Urgent Evidence

CASE Sub-topic of Chain of Custody

Introduction

When evidence is submitted to a lab for analysis, the submitter has the option to submit the evidence as "Urgent" or "Rushed." This normally occurs when the evidence is known to have a quick turnaround (i.e. the case's scheduled court date occurs within a few days, or the evidence is needed to execute a search warrant, etc.). Indicating something as "Urgent" evidence requires examiners/analysts to push that evidence to the front of the analysis queue; that is, that evidence will be examined/analyzed next before continuing to work on any backlog cases/investigations.

An urgent submission which goes through the laboratory will follow an identical process to that of any submission, except in some cases urgent evidence may bypass a standard initial destination of an evidence vault, instead heading straight to processing. The chain of custody would need to accommodate this omitted visit, while still maintaining the integrity of the evidence's handling.

Narrative

An investigator receives evidence that a submitter has marked as urgent. The following table shows the timeline of this exhibit's processing, jumping straight to a processing kiosk instead of the evidence vault.

Date / Time	Action
01/01/2019 14:00	Exhibit submitted for Kiosk examination
01/01/2019 14:05	Exhibit seal checks (passed) & Exhibit receipted in lab
01/01/2019 14:05	Exhibit assigned to Kiosk technician
01/01/2019 14:15	Sealed Exhibit Photographed
01/01/2019 14:20	Exhibit Unsealed
01/01/2019 14:21	Unsealed Exhibit Photographed
01/01/2019 14:25	Exhibit Connected to Kiosk & process started
01/01/2019 14:55	Exhibit Disconnected from Kiosk
01/01/2019 15:00	Exhibit Resealed
01/01/2019 15:03	Picture selected, via kiosk review screen, from those extracted from exhibit
01/01/2019 15:05	Report DVD Generated as associated exhibit
01/01/2019 15:10	DVD Report sealed
01/01/2019 15:15	Witness statement completed
01/01/2019 15:20	Sealed Exhibit handed the OIC & Transfer documentation signed

Discussion: Kiosk Investigations

For a kiosk investigation the laboratory will not be part of the process, instead the interaction will be directly between the kiosk trained submitting officer and the kiosk used, and will follow a known sequence of steps either directed by a documented instruction/script or directly by the on-screen step processes built into the kiosk itself.

Therefore the only chain of custody information will be that which recorded on the kiosk during the sequence of steps, and would be along the lines of:

Date/Time Exhibit unsealed
Date/Time Exhibit photographs taken by officer are uploaded
Date/Time [Sub-]Exhibit (e.g. SIM Card, MemoryCard, Phone, etc.) is connected to kiosk
Date/Time of processes started & completed by Kiosk (may contain numerous entries depending on level of detail provided by vendor)
Date/Time [Sub-]Exhibit was disconnected from Kiosk
Date/Time Exhibit was resealed

and would be automatically generated by the kiosk as part of the data exported in CASE format within the Report package contained on the DVD in the final steps above. The idea being that the kiosk activity could subsequently be imported into a Case Management System for review and quality control.

Note: The above chain of custody details (i.e. unseal, photograph, connect to forensic tool, image, process, disconnect from forensic tool, reseal) are effectively identical to the chain of custody typically used within the laboratory environment.

Illustrative Data and Queries

The queries in this section, and their computed results, are backed by the data in urgent_evidence.json.

Events, locations, tools, and people represented in this and other CASE narratives are presented, and at many times created, for illustration purposes only and do not necessarily represent real events, locations, tools, or people.

Action timeline

According to the CASE report, what is the timeline of all of the recorded actions? (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>

SELECT ?lStartTime ?lEndTime ?lDescription
WHERE
{
  ?nAction
    a case-investigation:InvestigativeAction ;
    uco-core:description ?lDescription ;
    uco-action:endTime ?lEndTime ;
    .

  OPTIONAL
  {
    ?nAction
      uco-action:startTime ?lStartTime ;
      .
  }
}
ORDER BY ?lEndTime

	?lStartTime	?lEndTime	?lDescription
0		2019-01-01 14:00:00+00:00	Exhibit submitted for Kiosk examination
1		2019-01-01 14:05:00+00:00	Exhibit seal checks (passed) & Exhibit receipted in lab
2		2019-01-01 14:05:30+00:00	Exhibit assigned to Kiosk technician
3		2019-01-01 14:15:00+00:00	Sealed Exhibit Photographed
4		2019-01-01 14:20:00+00:00	Exhibit Unsealed
5		2019-01-01 14:21:00+00:00	Unsealed Exhibit Photographed
6	2019-01-01 14:25:00+00:00	2019-01-01 14:55:00+00:00	Exhibit Connected to Kiosk & process started; exhibit disconnected at conclusion
7		2019-01-01 15:00:00+00:00	Exhibit Resealed
8		2019-01-01 15:03:00+00:00	Picture selected, via kiosk review screen, from those extracted from exhibit
9		2019-01-01 15:05:00+00:00	Report DVD Generated as associated exhibit
10		2019-01-01 15:10:00+00:00	DVD Report sealed
11		2019-01-01 15:15:00+00:00	Witness statement completed
12		2019-01-01 15:20:00+00:00	Sealed Exhibit handed the OIC & Transfer documentation signed

Locations

According to the CASE report, in what locations did the investigative actions take place? (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX drafting: <http://example.org/ontology/drafting#>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-location: <https://ontology.unifiedcyberontology.org/uco/location/>

SELECT DISTINCT ?nLocation ?lRoomId ?lDescription
WHERE
{
  ?nAction
    a case-investigation:InvestigativeAction ;
    uco-action:location ?nLocation ;
    .

  ?nLocation
    a uco-location:Location ;
    uco-core:description ?lDescription ;
    uco-core:hasFacet [
      a uco-location:SimpleAddressFacet ;
      drafting:roomId ?lRoomId ;
    ]
    .

}
ORDER BY ?nLocation

	?nLocation	?lRoomId	?lDescription
0	http://example.org/kb/location-uuid-1	1-001	(Room 1-001) Police station intake lab
1	http://example.org/kb/location-uuid-3	2-013	(Room 2-013) Police station evidence processing lab
2	http://example.org/kb/location-uuid-4	3-022	(Room 3-022) Desk of Officer Hudson

Of note:

CASE and UCO do not yet implement the concept of roomId. It is provided here to assist with future concept development.
The evidence vault—room B-001—is not among these locations. The urgency of the processing caused that room to be bypassed.
The witness statement is produced by the analyzing officer, following UK Crown Prosecution Service Guidance. (Were this a civil case, UK Ministry of Justice Guidance would have been followed instead.) The officer's signed statement describes the officer's experience, role, and training, and describes and accompanies the chain of custody and analysis results up through the kiosk's processing conclusion in the evidence processing lab.

Investigative personae

According to the provenance chain, who was involved in handling this evidence? (SPARQL source)

The evidence exhibit number is EXH-20190101-7.

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-identity: <https://ontology.unifiedcyberontology.org/uco/identity/>

SELECT DISTINCT ?lLastName
WHERE
{
  # Many actions involve the exhibit's device.
  # Look up the exhibit-device based on its exhibit number.
  ?nOriginalProvenanceRecord
    a case-investigation:ProvenanceRecord ;
    case-investigation:exhibitNumber "EXH-20190101-7" ;
    uco-core:object ?nExhibitDevice ;
    .

  # Then, look up the people that produced other provenance records for this device.
  ?nInvestigativeAction
    a case-investigation:InvestigativeAction ;
    uco-action:performer ?nPerformer ;
    uco-action:result ?nActionProvenanceRecord ;
    .

  # This query component ties the provenance records together
  # by object-reference to the device.
  ?nActionProvenanceRecord
    a case-investigation:ProvenanceRecord ;
    uco-core:object ?nExhibitDevice ;
    .

  ?nPerformer
    a uco-identity:Person ;
    uco-core:hasFacet ?nSimpleName ;
    .

  ?nSimpleName
    a uco-identity:SimpleNameFacet ;
    uco-identity:familyName ?lLastName ;
    .
}
ORDER BY ?lLastName

	?lLastName
0	Hudson
1	Smith
2	Walker

Photographs of exhibits

What photographs were taken of the exhibit and sub-exhibits? (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/>
PREFIX uco-tool: <https://ontology.unifiedcyberontology.org/uco/tool/>
PREFIX uco-types: <https://ontology.unifiedcyberontology.org/uco/types/>

SELECT ?lExhibitNumber ?lFileName ?lModifiedTime ?lHashValue
WHERE {

  # This query uses sub-queries to prevent unnecessary joins.
  # The first sub-query identifies for which graph nodes we will retrieve
  # annotating properties.

  # The files being returned are photographs that were created as the
  # results of investigative actions, and are recorded in the generated
  # provenance records.
  # Retrieve the exhibit devices' nodes and the file objects' nodes.

  {
    SELECT ?nExhibitDevice ?nPictureFile
    WHERE {
      ?nPictureFile
        a/rdfs:subClassOf* uco-observable:ObservableObject ;
        uco-core:hasFacet ?nRasterPictureFacet ;
        .

      ?nInvestigativeAction
        a case-investigation:InvestigativeAction ;
        uco-action:instrument ?nCameraDevice ;
        uco-action:object ?nExhibitDevice ;
        uco-action:result ?nPictureFile ;
        uco-action:result ?nProvenanceRecord ;
        .

      # To avoid confusing pictures taken of evidence with pictures
      # extracted from evidence, identify the investigator's camera by
      # merit of it being an analytic tool.
      {
        SELECT ?nCameraDevice
        WHERE {
          ?nCameraDevice
            a/rdfs:subClassOf* uco-observable:ObservableObject ;
            a uco-tool:AnalyticTool ;
            uco-core:hasFacet ?nCameraDeviceDeviceFacet ;
            .

          ?nCameraDeviceDeviceFacet
            a uco-observable:DeviceFacet ;
            uco-observable:deviceType "camera" ;
            .
        }
      }  # Ends sub-query: SELECT ?nCameraDevice

      # The provenance record confirms the picture file was recorded in
      # the provenance chain.

      ?nProvenanceRecord
        a case-investigation:ProvenanceRecord ;
        uco-core:object ?nPictureFile ;
        .

      # The raster picture facet distinguishes these files as picture
      # files.

      ?nRasterPictureFacet
        a uco-observable:RasterPictureFacet ;
        .

      # Because provenance records are input to some actions, confirm
      # that the exhibit device node has a Device facet, to prevent
      # accidentally returning provenance records in this inner query's
      # results.
      # (These two blocks retrieving the facet can cause a Cartesian
      # product if not run in a sub-, or at this point sub-sub-, query.)

      {
        SELECT ?nExhibitDevice
        WHERE {
          ?nExhibitDevice
            a/rdfs:subClassOf* uco-observable:Device ;
            .
        }
      }  # Ends sub-query: SELECT ?nExhibitDevice
    }
  }  # Ends sub-query: SELECT ?nExhibitDevice ?nPictureFile

  # The first returned property for the outer query is the label of the
  # subject device, which must be retrieved by one of the provenance
  # records that is not a result of taking the pictures.
  # This is run in a SELECT DISTINCT sub-query because multiple
  # provenance records of the subject device attach the exhibit number
  # redundantly.
  {
    SELECT DISTINCT ?nExhibitDevice ?lExhibitNumber
    WHERE {
      ?nLabellingProvenanceRecord
        a case-investigation:ProvenanceRecord ;
        case-investigation:exhibitNumber ?lExhibitNumber ;
        uco-core:object ?nExhibitDevice ;
        .
    }
  }

  # The other properties being returned are characteristics of the
  # files.  Retrieve those properties once the sub-query has returned
  # which files.

  ?nPictureFile
    uco-core:hasFacet ?nContentDataFacet ;
    uco-core:hasFacet ?nFileFacet ;
    .

  ?nContentDataFacet
    a uco-observable:ContentDataFacet ;
    uco-observable:hash ?nHash ;
    .

  ?nHash
    uco-types:hashValue ?lHashValue ;
    .

  ?nFileFacet
    a uco-observable:FileFacet ;
    uco-observable:fileName ?lFileName ;
    uco-observable:modifiedTime ?lModifiedTime ;
    .

}
ORDER BY ?lExhibitNumber ?lFileName

	?lExhibitNumber	?lFileName	?lModifiedTime	?lHashValue
0	EXH-20190101-7	IMG_4829.jpg	2019-01-01 14:14:07+00:00	6ba5b138057cca4e737a86083cf28426093f218efbef64967863a6c83138fe89
1	EXH-20190101-7	IMG_4830.jpg	2019-01-01 14:14:30+00:00	cadc54f42a9d01ecb5ecdc3a9a4824c73301d6ce9857eaa73fc28317ccd5d40f
2	EXH-20190101-7	IMG_4831.jpg	2019-01-01 14:15:00+00:00	ee3657ad73c09098312e71a31ca7ac468c1fb1b998b5d6647ad471dcc89c4141
3	EXH-20190101-7	IMG_4832.jpg	2019-01-01 14:20:07+00:00	132bfadcc46addedcafcd84653f1a56007eba2f27bfcb15824536cda65a49c9a
4	EXH-20190101-7	IMG_4833.jpg	2019-01-01 14:20:32+00:00	1929ec6c6186f43860da7c77c0c65d1b8543a5543572261a1b71084e7bf80a0e
5	EXH-20190101-7	IMG_4834.jpg	2019-01-01 14:21:00+00:00	fc0819ed4dcb2af9c85a041a0da11ea6a146dec0b108c09f5e0d41e8ea3bb041

Actions to artifact

Among the artifacts extracted from the device, a picture file IMG_1863.jpg was extracted. Starting at initial evidence submission, what actions were taken to extract that file?

This query inspects the derivation chains of artifacts. A supplemental graph of a predicate adapted from the W3C PROV Ontology creates a chain of InvestigativeActions that can be analyzed with a path operator. (SPARQL source for wasInformedBy.)

CONSTRUCT
{
  # Identify all actions A, B chained together by passing some
  # intermediary result, A -> result -> B.
  #
  # Since the latest provenance record for the object should be used,
  # the generating action needs to be considered in the construction
  # as well.
  ?nUsingAction case-investigation:wasInformedBy ?nMostRecentAction .
}
WHERE {
  # ?nResult can only be generated by one action - i.e. can only be a
  # result of one action.
  ?nGeneratingAction
    a case-investigation:InvestigativeAction ;
    uco-action:result ?nGenerationProvenanceRecord ;
    uco-action:result ?nResult ;
    .

  # ?nResult might be processed by multiple actions, but cannot be
  # generated by multiple actions.  The designation for having been
  # processed multiple times is to be a member of multiple provenance
  # records.
  #
  # To allow for the case where ?nGeneratingAction is also
  # ?nMostRecentAction, do not require ?nResult be an input to
  # ?nMostRecentAction.
  #
  # The nested SELECT DISTINCT clause removes repetitions from multiple
  # nResult nodes passed between activities.  The nResult nodes are not
  # included in the constructed results, so there's no sense making the
  # results consumer loop through the same action pair once per distinct
  # passed result.  This sub-query reduces the inspection to all pairs
  # of actions linked by passing some provenance record.
  {
    SELECT DISTINCT ?nMostRecentAction ?nUsingAction ?nMostRecentProvenanceRecord
    WHERE {
      ?nMostRecentAction
        a case-investigation:InvestigativeAction ;
        uco-action:result ?nMostRecentProvenanceRecord ;
        .

      ?nUsingAction
        a case-investigation:InvestigativeAction ;
        uco-action:object ?nMostRecentProvenanceRecord ;
        .

      ?nMostRecentProvenanceRecord
        a case-investigation:ProvenanceRecord ;
        .
    }
  }

  ?nUsingAction
    uco-action:object ?nResult ;
    .

  ?nGenerationProvenanceRecord
    a case-investigation:ProvenanceRecord ;
    uco-core:object ?nResult ;
    .

  #It is possible that ?nMostRecentProvenanceRecord may also be
  # ?nGenerationProvenanceRecord.
  ?nMostRecentProvenanceRecord
    uco-core:object ?nResult ;
    .
}

That graph is then analyzed with the * path operator. The query uses * instead of + in order to include the action that generated the file as well. (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/>

SELECT DISTINCT ?nDerivingAction ?lDescription
WHERE {
  # Identify action at end of path.
  ?nEndAction
    uco-action:endTime ?lEndActionEndTime ;
    uco-action:result/uco-core:hasFacet/uco-observable:fileName "IMG_1863.jpg" ;
    .

  # Identify all actions in chain.
  ?nEndAction case-investigation:wasInformedBy* ?nDerivingAction .

  # Extract annotations of actions in chain.
  ?nDerivingAction
    uco-core:description ?lDescription ;
    uco-action:endTime ?lDerivingActionEndTime ;
    .
}
ORDER BY ?lDerivingActionEndTime

	?nDerivingAction	?lDescription
0	http://example.org/kb/action-uuid-1	Exhibit submitted for Kiosk examination
1	http://example.org/kb/action-uuid-3	Exhibit assigned to Kiosk technician
2	http://example.org/kb/action-uuid-7	Exhibit Connected to Kiosk & process started; exhibit disconnected at conclusion

Initial Evidence Submission

What objects were the initial evidence submission(s) into the ProvenanceRecord chain? (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>

SELECT DISTINCT ?nSourceObject
WHERE
{
    # Locate the objects by crossing the rootExhibitNumber
    # with the exhibitNumber, to find the source ProvenanceRecord.
    ?nProvenanceRecord
      uco-core:object ?nSourceObject ;
      case-investigation:rootExhibitNumber ?lExhibitNumber ;
      case-investigation:exhibitNumber ?lExhibitNumber ;
      .
}

	?nSourceObject
0	http://example.org/kb/subject-device-uuid-1

Selection from Automated Exhibit Extraction

Several picture files were extracted by the kiosk, tracked in the internal process-record exhibit EXH-20190101-7-KioskReport. Some of them were selected by the investigator for presentation in exhibit EXH-20190101-7-B, after visual review of just some of the files. Which were extracted, displayed, and selected? (SPARQL source)

PREFIX case-investigation: <https://ontology.caseontology.org/case/investigation/>
PREFIX uco-action: <https://ontology.unifiedcyberontology.org/uco/action/>
PREFIX uco-core: <https://ontology.unifiedcyberontology.org/uco/core/>
PREFIX uco-observable: <https://ontology.unifiedcyberontology.org/uco/observable/>

SELECT DISTINCT ?lFileName ?lReviewStatus
WHERE {
  # Use the requested exhibit numbers to identify provenance records
  # that will contain the files of interest.
  # The extraction provenance record:
  ?nExtractionProvenanceRecord
    a case-investigation:ProvenanceRecord ;
    case-investigation:exhibitNumber "EXH-20190101-7-KioskReport" ;
    uco-core:object ?nFile ;
    .
  # The selection provenance record:
  ?nSelectionProvenanceRecord
    a case-investigation:ProvenanceRecord ;
    case-investigation:exhibitNumber "EXH-20190101-7-B" ;
    .

  # Find the selection action via the provenance records being some
  # input and output.
  ?nSelectionAction
    uco-action:object ?nExtractionProvenanceRecord ;
    uco-action:result ?nSelectionProvenanceRecord ;
    .

  # Use duck-typing to filter down to the objects that have a
  # RasterPictureFacet.
  ?nFile
    uco-core:hasFacet / a uco-observable:RasterPictureFacet ;
    uco-core:hasFacet / uco-observable:fileName ?lFileName ;
    .

  # Run a sub-query to find each requested status for the extracted
  # files.
  # Each will depend on the non-existence of some pattern.
  {
    SELECT ?nFile ?lReviewStatus
    WHERE {
      # Find the files in the extracted-set that were not inputs to the
      # selection action.
      # (This example chooses to represent a picture being displayed to
      # the reviewer as being the threshold for consideration as an
      # input to the action.  Other systems may differ.)
      FILTER NOT EXISTS {
        ?nSelectionAction
          uco-action:object ?nFile ;
          .
      }
      BIND ("Not displayed" AS ?lReviewStatus)
    }
  }
  UNION
  {
    SELECT ?nFile ?lReviewStatus
    WHERE {
      ?nSelectionAction
        uco-action:object ?nFile ;
        .
      FILTER NOT EXISTS {
        ?nSelectionProvenanceRecord
          uco-core:object ?nFile ;
          .
      }
      BIND ("Displayed" AS ?lReviewStatus)
    }
  }
  UNION
  {
    SELECT ?nFile ?lReviewStatus
    WHERE {
      ?nSelectionProvenanceRecord
        uco-core:object ?nFile ;
        .
      BIND ("Selected" AS ?lReviewStatus)
    }
  }
}
ORDER BY ?lFileName

	?lFileName	?lReviewStatus
0	IMG_1863.jpg	Selected
1	IMG_1864.jpg	Displayed
2	IMG_1865.jpg	Not displayed