CASE Sub-topic of Chain of Custody
When evidence is submitted to a lab for analysis, the submitter has the option to submit the evidence as "Urgent" or "Rushed." This normally occurs when the evidence is known to have a quick turnaround (i.e. the case's scheduled court date occurs within a few days, or the evidence is needed to execute a search warrant, etc.). Indicating something as "Urgent" evidence requires examiners/analysts to push that evidence to the front of the analysis queue; that is, that evidence will be examined/analyzed next before continuing to work on any backlog cases/investigations.
An urgent submission which goes through the laboratory will follow an identical process to that of any submission, except in some cases urgent evidence may bypass a standard initial destination of an evidence vault, instead heading straight to processing. The chain of custody would need to accommodate this omitted visit, while still maintaining the integrity of the evidence's handling.
An investigator receives evidence that a submitter has marked as urgent. The following table shows the timeline of this exhibit's processing, jumping straight to a processing kiosk instead of the evidence vault.
Date / Time | Action |
---|---|
01/01/2019 14:00 | Exhibit submitted for Kiosk examination |
01/01/2019 14:05 | Exhibit seal checks (passed) & Exhibit receipted in lab |
01/01/2019 14:05 | Exhibit assigned to Kiosk technician |
01/01/2019 14:15 | Sealed Exhibit Photographed |
01/01/2019 14:20 | Exhibit Unsealed |
01/01/2019 14:21 | Unsealed Exhibit Photographed |
01/01/2019 14:25 | Exhibit Connected to Kiosk & process started |
01/01/2019 14:55 | Exhibit Disconnected from Kiosk |
01/01/2019 15:00 | Exhibit Resealed |
01/01/2019 15:05 | Report DVD Generated as associated exhibit |
01/01/2019 15:10 | DVD Report sealed |
01/01/2019 15:15 | Witness statement completed |
01/01/2019 15:20 | Sealed Exhibit handed the OIC & Transfer documentation signed |
For a kiosk investigation the laboratory will not be part of the process, instead the interaction will be directly between the kiosk trained submitting officer and the kiosk used, and will follow a known sequence of steps either directed by a documented instruction/script or directly by the on-screen step processes built into the kiosk itself.
Therefore the only chain of custody information will be that which recorded on the kiosk during the sequence of steps, and would be along the lines of:
and would be automatically generated by the kiosk as part of the data exported in CASE format within the Report package contained on the DVD in the final steps above. The idea being that the kiosk activity could subsequently be imported into a Case Management System for review and quality control.
Note: The above chain of custody details (i.e. unseal, photograph, connect to forensic tool, image, process, disconnect from forensic tool, reseal) are effectively identical to the chain of custody typically used within the laboratory environment.
The queries in this section, and their computed results, are backed by the data in urgent_evidence.json.
Events, locations, tools, and people represented in this and other CASE narratives are presented, and at many times created, for illustration purposes only and do not necessarily represent real events, locations, tools, or people.
According to the CASE report, what is the timeline of all of the recorded actions? (SPARQL source)
SELECT ?lStartTime ?lEndTime ?lDescription
WHERE
{
?nAction
a case-investigation:InvestigativeAction ;
uco-core:facets ?nActionReferences ;
uco-core:description ?lDescription ;
.
?nActionReferences
a uco-action:ActionReferences ;
uco-action:endTime ?lEndTime ;
.
OPTIONAL
{
?nActionReferences
uco-action:startTime ?lStartTime ;
.
}
}
ORDER BY ?lEndTime
?lStartTime | ?lEndTime | ?lDescription | |
---|---|---|---|
0 | 2019-01-01T14:00+00:00 | Exhibit submitted for Kiosk examination | |
1 | 2019-01-01T14:05+00:00 | Exhibit seal checks (passed) & Exhibit receipted in lab | |
2 | 2019-01-01T14:05:30+00:00 | Exhibit assigned to Kiosk technician | |
3 | 2019-01-01T14:15+00:00 | Sealed Exhibit Photographed | |
4 | 2019-01-01T14:20+00:00 | Exhibit Unsealed | |
5 | 2019-01-01T14:21+00:00 | Unsealed Exhibit Photographed | |
6 | 2019-01-01T14:25+00:00 | 2019-01-01T14:55+00:00 | Exhibit Connected to Kiosk & process started; exhibit disconnected at conclusion |
7 | 2019-01-01T15:00+00:00 | Exhibit Resealed | |
8 | 2019-01-01T15:05+00:00 | Report DVD Generated as associated exhibit | |
9 | 2019-01-01T15:10+00:00 | DVD Report sealed | |
10 | 2019-01-01T15:15+00:00 | Witness statement completed | |
11 | 2019-01-01T15:20+00:00 | Sealed Exhibit handed the OIC & Transfer documentation signed |
According to the CASE report, in what locations did the investigative actions take place? (SPARQL source)
SELECT DISTINCT ?nLocation ?lRoomId ?lDescription
WHERE
{
?nAction
a case-investigation:InvestigativeAction ;
uco-core:facets [
a uco-action:ActionReferences ;
uco-action:location ?nLocation ;
] ;
.
?nLocation
a uco-location:Location ;
uco-core:description ?lDescription ;
uco-core:facets [
a uco-location:SimpleAddress ;
drafting:roomId ?lRoomId ;
]
.
}
ORDER BY ?nLocation
?nLocation | ?lRoomId | ?lDescription | |
---|---|---|---|
0 | http://example.org/kb/location-uuid-1 | 1-001 | (Room 1-001) Police station intake lab |
1 | http://example.org/kb/location-uuid-3 | 2-013 | (Room 2-013) Police station evidence processing lab |
2 | http://example.org/kb/location-uuid-4 | 3-022 | (Room 3-022) Desk of Officer Hudson |
Of note:
roomId
. It is provided here to assist with future concept development.According to the provenance chain, who was involved in handling this evidence? (SPARQL source)
The evidence exhibit number is EXH-20190101-7
.
SELECT DISTINCT ?lLastName
WHERE
{
# Many actions involve the exhibit's device.
# Look up the exhibit-device based on its exhibit number.
?nOriginalProvenanceRecord
a case-investigation:ProvenanceRecord ;
case-investigation:exhibitNumber "EXH-20190101-7" ;
uco-core:object ?nExhibitDevice ;
.
# Then, look up the people that produced other provenance records for this device.
?nInvestigativeAction
a case-investigation:InvestigativeAction ;
uco-core:facets ?nActionReferences ;
.
?nActionReferences
a uco-action:ActionReferences ;
uco-action:performer ?nPerformer ;
uco-action:result ?nActionProvenanceRecord ;
.
# This query component ties the provenance records together
# by object-reference to the device.
?nActionProvenanceRecord
a case-investigation:ProvenanceRecord ;
uco-core:object ?nExhibitDevice ;
.
?nPerformer
a uco-identity:Identity ;
uco-core:facets ?nSimpleName ;
.
?nSimpleName
a uco-identity:SimpleName ;
uco-identity:familyName ?lLastName ;
.
}
ORDER BY ?lLastName
?lLastName | |
---|---|
0 | Hudson |
1 | Smith |
2 | Walker |
What photographs were taken of the exhibit and sub-exhibits? (SPARQL source)
SELECT ?lExhibitNumber ?lFileName ?lModifiedTime ?lHashValue
WHERE {
# This query uses sub-queries to prevent unnecessary joins.
# The first sub-query identifies for which graph nodes we will retrieve
# annotating properties.
# The files being returned are photographs that were created as the
# results of investigative actions, and are recorded in the generated
# provenance records.
# Retrieve the exhibit devices' nodes and the file objects' nodes.
{
SELECT ?nExhibitDevice ?nPictureFile
WHERE {
?nPictureFile
a uco-observable:CyberItem ;
uco-core:facets ?nRasterPictureFacet ;
.
?nInvestigativeAction
a case-investigation:InvestigativeAction ;
uco-core:facets ?nActionReferencesFacet ;
.
?nActionReferencesFacet
a uco-action:ActionReferences ;
uco-action:instrument kb:camera-uuid-1 ;
uco-action:object ?nExhibitDevice ;
uco-action:result ?nPictureFile ;
uco-action:result ?nProvenanceRecord ;
.
kb:camera-uuid-1
a uco-tool:AnalyticTool ;
.
# The provenance record confirms the picture file was recorded in
# the provenance chain.
?nProvenanceRecord
a case-investigation:ProvenanceRecord ;
uco-core:object ?nPictureFile ;
.
# The raster picture facet distinguishes these files as picture
# files.
?nRasterPictureFacet
a uco-observable:RasterPicture ;
.
# Because provenance records are input to some actions, confirm
# that the exhibit device node has a Device facet, to prevent
# accidentally returning provenance records in this inner query's
# results.
# (These two blocks retrieving the facet can cause a Cartesian
# product if not run in a sub-, or at this point sub-sub-, query.)
{
SELECT ?nExhibitDevice
WHERE {
?nExhibitDevice
a uco-observable:CyberItem ;
uco-core:facets ?nDeviceFacet ;
.
?nDeviceFacet
a uco-observable:Device ;
.
}
} # Ends sub-query: SELECT ?nExhibitDevice
}
} # Ends sub-query: SELECT ?nExhibitDevice ?nPictureFile
# The first returned property for the outer query is the label of the
# subject device, which must be retrieved by one of the provenance
# records that is not a result of taking the pictures.
# This is run in a SELECT DISTINCT sub-query because multiple
# provenance records of the subject device attach the exhibit number
# redundantly.
{
SELECT DISTINCT ?nExhibitDevice ?lExhibitNumber
WHERE {
?nLabellingProvenanceRecord
a case-investigation:ProvenanceRecord ;
case-investigation:exhibitNumber ?lExhibitNumber ;
uco-core:object ?nExhibitDevice ;
.
}
}
# The other properties being returned are characteristics of the
# files. Retrieve those properties once the sub-query has returned
# which files.
?nPictureFile
uco-core:facets ?nContentDataFacet ;
uco-core:facets ?nFileFacet ;
.
?nContentDataFacet
a uco-observable:ContentData ;
uco-observable:hash ?nHash ;
.
?nHash
uco-types:hashValue ?lHashValue ;
.
?nFileFacet
a uco-observable:File ;
uco-observable:fileName ?lFileName ;
uco-observable:modifiedTime ?lModifiedTime ;
.
}
ORDER BY ?lExhibitNumber ?lFileName
?lExhibitNumber | ?lFileName | ?lModifiedTime | ?lHashValue | |
---|---|---|---|---|
0 | EXH-20190101-7 | IMG_4829.jpg | 2019-01-01T14:14:07+00:00 | 6ba5b138057cca4e737a86083cf28426093f218efbef64967863a6c83138fe89 |
1 | EXH-20190101-7 | IMG_4830.jpg | 2019-01-01T14:14:30+00:00 | cadc54f42a9d01ecb5ecdc3a9a4824c73301d6ce9857eaa73fc28317ccd5d40f |
2 | EXH-20190101-7 | IMG_4831.jpg | 2019-01-01T14:15:00+00:00 | ee3657ad73c09098312e71a31ca7ac468c1fb1b998b5d6647ad471dcc89c4141 |
3 | EXH-20190101-7 | IMG_4832.jpg | 2019-01-01T14:20:07+00:00 | 132bfadcc46addedcafcd84653f1a56007eba2f27bfcb15824536cda65a49c9a |
4 | EXH-20190101-7 | IMG_4833.jpg | 2019-01-01T14:20:32+00:00 | 1929ec6c6186f43860da7c77c0c65d1b8543a5543572261a1b71084e7bf80a0e |
5 | EXH-20190101-7 | IMG_4834.jpg | 2019-01-01T14:21:00+00:00 | fc0819ed4dcb2af9c85a041a0da11ea6a146dec0b108c09f5e0d41e8ea3bb041 |
Of note:
kb:camera-uuid-1
, to avoid confusing pictures taken of evidence with pictures extracted from evidence. A change to UCO is under consideration to enable this query to function based on a tool class, without needing to hard code the camera's identifier.