Many digital investigators in law enforcement work for multiple teams and agencies. Keith Vincent is no exception. In his current role in the Economic Crimes Unit of the Chesterfield County Police Department, his title is Detective. In his earlier work as a deputized U.S. Marshal for the Federal Bureau of Investigation’s Child Exploitation Task Force, he was the Task Force Officer, and in his work with Internet Crimes Against Children (ICAC), he served as ICAC representative for his agency.
Not long ago ICAC completed Operation “Spring Clean” in the Richmond, Virginia area, which involved 17 search warrants and resulted in six arrests for the sexual exploitation of children committed via the internet and facilitated through the use of technology. “Most of the cases went federal,” Vincent said, “and the smaller ones were prosecuted at the state level by the attorney general’s office.” To support these operations as well as to investigate other criminal acts in Chesterfield, Virginia, Vincent has always needed to use state-of-the-art digital investigations tools.
Until recently, Vincent was a member of the Chesterfield County Police Department’s Special Victims Unit (SVU), which was historically tasked with the investigation of child sexual abuse, physical abuse, and neglect cases. “Now the SVU’s scope has expanded and they investigate all sex offenses, regardless of the age of the victim, as well as physical abuse and neglect,” Vincent said. In his current role with the Economic Crimes Unit, he primarily concentrates on computer forensics investigations, as well as proactive online investigations.
As with many law-enforcement investigative teams, caseloads are constantly rising, yet budgets do not inflate at the same rate, if at all. The Chesterfield County Police Department had been using a free forensics tool prior to the time that Vincent joined the team. “We were looking for something to replace it and had some grant money through another division. I ran across EnCase by talking with some FBI guys and others, asking what they use.” Vincent’s team bought EnCase Forensic as well as an Annual Training Passport, “and they sent me up to Washington DC for training.”
Solution and Results
One of the features that helps keep Vincent productive is the gallery view. He said, “I call the gallery view in EnCase Forensic ‘the home plate,’ and it helps me work a lot faster. I like the fact that I can green-check or home-plate a particular part of the file tree and then go over to the gallery view and see all the images at once. One of the first things I do regardless of the case is jump right into the gallery view in the user’s profile to see which JPEGs happen to be there.”
While working with the SVU unit, Vincent was given an arson case—a rare type of case for him—to investigate. “The fire marshal and one of the arson investigators handed me the laptop and gave me some background on what they were looking for. The suspect was allegedly setting fire to abandoned properties. He set fire to several abandoned homes, some with homeless people living in them, but fortunately they weren’t harmed. After setting a fire, the suspect hid out of sight and took photographs of the firefighters fighting the fire, Vincent asked the fire marshal and arson investigator what type of potential evidence they needed, and they asked for anything that could tie the suspect to the scene of the fire. He reported, “We’re looking for any documents, we’re looking for e-mails, internet history, etc. So I found his profile and looked into his user data. I home-plated everything and started looking at his temporary internet files. I did several keyword searches, including using the name of the city, 'Chesterfield,’ as one of the keywords searches, and I got 30,000 hits.”
In the text strings where “Chesterfield” appeared, Vincent found that the vast majority involved the Chesterfield Fire Department. When he searched on “fire department,” he found 3,500 instances that led to online stories of arson investigations across the country. “He looked at wildfires out west, and had a keen interest in arson investigations in Chicago,” he said. “And I found 900 instances of the word ‘arson.’ Some of the text strings I found were Google searches on ways to avoid being caught for arson. He actually searched in the Virginia code book on the laws about and punishment for arson. He even logged into and was a member of some prison chat forums that seem to be run by former prison inmates. He was Googling defense attorneys, what the uniforms were like in certain jails. He was very detailed in his research.”
Vincent took the potential evidence to the investigator and the fire marshal and said, “I think you’ve got to sit down with his attorney. The suspect’s attorney met with the prosecuting attorney for a meeting. And the defense attorney looked at the evidence and said, ‘We’re pleading guilty to everything.’”
Armed with thorough and useful results from his use of EnCase Forensic and leveraging his “very good experiences with training” covered by his Annual Training Passport, Vincent considers the Chesterfield County Police Department well-equipped to efficiently investigate every case their agency and partner agencies hand over to them, and to help those agencies uncover criminal activity and bring the perpetrators to justice.