THE CRIMESCENE - Lake County Prosecutor

1 Jamie Walsh has only been a Digital Evidence Exam-iner with the Lake County Crime Laboratory since No-vember 2011, but he is an old hand when it comes to ex-amining computers and mobile devices. As cell phones and computers are used more often in cyber crime, Walsh s experience is invaluable in helping catch criminals. Walsh worked for the Wickliffe Police Department for 32 years before joining the Lake County Crime Laborato-ry full-time. From 1998 through 2011, he served as a detective for the department and his interest in electronics became part of his casework. I have always had an interest in computers. When I was assigned to the detective bureau at the Wickliffe PD, I was able to use those skills and started doing my own computer and mobile device forensics, Walsh said.

2 Walsh began working in digital forensics before there were degrees available in that field. Instead, he studied in specialized classes and (CONTINUED ON PAGE 3)Jamie Walsh: On the Cutting Edge of Cyber Crime No witness saw Michael aquila peer through JoAn-ne s bedroom window at 4 on Aug. 17, 1995. No one observed aquila sneak into JoAnne s Willoughby apart-ment. No one heard aquila attempt to rape the sleeping JoAnne and then cut her throat. The sound of the strug-gle did not wake her neighbors or even her family, who were sleeping in another bedroom. aquila fled, leaving JoAnne mortally wounded. But JoAnne managed to call 911. When a paramedic asked 27-year-old JoAnne who did this to her, she could only groan, I don t know and I want to live.

3 Then JoAnne died. Upon arrival at the crime scene, the police and the Crime Laboratory scientists (CONTINUED ON PAGE 5)Caught by Science WINTER 2014 PAGE 1 T H E C R I M E S C E N E N E W S L E T T E R O F T H E L A K E C O U N T Y C R I M E L A B O R A T O R Y Jamie Walsh PAGE 2 Frequently Asked Questions Q: Two kids smoked marihuana from the bong tested by the LCCL. It was later discovered that the kids be-came extremely sick after using the bong, and they be-lieved the marihuana was mixed with something else. The report shows that the bong was tested and the pres-ence of marihuana was located, but the police now sus-pect the presence of another narcotic. Do you think that the bong should be retested be-cause of the new suspicions of another narcotic?

4 A: No. When evidence is sampled and analyzed, any controlled substances that are present in that sample will be separated from one another and identified. With a few exceptions (Khat, LSD, mushrooms, steroids), multiple tests do not need to be run to identify each sep-arate drug that may be present in a sample. When controlled substance evidence is submitted to the laboratory, a representative sample of that evidence is removed, whether it is a small amount from a larger population or a swab of a residue. The sample is then analyzed utilizing Gas Chromatography/Mass Spec-trometry (GC/MS). This method allows for different drugs and other components that may be present in a sample to be separated based on their individual molec-ular weights (size).

5 The representative sample is dissolved in an organic solvent then vaporized at high temperature into a gas. The vaporized sample then passes through the Gas Chromatography (GC) instrument, and any components in that sample will separate from one another over time. Larger molecular weight components pass through at a slower rate than smaller components. The identification of individual sample components is confirmed using the Mass Spectrometery (MS) instru-ment. The separated components pass through the GC into the MS where the component molecules are bom-barded with electrons to produce a unique molecular fragmentation pattern, much like a chemical finger-print.

6 This chemical fingerprint is used to identify what the component is, whether it be a drug or some other substance. Therefore, when evidence is tested, the sci-entists are able to identify all controlled substances pre-sent in the sample by performing one test. For more information, please contact Kimberly Gil-son, Forensic Chemist, at (440) 350-2793 or You may also contact Douglas Rohde, Supervisor of Chemistry and Toxicolo-g y , a t ( 4 4 0 ) 3 5 0-2 7 9 3 o r D o u g ANSWERED BY SCIENTIST KIMBERLY GILSON E X P E R T I N F O R E N S I C C H E M I S T R Y This Column Answers Questions Commonly Asked of our Scientists T H E C R I M E S C E N E W I N T E R 2 0 1 4 The Gas Chromatograph/Mass Spectrometer sepa-rates and identifies the drugs present within the evi-dence.

7 PAGE 3 has received more than 500 hours of training in the field of digital evidence examination. I obtained my training through spending hundreds of hours in special-ized computer and mobile device train-ing classes, Walsh said. Walsh contin-ues to take classes to stay current. His area of expertise is constantly evolving: as technology advances, so do the chal-lenges Walsh faces. He is constantly learning more, updating his information, reviewing his skills and adding to his experience. Walsh s job does not just keep him up-to-date with current technological de-velopments; he also has to be familiar with antiquated technology that is no longer common but might become part of an investigation.

8 While keeping up with the technolog-ical world can be overwhelming, Walsh takes a lot of pride and joy in being able to help law enforcement. I am always happy to know I helped one of our agencies obtain a conviction, especially when it is a crime involving child exploitation, Walsh said. Walsh has been examining digital evidence since before cell phones were smart phones and before laptops were commonplace. Digital evidence examination is a lot more complicated than searching a sus-pect s internet history. Walsh can even find damaged, encrypted, and deleted files in a computer. Likewise, Walsh can find text mes-sages and call information in a cell phone s memory.

9 That information can, in turn, be used to establish a connec-tion between people who are involved in a crime. Practically anything with digital in-formation may potentially yield evi-dence, even video game systems or GPS units. For example, a car s GPS unit might give Walsh information about the car s movement, location, and speed. This evi-dence can aid an investigation by either coinciding with or contradicting a per-son s story. In August 2010, Walsh began work-ing with the Lake County Crime Labora-tory as a volunteer. He performed volun-tary technical reviews for the Digital Evidence section when it first began. When Walsh s predecessor left for the corporate world, Lake County Prosecu-tor Charles Coulson offered Walsh a job, and he accepted.

10 Walsh was also an instructor at the Cuyahoga Community College Police Academy (CONTINUED ON PAGE 4)Jamie Walsh: On the Cutting Edge of Cyber Crime Continued from Page 1 HIGHLIGHTS Certified Forensic Com-puter Examiner (CFCE), IACIS (International Asso-ciation of Computer Inves-tigative Specialists) AccessData Certified Ex-aminer (ACE), AccessData Past President and found-ing member of the High Technology Crime Investi-gation Association, Ohio Chapter 2009 Hall of Fame Award for the High Technology Crime Investigation Asso-ciation, Ohio Chapter Contact Info: (440) 350-2793 T H E C R I M E S C E N E W I N T E R 2 0 1 4 Jamie Walsh: On the Cutting Edge of Cyber Crime Continued from Page 3 PAGE 4 from 1992 to 2007.