Winter - Lake County, Ohio

WINTER 2014
THE
CRIMESCENE
NEWSLETTER OF THE LAKE COUNTY CRIME LABORATORY
Jamie Walsh: On the Cutting Edge of Cyber Crime
Jamie Walsh has only been a Digital Evidence Examiner with the Lake County Crime Laboratory since November 2011, but he is an old hand when it comes to examining computers and mobile devices.
As cell phones and computers are used more often in
cyber crime, Walsh’s experience is invaluable in helping
catch criminals.
Walsh worked for the Wickliffe Police Department for
32 years before joining the Lake County Crime Laboratory full-time.
From 1998 through 2011, he served as a detective for
the department and his interest in electronics became
part of his casework.
“I have always had an interest in computers. When I
was assigned to the detective bureau at the Wickliffe
PD, I was able to use those skills and started doing my
own computer and mobile device forensics,” Walsh said.
Walsh began working in digital forensics before there
were degrees available in that field. Instead, he studied
in specialized classes and (CONTINUED ON PAGE 3)
Jamie Walsh
Caught by Science
No witness saw Michael Aquila peer through JoAnne’s bedroom window at 4 a.m. on Aug. 17, 1995. No one
observed Aquila sneak into JoAnne’s Willoughby apartment. No one heard Aquila attempt to rape the sleeping
JoAnne and then cut her throat. The sound of the struggle did not wake her neighbors or even her family, who
were sleeping in another bedroom. Aquila fled, leaving
JoAnne mortally wounded. But JoAnne managed to call
911.
When a paramedic asked 27-year-old JoAnne who did
this to her, she could only groan, “I don’t know” and “I
want to live.” Then JoAnne died.
Upon arrival at the crime scene, the police and the
Crime Laboratory scientists (CONTINUED ON PAGE 5)
PAGE 1
THE CRIMESCENE WINTER 2014
Frequently Asked Questions
This Column
Answers
Questions
Commonly
Asked of our
Scientists
ANSWERED BY SCIENTIST KIMBERLY GILSON
EXPERT IN FORENSIC CHEMISTRY
Q: Two kids smoked marihuana from the bong tested
by the LCCL. It was later discovered that the kids became extremely sick after using the bong, and they believed the marihuana was mixed with something else.
The report shows that the bong was tested and the presence of marihuana was located, but the police now suspect the presence of another narcotic.
Do you think that the bong should be retested because of the new suspicions of another narcotic?
A: No. When evidence is sampled and analyzed, any
controlled substances that are present in that sample
will be separated from one another and identified. With
a few exceptions (Khat, LSD, mushrooms, steroids),
multiple tests do not need to be run to identify each separate drug that may be present in a sample.
When controlled substance evidence is submitted to
the laboratory, a representative sample of that evidence
is removed, whether it is a small amount from a larger
population or a swab of a residue. The sample is then
analyzed utilizing Gas Chromatography/Mass Spec-
trometry (GC/MS). This method allows for different
drugs and other components that may be present in a
sample to be separated based on their individual molecular weights (size).
The representative sample is dissolved in an organic
solvent then vaporized at high temperature into a gas.
The vaporized sample then passes through the Gas
Chromatography (GC) instrument, and any components
in that sample will separate from one another over
time. Larger molecular weight components pass
through at a slower rate than smaller components.
The identification of individual sample components
is confirmed using the Mass Spectrometery (MS) instrument. The separated components pass through the GC
into the MS where the component molecules are bombarded with electrons to produce a unique molecular
The Gas Chromatograph/Mass Spectrometer separates and identifies the drugs present within the evidence.
fragmentation pattern, much like a chemical fingerprint. This chemical fingerprint is used to identify what
the component is, whether it be a drug or some other
substance. Therefore, when evidence is tested, the scientists are able to identify all controlled substances present in the sample by performing one test.
For more information, please contact Kimberly Gilson, Forensic Chemist, at (440) 350-2793 or [email protected]. You may also contact
Douglas Rohde, Supervisor of Chemistry and Toxicology,
at
(440)
350-2793
or
[email protected].
PAGE 2

Certified Forensic Computer Examiner (CFCE),
IACIS (International Association of Computer Investigative Specialists)

AccessData Certified Examiner (ACE), AccessData

Past President and founding member of the High
Technology Crime Investigation Association, Ohio
Chapter

2009 Hall of Fame Award
for the High Technology
Crime Investigation Association, Ohio Chapter
Contact Info:
(440) 350-2793
[email protected]
Jamie Walsh: On the Cutting Edge of
Cyber Crime
Continued from Page 1
has received more than 500 hours of
training in the field of digital evidence
examination.
“I obtained my training through
spending hundreds of hours in specialized computer and mobile device training classes,” Walsh said. Walsh continues to take classes to stay current. His
area of expertise is constantly evolving:
as technology advances, so do the challenges Walsh faces. He is constantly
learning more, updating his information,
reviewing his skills and adding to his
experience.
Walsh’s job does not just keep him up
-to-date with current technological developments; he also has to be familiar
with antiquated technology that is no
longer common but might become part of
an investigation.
While keeping up with the technological world can be overwhelming, Walsh
takes a lot of pride and joy in being able
to help law enforcement.
“I am always happy to know I helped
one of our agencies obtain a conviction,
especially when it is a crime involving
child exploitation,” Walsh said.
Walsh has been examining digital
evidence since before cell phones were
smart phones and before laptops were
commonplace.
Digital evidence examination is a lot
more complicated than searching a suspect’s internet history. Walsh can even
find damaged, encrypted, and deleted
files in a computer.
Likewise, Walsh can find text messages and call information in a cell
phone’s memory. That information can,
in turn, be used to establish a connection between people who are involved in
a crime.
Practically anything with digital information may potentially yield evidence, even video game systems or GPS
units.
For example, a car’s GPS unit might
give Walsh information about the car’s
movement, location, and speed. This evidence can aid an investigation by either
coinciding with or contradicting a person’s story.
In August 2010, Walsh began working with the Lake County Crime Laboratory as a volunteer. He performed voluntary technical reviews for the Digital
Evidence section when it first began.
When Walsh’s predecessor left for the
corporate world, Lake County Prosecutor Charles Coulson offered Walsh a job,
and he accepted.
Walsh was also an instructor at the
Cuyahoga Community College Police
Academy (CONTINUED ON PAGE 4)
PAGE 3
THE CRIMESCENE WINTER 2014
HIGHLIGHTS
THE CRIMESCENE WINTER 2014
Jamie Walsh: On the Cutting Edge of Cyber Crime
Continued from Page 3
from 1992 to 2007. His experience as a police officer also
allows Walsh to assist in the Firearms section and serve
on its Crime Scene Response Team.
Walsh is a founding member, former president, and
2009 Hall of Fame inductee of the High Technology
Crime Investigation Association Ohio Chapter. He is
also a member of such professional organizations as
High Technology Crime Consortium, FBI Infragard
Northern Ohio Chapter, Ohio Identification Officers Association and the International Association of Computer
Investigative Specialists.
In his free time, Walsh still enjoys working on computers and all the challenges that come along with it. “I
also enjoy home improvement projects and traveling,”
Walsh added. Most importantly, Walsh is a family man.
He and his wife have two adult sons.
The more prevalent technology is, the more valuable
Walsh’s knowledge and experience become. “Not everyone has a computer, but everyone has at least one cell
phone, if not more,” Walsh said. “Cyber instruments are
involved in every aspect of life now. They always leave a
digital trail. I can examine that digital trail, obtaining
the data that may be needed to break open a case.”
In the hands of Jamie Walsh, a cell phone memory chip
less than one square inch in size has the potential to
produce enormous quantities of evidence.
The 3D Laser Crime Scene Scanner has Arrived
In early December, the crime scene responders
from the Lake County Crime Laboratory and the
investigators from the Lake County Prosecutor’s
Office were trained in the use of the Crime Laboratory’s newly acquired 360° 3D laser crime scene
scanner.
The crime scene responders are now available to
deploy this device on any crime scene where it may
be useful.
This camera will create, a perfectly to scale, 3D,
virtual-reality replication of a crime scene. Both
laser light and natural light are used by the camera. In most situations, the camera can produce
high-resolution color images. In situations such as
arson scenes, where there is not much natural light
and the scene material is blackened, the laser can
render very detailed, high-resolution, greyscale
images.
For questions please contact Chief Investigator
Tom Walsh at (440) 350-2683 or Laboratory Director Linda Erdei at (440) 350-2793.
PAGE 4
THE CRIMESCENE WINTER 2014
Caught by Science
Continued from Page 1
had no suspects or murder weapon. In fact, the knife
that was used to repeatedly cut JoAnne’s neck was never recovered. But the killer did leave a clue behind: his
fingerprints. He also carried away two important pieces
of evidence: a carpet fiber from the apartment and the
victim’s blood on his shoes.
These clues—almost invisible to the naked eye and
practically indiscernible to the layperson—were all that
law enforcement needed to identify a suspect and get a
conviction.
In the hands of qualified analysts and examiners, a
carpet strand, a blood speck, and a fingerprint can be
every bit as conclusive (if not more) as an eyewitness or
even a murder weapon.
THE PRINTS
About a year before JoAnne’s murder, Aquila had
been arrested for having a loaded gun in his car. Aquila
ended up pleading no contest to a charge of improperly
handling a firearm in Willoughby Municipal Court.
Aquila served no jail time for the firearm charge, but
authorities did put his fingerprints into the Lake County Crime Laboratory’s newly computerized Automated
Fingerprint Identification System (AFIS). Those fingerprints were the first clue that led to his murder conviction. Aquila’s prints joined the 1994 database that already included 13,000 fingerprints from suspects in
Lake County. At the time, it was one of only four databases of its kind in the state.
The window of JoAnne’s apartment where Aquila’s fingerprints were found.
The current AFIS terminal that gives the Lake County
Crime Laboratory full access to a nationwide network
of fingerprint databases.
When the LCCL Crime Scene Examiners searched
JoAnne’s apartment for clues, they found latent prints
on the outside of her bedroom window. The Fingerprint
Examiner took the latent prints back to the laboratory
and entered them into AFIS. After ten minutes of computing, the AFIS computer printed out a list of ten
names that were the closest matches.
AFIS is a valuable piece of equipment,
but it does not catch killers by itself.
Comparing fingerprints is not a matter of
simply putting a print into a database
and the computer spitting out a suspect’s
name. AFIS could help the fingerprint
examiners navigate its haystack, but it
still takes an expert to find the needle.
Fingerprint expert Mitch Wisniewski
took the list of ten suspects offered by
AFIS and began manual comparisons of
each suggested print to see if a valid
match existed. An identification was
made. The latent prints matched exactly
to Aquila. Investigators now knew that
Aquila had touched the outside of the
bedroom window at some point in time.
(CONTINUED ON PAGE 6)
PAGE 5
THE CRIMESCENE WINTER 2014
Caught by Science
Continued from Page 5
This evidence did not place him inside the apartment, but it was
enough to start questioning Aquila.
At about 7:30 p.m., approximately
13 hours after the murder, police officers saw Aquila drive his car to his
mother’s home in Wickliffe. When the
police approached, Aquila fled, leading to a high-speed chase through
several communities. He eluded the
police but soon turned himself in after family members urged him to surrender. When arrested, Aquila said
he only fled because he was driving
with a suspended license. He denied
any knowledge of the murder.
THE CARPET
The fingerprints showed that Aquila had once been outside JoAnne’s
apartment window. While pertinent,
that piece of information would not
be enough to get a conviction.
The tread, shown above, from Aquila’s shoe yielded a fiber (about the
size of a period on this page) from JoAnne’s bedroom carpet. Arrows
point to circles marking minute blood spots found
on Aquila’s shoes.
The fiber found on Aquila’s shoe, magnified 500 times under a comparison microscope, was a match to the fibers of the carpet in
JoAnne’s apartment.
PAGE 6
Knowing they needed more evidence, authorities confiscated everything Aquila had
on him when he was arrested, including his
pager, gold chain, clothes, and shoes. Those
shoes—a Nike Air Diamond Fury “Ken
Griffey, Jr.” signature model—contained the
next pieces of evidence.
Authorities would later learn that Aquila
threw away his clothes and washed the blood
off himself in a nearby pond after he stabbed
JoAnne. However, Aquila was a huge Ken
Griffey, Jr., fan, and he could not bring himself to part with his Griffey-endorsed sneakers.
It was on these sneakers that Trace Evidence Examiner David Green found the evidence that proved Aquila had been inside
JoAnne’s apartment.
While picking particles off the shoes with
tape and tweezers, Green spotted a single
strand of carpet in the sole of one of the
shoes. The strand was only the size of a pinprick. But when it was placed on a slide next
to a piece of carpet cut from JoAnne’s bedroom and (CONTINUED ON PAGE 7)
Continued from Page 6
magnified 500 times under a comparison microscope, it
was found to be a perfect match for the carpet in JoAnne’s bedroom.
But, carpets are not like fingerprints. Different
homes, especially in an apartment complex, can have
the same type of carpet. So, Green and Willoughby Police researched the history of JoAnne’s carpet until they
were certain that it was unlike any other of the hundreds of carpets in the apartment complex. The authorities now had Aquila in JoAnne’s bedroom, but they still
did not necessarily have him present at the time of the
murder.
THE BLOOD
Authorities now knew that at some point in time Aquila had been both outside and inside JoAnne’s apartment. But that still was not conclusive evidence. To be
certain of Aquila’s role in JoAnne’s murder, the Crime
Laboratory would have to prove that Aquila was there
when she was attacked. Once again, the shoes provided
the clues.
Serologist Linda Erdei (now the Director of the
Crime Laboratory), found several spots of blood on Aquila’s sneakers. The spots were minute: so small that a
layperson would not have recognized their significance.
Portions of the DNA from this minute sample were
faithfully replicated millions of times to determine a
match to JoAnne’s blood.
The DNA test provided the strongest evidence yet of
Aquila’s guilt. It proved with certainty that the blood on
Aquila’s shoes came from JoAnne. Authorities now
knew that, not only had Aquila been in her apartment,
he was there while she was bleeding.
While the carpet strand and blood spot provided vital
evidence, it all began with the fingerprints. Had the fingerprint examiners not identified Aquila so quickly, the
evidence on his shoes might have brushed off and been
lost forever.
The Crime Laboratory had worked quickly. JoAnne
was murdered on August 17. That same day, the fingerprint examiners matched Aquila’s prints to those they
found at JoAnne’s apartment.
By August 21, Green had found JoAnne’s carpet
strand in the sole of Aquila’s sneaker. On August 22,
Erdei matched blood on Aquila’s shoes with the victim.
From fingerprints to a DNA identification in six
days, the authorities had their suspect.
THE CONVICTION
Confronted with the scientific evidence, Aquila finally confessed to the murder. Aquila told police that he
had been wandering the apartment complex parking lot,
looking for cars to break into. Then he saw JoAnne
sleeping in her bedroom and decided to rape her.
Aquila said he failed to force open the bedroom window, so he pried open a patio door with his knife. Then
he walked into JoAnne’s room. Aquila claimed that
when he touched her, JoAnne awoke and lunged at him.
He said the two struggled, and he stabbed her several
times before he ran away.
Aquila pleaded guilty to aggravated murder, aggravated robbery, aggravated burglary, kidnapping, and
fleeing in the Lake County Court of Common Pleas on
Dec. 19, 1995. He was 20 years old at the time. He is
now 38, imprisoned in the Trumbull Correctional Institution, and serving a sentence of 51 and one-half years
to life imprisonment.
Aquila, standing in front of Prosecuting Attorney Charles
Coulson, appeared in court for his sentencing hearing,
where he received a prison sentence of 51 and one-half
years to life.
Photo courtesy of the Cleveland Plain Dealer.
PAGE 7
THE CRIMESCENE WINTER 2014
Caught by Science
THE CRIMESCENE WINTER 2014
LAKE COUNTY
CRIME LABORATORY
235 Fairgrounds Road • Painesville, OH 44077
(440) 350-2793 • fax (440) 350-2731
An ASCLD/LAB-International Accredited Laboratory since 2009
An ASCLD/LAB-Legacy Accredited Laboratory 2000-2009
The CRIMESCENE
A quarterly publication of the Office of the Lake County Prosecuting
Attorney, www.LakeCountyProsecutor.org. For questions, comments,
or to receive an electronic copy of this newsletter, please contact us
at:
(440) 350-2793
or
[email protected]
© 2014
Another New Tool for Cell
Phone Evidence
Memory reading hardware and adapter allows a
digital evidence expert access to a memory chip
removed from a mobile device.
PAGE 8
With the acquisition of new equipment and training,
Digital Evidence Examiner Jamie Walsh can now employ the “chip-off” technique to recover data from mobile devices that are password-protected or physically
damaged.
The chip-off technique involves the careful removal of
a memory chip from a mobile device. Specialized equipment is then used to obtain a memory dump of the chip.
The memory dump is then examined using conventional forensic software techniques.
The chip-off technique has the potential to allow access to an area of mobile device forensics that until just
recently was unobtainable with available forensic tools.