Rules/protocols for evidence retention and investigation [Archive]

tfk

11th September 2009, 10:56 AM

Matt,

I ran into this really interesting publication from Washington State Patrol.

It describes the proper procedures for gathering forensic evidence, and it describes some of the tests that are done on things like paint & explosives.

http://www.wsp.wa.gov/forensics/docs/bureau/fsg_0708_rev4.pdf

Excerpts:

Explosives

Laboratory personnel should never accept unexploded (intact) explosive devices. If the items are hand- delivered, the people receiving the evidence should verify that the explosive material(s) was removed from the device and that all triggering mechanisms have been removed and/or rendered inoperative.

Explosives analysis is performed in the Cheney, Marysville, Seattle, and Tacoma laboratories. Explosive analysis entails the identification of the explosives removed from an explosive device and/or the examination of bomb fragments and debris recovered from the scene of an explosion. Often bomb fragments and explosion site debris will be examined to not only attempt to identify the explosives used but also for the presence of wires, circuitry, batteries, and any other material that may provide information on the nature of the device used. Other times materials will be examined to determine if they were incendiary-type devices used to initiate a fire or cause damage to a specific object. An example would be the use of Thermite® to damage a car or gain entry to a metal container.

Stereomicroscopy will permit the examination of items for the presence of unreacted explosive and explosive reaction products. Particle picking will permit characterization and the identification of these materials. If there are no visible particles, an acetone wash (to isolate organic explosives) followed by a water wash (to isolate inorganic explosives), will facilitate subsequent tests for explosives and their reaction products. Physical examination of the fragments, including stereomicroscopy and scanning electron microscopy, may provide information on the nature of the device that was used. The following instrumentation and techniques are used in the analysis of explosives:

Sterobinocular microscopy
Comparison polarized light microscope (PLM)
Melting point determinations
Microchemical testing
Fourier Transform Infra-red spectroscopy (FTIR)
Raman Spectroscopy
X-ray fluorescence spectroscopy (XRF)
Scanning electron microscopy-energy dispersive spectroscopy (SEM-EDS)
Gas Chromatography/Mass Spectrometry (GS-MS)
Capillary-Electrophoresis (CE)

___

POST-BLAST DEBRIS

Debris from an explosion may be burned, buried in rubble, and/or scattered over a wide area. Pieces of an explosive device may be thrown farther from the site of an explosion than one might think. An extensive search of the surroundings and painstaking sifting through rubble may be required to obtain important evidence. This evidence may include fragments of the explosive device itself (e.g., pipe fragments, blasting caps, electrical components) or chemical residues deposited on objects near the explosion. Crime laboratory analysis can often determine what explosive material was used in the device, and may sometimes provide information about the general construction of the device, and how the device was initiated. In some cases, unusual or distinguishing characteristics of the explosive or the device can be linked to materials in a suspect's possession.

COMPONENTS OF EXPLOSIVE DEVICES AND DEACTIVATED DEVICES

Components of explosive devices may include tape, glue, containers, pipes, fuses, wires, blasting caps, clothespins, clocks, remote controls, etc. Many everyday items can be used in the construction of an explosive device, and nothing about these items may be suspicious or sinister in itself. When found together with bulk explosives, or when found partly assembled, the particular combination of materials found may suggest how these materials might be combined in an explosive device. Unexploded devices, and the individual components of a device, will often provide the best evidence to link an individual to a bombing attempt. Fingerprints will often be intact, tape and glue will not have burned away, wiring and fusing will be undisturbed. In such cases, chemical analysis along with trace examination and fingerprinting can provide a more complete picture of the device, and there is a much greater chance of connecting the device to an individual.

COLLECTION AND PACKAGING OF EXPLOSIVES EVIDENCE

• Do not submit active devices to the laboratory. Active devices, including blasting caps, should be dismantled, deactivated, or discharged in some way before submission to the laboratory. Call your local bomb squad or the Washington State Patrol Bomb Unit to deactivate the device. Make note of what method was used to deactivate the device (e.g., water cannon, blown up with dynamite, etc.), and provide this information when submitting the evidence.

• Items with sharp or jagged edges should not be packaged in paper envelopes. Use sturdier containers such as clean metal paint cans.

• Many explosives, particularly "high" explosives, contain components that are volatile and will evaporate over time. If it is suspected that high explosives (e.g. dynamite, nitroglycerin, C4, etc.) may be present, evidence should be packaged in a vapor-tight container. Clean metal paint cans or vapor-tight plastic bags (such as Kapak bags) are suitable to preserve volatile evidence.

• Submit only small amounts of bulk explosives. Be sure to include representative samples of the bulk material, especially if there are indications of mixtures. Typically a teaspoon of material is sufficient for laboratory analysis of bulk explosives.

• Flash powder can be very sensitive and may ignite with a spark. If possible, package flash powder in anti- static plastic bags, made for use with static-sensitive computer components; or use paper packages, making sure to completely seal all openings and seams – flash powder is a very fine powder and will seep out of very small openings. Do not package bulk flash powder in metal containers or plastic bags not designed to be static-resistant.

• Whenever possible, submit control samples in a separate package along with the evidence. For example, if soil from a blast site is submitted, also collect a sample of similar soil from an area away from the seat of the blast. If a portion of rubber molding with blast residues is submitted, also submit a clean area of the molding. Package controls in the same manner as samples with residues – the manner in which a piece of material is packaged can affect the analysis (e.g., bacterial action in soil over time).

• Porous materials or objects with cracks and ridges tend to collect a large amount of useful residues. Materials from near the blast site such as foam, rubber, pipe threads, cardboard, or any rough-surfaced items will often be useful items to collect.

• If fingerprint analysis is desired, submit the items to the crime laboratory first. Indicate clearly that a fingerprint examination is needed. The crime laboratory can usually forward evidence to the latent prints laboratory after the explosives analysis is finished.

• Give the laboratory as much information as possible about the circumstances of the case. If evidence is from a blast scene, send pictures, diagrams, witness statements, officer's reports, etc. If a suspect has been interviewed or a premise searched, send information about what the suspect may have been involved with, including internet recipes, jars of chemicals recovered, statements from the suspect about what kind of device he was making, etc. The more information the laboratory has about the circumstances of a case or the source of a particular item of evidence, the better able we will be to help investigate an incident.

• The person who collects explosives evidence must be free of contamination. If the individual collecting evidence has been involved with explosives recently, they should wear clean clothing including footwear.
Hands should be washed and gloves should be worn. If very small amounts of explosives residues are involved, alcohol swabs and water swabs (with controls) should be taken of the evidence collector’s hands and shoes, before any evidence is collected. Submit these swabs along with the evidence.

• For larger scale incidents than are typically encountered, assistance may be required from an agency with more resources at its disposal than any local agency or the state crime laboratories. For scenes beyond the capabilities of local responders or the laboratory, it may be necessary to contact your local BATF or FBI office. The BATF and FBI can provide scene response, investigative assistance, and laboratory services in cooperation with local agencies and the state crime laboratories. When in doubt, call the state crime laboratory, and a BATF or FBI field office.

If any questions arise about evidence collection or about what services the laboratory can provide, call the state crime lab for assistance and advice.

____

Gathering paint samples:

PAINT AND OTHER PROTECTIVE COATINGS

Chips and fragments of protective coatings-such as paint, varnish, lacquer, enamels, and plastics-can often be found at the scenes of hit-and-run cases and burglaries involving forced entries. A transfer of paint can occur when two vehicles collide. Chips of paint at the accident scene or on the victim's clothing may produce information regarding the year, make, and model of the vehicle which fled the scene. Traces of paint on burglary tools may connect these tools to the burglary scene.

Significance

The examination and comparison of paint or other protective coating chips and fragments may reveal:

• That the paint chip from the scene came from a particular object or vehicle by a physical match (i.e., the questioned paint chip edges fit like a piece of a jigsaw puzzle with edges of the damaged area).

• A possibility of common origin if the questioned chips and control samples show similarities in physical and chemical characteristics. Multilayered chips which also show similarities and correspondence in the number of layers, order of colors, and thickness of the layers can increase the probability of a common origin to a very high degree, sometimes approaching the level of reasonable, scientific certainty.

• The type of paint or coating and its applications. This information may lead to a possible source. Chips left by an automobile at a hit-and-run scene may produce information regarding the make, model, and year of manufacture.

Collection

• Paperfolds and plastic or paper envelopes can be used to collect the paint samples. Paper is preferred over plastic because of the static electricity buildup problems of plastic.
• Small samples of material should be collected on a clean piece of paper. The paper fold is then labeled, sealed, and placed in an envelope, which in turn is labeled and sealed.

• A convenient method of collecting paint scrapings is to tape an envelope or clean sheet of paper just below the sampling area. Hold the envelope or paper open and scrape the paint samples loose, allowing them to fall into the paper. Be sure the paint samples contain all the layers of paint down to the underlying surface. Use a new, clean blade for sampling each particular area. Tape the corners and seams of the envelope or use folded paper.

• If the item containing the paint or paint smear is small enough, the entire item should be submitted to the laboratory. Do not attempt to remove the paint.

• If an item is too large to submit to the laboratory, control paint chips or the questioned paint chips representing all of the layers must be submitted. Do not scrape off the sample in such a manner that the paint chip sample contains only a partial number of layers. The forensic scientist will examine a cross- section of the chip to determine the number, depth, and the color of each layer.

Packaging

• Each of the recovered items must be packaged separately, properly labeled, and sealed. If a vehicle is involved, labeling should include the location on the vehicle, make, model, year, VIN, and license plate number. Envelopes must be sealed on the corners with tape to ensure that no leakage occurs. Put the paint chips into a folded paper packet and label, then place the packet into a second envelope, also labeled properly.

• Tools with paint smears must be protected to avoid loss or contamination of the questioned paint. The area containing the paint smear should be protected with soft tissue paper, and the tool packaged securely into an appropriate container (e.g., box).

• If paint chips are to be submitted for a possible physical match, they must be packaged so that the chips do not break. The chips must be protected with tissue paper or cotton and placed in a small, rigid container.

CONTROL/REFERENCE SAMPLES

• In all cases, the control samples must be taken from an undamaged area immediately adjacent to the area of damage or of interest. The collected chips must contain all of the layers down to the underlying surface. If a physical match is possible, all paint from the damaged area must be collected or the item submitted.

• When investigating a hit-and-run collision, control samples should be taken from each vehicle. The samples should be taken from the undamaged area on the same panel immediately adjacent to the damage.
Similar control samples must be taken from the suspect vehicle when it is apprehended. Different body panels or parts may have different paint or layer structure. Samples from each damaged panel must be taken (i.e., fender and door).

• At burglary scenes, control samples should be taken from an area immediately adjacent to the toolmark. Do not touch the toolmark itself; it may be altered and rendered useless for later toolmark comparison examinations. The paint on a door or window jamb may not be the same as on the door or window itself. If it appears that paint may have transferred from both surfaces, control samples must be taken from each surface.
____

Tom