Preface

This book was inspired over a decade ago when I was a new detective. The biggest obstacle I faced was that of attribution. In every case to which I was assigned, attributing a crime to a suspect was the main focus. Some cases were easy. Other cases, seemingly impossible. Even just the identification of a suspect was next to impossible in some cases. But in every case, I did my best to identify the suspect and attribute criminal behavior appropriately.

I’m probably no different than most investigators; in that experiencing a horrific crime scene has some effect on the effort I put forth in investigations. After recovering evidence in the first child pornography case assigned to me, I was determined and driven to follow the evidence, identify the suspect, and collect enough evidence to close the case with charges. Seeing the personal damage caused to victims by the sliver of darkness in human nature is more than enough motivation to make sure a case is done right, the first time.

In this age of technology, where the Internet has increased the ease of crime through enabling transfer of contraband, harassment, bullying, intrusions, and facilitating terrorism through electronic communication, investigators need to accomplish the very important goal of Placing the Suspect Behind the Keyboard. The identification of a crime and victim does not further our justice system if we do not also identify the suspects.

The intention of this book is to be a guide to that end of placing the suspect behind the keyboard through a combination of digital forensics techniques and more traditional, non-technical investigative methods. Throughout the book, consider that the investigator and the forensic examiner may be the same person or more than two separate people, depending upon the size of their organization. However, their goal is the same and their cooperation with each other should not have half an inch of light between them or their common goal of a successful case conclusion.

Each chapter in this book is independent of the others, but all are interconnected through the same theme and purpose. The principles and concepts cover the best case scenarios and the worst case scenarios. Sometimes, the best evidence is out front in plain sight and the investigator has all the legal authority to seize it. Other times, the evidence may not exist, or be accessible, or able to be interpreted. Rather than giving in, take a step back and reflect on your investigation. There is a clue waiting for you to find it, and follow it. This is a book of clues.

Although the theme of this book primarily supports criminal investigations, many of the same methods and processes can be used in civil litigation and internal corporate matters. The primary differences being the legal authority in certain methods of investigations may be different between civil and criminal cases.

I also intentionally focused on the mindset of conducting an investigation, as it is your ideas and intuition that solve cases. Using software and hardware just helps you exploit your ideas eventually into physical evidence. Considering that my first forensic lab was literally a small storage closet converted into a cramped digital forensic lab, remember that it is the person, not the gear, which solves cases. Think of your ability as becoming the Pablo Picasso of forensics. Picasso’s art and skill in painting didn’t rely upon the kind of paint brush or the number of colors he used. He relied upon his mind. You as the examiner or investigator can do the same.

The principals outlined in the book are meant to be principals, not an absolute checklist, but a guide. The principals can be applied today just as much as they can be applied tomorrow. It is my sincerest intention that by reading this book, you have found one thing that will make your work easier and one thing that makes a case. If you learned one thing that saves you many hours of time, that will have been worth the time reading the book.

But if you learned just one small thing, just that one small Eureka! moment which blasts your case wide open, then your time reading this book was more than worthwhile to you. It was worthwhile to the victims in that one case, whether it be a child, a parent, or a business. And it definitely will impact the suspect, that same suspect you placed behind the keyboard.