Enterprise security investigators, investigative firms and law enforcement more often today are involved in incidents that center on digital cameras, camera-embedded cellular telephones and other image capture and storage devices. In addition to crimes of violence and assaults, digital cameras can be the thief’s tool in intellectual property crimes – in offices, plants, research and development centers. There have been reported incidents of a visitor to a corporation taking illicit pictures with a personal cell phone, sending them to a remote site and then erasing the photos. Some enterprises now prohibit cell phones in certain sensitive areas. Similar to data erased from a computer hard drive and e-mails erased from a local desktop, erased digital photos may still be recoverable during an investigation. – Editor

The Wall Street Journal, just two years ago, estimated that approximately three billion of the six and a half billion people in the world would have a cell phone. Many of these phones have Internet access and digital cameras built into them. In addition to that, millions of digital cameras, personal computer Web cams, and digital picture frame devices are sold worldwide. These statistics are meant to give an idea of the enormity of digital picture taking and sharing activities.
     
It is also common knowledge that cybercrime has been increasing in magnitude each year. However, another interesting development has been the number of electronic devices that show up at crime scenes as either belonging to the victim or having been dropped or left by an alleged criminal.

Many of these phones or cameras contain evidence of the crime or support a timeline of people associated with the crime. Security executives may have taken the devices from someone on the corporation’s private property, suspecting business espionage. On the law enforcement side, many sex crime assailants use cell phone cameras and digital cameras to take pictures of their victims as a type of trophy to view at later times. Other people break the federal Video Voyeurism Law of 2004 by using Web cams, cell phone cameras, or other such devices to take pictures of people in business and private places where there is an expectation of privacy. People in changing rooms, locker rooms, and even public toilets have had their picture taken without consent which violates the laws of many countries.
     
It is, therefore, imperative that corporate and law enforcement investigators learn how to examine such devices for pictures after they are lawfully seized for an investigation.
     
It is important to realize that cell phones, digital cameras, and other digital picture devices often use a FAT 32 or ext 3 file system that act as a small hard drive. That means that if a device has wireless, infrared, or Bluetooth capability, then a person could have covertly placed the picture on that device. The resolution or color schema of the picture may prove that the camera or phone in question could not have taken the picture.
     
Sometimes people will intentionally delete pictures from a digital camera. On other occasions the hardware or operating system will fail and delete the pictures. No matter the situation, it’s important to understand how to retrieve digital photographs.

One method that works well is by connecting a cable from the device in question to a personal computer and then running recovery software. It is a good practice to have a “write blocker” for the USB port so that the device in question is not altered by the recovery software. Write blockers can be hardware or software changes to the operating system registry.
     
There are many recovery software packages that work well. One used by the authors is a program from www.RecoverMyFiles.com employed to recover 550 pictures from a young lady’s camera. The camera owner was in the U.S. studying cybercrime. The process took approximately three hours. However, she said there were about 600 pictures and 50 that were recovered were not visible. The authors then used another program called Data Lifter 2 with its utility File Extractor Pro and uncovered the other 50 pictures in about two hours. That utility is excellent at taking fragmented pictures and assembling them.
     
So in investigations, it is helpful to learn something about digital evidence collection and picture recovery.
     
The portability of the aforementioned devices has obviously become both a blessing and a burden.  For the good and honest parts of the world population, the advent of digital and wireless technology serves to enhance the quality of life.  However, the criminal paradoxically could say the same thing about his or her high-tech ability to expand an illegal enterprise.
     
The challenge for private security and criminal justice is that the technology most often changes to the advantage of the bad guys.
     
They only need to think of one way to abuse a given technology.  The investigator is put in the position of having to sift through the various combinations and permutations of that same technology to unravel the crime.  The answers are not easy.  At the least, it would take a higher level of cooperation than currently exists from tech manufacturers to thwart the furtherance of criminal activities in the areas described herein.