|
MUSHROOMS LACED WITH GAMMA-HYDROXYBUTYRIC ACID (GHB) AT A The Oklahoma State Bureau of Investigation Central Regional Laboratory (Oklahoma City) recently received a dark brown glass jar containing apparent psilocybe mushrooms (see Photo 1). The exhibit was seized at a clandestine methamphetamine laboratory by the Midwest City Police Department (Midwest City is a suburb of Oklahoma City). The mushrooms (total net mass approximately 3 grams) had the texture and odor typical of psilocybe mushrooms; however, derivatization with bis(trimethylsilyl)trifluoroacetamide (BSTFA) followed by analysis by GC and GC/MS indicated neither psilocin or psilocybin but rather gamma-hydroxybutyric acid (GHB; not quantitated, but a rather low loading based on the gas chromatogram). This is the first ever submission of GHB-laced mushrooms to the laboratory. [Editor’s Notes: The analyst in this case has analyzed several dozen cases of psilocybe mushrooms, and feels that these were in fact psilocybe mushrooms that had been intentionally laced with GHB. It is unclear why the mushrooms were negative for psilocin or psilocybin.]
* * * * * - INTELLIGENCE ALERT - ECSTASY MIMIC TABLETS (CONTAINING META-CHLOROPHENYL- The Iowa Criminalistics Laboratory (Ankeny, Iowa) recently received 44 multi-colored tablets with no logo, suspected Ecstasy (see Photo 2). The exhibits were seized by the Iowa City Police Department (circumstances unknown; Iowa City is in southeastern Iowa). Analysis of the tablets (not weighed, 9 x 3.5 millimeters) by TLC and GC/MS, however, indicated not MDMA but rather meta-chlorophenylpiperazine (mCPP; not quantitated, but a moderate loading based on the TIC). This is the first submission of mCPP to the laboratory. The laboratory also recently received 6 clear capsules, each containing a small amount of white powder, submitted as an unknown/suspected controlled substance (photo not taken, but the same as those pictured in the January 2006 issue of Microgram Bulletin (page 3). The exhibits were seized by the Marion Police Department (circumstances unknown; Marion is in eastern Iowa). Analysis of the powder (not weighed) by Marquis, TLC, and GC/MS indicated 2,5-dimethoxy-4-iodophenethylamine (2C-I; not quantitated but apparently high purity based on the TIC). The identification was tentative, due to the lack of a reference standard. This is the second submission of presumed 2C-I to the laboratory; the first occurred in 2004. * * * * * - INTELLIGENCE ALERT - ECSTASY MIMIC TABLETS (CONTAINING META-CHLOROPHENYL- The Texas Department of Public Safety Crime Laboratory in Garland recently received 6 beige tablets and partial tablets with the Mitsubishi logo on one face and half-scored on the opposite face, resembling previously submitted Ecstasy tablets (see Photo 3, next page). The exhibits were seized by the Frisco Police Department (circumstances not provided; Frisco is a northern suburb of Dallas). Analysis of the tablets (total net mass of intact and partial tablets 1.70 grams) by color tests, UV, and GC/MS, however, indicated not MDMA but rather meta-chlorophenylpiperazine (mCPP; not quantitated but a moderate loading based on the TIC). This was the first submission of mCPP to the laboratory. * * * * * - INTELLIGENCE BRIEF - The Kentucky
State Police Northern Regional Laboratory (Cold Spring) recently
received 75 bundles of apparent khat (see Photo
4). Each
bundle contained 4 smaller sub-bundles, and was wrapped in the standard
manner, in a large leaf secured with a husk-like twine. The exhibits
(total net mass
approximately 13 pounds) had been shipped in a cardboard box from Paris,
France to the Northern Kentucky/Cincinnati Regional Airport, and were
seized by U.S. Customs and Border Protection agents. Unusually, there
was no effort
to cool the material during shipping, and it had a moist and distinctly
wilted appearance, with signs of mold, upon receipt at the laboratory.
Analysis of extracts by GC and GC/MS indicated no cathinone, but confirmed
cathine
(not quantitated). It was estimated that the package had been in transit
for at least 14 days prior to its seizure, explaining its degraded
appearance
and complete loss of cathinone. This is the second submission of khat
to the laboratory; the first was submitted approximately 5 years ago.
Cathine is a Schedule IV controlled substance under Kentucky law. * * * * * - INTELLIGENCE ALERT - WALL HANGINGS CONTAINING COCAINE FROM GUATEMALA The DEA Mid-Atlantic
Laboratory (Largo, Maryland) recently received 7 multicolored fabric
wall hangings
with wooden dowels at each end
(see Photos 5 and 6). The dowels
were hollowed out, and contained white powders, suspected cocaine (see Photo
7). The exhibits were seized
by Immigration and Customs Enforcement personnel from a parcel service
flight from Guatemala to Miami, and were submitted to the laboratory
after a controlled delivery in the mid-Atlantic region (details not
available). The dowels were 18 inches long by about 1 ½ inches
in diameter, and were outfitted with end caps which appeared to be
glued on. Analysis of the powder (total net mass 439.3 grams) by GC,
MS, and IR confirmed 90 percent cocaine hydrochloride. This was the
Mid-Atlantic Laboratory’s first encounter with this smuggling
technique.
- INTELLIGENCE ALERT - POLYDRUG SEIZURE (MDMA POWDER, ECSTASY TABLETS,
Photo 8 The DEA Western Laboratory (San Francisco, California) recently received
a polydrug seizure including: A) 5 boxes each containing 12 food saver
plastic bags of white powder, suspected methamphetamine (see Photo
8); B) 30,004 red tablets with an infinity logo, suspected MDMA (no
photo); C) 10,890 white tablets with a Lemmon 714 logo on one face
and half-scored on the opposite face, apparent Quaalude tablets (no
photo); and D) 477 grams of plant material, suspected marijuana (no
photo). The exhibits were seized near the U.S./Canadian border by agents
from the U.S. Border Patrol Office in Oroville, Washington (circumstances
not provided). Analysis of the powder (total net mass 59.57 kilograms)
by FTIR and GC/MS indicated not methamphetamine but rather 86 percent
MDMA hydrochloride. Analysis of the red/infinity logo tablets by GC,
GC/MS, and GC/IRD confirmed MDMA hydrochloride (94 milligrams/tablets).
Analysis of the white/Lemmon 714 logo tablets by GC, GC/MS, and GC/IRD
indicated not methaqualone but rather diazepam (39 milligrams/tablet).
Analysis of the plant material by microscopy, Duquenois-Levine, TLC,
and GC/MS confirmed marijuana. This was the largest ever submission
of powdered MDMA hydrochloride to the Western Laboratory. * * * * * - INTELLIGENCE BRIEF - PCP LABORATORY IN SOUTH HOLLAND, ILLINOIS The DEA North
Central Laboratory (Chicago, Illinois) recently assisted the DEA
Chicago Field Division, the South Chicago HIDTA Task Force,
and the South Holland, Illinois Fire Department in the seizure of a
clandestine phencyclidine (PCP) laboratory located in a house in South
Holland (a suburb of Chicago). The laboratory was inactive at the time
of its seizure, and appeared to primarily be a storage site for chemicals
used in the synthesis of PCP, as well as for PCP base which had not
been extracted from reaction mixtures. However, sales of PCP were active
and ongoing prior to the raid. Chemicals found at the site included
2 unlabeled one-gallon cans of cyclohexylamine, 4 gallons of cyclohexanone,
approximately 4 gallons of ether, and 50 pounds of white powder (analysis
by FTIR
and uranyl acetate microcrystalline test identified the latter substance
as potassium cyanide). Also recovered at the residence were 73 two-quart
mason jars containing bi-layered liquids with volumes varying between
200-500 milliliters. Analysis of the top (organic) layers by GC/MSD
indicated cyclohexanone, bromobenzene, cyclohexylpiperidine, biphenyl,
* * * * * * * * *
* * * * * * * * * * * SELECTED REFERENCES [Selected references are a compilation of recent publications of presumed interest to forensic chemists. Unless otherwise stated, all listed citations are published in English. Listed mailing address information exactly duplicates that provided by the abstracting service. Patents and Proceedings are reported only by their Chemical Abstracts citation number.]
* * * * * * * * * * * * * * * * * * * * SCIENTIFIC MEETINGS 1.
Title: 32nd Annual NEAFS Meeting (Third
and Final Bimonthly Posting) * * * * * * * * * * * * * * * * * * * * NEW EMAIL ADDRESSES NEEDED The email addresses for the following organizations returned rejection notices to the Microgram Editor for at least the past three issues of Microgram Bulletin, and therefore the respective organizations have been dropped from the subscription list. Note that the errors include “mailbox full”, “over quota”, “user not found”, or “user unknown” messages, and also a variety of anti-spam/filtering rejection messages (the latter likely resulting from failure to “whitelist” the microgram_editor@mailsnare.net address). The Microgram Editor requests your assistance in contacting these organizations, determining if they wish to remain on the Microgram subscription e-net, and if so asking them to forward a valid email address to the microgram_editor@mailsnare.net address. In addition, if the Office has closed or is known to be no longer interested, please forward that information to the Microgram Editor. U.S. Subscribers (by State): Non-U.S. Subscribers (by Country):
* * * * *
The rapid rate of change in computer technology is a continuous challenge for digital evidence examiners. In most cases, these changes are technical improvements in software or hardware. More recently, however, the fallout from a non-technological issue is creating a significant operational challenge for digital evidence examiners, that being information security. The loss and/or criminal mis-use of personal information has rapidly become a paramount issue for both individuals and organizations. In an effort to combat the problem, many digital technology users have implemented some form (or forms) of information security. This represents a major shift in public attitudes and behavior - five years ago, protecting personal information was (on average) a low priority for users - but now it is a major concern. One of the better known forms of information security is data encryption, which is generally defined as "the process of obscuring information to make it unreadable without special knowledge." To read encrypted data, you must provide a key or password that allows it to be decrypted. Data encryption has been around for many years, as evidenced by the numerous software and hardware products that are currently available to perform it. As noted above, however, until recently encryption was not commonly utilized by most users. While both software and hardware encryption protocols present unique problems for computer forensic examiners, this article will only focus on the issues presented by a specialized "pseudo-encryption" technique the "security mode feature set" found on most modern hard disks that have an Advanced Technology Attachment (ATA) interface. The "security mode feature set" is a hard disk firmware implemented password lock that was first defined in the ATA-3 Interface standard published in 1997 as American National Standards Institute (ANSI) standard X3.298-1997. Since that date, nearly all manufactured ATA hard disks (such as Integrated Device Electronics (IDE, also known as Parallel ATA or P-ATA), and Serial ATA) have had this capability built in, but until recently it has been only rarely used. "The security mode feature allows a host [that is, the computer] to implement a security password system to prevent unauthorized access to the internal disk drive" (http://www.t13.org). Support of this feature is indicated in Word 128 of the Identify Device response command, which enables the host to receive parameter information from the internal disk drive during the boot sequence. Many subject matter experts do not believe that this security feature is a true encryption protocol, because it does not actually encrypt the information on the disk; rather, it makes the disk inaccessible until the proper password is provided. However, it does meet the basic definition, since the information cannot be read without the password. The "security
mode feature set" uses two independent 32
byte passwords, one "user" and one "master," and
specifies one of two security modes "high" and "maximum." Each
password must be at least 4 characters in length. The "user" password
enables the security feature, blocking access to all user data on the
hard disk. The "master" password can be used to unlock the
hard disk if the "user" password is lost or if an administrator
requires access. Providing an incorrect "user" or "master" password
does nothing to the hard disk or the information it contains; rather,
the hard disk cannot be accessed until the correct password is entered.
A password ("user" or "master") can only be provided
a maximum of five times before the system must be reset or power cycled.
The passwords can be set using either the system's Basic Integrated
Operating System (BIOS) or with third-party tools. The passwords and large sections of the hard disk's firmware are stored on the non-user accessible service area of the disk, and not on the controller card or mother board. Therefore, when a hard disk password is set, it travels with the device, so the disk is protected even if it is placed in another computer. This means that the password cannot be bypassed by replacing the controller card, or by removing the complementary symmetry/metal oxide semiconductor (CMOS) battery, or by adjusting jumper settings to "reset" it. When engaged, the "security mode feature set" presents digital evidence examiners with some interesting challenges - the first being determining whether the hard disk is password protected, and the second being determining what security mode is set, "high" or "maximum." Knowing which password was used to lock the disk is not critical, as either will grant access to the data. However, as noted above, knowing what security mode is set is of paramount importance, as utilizing the "master" password when the security mode is set to "maximum" will result in complete loss of the data. Obviously, if the disk is password protected in this manner, it is not possible to obtain a usable image (copy) for forensic analysis without providing the password, or bypassing it. Determining the Security Status of a Disk If the hard disk
is removed from a computer and attached to a forensic examination
system via
a write-blocking device it may or may not prompt
for a password. Forensic software may be able to obtain an image, but
it will not be exploitable. The problem will be apparent when the examiner
notes that the disk is identified as "unused disk space" despite
the fact it appears to contain a large amount of random characters
that span a significant portion of the disk. This is different than
a hard disk that presents itself as "unallocated disk space," which
usually indicates some sort of proprietary hardware issue (frequently
encountered with laptop systems). Either scenario can be identified
by either previewing the disk prior to imaging or by utilizing diagnostic
software or other similar specialized third-party tools that are designed
to identify a disk's security status. If the preview identifies the
disk as "unused disk space" or "unallocated disk space",
diagnostic software must be used to determine whether or not it is
locked. If the disk is locked, the "security mode feature set" has
been activated. If the disk is not locked, a hardware proprietary issue
is more likely; this can be overcome by obtaining an image using a
forensic or controlled boot disk. [Note: Caution must be exercised
when using diagnostic software or other third-party tools, as they
may not be forensically sound and might alter the disk's contents.] The last method requires specialized forensic hardware that is designed to intercept the boot sequence, access the hard disk, and obtain the stored password. This method is used by a few digital forensics units and data recovery companies; unfortunately, it is currently very expensive. Digital forensics units without this technology should conduct extensive research into its cost effectiveness before pursuing this solution. Should purchasing this solution prove not to be feasible, an alternative is to coordinate with either larger digital forensics units or data recovery companies for assistance. Once the password has been provided, the examiner is granted access to the hard disk, and it functions as any other hard disk would - until it is shut down. Shutdown reactivates the security feature, requiring the password to be re-entered upon restarting. The feature can be deactivated using either the BIOS or third party tools, but this is not a proper option for a digital forensic examiner, as the disk is evidence and should be write-blocked. Additionally, the image that is obtained will not be affected by the security feature as long as it is processed using forensic software. As stated above, the security feature does not encrypt the disk's content - it merely prevents access. If the disk's contents are encrypted, once you access the disk you will either be prompted for another password as the computer's operating system initiates, or you will only be granted access to a generic desktop and have to initiate a decryption algorithm (which will require yet another password), in order to view the disk's contents. The details of disk encryption issues will be discussed in future articles. As you can see the "security mode feature set" does make a computer forensic examiner's job a little more complicated, but it is nothing that a well trained examiner cannot overcome. Additional information about this feature can be found at: http://t13.org/project/d2008r7b-ATA-3.pdf
|
|||||||||||||||
