Fighting crime, one USB drive at a time

The NSW Police Force is on a mission to boost the digital capability of the state's law enforcement, enlisting the support of 50 frontline officers specially trained in identifying and preserving electronic evidence.

The Technology Enabled Crime Officers, or TECOs, are the first to undergo an intensive two-week training program which takes them through network architecture, metadata and encryption and the use of specialised forensic tools. Another 10 are expected to complete the course in August.

Inspector Glenn Allen, Operations Controller of the State Electronic Evidence Branch, told iTnews one of the main aims of the TECO training was to ensure officers don’t compromise the integrity of data in the process of capturing and analysing it.

“Take SMS messages as an example,” he said.

“If an officer was simply to go through the inbox of a suspect’s phone then they would unintentionally change the data. A message would be changed from being unread to read and the officer would have modified the access times as recorded on the device."

The TECOs use tools such as data extraction devices and write-blocker software to ensure they don’t leave their own digital footprint on the sensitive information they are trying to extract.

The TECOs are also trained to use the ADF Solutions Triage-Examiner, a USB key which has been designed to scan a suspect’s laptop or PC for valuable evidence.

“We also provide TECOs with refresh keys so that after each and every deployment of their forensic laptop it is completely sanitised and brought build so that there is no possibility of data remaining on the system that could contaminate a future investigation,” Inspector Allen said.

The 50 TECOs, along with around 150 of their mobile-specialist colleagues, have examined roughly 1000 mobile phones, 200 computers, 320 data storage devices and 92 other devices like GPS systems since January this year.

Allen said the deployment of TECOs into investigations had already proven benefical.

"[During a recent investigation in Sydney] investigators received a complaint of sexual assault, but there was little physical or other corroborative evidence recovered.

“However when investigators executed a search warrant they identified a document in a rubbish bin at the suspect’s premises which appeared to analyse the strengths and weaknesses of the allegations against the suspect. Police had not actually spoken to that person at the time," he said.

“The local TECO was enlisted to analyse the suspect’s computer and establish the time the document was created and some of the search terms that were used to find the content. Those search terms pretty much corroborated the version that the victim had supplied to the police.

“The fact that the searching that was undertaken on the computer related to same activities that the victim had alleged took place corroborated their version of events in the absence of any physical or biological evidence,” he added.

Allen recounted another recent case where a person suspected of selling a single firearm went on to face several charges after photos of more guns were found on his phone.

The TECO training also offers a guide on the legal parameters police officers must work within while gathering evidence. Allen said the same search warrant legislation that applies to non-electronic evidence applies to TECOs and their investigations.

The expanding force of TECOs and mobile device officers complement the specialist electronic evidence lab that has been operating in the force for more than a decade. Allen declined to comment on the number of such specialists in NSW for operational reasons.