Microgram Bulletin

 

Published by the Drug Enforcement Administration 
Office of Forensic Sciences Washington, D.C. 20537 

The U. S. Attorney General has determined that the publication of this periodical is necessary in the transaction of the public business required by the Department of Justice. Information, instructions, and disclaimers are published in the January issues.


January 2007

- INTELLIGENCE ALERT-

SUBSCRIBER EVALUATION SURVEY COMING

This issue marks the start of Microgram’s 40th year of publication. The last survey of Microgram subscribers was approximately eight years ago. Since that survey, Microgram has undergone many changes, including conversion from law enforcement sensitive to unclassified, from hard copy mailings to Internet postings on the DEA website with email notifications, from black and white to color, from the technical “nuts and bolts” aspects of how computers operate to Computer Forensics/Digital Evidence, and the splitting into Microgram Bulletin and Microgram Journal. In addition, the readership has expanded from about 400 organizations (the majority of which were forensic and crime laboratories) to over 1,400 organizations (the majority of which are front-line law enforcement agencies). In CY 2006, the external Microgram website had approximately 1.4 million “hits” (pageviews).

In an effort to further improve the value of Microgram to the readership, a survey will be emailed to the subscribers within the next week. This survey will ask subscribers to evaluate Microgram, offer constructive criticism, and make suggestions for improvements.

In order to limit the responses to a reasonable number, and to avoid repetitive comments from the same agency, it is requested that only the primary Point-of-Contact (POC) for each agency respond to the survey (that is, the individual who receives the emailed notices). However, all readers from the subscriber agencies are invited to provide input to their respective POCs. Note that the survey will not be posted on the Microgram website.

* * * * *

- INTELLIGENCE ALERT -

METHAMPHETAMINE SUPER-LAB USING TARTARIC ACID
RESOLUTION IN GUADALAJARA, MEXICO

The DEA Special Testing and Research Laboratory (Dulles, Virginia) recently received 11 exhibits acquired at a clandestine methamphetamine laboratory in Guadalajara, Mexico. The laboratory purportedly contained 500 kilograms of finished methamphetamine products when seized (no photos). Based on the items and chemicals recovered at the site, phenylacetic acid was being converted to phenyl-2-propanone (phenylacetone), which was then being converted to methamphetamine via a reductive amination route. Of the 11 exhibits, one contained 99 percent phenylacetic acid, three contained methamphetamine hydrochloride (average purity 99 percent), and quite unusually, five contained high purity methamphetamine tartrate (average purity 90 percent); the remaining two exhibits were water.

Tartaric acid is commonly utilized to resolve racemic mixtures of amine bases, but resolution of illicitly prepared drugs is unusual, especially on such a large scale. Enantiomeric analyses indicated that the methamphetamine hydrochloride samples averaged 77 percent dextro and 23 percent levo, while the methamphetamine tartrate samples averaged 91 percent levo and 9 percent dextro. These are the first submissions of these types to the Special Testing and Research Laboratory.

* * * * *

- INTELLIGENCE ALERT -

COCAINE IN A VERY LARGE BLOCK OF WAX IN NEW YORK

Photo 1 (Note: The Bottom Ruler is 18 Inch; The Left-Hand Ruler is 12 Inch
Photo 1 (Note: The Bottom Ruler is 18 Inch; The Left-Hand Ruler is 12 Inch

The DEA Northeast Laboratory (New York, New York) recently received a large block of dark colored wax (26.9 kilograms) that contained a brick of white powder, suspected cocaine (see Photo 1). The exhibit was seized in New York City by agents from the New York Strike Force (details sensitive). Analysis of the powder (total net mass 2.0 kilograms) by GC/FID, CE, GC/MS, and FTIR/ATR confirmed 82 percent cocaine hydrochloride, adulterated with levamisole. The Northeast Laboratory has encountered a variety of concealment techniques, including cocaine in wax candles*, but this is the first submission of cocaine smuggled in such a large block of wax.

[* Editor’s Note: For two examples of large wax candles containing cocaine, see: Microgram Bulletin 2003;36(9):202, and: Microgram Bulletin 2004;37(1):2.]

 

* * * * *

- INTELLIGENCE ALERT -


COCAINE SMUGGLED IN ELECTRIC GUITARS (FROM MEXICO)
AT THE BALTIMORE/WASHINGTON INTERNATIONAL (BWI) AIRPORT


Photo 2

eye shadow container that contained a plastic baggie containing a white powder, suspected cocaine
Photo 3
The DEA Mid Atlantic Laboratory (Largo, Maryland) recently received two electric guitars with compressed white powders concealed in hollowed-out sections in their bases, suspected cocaine (see Photos 2 and 3). The exhibits originated in Mexico, and were seized at the Baltimore/Washington International Airport by Immigration and Customs Enforcement personnel (no further details). Both guitars appeared to be fully operational (not checked), and neither had obvious seams or any external indications of tampering (that is, the paint and an inner, hard plastic layer were apparently added after the drugs were concealed). Analysis of the powder (total net mass 2,878 grams) with GC, GC/MS, and FTIR confirmed 83 percent cocaine hydrochloride adulterated with diltiazem. This is the first known submission of this concealment method to the Mid Atlantic Laboratory.

 

* * * * *

- INTELLIGENCE ALERT -

eye shadow container that contained a plastic baggie containing a white powder, suspected cocaine
Photo 4

OPIUM SMUGGLED IN ATTACHE CASES IN LOUISVILLE, KENTUCKY

The DEA North Central Laboratory (Chicago, Illinois) recently received 16 red leather attaché cases and 5 black vinyl attaché cases; the red cases had plastic pouches sewn into the seams of their front and back panels, each of which contained a gummy black substance that had the characteristic odor of opium (see Photo 4). The exhibits were in transit from Turkey to Canada, and were seized by U.S. Customs Service personnel at a parcel delivery service’s sorting and processing facility in Louisville, Kentucky. The cases were professionally assembled, showed no external signs of tampering, and (until disassembled) did not smell of opium. The pouches were flat and the same size as the attaché, each consisted of a layer of thin cardboard, two pieces of stiff plastic, and a layer of carbon paper, and contained approximately 254 grams of the suspected opium. Analysis of the substance (total net mass 8.185 kilograms in 32 pouches) by GC/FID and GC/MS identified meconin, hydrocotarine, codeine, morphine, thebaine, papaverine, noscapine and acetaminophen, confirming opium. The black attaché cases were constructed with a layer of vinyl over a piece of thin cardboard, but did not contain any secreted materials. The North Central Laboratory receives these type submissions several times a year.

* * * * *

- INTELLIGENCE ALERT -

DRIED OPIUM POPPY PODS IN FRESNO, CALIFORNIA

25 packets, each packaged with plastic wrapping over black electrical tape, suspected cocaine
Photo 5

The DEA Western Laboratory (San Francisco, California) recently received 47 dried plant pods on short stalks, suspected opium poppy pods (see Photo 5). The exhibits were shipped from New York via a commercial carrier, and were seized in Fresno, California by personnel from the U.S. Department of Agriculture (no further details). The pods (total net mass 553.6 grams) averaged 5 centimeters tall by 2.5 - 3.5 centimeters in diameter, and each contained a mass of small black seeds. Following standard acid/base workup, analysis of methylene chloride extracts by GC/MS confirmed morphine and codeine (not quantitated), and also indicated thebaine, noscapine, and papverine, confirming opium poppy pods. This is one of the largest exhibits of poppy pods ever submitted to the Western Laboratory.

 

* * * * *

two pieces of a cardboard type paper with gridlines marking off 430 squares (each 0.82 x 0.75 centimeters), a suspected steroid
Photo 6

- INTELLIGENCE BRIEF -

- QUAALUDE LEMMON 714 MIMIC TABLETS (CONTAINING DIAZEPAM) -

- SURPRISING PERSISTENCE -

The recent reports of Quaalude mimic tablets (containing diazepam) in Lexington Park, Maryland (Microgram Bulletin 2006;39(8):99; see Photo 6) and on the U.S./Canadian border near Oroville, Washington (Microgram Bulletin 2006;39(9):115; no photo) mark the latest two submissions in a now 25 year history of such tablets. Manufacture of authentic (pharmaceutical) Quaalude Lemmon 714 tablets (containing methaqualone) was discontinued by Lemmon Pharmaceuticals on November 15th, 1983; however, Quaalude counterfeit, mimic, and fake tablets had been in common circulation since the mid-1970s. [“Counterfeits” contained methaqualone, “mimics” contained one or more of a variety of controlled substances (not including methaqualone), and “fakes” contained no controlled substances.] The licit and illicit Quaaludes submitted to forensic laboratories between about 1975 and 1980 were primarily Rorer 714s, but the William H. Rorer Company sold the Quaalude rights to Lemmon Pharmaceuticals in 1979, and by mid-1980 most Quaaludes (both licit and illicit) were Lemmon 714s. Amazingly, illicit Lemmon 714s were being seized on the streets before the licit product was available at pharmacies. This reflected the enormous extent of Quaalude abuse, which rivaled marijuana abuse in 1980 and 1981, and in fact the Lemmon 714 tablet is by far the most illicitly replicated pharmaceutical product in the history of the Drug Enforcement Administration, with at one time over 250 different exemplars in the Reference Collection at the DEA Special Testing and Research Laboratory.

Extensive efforts by the DEA Office of Diversion Control in the late 1970s and early 1980s led to increasingly restrictive international controls on methaqualone and its precursors, and methaqualone was transferred to Schedule I of the U.S. Controlled Substances Act in 1984. As stocks of methaqualone dried up worldwide, clandestine manufacturers quickly settled on diazepam as the controlled substance of choice for Lemmon 714 mimics, and virtually all such tablets submitted to forensic laboratories since 1990 were determined to contain only diazepam. Initial variability in tablet compositions was a serious concern - some of the early mimics contained as much as 300 milligrams of diazepam, and overdoses and deaths from combining these Quaaludes mimics and alcohol were a major problem in some areas (quite notably in Atlanta, Georgia).

Currently, it is believed that Lemmon 714 mimics are still being sporadically produced, probably outside the United States. However, it is also thought that many of the Lemmon 714 mimics being seized by law enforcement authorities may actually be from 20 - 25 year old stashes (that is, recovered by previously incarcerated Quaalude traffickers upon their releases from prison). Oddly, despite ample published information to the contrary, most of the “testimonials” concerning Quaaludes (that is, Lemmon 714 tablets) on the various drug-abuse websites make it clear that the users still believe that they are ingesting genuine Quaaludes (which is quite unlikely). The last report in Microgram of authentic or counterfeit Quaaludes was in 1981, and the last submissions of such tablets to the DEA Special Testing and Research Laboratory were in 1985. Diazepam is currently classified as Schedule IV.

The following list are all the citations in Microgram or Microgram Bulletin of Quaalude Lemmon 714 mimic tablets containing diazepam or (less commonly) a mixture of diazepam and another controlled substance.* Not included are approximately another dozen citations of “Quaaludes containing diazepam” that did not contain logo information or photos.

1980;13(2):16 - Philadelphia Police Department Crime Laboratory
1980;13(4):50 - New Jersey State Police North Regional Laboratory (Little Falls)
1980;13(6):102 - DEA Southeast Laboratory (Miami)
1980;13(7):113 - DEA South Central Laboratory (Dallas)
1980;13(6):124 - DEA Southeast Laboratory (Miami)
1980;13(6):161 - Southeast Missouri Regional Crime Laboratory (Cape Girardeau)

1981;14(2):10 - Philadelphia Police Department Crime Laboratory
1981;14(4):37 - Regional Forensic Laboratory (Painesville, Ohio)
1981;14(5):54 - Philadelphia Police Department Crime Laboratory

1982;15(10):165 - Metro-Dade Police Department Crime Laboratory (Miami)

1984;17(12):176 - DEA Northeast Laboratory (New York)

1991;24(10):244 - Southeast Missouri Regional Crime Laboratory (Cape Girardeau)
1991;24(12):283 - Aurora Police Department Crime Laboratory (Colorado)

1992;25(3):42 - San Bernardino County Sheriff’s Forensic Science Laboratory (California)

1993;26(10):221 - Northern Illinois Police Crime Laboratory (Highland Park)

1995;28(8):235 - Mansfield Police Department Laboratory (Ohio)

1996;29(8):199 - University of Massachusetts Drugs of Abuse Laboratory

1997;30(2):26 - Regional Crime Laboratory at the Indian River Community College (Florida)
1997;30(6):115 - Tennessee Bureau of Investigation Crime Laboratory (Nashville)

2006;39(8):99 - Maryland State Police Forensic Sciences Division (Pikesville)
2006;39(9):115 - DEA Western Laboratory (San Francisco)


* Notes: All issues of Microgram and Microgram Bulletin published prior to January 2003 are Law Enforcement Restricted. Dr. Edward Franzosa, Ph.D., of the DEA Special Testing and Research Laboratory (Dulles, Virginia) contributed to this Intelligence Brief.

* * * *
* * * *
* * * *
* * * *
* * * *

SELECTED REFERENCES

[Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. Listed mailing address information (which is sometimes cryptic or incomplete) exactly duplicates that provided by the abstracting service. Patents are reported only by their Chemical Abstracts citation number.]

1. Apollonio LG, Pianca DJ, Whittall IR, Kyd JM, Maher WA. A comparison of atmospheric pressure chemical ionization and electrospray ionization in testing of amphetamine-type substances and ketamine using ultra-performance liquid chromatography/mass spectrometry. Rapid Communications in Mass Spectrometry 2006;20(18):2777. [Editor’s Notes: The title technique was used to analyze a reference mixture of amphetamine, methamphetamine, MDA, MDMA, and ketamine. Contact: National Centre for Forensic Studies, University of Canberra, Bruce ACT 2601, Australia.]

2. Burnett A, Fan W, Upadhya P, Cunninham J, Edwards H, Munshi T, Hargreaves M, Linfield E, Davies G. Complementary spectroscopic studies of materials of security interest. (Proceedings) Chemical Abstracts 2006:1148742.

3. Causin V, Marega C, Carresi P, Schiavone S, Marigo A. A quantitative differentiation method for plastic bags by infrared spectroscopy, thickness measurement, and differential scanning calorimetry for tracing the source of illegal drugs. Forensic Science International 2006;164(2-3):148. [Editor’s Notes: 50 bags of types typically used for drug packaging were analyzed. The results indicate that even mass-produced bags have a large degree of variability, and can be differentiated and/or linked. Contact: Dipartimento di Scienze Chimiche dell’Universita, via Marzolo 1, Padua 35131, Italy.]

4. Cox M, Klass G. Synthesis by-products from the Wacker oxidation of safrole in methanol using p-benzoquinone and palladium chloride. Forensic Science International 2006;164(2-3):138. [Editor’s Notes: Presents the title study, including analyses of samples from a clandestine laboratory seized in Australia that was employing this synthesis route. Contact: Forensic Science, 21 Divett Place, Adelaide 5000 SA, Australia.]

5. Freudenmann RW, Oxler F, Bernschneider-Reif S. The origin of MDMA (Ecstasy) revisited: The true story reconstructed from the original documents. Addiction 2006;101:1241. [Editor’s Notes: Debunks the common (almost universal) belief that MDMA was developed by Merck as an appetite suppressant. Contact: Department of Psychiatry, University of Ulm, Leimgrubenweg 12, 89075 Ulm, Germany.]

6. Kraj A, Swist M, Strugala A, Parczewski A, Silberring J. Fingerprinting of 3,4-methylenedioxymethamphetamine markers by desorption/ionization on porous silicon. European Journal of Mass Spectrometry 2006;12:253. [Editor’s Notes: Presents the title study on MDMA synthesized by four different routes. Analyses were done using MALDI-ToF mass spectrometry. Contact: Department of Neurobiochemistry, Faculty of Chemistry and Regional Laboratory, Jagiellonian University, Ingardena 3, 30-060 Krakow, Poland.]

7. Odell LR, Skopec J, McCluskey A. A cold synthesis of heroin and implications in heroin signature analysis. Forensic Science International 2006;164(2-3):221. [Editor’s Notes: Focuses on the impurity profile of heroin produced by this unusual route. Several trifluoroacetyl derivatives were identified, but were also found to be sensitive to typical heroin signature.workup and analysis procedures. Contact: Chemistry Building, School of Environmental and Life Sciences, The University of Newcastle, University Drive, Callaghan NSW 2308, Australia.]

8. Qi Y, Evans ID, McCluskey A. Australian Federal Police seizures of illicit crystalline methamphetamine (Ice) 1998 - 2002: Impurity analysis. Forensic Science International 2006;164(2-3):201. [Editor’s Notes: 19 samples seized at Australian POE’s were analyzed by methamphetamine impurity profiling techniques; over 30 characteristic impurities were identified. Contact: Chemistry Building, School of Environmental and Life Sciences, The University of Newcastle, University Drive, Callaghan NSW 2308, Australia.]

9.Schiff PL. Ergot and its alkaloids. American Journal of Pharmaceutical Education 2006;70(5):1. [Editor’s Notes: A historical overview and review. Contact: Department of Pharmaceutical Sciences, School of Pharmacy, University of Pittsburgh, Pittsburgh, PA 15261.]

10. Tsujikawa K, Mohri H, Kuwuyama K, Miyaguchi H, Iwata Y, Gohda A, Fukushima S, Inoue H, Kishi T. Analysis of hallucinogenic constituents in Amanita mushrooms circulated in Japan. Forensic Science International 2006;164(2-3):172. [Editor’s Notes: 7 samples were analyzed. Contact: First Chemistry Section, National Research Institute of Police Science, 6-3-1, Kashiwanoha, Kashiwa, Chiba 277-0882, Japan.]

11. Zhang L, Ma L, Gong H, Li L. Determination of scopolamine content in compound Huangqi capsules by HPLC. Zhongcaoyao 2005;36(11):1661. [Editor’s Notes: Presents the title analysis. This article is written in Chinese. Contact: Department of Pharmaceutical Chemistry, Medical College of Chinese People’s Armed Police Force, Tianjin 300162, Peop. Rep. China.]

Additional References of Possible Interest:

1. Anwar F, Latif S, Ashraf M. Analytical characterization of hemp (Cannabis sativa) seed oil from different agro-ecological zones of Pakistan. Journal of the American Oil Chemists Society 2006;83(4):323. [Editor’s Notes: Presents the title study on cold-pressed hemp seed oils from 3 different regions. Contact: Departments of Chemistry and Botany, University of Agriculture, Faisalabad-38040, Pakistan.]

2. Gosav S, Praisler M, Dorohoi DO, Popa G. Structure-activity correlations for illicit amphetamines using ANN and constitutional descriptors. Talanta 2006;70(5):922. [Editor’s Notes: Compounds not specified in the abstract. “ANN” is an acronym for an artificial neural network; the “constitutional descriptors” were not specified in the abstract. The primary database consisted of GC-FTIR data for a large number of drugs of abuse and related compounds. Contact: Department of Physics, Dunarea de Jos University, Str. Domneasca nr. 47, Galati, Rom.]

3. Jiang H-p, Ren C-h. Study on DFT of the structure and property of MDMA molecule. Xihua Daxue Xuebao, Ziran Kexueban 2006;25(5):69 6A. [Editor’s Notes: A theoretical study of the structure and properties of MDMA by the “d. functional theory” (“d.” was not defined in the abstract). This article is written in Chinese. Contact: Department of Criminal Technology, College of Sichuan Police Officer, Luzhou Sichuan 646000, Peop. Rep. China.]

4. Mitchell-Roberts AC. Advanced techniques in mass spectrometry for forensic applications. Dissertation Abstracts International, B 2006;67(1):237. [Editor’s Notes: Abstract not provided. Contact: Univ. of Florida, Gainesville, FL (zip code not provided).]

5. Morley SR, Hall CJ, Forrest ARW, Galloway JH. Levamisole as a contaminant of illicit cocaine. Journal of the Clandestine Laboratory Investigating Chemists Association 2006;16(4):11. [Editor’s Notes: Focus is on detection in body fluids of cocaine abusers (including six who were deceased) acquired over a 20 week period in the United Kingdom. JCLICA is a law enforcement restricted journal. Contact: Toxicology Section, Department of Clinical Chemistry, Sheffield Teaching Hospital Foundation Trust, Sheffield, S10 2JF, United Kingdom.]

6. Uchida K, Yokoshima S, Kan T, Fukuyama T. Total synthesis of (+/-)-morphine. Organic Letters 2006;8(23):5311. [Editor’s Notes: Presents the title synthesis. Contact: Graduate School of Pharmaceutical Sciences, University of Tokyo, 7-3-1 Hongo, Bunkyo-ku, Tokyo 113-0033, Japan.]

* * * *
* * * *
* * * *
* * * *
* * * *

THE JOURNAL/TEXTBOOK COLLECTION EXCHANGE

The Journal/Textbook Collection Exchange is a service intended to facilitate the transfer of unwanted journals and textbooks to forensic libraries or other Microgram subscribers. At present, this service is offered once a quarter (in January, April, July, and October). There were no donations offered during the past quarter.

All subscribers are encouraged to donate surplus or unwanted items/collections. Reference texts and long runs of forensic/analytical journals are of particular interest; however, even single issues are worthwhile. If interested, please consult the Microgram website or contact the Microgram Editor for further instructions.

The next offering of journals and textbooks will be in the April 2007 issue of Microgram Bulletin.

* * * *
* * * *
* * * *
* * * *
* * * *

THE DEA FY - 2007 STATE AND LOCAL
FORENSIC CHEMISTS SEMINAR SCHEDULE

The remaining FY - 2007 schedule for the DEA's State and Local Forensic Chemists Seminar is as follows:

February 5-9, 2007
May 7-11, 2007
July 9-13, 2007
September 10-14, 2007

Note that the school is open only to forensic chemists working for law enforcement agencies, and is intended for chemists who have completed their agency’s internal training program and have also been working on the bench for at least one year. There is no tuition charge for this course. The course is held at the AmeriSuites Hotel in Sterling, Virginia (near the Washington/Dulles International Airport). A copy of the application form is reproduced on the last page of the August 2004 issue of Microgram Bulletin. Completed applications should be mailed to the Special Testing and Research Laboratory (Attention: J. Kerlavage) at: 22624 Dulles Summit Court, Dulles, VA 20166. For additional information, call 703/668-3337.

 

* * * *
* * * *
* * * *
* * * *
* * * *

EMPLOYMENT OPPORTUNITY

Position: Forensic Chemist                                                  (Second Posting)
Location: Indian River Crime Laboratory; Fort Pierce, Florida
Salary: $55,000 - $65,000 depending on experience
Application Deadline: Open until filled

Duties: Responsibilities include the analysis of controlled substances; interpretation of laboratory analyses and results; preparation of written reports; and the ability to testify as an expert witness.

General Requirements: The applicant must be skilled in using gas chromatography, mass spectroscopy, ultraviolet and infrared spectrophotometry, and other drug analysis equipment and methodologies. A familiarity with the technical and safety requirements of ASCLD/LAB, and demonstrated proficiency testing in controlled substance analysis are required. A Master’s degree in chemistry or forensic science (with chemistry undergraduate degree) and two years of forensic laboratory experience are preferred. Experience in head space BAC analysis is desirable. An extensive background investigation is required, and laboratory personnel are subject to random drug testing. EEO.

Application Procedure: Applications may be obtained on line at stluciesheriff.com or by contacting:

Saint Lucie County Sheriff’s Office
Human Resources Department
4700 W. Midway Road
Fort Pierce, FL 34981 4825
Phone: (772) 462 3206
Fax: (772) 462 3218

For additional information about the position, contact:

Daniel C. Nippes, Director (or) Babu Thomas, Senior Criminalist
Indian River Crime Laboratory
2502 S. 35th Street
Fort Pierce, FL 34981
dnippes -at- ircc.edu (or) bthomas -at- ircc.edu
Phone: (772) 462 3600

* * * *
* * * *
* * * *
* * * *
* * * *

 

NEW MICROGRAM EDITOR EMAIL ADDRESS
BECAME EFFECTIVE JANUARY 1st, 2007

On January 1st, 2007, the Microgram Editor’s email address changed from microgram_editor -at- mailsnare.net to: microgram-2007 -at- mailsnare.net. This change was necessitated by the ever-increasing numbers of spam emails being received at the microgram_editor -at- mailsnare.net address. An automated response will be maintained on the microgram_editor -at- mailsnare.net address for the first three months of CY 2007.

Please make a note of this change. Note that similar email address changes can be anticipated on the first of each year, substituting the appropriate year in the address.

* * * *
* * * *
* * * *
* * * *
* * * *

 

Computer Corner

Who is Qualified to Conduct Forensic Examinations
of Digital Evidence? - Differing Points of View

#213
Clay Schilling
Group Supervisor
DEA Digital Evidence Laboratory

An issue that is arising with increasing frequency is who is best qualified to conduct computer forensic examinations? It is becoming routine for criminal investigators, prosecutors, and intelligence analysts to request copies of seized digital evidence with the intent of performing their own examinations. The justifications presented for these requests range from: "Only I can determine what is relevant;" to: "I don't have time to wait, I need the information now;" to: "It's just information - anyone can process it." After discussing the complexities and pitfalls associated with conducting computer forensic examinations, most of the individuals making such requests usually come to understand that such examinations should in fact only be conducted by individuals trained in digital forensics. This two-part article will explore this issue in greater detail.

The Root of the Problem

Not surprisingly, "digital evidence" appears to be the only forensic discipline that is plagued by this issue. That is, very few of the persons demanding copies of seized digital evidence would ever request the evidence in any other forensic discipline with the intention of conducting their own analyses. This suggests an underlying misconception as to what digital evidence is, and what it takes to properly analyze it in a forensically sound manner. Almost certainly, the fact that virtually everyone is familiar with computers and many other consumer digital or electronic devices (such as cell phones, personal data assistants (PDAs), flash drives, etc.) has them believing that extracting information from such devices is not particularly challenging - especially if they have successfully performed troubleshooting or data recovery on their own or other digital devices. In this field, it is true that a little knowledge can be a dangerous thing.

Digital Evidence - Storage Media versus Information

Digital evidence is defined as: "Any information of probative value that is stored or transmitted in binary form" (Scientific Working Group on Digital Evidence (SWGDE), SWGDE / SWGIT Digital & Multimedia Evidence Glossary, Version: 2.0 (January 13, 2006)). It is possible that using the term "information" as a synonym for "digital evidence" is a major part of the problem. When "digital evidence" is seized at a crime scene, the investigators are not collecting "information" per se - rather, they are collecting physical items, such as computers, cell phones, PDAs, hard disk drives (HDDs), compact disks (CDs), digital video disks (DVDs), floppy disks, flash drives, and/or similar item(s). These physical items (also sometimes identified as "digital storage media") - and not the information that is recorded on them - are usually what is identified on evidence custody documents, entered into evidence management systems, and presented in court as to what was seized. However, forensic definitions and courtroom testimonies concerning digital evidence are almost always about the information that was recovered from the media - not about the media itself.

In order to simplify the "apples and oranges " disparities between the information and the media, two models have been developed that equate the "digital storage media" to a "filing cabinet" or to a "crime scene."

The Filing Cabinet Model

The "filing cabinet" model is easy to understand, as it is also a "storage container" that holds a wealth of information that is organized in "hard copy" files and folders (apparently) equivalent to the "electronic" files and folders found on a hard drive or equivalent "digital storage media." This may explain why many criminal investigators, prosecutors, and intelligence analysts believe that they do not need any assistance to extract and review "electronic" information. However, this apparent equivalency is false, as there are many nuances and complications associated with the forensically valid recovery of "electronic" infomation. "Hard copy" files are tangible, easily retrievable by anyone with "physical" access, and usually do not need a forensic examiner to recover the information. Forensic analysis (if any) is done after the retrieval, and usually focuses on issues such as ownership, origin, source, and access. In contrast,"electronic" files are recorded in digital form (that is, as "1s and 0s"), and require translation by the computer's operating system to be rendered intelligible. Furthermore, the ease of retrieval depends on the file's location (active files, free space, or file slack), its condition (contiguous or fragmented), and any of a variety of protective measures (passwords, encryption, steganographic concealment, hard drive locking, etc.). Thus, a preliminary forensic analysis is required "up front" to identify and bypass protective measures, create a working copy, locate and extract relevant files, reconstruct fragmented files, recover deleted files, determine file creation, modifications, and last accessed dates and times, identify (if possible) who created the file, modified it, and last accessed it, identify how the file was placed on the computer (that is, was it created locally or was it added via an external drive (CD, floppy, thumb drive, etc.), the Internet, or an email message), and to determine associations and links to other files or their content, and so on. In short, far more complex than processing a filing cabinet.

The Crime Scene Model

The "crime scene" model is an alternate perspective that views the "digital storage media" as a "crime scene" or "location." This model equates the media to a house that contains evidence in many different locations, some obvious and others well hidden. Thus, the files, folders, and partitions of the digital evidence are equivalent to the rooms, closets, furniture, and other items located in-house and so the digital forensic examination can be conducted in a similar manner as a typical crime scene examination. The "scene" (digital media / house) is entered and the various locations (partitions, folders / rooms, furniture) are searched for evidence (electronic / physical). When evidence is located and identified it is collected / recovered and analyzed.

However, "crime scenes" are normally processed by individuals that have been highly trained in the forensically sound identification, recovery, preservation, and analysis of evidence. Criminal investigators, prosecutors, and intelligence analysts are generally not trained to process "crime scenes." In short, just as "physical" evidence must be sent to a crime laboratory for analysis, "electronic" evidence must be sent to a computer forensics laboratory for analysis - and it is imperative that only trained examiners be allowed to process "electronic" evidence to ensure its preservation, proper extraction, analysis, and eventual use in prosecutions.

Part II of this discussion will focus on highlighting the various complexities and pitfalls associated with conducting digital forensic examinations.

Questions or comments? E mail: Clayton.D.Schilling -at- usdoj.gov

* * * *
* * * *
* * * *
* * * *
* * * *

INFORMATION AND INSTRUCTIONS FOR MICROGRAM BULLETIN

[Editor’s Preface: The following information and instructions are derived from the Microgram website
< http://www.dea.gov/programs/forensicsci/microgram/index.html >, and are provided here for the convenience of those subscribers who are only receiving hard “circulation” copies of Microgram Bulletin at their Offices.]

General Information
Microgram Bulletin is a monthly newsletter published by the U.S. Drug Enforcement Administration's Office of Forensic Sciences, and is primarily intended to assist and serve forensic scientists concerned with the detection and analyses of suspected controlled substances for forensic/law enforcement purposes.

Access to Microgram Bulletin
Microgram Bulletin is unclassified (as of the January 2003 issue), and is published on the DEA public access website (see the above URL). At this time, Microgram Bulletin is available only electronically, and requires Internet access. Professional scientific and law enforcement personnel may request email notifications when new issues are posted (such notifications are not available to private citizens). The publications themselves are never sent electronically (that is, as attachments).

Requests to be added to the email notification list should preferably be submitted via email to the Microgram Editor at: microgram-2007 -at- mailsnare.net Requests can also be mailed to: Microgram Editor, Drug Enforcement Administration, Office of Forensic Sciences, 2401 Jefferson Davis Highway, Alexandria, VA 22301. All requests to be added to the Microgram email notification list should include the following Standard Contact Information:

* The Full Name and Mailing Address of Submitting Laboratory or Office;

* The Full Name, Title (Laboratory Director, Assistant Special Agent in Charge, Librarian, etc.), Phone Number, FAX Number, and Preferred email Address of the Submitting Individual (Note that subscriptions are mailed to titles, not names, in order to avoid subscription problems arising from future personnel changes);

* If available, the generic email address for the Submitting Laboratory or Office;

* If a generic email address is not available, one private email address for an individual who is likely to be a long-term employee, who has a stable email address, and who will be responsible for forwarding Microgram information to all of the other employees in the requestor's Office (Note that only one email address per Office will be honored).

* If requesting hard copy mailings, the number of copies requested (two max), and justification.

Requests to be removed from the Microgram email notification list, or to change an existing email address, should also be sent to the Microgram Editor. Such requests should include all of the pertinent Standard Contact Information detailed above, and also should provide both the previous and the new email addresses.

Email notification requests/changes are usually implemented within six weeks.

Email Notifications (Additional Comments)
As noted above, the email notification indicates which issue has been posted, provides the Microgram URL, and additional information as appropriate. Note that Microgram e-notices will NEVER include any attachments, or any hyperlink other than the Microgram URL. This is important, because the Microgram email address is routinely hijacked and used to send spam, very commonly including malicious attachments. For this reason, all subscribers are urged to have current anti-viral, anti-spyware, and firewall programs in operation. However, in order to ensure that the email notifications are not filtered as spam, the microgram-2007 -at- mailsnare email address must be “whitelisted” by the Office’s ISP.

Costs
Subscriptions to Microgram Bulletin are free.

Submissions to Microgram Bulletin
Microgram Bulletin includes Intelligence Alerts, Intelligence Briefs, Safety Alerts, Selected Intelligence Briefs, Selected Literature References, Meeting Announcements, Employment Opportunities, pertinent sections from the Code of Federal Regulations, Columns of topical importance, and similar material of interest to the counter-drug community. Explanatory details for most of the above types of submission are detailed below, and typical examples are published in most issues of Microgram Bulletin.

All submissions must be in English. Because Microgram Bulletin is unclassified, case sensitive information should not be submitted! All submissions should, whenever possible, be submitted electronically, as straight email or as an IBM® PC-compatible Corel WordPerfect® or Microsoft Word® attachment, to: microgram-2007 -at- mailsnare.net Current versions of Corel WordPerfect® or Microsoft Word® (defined as having release dates less than 5 years old) should be utilized. If email submission is not possible, submissions may be mailed to: Microgram Editor, Drug Enforcement Administration, Office of Forensic Sciences, 2401 Jefferson Davis Highway, Alexandria, VA 22301. Hard copy mailings should be accompanied by an electronic version on either a 3 ½ inch IBM® PC-compatible diskette or a standard CD-R. Note that diskettes should be mailed in an irradiation-proof protective sleeve, and the mailing envelope should be marked: “Warning - Contains Electronic Media - Do Not Irradiate”. Note also that mailed submissions may be subject to lengthy handling delays beyond the control of the Office of Forensic Sciences, and electronic media sent through the mail may be destroyed en route by sanitizing procedures, despite protective measures and written warnings. All submissions should include the following Contact Information: The Full Name and Address of Submitting Laboratory or Office, and the Full Name, Phone Number, FAX Number, and Preferred email Address of the Submitting Individual.

Intelligence Alerts and Briefs are concise synopses of the physical and chemical characteristics of novel and/or interesting exhibits submitted to law enforcement laboratories involved in the detection and analyses of suspected controlled substances for forensic/law enforcement purposes. Alerts have some unusual aspect, such as a novel drug, an atypical formulation, or a new smuggling technique, whereas Briefs are reports of routine analyses (that is, that confirmed what was suspected/expected). Both Alerts and Briefs should include descriptive details adhering to (as appropriate) the following outline:

What laboratory did the analysis? (Full Name)
Where is the laboratory located?
What agency seized the exhibit?
Where was the exhibit seized? (If an obscure locale, give distance and direction from the nearest city)
Were there any interesting (but non-sensitive) aspects of the seizure (traffic stop, unusual smuggling technique, at a “Rave,” etc.)
What controlled substance was suspected upon submission?
Detailed physical description (appearance, dimensions, logos, odor, packaging, etc.)
Quantities (numbers of tablets, packages or bricks, average mass, total net mass, etc.)
Photos (see additional information, below)
What techniques were used to analyze the exhibit?
Actual composition of the exhibit?
Quantitation data? (if not quantitated, provide a qualitative approximation if possible)
Adulterants and diluents? (if identified, especially if unusual)
First seizure of this type? (if not, provide brief details of previous examples)
Editorial comments? (if any)
Literature references for unusual submissions? (if needed)

In order to avoid confusion, if uncommon controlled substances are identified, the description should use the full chemical name(s) of the identified substances (if desired, acronyms or street terminology (e.g., “Foxy-Methoxy", “Nexus”, or “STP”) can be included in parentheses after the full chemical name).

Photographs should be provided as ATTACHMENTS, not as embedded images in documents. Jpeg images are preferred. Photographs should be of reasonable size - 250 KB or less per photograph. Unless the scale is obvious, photographs of subject exhibit(s) should include either a metric ruled scale or a coin or bill (U.S. currency) to place the exhibit’s size in context.

Safety Alerts are urgent communiques to the Microgram Bulletin readership which give notice of a specific safety issue of particular interest to forensic or crime laboratory personnel, or to law enforcement personnel dealing with controlled substances. They should include a concise synopsis of the incident(s), recommendations (if any), pertinent literature citations (if any are known), and a mechanism for providing feedback (if appropriate).

Selected Intelligence Briefs are reprinted (with permission) unclassified intelligence briefs of presumed interest to the Microgram Bulletin readership that have been previously published in restricted or non-restricted publications or websites that are also dedicated to the detection and analyses of suspected controlled substances for forensic/law enforcement purposes. Selected Intelligence Briefs must be unclassified, and should be a minimum of 1 page and a maximum of 10 pages in length (single spaced at 11 pitch Times New Roman font, including photos, tables, charts, etc.) All Microgram Bulletin subscribers are invited to submit such material, which must include the author’s and publisher’s contact information.

Selected Literature References is a monthly compilation of reference citations of presumed interest to the Microgram Bulletin readership, derived from approximately 7,500 scientific periodicals. The focus of the Selected Literature References is the detection and analysis of suspected controlled substances for forensic/law enforcement purposes. References from clinical and toxicological journals are included only if the material is considered to be of high interest to forensic chemists (for example, contains the mass spectra of an unusual substance that is not known to be published elsewhere). Note that citations from obscure periodicals may be missed, and all Microgram Bulletin subscribers are invited to submit citations of interest if they do not appear in Microgram Bulletin within three months of their publication. Of particular interest are articles from regional forensic science associations that are unlikely to be noted by any abstracting service. Citations should include a summary sentence and the primary author’s contact information.

Meeting Announcements list upcoming meetings of presumed interest to the Microgram Bulletin readership. In general, only meetings which are dedicated to forensic chemistry/forensic drug analysis or include a subsection so dedicated will be publicized in Microgram Bulletin. Meeting Announcements should include the Formal Title, Sponsoring Organization, Inclusive Dates, Location (City, State, and specific locale), Registration Deadline, Recommended Hotel (include details on special rates and deadlines where applicable), and Contact Individual’s Name, Phone Number, and email Address. If available, the URL for the meeting website should also be included in the Announcement. Meeting Announcements will be posted for a maximum of three consecutive months, or (alternately) three times every other month over a five month period, but not past the registration deadline.

Employment Opportunities lists job announcements of presumed interest to the Microgram Bulletin readership. In general, only jobs with a forensic chemistry/forensic drug analysis focus for Federal, State, or Local Crime Laboratories or Offices will be publicized in Microgram Bulletin. Exceptions may be requested and will be considered on a case-by-case basis (for example, an academic position in a Forensic Chemistry Department). Employment Opportunity announcements should include the Formal Title of the Organization, Formal Title of the Laboratory or Office, Position Title, Laboratory or Office Location (City and State), Salary Range, Opening and Closing Dates, Duties, General Requirements, Specialized Requirements (if any), Application Procedures, and the Contact Individual’s Name, Phone Number, email Address, and Mailing Address. If available, the URL for the agency’s website, and (if available) the specific URL for the job posting should also be included in the Announcement. Employment Opportunities will be posted for a maximum of 3 consecutive months, but not past the application deadline.


The Journal/Textbook Collection Exchange
If any subscriber is interested in donating any forensic or analytical chemistry journal and/or textbook collection to a fellow subscriber or library, Microgram Bulletin is willing to list the offered materials and the associated contact information in a future issue (currently January, April, July, and October). The general format should follow the example in the January 2003 issue, and should be sent via email to the Microgram Editor at: microgram-2007 -at- mailsnare.net Only items for donation (not for sale) will be considered for publication, and donations to libraries should adhere to journal restrictions and/or time limits (if any) on such offers.


Requests for Microgram and/or Microgram Bulletin Archives, 1967 - 2002

All issues of Microgram (November 1967 - March 2002) and the first nine issues of its successor Microgram Bulletin (April - December 2002) were and continue to be Law Enforcement Restricted publications, and are therefore (permanently) unavailable to the general public. [Note that this restriction includes requests made under the Freedom of Information (FOI) Act.]

However, past issues or individual sections of issues (e.g., specific articles) are available to law enforcement affiliated offices and laboratories. Requests from such offices and laboratories must be made on official letterhead and mailed to:

Deputy Assistant Administrator
Office of Forensic Sciences
Drug Enforcement Administration
2401 Jefferson Davis Highway
Alexandria, VA 22301

Note that requests made via email will not be honored.

DISCLAIMERS

1) All material published in Microgram Bulletin is reviewed prior to publication. However, the reliability and accuracy of all published information are the responsibility of the respective contributors, and publication in Microgram Bulletin implies no endorsement by the United States Department of Justice or the Drug Enforcement Administration.

2) Due to the ease of scanning, copying, electronic manipulation, and/or reprinting, only the posted copies of Microgram Bulletin (on www.dea.gov) are absolutely valid. All other copies, whether electronic or hard, are necessarily suspect unless verified against the posted versions.

3) WARNING!: Due to the often lengthy time delays between the actual dates of seizures and their subsequent reporting in Microgram Bulletin, and also because of the often wide variety of seizure types with superficially similar physical attributes, published material cannot be utilized to visually identify controlled substances currently circulating in clandestine markets. The United States Department of Justice and the Drug Enforcement Administration assume no liability for the use or misuse of the information published in Microgram Bulletin.