-
Notifications
You must be signed in to change notification settings - Fork 6
/
index.html.in
190 lines (178 loc) · 11.5 KB
/
index.html.in
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
---
<!-- layout: blank -->
title: Urgent Evidence
jumbo_desc: CASE Sub-topic of Chain of Custody
---
<div class="row">
<div class="col-xs-12">
<h2>Introduction</h2>
<p>When evidence is submitted to a lab for analysis, the submitter has the option to submit the evidence as "Urgent" or "Rushed." This normally occurs when the evidence is known to have a quick turnaround (i.e. the case's scheduled court date occurs within a few days, or the evidence is needed to execute a search warrant, etc.). Indicating something as "Urgent" evidence requires examiners/analysts to push that evidence to the front of the analysis queue; that is, that evidence will be examined/analyzed next before continuing to work on any backlog cases/investigations.</p>
<p>An urgent submission which goes through the laboratory will follow an identical process to that of any submission, except in some cases urgent evidence may bypass a standard initial destination of an evidence vault, instead heading straight to processing. The chain of custody would need to accommodate this omitted visit, while still maintaining the integrity of the evidence's handling.</p>
<h2>Narrative</h2>
<p>An investigator receives evidence that a submitter has marked as urgent. The following table shows the timeline of this exhibit's processing, jumping straight to a processing kiosk instead of the evidence vault.</p>
<div class="table-responsive">
<table class="table table-bordered table-condensed">
<thead>
<tr>
<th>Date / Time</th>
<th>Action</th>
</tr>
</thead>
<tbody>
<tr>
<td>01/01/2019 14:00</td>
<td>Exhibit submitted for Kiosk examination</td>
</tr>
<tr>
<td>01/01/2019 14:05</td>
<td>Exhibit seal checks (passed) & Exhibit receipted in lab</td>
</tr>
<tr>
<td>01/01/2019 14:05</td>
<td>Exhibit assigned to Kiosk technician</td>
</tr>
<tr>
<td>01/01/2019 14:15</td>
<td>Sealed Exhibit Photographed</td>
</tr>
<tr>
<td>01/01/2019 14:20</td>
<td>Exhibit Unsealed</td>
</tr>
<tr>
<td>01/01/2019 14:21</td>
<td>Unsealed Exhibit Photographed</td>
</tr>
<tr>
<td>01/01/2019 14:25</td>
<td>Exhibit Connected to Kiosk & process started</td>
</tr>
<tr>
<td>01/01/2019 14:55</td>
<td>Exhibit Disconnected from Kiosk</td>
</tr>
<tr>
<td>01/01/2019 15:00</td>
<td>Exhibit Resealed</td>
</tr>
<tr>
<td>01/01/2019 15:03</td>
<td>Picture selected, via kiosk review screen, from those extracted from exhibit</td>
</tr>
<tr>
<td>01/01/2019 15:05</td>
<td>Report DVD Generated as associated exhibit</td>
</tr>
<tr>
<td>01/01/2019 15:10</td>
<td>DVD Report sealed</td>
</tr>
<tr>
<td>01/01/2019 15:15</td>
<td>Witness statement completed</td>
</tr>
<tr>
<td>01/01/2019 15:20</td>
<td>Sealed Exhibit handed the OIC & Transfer documentation signed</td>
</tr>
</tbody>
</table>
</div>
<h2>Discussion: Kiosk Investigations</h2>
<p>For a kiosk investigation the laboratory will not be part of the process, instead the interaction will be directly between the kiosk trained submitting officer and the kiosk used, and will follow a known sequence of steps either directed by a documented instruction/script or directly by the on-screen step processes built into the kiosk itself.</p>
<p>Therefore the only chain of custody information will be that which recorded on the kiosk during the sequence of steps, and would be along the lines of:
<ul>
<li>Date/Time Exhibit unsealed</li>
<li>Date/Time Exhibit photographs taken by officer are uploaded</li>
<li>Date/Time [Sub-]Exhibit (e.g. SIM Card, MemoryCard, Phone, etc.) is connected to kiosk</li>
<li>Date/Time of processes started & completed by Kiosk (may contain numerous entries depending on level of detail provided by vendor)</li>
<li>Date/Time [Sub-]Exhibit was disconnected from Kiosk</li>
<li>Date/Time Exhibit was resealed</li>
</ul>
<p>and would be automatically generated by the kiosk as part of the data exported in CASE format within the Report package contained on the DVD in the final steps above. The idea being that the kiosk activity could subsequently be imported into a Case Management System for review and quality control.</p>
<p><em>Note: The above chain of custody details (i.e. unseal, photograph, connect to forensic tool, image, process, disconnect from forensic tool, reseal) are effectively identical to the chain of custody typically used within the laboratory environment.</em></p>
<h2 id="queries">Illustrative Data and Queries</h2>
<p>The queries in this section, and their computed results, are backed by the data in <a href="urgent_evidence.json">urgent_evidence.json</a>.</p>
<p>Events, locations, tools, and people represented in this and other CASE narratives are presented, and at many times created, for illustration purposes only and do not necessarily represent real events, locations, tools, or people.</p>
<div class="card">
<h5 class="card-header" id="query-action_timeline">Action timeline</h5>
<div class="card-body">
<p class="card-text">According to the CASE report, what is the timeline of all of the recorded actions? (<a href="src/query-action_timeline.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_ACTION_TIMELINE_SPARQL@
{% endhighlight %}
@QUERY_ACTION_TIMELINE_HTML@
</div>
</div>
<div class="card">
<h5 class="card-header" id="query-investigative_locations">Locations</h5>
<div class="card-body">
<p class="card-text">According to the CASE report, in what locations did the investigative actions take place? (<a href="src/query-investigative_locations.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_INVESTIGATIVE_LOCATIONS_SPARQL@
{% endhighlight %}
@QUERY_INVESTIGATIVE_LOCATIONS_HTML@
<p class="card-text">Of note:</p>
<ul>
<li class="card-text">CASE and UCO do not yet implement the concept of <code>roomId</code>. It is provided here to assist with future concept development.</li>
<li class="card-text">The evidence vault—room B-001—is not among these locations. The urgency of the processing caused that room to be bypassed.</li>
<li class="card-text">The witness statement is produced by the analyzing officer, following <a href="https://www.cps.gov.uk/legal-guidance/admitting-evidence-under-sections-9-and-10-criminal-justice-act-1967">UK Crown Prosecution Service Guidance</a>. (Were this a civil case, <a href="https://www.justice.gov.uk/courts/procedure-rules/civil/standard-directions/general/witness-statements">UK Ministry of Justice Guidance</a> would have been followed instead.) The officer's signed statement describes the officer's experience, role, and training, and describes and accompanies the chain of custody and analysis results up through the kiosk's processing conclusion in the evidence processing lab.</li>
</ul>
</div>
</div>
<div class="card">
<h5 class="card-header" id="query-investigative_personae">Investigative personae</h5>
<div class="card-body">
<p class="card-text">According to the provenance chain, who was involved in handling this evidence? (<a href="src/query-investigative_personae.sparql">SPARQL source</a>)</p>
<p class="card-text">The evidence exhibit number is <code>EXH-20190101-7</code>.</p>
{% highlight sparql %}
@QUERY_INVESTIGATIVE_PERSONAE_SPARQL@
{% endhighlight %}
@QUERY_INVESTIGATIVE_PERSONAE_HTML@
</div>
</div>
<div class="card">
<h5 class="card-header" id="query-exhibit_photos">Photographs of exhibits</h5>
<div class="card-body">
<p class="card-text">What photographs were taken of the exhibit and sub-exhibits? (<a href="src/query-exhibit_photos.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_EXHIBIT_PHOTOS_SPARQL@
{% endhighlight %}
@QUERY_EXHIBIT_PHOTOS_HTML@
</div>
</div>
<div class="card">
<h5 class="card-header" id="query-actions_to_artifact">Actions to artifact</h5>
<div class="card-body">
<p class="card-text">Among the artifacts extracted from the device, a picture file <code>IMG_1863.jpg</code> was extracted. Starting at initial evidence submission, what actions were taken to extract that file?</p>
<p class="card-text">This query inspects the derivation chains of artifacts. A supplemental graph of a <a href="https://www.w3.org/TR/prov-o/#wasInformedBy">predicate adapted from the W3C PROV Ontology</a> creates a chain of <code>InvestigativeAction</code>s that can be analyzed with a path operator. (SPARQL source for <a href="../src/query-construct-wasInformedBy.sparql"><code>wasInformedBy</code></a>.)</p>
{% highlight sparql %}
@QUERY_CONSTRUCT_WASINFORMEDBY_SPARQL@
{% endhighlight %}
<p class="card-text">That graph is then analyzed with the <code>*</code> path operator. The query uses <code>*</code> instead of <code>+</code> in order to include the action that generated the file as well. (<a href="src/query-actions_to_artifact.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_ACTIONS_TO_ARTIFACT_SPARQL@
{% endhighlight %}
@QUERY_ACTIONS_TO_ARTIFACT_HTML@
</div>
</div>
<div class="card">
<h5 class="card-header" id="query-initial_evidence_submission">Initial Evidence Submission</h5>
<div class="card-body">
<p class="card-text">What objects were the initial evidence submission(s) into the <code>ProvenanceRecord</code> chain? (<a href="src/query-initial_evidence_submission.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_INITIAL_EVIDENCE_SUBMISSION_SPARQL@
{% endhighlight %}
@QUERY_INITIAL_EVIDENCE_SUBMISSION_HTML@
<div class="card">
<h5 class="card-header" id="query-selection_from_automated_exhibit_extraction">Selection from Automated Exhibit Extraction</h5>
<div class="card-body">
<p class="card-text">Several picture files were extracted by the kiosk, tracked in the internal process-record exhibit <code>EXH-20190101-7-KioskReport</code>. Some of them were selected by the investigator for presentation in exhibit <code>EXH-20190101-7-B</code>, after visual review of just some of the files. Which were extracted, displayed, and selected? (<a href="src/query-selection_from_automated_exhibit_extraction.sparql">SPARQL source</a>)</p>
{% highlight sparql %}
@QUERY_SELECTION_FROM_AUTOMATED_EXHIBIT_EXTRACTION_SPARQL@
{% endhighlight %}
@QUERY_SELECTION_FROM_AUTOMATED_EXHIBIT_EXTRACTION_HTML@
</div>
</div>
</div>
</div>