TUCSON, Ariz. — Crime can happen anywhere at anytime and these days online criminals operate in the darkest corners of the web. Tucson Police Department has its experts on standby to crack criminal computers so detectives can crack the case.
It starts when researchers receive hardware from evidence lock up, and the search is on. Digital forensics examiner Brian O'Sullivan spends his days digging for data to find out who did what and when. His goal is to follow the digital footprint left behind.
"We look for deleted images deleted files, is what we're looking for on average web history," he said. "A typical day involves the analysis of data acquisition that means we make a copy of the data to work off of and analysis is actually digging into the data to find artifacts."
Detectives are looking for all types of data to help with investigations. The media forensic's team also saves their data separate from other departments on a fully contained database to maintain maximum security.
"What detectives need from us is to perform an in-depth analysis of a computer system, look at who's the owner, what kind of files are on there, what type of activity is seen on the file system, and either proof of knowledge or ownership of the files that we find on the computer," O'Sullivan said. "On average, web history is also a big one were looking for -- information that ties an owner and usage to that system."
Investigators say they have various top secret ways to break in to a computer. It can take a few hours to a couple of days to get results. The information is confirmed and sent to detectives before they head to court.
"We don't always need to break a password," O'Sullivan said. "We have decryption hardware and software that we can use to access cell phones or computers. As for anti-forensic software, there are ways certain avenues we can pursue to still find evidence. Once we turn in our report over to the detectives they may issue more charges in a case with the new found evidence that we present to them."
Some of the images in the can be disturbing to investigators. They see pictures, videos and files on a daily basis and many of them involve the exploitation of children, fraud and more. Police have counseling protocols in place to deal with vicarious trauma. Vicarious trauma is the emotional residue that comes from exposure to tragic events.
"Data -- it can kinda be a bit tricky if, sometimes, were looking for files that exist sometimes we're looking for data that's already been deleted off of the system and sometimes were looking for web activity on the computer," O'Sullivan said. "We have a check-in twice a year with the department psychiatrist just to ensure that we are doing well and the content that we are seeing is not affecting our work or personal lives."
