keydet89 wrote:
As such, I would think that it would be a benefit for everyone if more of this stuff was shared. If you look it and consider it, and then make a reasoned choice whether you can incorporate it or not, that's cool. Or maybe just ask for clarification. I think that we can all benefit from sharing our perspectives, whether we use the information or not.Sure <img src="images/smiles/icon_smile.gif" alt="Smile" title="Smile" /> , and the good thing of a forum is the possibility to talk and provide and discuss opinions and ideas.
TuckerHST wrote:
Possible red herring, yes. It would be terrible advice to give a n00b who lacked the ability to separate the wheat from the chaff. On the other hand, there are almost always factors that narrow the relevant issues, and it's part of an investigator's job to exercise good judgment. For example, if the case concerns a narrow window of time, say a month, and image creation dates were during that time, it would be imprudent not to examine the EXIF data.Of course <img src="images/smiles/icon_biggrin.gif" alt="Very Happy" title="Very Happy" /> , but here, in this thread and in this context it is the least probing piece of info one can find.
Let's hypotize that a set of three images with geotags of Miami are found on that laptop, NOT picturing the suspect (and of course NOT taken with the laptop on-board camera).
Please consider how if you find a picture of the suspect in Miami, that proves that the suspect was in Miami and not that the laptop was there. (unless in the picture the laptop was held in his/her hands and in such a way that you can read in the picture the serial or COA sticker, or the laptop cover has an identifiable crack/scratch, etc. <img src="images/smiles/icon_wink.gif" alt="Wink" title="Wink" /> )
Excluding beforehand that the pictures were downloaded or received as attachment to e-mail, etc. (which could anyway be a third possibility) there are two ways they could reach the laptop's hard disk:
they were copied to it from a Mass Storage device (say USB stick or SD card)
they were copied from it from the camera/device that took the pictures directly
If #1, nothing connects the pictures (and the locations where they were made) to the movements of the laptop.
Two weeks ago my cousin came back from a trip in Egypt, took the SD card out of her camera and, since my wife's desktop has not a SD card reader, they used my laptop to see the pictures. The laptop has never been in Egypt. Really.
If #2, is the same, at the most, if the camera that took those pictures is among OTHER items seized found in the possession of the suspect, then it means that the camera (and not necessarily the laptop) has been in Miami.
My cousin did download the same pictures to her laptop once back, but she didn't brought it with her on the trip, just the camera.
Really.
jaclaz
↧