

Citation preview

Page 1: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

Jamie Walsh has only been a Digital Evidence Exam-

iner with the Lake County Crime Laboratory since No-

vember 2011, but he is an old hand when it comes to ex-

amining computers and mobile devices.

As cell phones and computers are used more often in

cyber crime, Walsh’s experience is invaluable in helping

catch criminals.

Walsh worked for the Wickliffe Police Department for

32 years before joining the Lake County Crime Laborato-

ry full-time.

From 1998 through 2011, he served as a detective for

the department and his interest in electronics became

part of his casework.

“I have always had an interest in computers. When I

was assigned to the detective bureau at the Wickliffe

PD, I was able to use those skills and started doing my

own computer and mobile device forensics,” Walsh said.

Walsh began working in digital forensics before there

were degrees available in that field. Instead, he studied

in specialized classes and (CONTINUED ON PAGE 3)

Jamie Walsh: On the Cutting Edge of Cyber Crime

No witness saw Michael Aquila peer through JoAn-

ne’s bedroom window at 4 a.m. on Aug. 17, 1995. No one

observed Aquila sneak into JoAnne’s Willoughby apart-

ment. No one heard Aquila attempt to rape the sleeping

JoAnne and then cut her throat. The sound of the strug-

gle did not wake her neighbors or even her family, who

were sleeping in another bedroom. Aquila fled, leaving

JoAnne mortally wounded. But JoAnne managed to call

911.

When a paramedic asked 27-year-old JoAnne who did

this to her, she could only groan, “I don’t know” and “I

want to live.” Then JoAnne died.

Upon arrival at the crime scene, the police and the

Crime Laboratory scientists (CONTINUED ON PAGE 5)

Caught by Science

WIN

TE

R 2

01

4

PAGE 1

THE

CRIMESCENE NEWSLETTER OF THE LAKE COUNTY CRIME LABORATORY

Jamie Walsh

Page 2: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

PAGE 2

Frequently Asked Questions

Q: Two kids smoked marihuana from the bong tested

by the LCCL. It was later discovered that the kids be-

came extremely sick after using the bong, and they be-

lieved the marihuana was mixed with something else.

The report shows that the bong was tested and the pres-

ence of marihuana was located, but the police now sus-

pect the presence of another narcotic.

Do you think that the bong should be retested be-

cause of the new suspicions of another narcotic?

A: No. When evidence is sampled and analyzed, any

controlled substances that are present in that sample

will be separated from one another and identified. With

a few exceptions (Khat, LSD, mushrooms, steroids),

multiple tests do not need to be run to identify each sep-

arate drug that may be present in a sample.

When controlled substance evidence is submitted to

the laboratory, a representative sample of that evidence

is removed, whether it is a small amount from a larger

population or a swab of a residue. The sample is then

analyzed utilizing Gas Chromatography/Mass Spec-

trometry (GC/MS). This method allows for different

drugs and other components that may be present in a

sample to be separated based on their individual molec-

ular weights (size).

The representative sample is dissolved in an organic

solvent then vaporized at high temperature into a gas.

The vaporized sample then passes through the Gas

Chromatography (GC) instrument, and any components

in that sample will separate from one another over

time. Larger molecular weight components pass

through at a slower rate than smaller components.

The identification of individual sample components

is confirmed using the Mass Spectrometery (MS) instru-

ment. The separated components pass through the GC

into the MS where the component molecules are bom-

barded with electrons to produce a unique molecular

fragmentation pattern, much like a chemical finger-

print. This chemical fingerprint is used to identify what

the component is, whether it be a drug or some other

substance. Therefore, when evidence is tested, the sci-

entists are able to identify all controlled substances pre-

sent in the sample by performing one test.

For more information, please contact Kimberly Gil-

son, Forensic Chemist, at (440) 350-2793 or Kimber-

[email protected]. You may also contact

Douglas Rohde, Supervisor of Chemistry and Toxicolo-

g y , a t ( 4 4 0 ) 3 5 0 - 2 7 9 3 o r D o u g -

[email protected].

ANSWERED BY SCIENTIST KIMBERLY GILSON EXPERT IN FORENSIC CHEMISTRY

This Column

Answers

Questions

Commonly

Asked of our

Scientists

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

The Gas Chromatograph/Mass Spectrometer sepa-

rates and identifies the drugs present within the evi-

dence.

Page 3: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

PAGE 3

has received more than 500 hours of

training in the field of digital evidence

examination.

“I obtained my training through

spending hundreds of hours in special-

ized computer and mobile device train-

ing classes,” Walsh said. Walsh contin-

ues to take classes to stay current. His

area of expertise is constantly evolving:

as technology advances, so do the chal-

lenges Walsh faces. He is constantly

learning more, updating his information,

reviewing his skills and adding to his

experience.

Walsh’s job does not just keep him up

-to-date with current technological de-

velopments; he also has to be familiar

with antiquated technology that is no

longer common but might become part of

an investigation.

While keeping up with the technolog-

ical world can be overwhelming, Walsh

takes a lot of pride and joy in being able

to help law enforcement.

“I am always happy to know I helped

one of our agencies obtain a conviction,

especially when it is a crime involving

child exploitation,” Walsh said.

Walsh has been examining digital

evidence since before cell phones were

smart phones and before laptops were

commonplace.

Digital evidence examination is a lot

more complicated than searching a sus-

pect’s internet history. Walsh can even

find damaged, encrypted, and deleted

files in a computer.

Likewise, Walsh can find text mes-

sages and call information in a cell

phone’s memory. That information can,

in turn, be used to establish a connec-

tion between people who are involved in

a crime.

Practically anything with digital in-

formation may potentially yield evi-

dence, even video game systems or GPS

units.

For example, a car’s GPS unit might

give Walsh information about the car’s

movement, location, and speed. This evi-

dence can aid an investigation by either

coinciding with or contradicting a per-

son’s story.

In August 2010, Walsh began work-

ing with the Lake County Crime Labora-

tory as a volunteer. He performed volun-

tary technical reviews for the Digital

Evidence section when it first began.

When Walsh’s predecessor left for the

corporate world, Lake County Prosecu-

tor Charles Coulson offered Walsh a job,

and he accepted.

Walsh was also an instructor at the

Cuyahoga Community College Police

Academy (CONTINUED ON PAGE 4)

Jamie Walsh: On the Cutting Edge of

Cyber Crime

Continued from Page 1

HIGHLIGHTS

Certified Forensic Com-

puter Examiner (CFCE),

IACIS (International Asso-

ciation of Computer Inves-

tigative Specialists)

AccessData Certified Ex-

aminer (ACE), AccessData

Past President and found-

ing member of the High

Technology Crime Investi-

gation Association, Ohio

Chapter

2009 Hall of Fame Award

for the High Technology

Crime Investigation Asso-

ciation, Ohio Chapter

Contact Info:

(440) 350-2793

[email protected]

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

Page 4: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

Jamie Walsh: On the Cutting Edge of Cyber Crime Continued from Page 3

PAGE 4

from 1992 to 2007. His experience as a police officer also

allows Walsh to assist in the Firearms section and serve

on its Crime Scene Response Team.

Walsh is a founding member, former president, and

2009 Hall of Fame inductee of the High Technology

Crime Investigation Association Ohio Chapter. He is

also a member of such professional organizations as

High Technology Crime Consortium, FBI Infragard

Northern Ohio Chapter, Ohio Identification Officers As-

sociation and the International Association of Computer

Investigative Specialists.

In his free time, Walsh still enjoys working on com-

puters and all the challenges that come along with it. “I

also enjoy home improvement projects and traveling,”

Walsh added. Most importantly, Walsh is a family man.

He and his wife have two adult sons.

The more prevalent technology is, the more valuable

Walsh’s knowledge and experience become. “Not every-

one has a computer, but everyone has at least one cell

phone, if not more,” Walsh said. “Cyber instruments are

involved in every aspect of life now. They always leave a

digital trail. I can examine that digital trail, obtaining

the data that may be needed to break open a case.”

In the hands of Jamie Walsh, a cell phone memory chip

less than one square inch in size has the potential to

produce enormous quantities of evidence.

The 3D Laser Crime Scene Scanner has Arrived

In early December, the crime scene responders

from the Lake County Crime Laboratory and the

investigators from the Lake County Prosecutor’s

Office were trained in the use of the Crime Labora-

tory’s newly acquired 360° 3D laser crime scene

scanner.

The crime scene responders are now available to

deploy this device on any crime scene where it may

be useful.

This camera will create, a perfectly to scale, 3D,

virtual-reality replication of a crime scene. Both

laser light and natural light are used by the cam-

era. In most situations, the camera can produce

high-resolution color images. In situations such as

arson scenes, where there is not much natural light

and the scene material is blackened, the laser can

render very detailed, high-resolution, greyscale

images.

For questions please contact Chief Investigator

Tom Walsh at (440) 350-2683 or Laboratory Direc-

tor Linda Erdei at (440) 350-2793.

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

Page 5: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

Caught by Science Continued from Page 1

PAGE 5

had no suspects or murder weapon. In fact, the knife

that was used to repeatedly cut JoAnne’s neck was nev-

er recovered. But the killer did leave a clue behind: his

fingerprints. He also carried away two important pieces

of evidence: a carpet fiber from the apartment and the

victim’s blood on his shoes.

These clues—almost invisible to the naked eye and

practically indiscernible to the layperson—were all that

law enforcement needed to identify a suspect and get a

conviction.

In the hands of qualified analysts and examiners, a

carpet strand, a blood speck, and a fingerprint can be

every bit as conclusive (if not more) as an eyewitness or

even a murder weapon.

THE PRINTS About a year before JoAnne’s murder, Aquila had

been arrested for having a loaded gun in his car. Aquila

ended up pleading no contest to a charge of improperly

handling a firearm in Willoughby Municipal Court.

Aquila served no jail time for the firearm charge, but

authorities did put his fingerprints into the Lake Coun-

ty Crime Laboratory’s newly computerized Automated

Fingerprint Identification System (AFIS). Those finger-

prints were the first clue that led to his murder convic-

tion. Aquila’s prints joined the 1994 database that al-

ready included 13,000 fingerprints from suspects in

Lake County. At the time, it was one of only four data-

bases of its kind in the state.

When the LCCL Crime Scene Examiners searched

JoAnne’s apartment for clues, they found latent prints

on the outside of her bedroom window. The Fingerprint

Examiner took the latent prints back to the laboratory

and entered them into AFIS. After ten minutes of com-

puting, the AFIS computer printed out a list of ten

names that were the closest matches.

AFIS is a valuable piece of equipment,

but it does not catch killers by itself.

Comparing fingerprints is not a matter of

simply putting a print into a database

and the computer spitting out a suspect’s

name. AFIS could help the fingerprint

examiners navigate its haystack, but it

still takes an expert to find the needle.

Fingerprint expert Mitch Wisniewski

took the list of ten suspects offered by

AFIS and began manual comparisons of

each suggested print to see if a valid

match existed. An identification was

made. The latent prints matched exactly

to Aquila. Investigators now knew that

Aquila had touched the outside of the

bedroom window at some point in time.

(CONTINUED ON PAGE 6)

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

The window of JoAnne’s apartment where Aqui-

la’s fingerprints were found.

The current AFIS terminal that gives the Lake County

Crime Laboratory full access to a nationwide network

of fingerprint databases.

Page 6: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

PAGE 6

This evidence did not place him in-

side the apartment, but it was

enough to start questioning Aquila.

At about 7:30 p.m., approximately

13 hours after the murder, police of-

ficers saw Aquila drive his car to his

mother’s home in Wickliffe. When the

police approached, Aquila fled, lead-

ing to a high-speed chase through

several communities. He eluded the

police but soon turned himself in af-

ter family members urged him to sur-

render. When arrested, Aquila said

he only fled because he was driving

with a suspended license. He denied

any knowledge of the murder.

THE CARPET The fingerprints showed that Aq-

uila had once been outside JoAnne’s

apartment window. While pertinent,

that piece of information would not

be enough to get a conviction.

Knowing they needed more evidence, au-

thorities confiscated everything Aquila had

on him when he was arrested, including his

pager, gold chain, clothes, and shoes. Those

shoes—a Nike Air Diamond Fury “Ken

Griffey, Jr.” signature model—contained the

next pieces of evidence.

Authorities would later learn that Aquila

threw away his clothes and washed the blood

off himself in a nearby pond after he stabbed

JoAnne. However, Aquila was a huge Ken

Griffey, Jr., fan, and he could not bring him-

self to part with his Griffey-endorsed sneak-

ers.

It was on these sneakers that Trace Evi-

dence Examiner David Green found the evi-

dence that proved Aquila had been inside

JoAnne’s apartment.

While picking particles off the shoes with

tape and tweezers, Green spotted a single

strand of carpet in the sole of one of the

shoes. The strand was only the size of a pin-

prick. But when it was placed on a slide next

to a piece of carpet cut from JoAnne’s bed-

room and (CONTINUED ON PAGE 7)

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

The fiber found on Aquila’s shoe, magnified 500 times under a com-

parison microscope, was a match to the fibers of the carpet in

JoAnne’s apartment.

The tread, shown above, from Aquila’s shoe yielded a fiber (about the

size of a period on this page) from JoAnne’s bedroom carpet. Arrows

point to circles marking minute blood spots found

on Aquila’s shoes.

Caught by Science Continued from Page 5

Page 7: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

PAGE 7

magnified 500 times under a comparison microscope, it

was found to be a perfect match for the carpet in JoAn-

ne’s bedroom.

But, carpets are not like fingerprints. Different

homes, especially in an apartment complex, can have

the same type of carpet. So, Green and Willoughby Po-

lice researched the history of JoAnne’s carpet until they

were certain that it was unlike any other of the hun-

dreds of carpets in the apartment complex. The authori-

ties now had Aquila in JoAnne’s bedroom, but they still

did not necessarily have him present at the time of the

murder.

THE BLOOD Authorities now knew that at some point in time Aq-

uila had been both outside and inside JoAnne’s apart-

ment. But that still was not conclusive evidence. To be

certain of Aquila’s role in JoAnne’s murder, the Crime

Laboratory would have to prove that Aquila was there

when she was attacked. Once again, the shoes provided

the clues.

Serologist Linda Erdei (now the Director of the

Crime Laboratory), found several spots of blood on Aqui-

la’s sneakers. The spots were minute: so small that a

layperson would not have recognized their significance.

Portions of the DNA from this minute sample were

faithfully replicated millions of times to determine a

match to JoAnne’s blood.

The DNA test provided the strongest evidence yet of

Aquila’s guilt. It proved with certainty that the blood on

Aquila’s shoes came from JoAnne. Authorities now

knew that, not only had Aquila been in her apartment,

he was there while she was bleeding.

While the carpet strand and blood spot provided vital

evidence, it all began with the fingerprints. Had the fin-

gerprint examiners not identified Aquila so quickly, the

evidence on his shoes might have brushed off and been

lost forever.

The Crime Laboratory had worked quickly. JoAnne

was murdered on August 17. That same day, the finger-

print examiners matched Aquila’s prints to those they

found at JoAnne’s apartment.

By August 21, Green had found JoAnne’s carpet

strand in the sole of Aquila’s sneaker. On August 22,

Erdei matched blood on Aquila’s shoes with the victim.

From fingerprints to a DNA identification in six

days, the authorities had their suspect.

THE CONVICTION Confronted with the scientific evidence, Aquila final-

ly confessed to the murder. Aquila told police that he

had been wandering the apartment complex parking lot,

looking for cars to break into. Then he saw JoAnne

sleeping in her bedroom and decided to rape her.

Aquila said he failed to force open the bedroom win-

dow, so he pried open a patio door with his knife. Then

he walked into JoAnne’s room. Aquila claimed that

when he touched her, JoAnne awoke and lunged at him.

He said the two struggled, and he stabbed her several

times before he ran away.

Aquila pleaded guilty to aggravated murder, aggra-

vated robbery, aggravated burglary, kidnapping, and

fleeing in the Lake County Court of Common Pleas on

Dec. 19, 1995. He was 20 years old at the time. He is

now 38, imprisoned in the Trumbull Correctional Insti-

tution, and serving a sentence of 51 and one-half years

to life imprisonment.

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

Aquila, standing in front of Prosecuting Attorney Charles

Coulson, appeared in court for his sentencing hearing,

where he received a prison sentence of 51 and one-half

years to life.

Photo courtesy of the Cleveland Plain Dealer.

Caught by Science Continued from Page 6

Page 8: THE CRIMESCENE - Lake County Prosecutor€¦ · cyber crime, Walsh’s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32

PAGE 8

LAKE COUNTY CRIME LABORATORY 235 Fairgrounds Road • Painesville, OH 44077

(440) 350-2793 • fax (440) 350-2731

An ASCLD/LAB-International Accredited Laboratory since 2009

An ASCLD/LAB-Legacy Accredited Laboratory 2000-2009

The CRIMESCENE

A quarterly publication of the Office of the Lake County Prosecuting

Attorney, www.LakeCountyProsecutor.org. For questions, comments,

or to receive an electronic copy of this newsletter, please contact us

at:

(440) 350-2793

or

[email protected]

© 2014

TH

E C

RIM

ES

CE

NE

WIN

TE

R 2

01

4

With the acquisition of new equipment and training,

Digital Evidence Examiner Jamie Walsh can now em-

ploy the “chip-off” technique to recover data from mo-

bile devices that are password-protected or physically

damaged.

The chip-off technique involves the careful removal of

a memory chip from a mobile device. Specialized equip-

ment is then used to obtain a memory dump of the chip.

The memory dump is then examined using convention-

al forensic software techniques.

The chip-off technique has the potential to allow ac-

cess to an area of mobile device forensics that until just

recently was unobtainable with available forensic tools.

Another New Tool for Cell Phone Evidence

Memory reading hardware and adapter allows a

digital evidence expert access to a memory chip

removed from a mobile device.