FM 3-19.13 LAW ENFORCEMENT INVESTIGATIONS (JANUARY 2005) - page 5

 

  Главная      Manuals     FM 3-19.13 LAW ENFORCEMENT INVESTIGATIONS (JANUARY 2005)

 

Search            copyright infringement  

 

 

 

 

 

 

 

 

 

 

 

Content      ..     3      4      5      6     ..

 

 

 

FM 3-19.13 LAW ENFORCEMENT INVESTIGATIONS (JANUARY 2005) - page 5

 

 

FM 3-19.13
Use the same investigative techniques to investigate these crimes as you
would other crimes against property.
10-8. The element of proof for larceny is that the accused wrongfully took,
obtained, or withheld the owner’s or other individual’s possession of the item
in question. Generally, moving the property or having dominion over it with
the intent to permanently deprive the owner of the item without his consent
meets the element of proof. Simply receiving, buying, or concealing stolen
property or being an accessory after the fact are not included.
10-9. It must also be shown that the property is of some value and belonged to
a known owner. The value of stolen property, other than items procured or
issued from US government sources and listed by value in an official
publication, is generally determined by its legitimate market value.
10-10. The lesser crime of wrongful appropriation has the same elements of
proof as those for larceny. However, the intent is to temporarily, rather than
permanently, deprive the owner of the property.
INVESTIGATIVE PROCEDURES
10-11. Investigating a burglary or housebreaking usually leads to other
possible crimes, such as larceny. The investigative techniques for larceny
often apply to both burglary and housebreaking. The investigator’s goal is to
identify and apprehend the offenders and recover stolen property. Crimes
against property are generally investigated using the same procedures
described in Chapter 5. Those procedures include—
z
Measuring, photographing, videotaping, and sketching the scene.
z
Searching for evidence.
z
Identifying, collecting, examining, and marking physical evidence.
z
Questioning victims, witnesses, and suspects.
z
Documenting all statements and observations in notes.
INVESTIGATOR'S TIPS
10-12. The following tips are provided to assist an investigator when
conducting an investigation of a burglary or housebreaking:
z
Establish who had the means, opportunity, and motive to commit the
offense.
z
Eliminate the individuals who had access to the stolen property.
z
Use the crime scene examination to determine how access was gained,
how many people were involved, and what was the time frame of the
occurrence. The presence of excessive damage is indicative of juvenile
involvement.
z
Establish what the suspect and victim did before and after the offense.
This will aid in eliminating them as suspects or in establishing their
ability or opportunity to participate in the crime.
z
Canvass, thoroughly, the people who actually live, work, and spend
time in the area where the crime was committed and inquire as to who
might know the victim or suspect.
Burglary, Housebreaking, and Larceny Investigations 10-3
FM 3-19.13
z
Chase the property not the people. Investigators must make timely
entries of stolen property into the NCIC files. They must expeditiously
make checks of pawnshops, flea markets, and other sources used for
quick resale of property. Internet sale sites should also be considered.
z
Believe nothing without first verifying it. Use polygraph early.
z
Send the evidence to the lab (always).
CRIME SCENE PROCESSING
10-13. The initial notification begins the investigative process. Obtain as
much detail as possible during this phase of the investigation. Fully identify
the caller and get detailed information about how the caller discovered the
crime and what action the caller took at the crime scene. Inform the caller to
avoid rearranging items and prevent others from entering the area. In many
cases, the caller may have been notified of the crime by a third party. Identify
the third party for later questioning. Use this information to develop a
preliminary plan.
10-14. Proceed to the crime scene in a safe manner. On the way to the crime
scene, watch for individuals fleeing the area, suspicious looking individuals
still at the crime scene, and automobiles that appear to be out of place. Note
the time of arrival, and record weather conditions. Verify that it is the correct
location of the reported incident. If necessary, assist injured personnel. Set up
crime scene security or if security has already been established, ensure that it
is adequate. Initiate a personnel roster to document all personnel who enter
the crime scene. Record this information in your notes.
10-15. Look for evidence in areas outside the immediate crime scene, such as
parking lots, sidewalks, or footpaths. Consider having the military police
record the license plate numbers of vehicles parked in the area. Observe the
general condition of the crime scene.
10-16. During the initial observation, determine if a crime was committed
and, if so, what type it was. Larceny is the offense most often involved during
the investigation of a housebreaking or burglary. Get a detailed description of
the missing property and record the exact location from which the item was
taken. Get the location of all parties initially thought to be involved in the
crime and the details concerning how the property was secured. Find out
where the owners or occupants were at the time of the crime. Observe the
mannerisms of the victims during the initial interview. If there is more than
one victim, interview them separately. Take note of inconsistencies in their
account of the incident.
10-17. Proof of ownership must be established early in the investigation.
Obtain the names and addresses of individuals who can verify ownership or
possession of the item. The owner may be able to provide documents or
photographs that can help establish ownership, possession, and the value of
the stolen property. If the stolen property was insured, get the amount, policy
number, name and address of the insuring company, and the names of any
beneficiaries of the policy. Insurance companies record detailed information
on items that are insured.
10-4 Burglary, Housebreaking, and Larceny Investigations
FM 3-19.13
10-18. Check for holes sawed or hacked through walls, floors, partitions, or
ceilings. The size, shape, and location of openings are important clues in the
investigation. Note the height of the openings from the ground or from where
the offender stood. If possible, determine if entry was made bodily or with an
instrument. Investigate the possibility that someone from inside the building
assisted in the crime. Look carefully to see if any evidence was destroyed. In
an attempt to mask a crime, offenders often wipe off fingerprints, wear gloves,
deface toolmarks, or try to obscure footprints and tire tracks.
EVIDENCE SEARCH
10-19. The circumstances of a case must always guide the actions of the
investigator when processing a crime scene. However, experience has shown
that systematically searching for and collecting evidence is helpful in
preventing errors.
10-20. Determine the initial points of entry and exit. Generally, evidence can
be found at these points. Check locks or fasteners for evidence of tampering.
Ask the victim to assist in the evidence search. The victim can identify items
missing from the scene or moved during the crime.
10-21. Once the points of entry and exit have been determined, inspect the
ground surrounding the entry and exit points for signs of evidence, such as
footprints or other impressions. Examine broken windows for clothing fibers,
blood, other trace evidence, and the method used to break or force the window
open. Ask the victim when the dwelling or structure was last known to be
secure. Look for cut locks in and around the crime scene. Check dumpsters for
discarded tools or evidence.
10-22. Look for fingerprints and other evidence at points where the offender
was likely to be. Such evidence may suggest how much time the offender spent
on the premises, his skill, or his familiarity with the location. Determine if the
offender’s search was systematic, thorough, selective, or haphazard. The
manner of search may reveal the crime to be the work of a professional or an
amateur.
10-23. Examine garbage containers and nearby dumpsters for food items
identified by the victim as missing from the refrigerator. These items may
have fingerprints or bite marks from the offender. Canvass the neighborhood
to identify possible witnesses.
EVIDENCE
10-24. Physical evidence must be protected and processed according to
AR 195-5. Fragile evidence must be protected from the elements, animals, and
people. All evidence, if possible, must be photographed, sketched, preserved,
collected, and recorded. Place your initials and the time and date of the
recovery on each item of evidence for positive identification at a later date.
10-25. Evidence gained through the questioning of people or by other means
must be verified. A confession does not negate the need for evidence. The
elements of the confession must be supported by evidence. Look for evidence
(such as fingerprints, palm prints, footprints, or identifiable tire tracks) that
places the suspect or his vehicle at the scene of the crime. Match soil or rock
Burglary, Housebreaking, and Larceny Investigations 10-5
FM 3-19.13
samples from the suspect’s clothing or vehicle to the samples taken from the
crime scene to help place the suspect at the scene.
10-26. Evidence may lead to finding stolen property in the possession of a
suspect or in a place under his control. Finding the item or evidence of the
item in the possession or control of the suspect is not, by itself, enough to
convict him of theft. The investigator must show that the suspect knowingly
and illegally deprived another of possession of the item.
10-27. Evidence usually common to breaking and entering includes—
z
Glass.
z
Cigarette butts.
z
Fingerprints.
z
Fabrics.
z
Blood.
z
Hair and fiber.
z
Dust prints.
z
Paint.
z
Salvia.
z
Shoe prints.
z
Small objects.
z
Soil.
z
Tape.
z
Tire tracks.
z
Toolmarks or impressions.
CRITICAL INTERVIEWS
10-28. During the investigation, identify potential witnesses. Speak with
neighbors, individuals who frequented the area, and coworkers of the victim.
Determine who had the motive, means, and opportunity to commit the
offense. Determine who had the desire to commit the act and who would
benefit the most from the act. Keep in mind that motive is, perhaps, the least
important factor to consider in determining who committed the crime.
However, the means is very important in determining who committed the
offense. Determine if the suspect had the means and if he was mentally and
physically capable of committing the offense. Determine if the suspect can be
placed at the scene of the crime and if his alibi can be proven false.
10-29. Interview the victim and obtain a sworn statement as soon as possible.
Get full details concerning possible suspects and a full description of the
missing property. Study the sworn statement to determine if it matches the
crime scene.
10-30. Once a potential suspect has been identified, question him and obtain
a sworn statement as soon as possible. Have the suspect describe his actions
before, during, and after the crime. Develop elements of the crime during the
interview. Obtain proper legal authority, and search the suspect's house,
vehicle, and storage areas.
10-6 Burglary, Housebreaking, and Larceny Investigations
FM 3-19.13
10-31. To develop leads, inquire at local pawn shops in the area. Provide the
shop owner with a full description of the stolen items. If such items were
pawned, coordinate with local police agencies to have the items seized or a
“police hold” placed on them.
Burglary, Housebreaking, and Larceny Investigations 10-7
Chapter 11
Computer Crimes
Computer crimes are among the fastest growing crimes in our society
today. Electronic devices can be used to commit a crime, can contain the
evidence of the crime, and can even be the targets of crime. Understanding
the role and nature of electronic evidence that may be found and how to
process the crime scene containing potential electronic evidence are crucial
issues facing all law enforcement personnel. Due to a rapid increase and
the serious nature of these crimes, several federal agencies have organized
special units that investigate computer crimes. The Computer Crime
Investigation Unit (CCIU) and USACIL are the primary supporting
agencies for military law enforcement investigators with regard to
electronic evidence.
OVERVIEW
11-1. Technology is advancing at such a rapid rate that the procedures
described in this chapter must be examined through the prism of current
technology and the practices adjusted, as appropriate. Electronic evidence can
be found in many new electronic devices available to today's consumers.
Appendix C describes a wide variety of the types of electronic devices
commonly encountered in crime scenes. It provides a general description of
each type of device, describes its common uses, and presents the potential
evidence that may be found in each type of equipment.
ELECTRONIC EVIDENCE
11-2. Electronic evidence is information and data of investigative value that
is stored on or transmitted by an electronic device (see Appendix D). As such,
electronic evidence is latent just as DNA and fingerprints are latent. In its
natural state, we cannot see the evidence that the physical object holds.
Equipment and software are required to make the evidence visible. Testimony
may be required to explain the examination process and any process
limitations.
11-3. Electronic evidence is, by its very nature, fragile. It can be altered,
damaged, or destroyed by improper handling or improper examination. For
this reason, special precautions should be taken to document, collect,
preserve, and examine this type of evidence. Failure to do so may render it
unusable or lead to an inaccurate conclusion. This chapter suggests methods
that will help preserve the integrity of such evidence.
Computer Crimes 11-1
FM 3-19.13
11-4. When dealing with electronic evidence, general forensic and procedural
principles should be applied to include the following:
z
Actions taken to secure and collect electronic evidence should not
change that evidence.
z
Persons conducting the examination of electronic evidence should be
trained for that purpose.
z
Activity relating to the seizure, examination, storage, or transfer of
electronic evidence should be fully documented, preserved, and
available for review.
11-5. This evidence is acquired when data or physical items are collected and
stored for examination purposes. The following are characteristics of
electronic evidence:
z
It is often latent just as fingerprints and DNA are latent.
z
It can transcend borders with ease and speed.
z
It is fragile and can be easily altered, damaged, or destroyed.
z
It is sometimes time sensitive.
11-6. Precautions must be taken in the collection, preservation, and
examination of electronic evidence. Handling electronic evidence at the crime
scene normally consists of—
z
Recognition and identification of the evidence.
z
Documentation of the crime scene.
z
Collection and preservation of the evidence.
z
Packaging and transportation of the evidence.
INVESTIGATIVE TOOLS AND EQUIPMENT
11-7. Special tools and equipment may be required to collect electronic
evidence. Experience has shown that advances in technology may dictate
changes in the tools and equipment required. Preparations should be made to
get the equipment required to collect electronic evidence. Investigative
agencies should have general crime scene processing equipment, such as
cameras, notepads, sketch pads, evidence forms, crime scene tape, and
markers. Each aspect of the process (documentation, collection, packaging,
and transportation) dictates tools and equipment. The following are additional
items that may be useful to have in a tool kit at an electronic crime scene:
z
Documentation tools such as—
„
Cable tags.
„
Indelible felt-tip markers.
„
Stick-on labels.
z
Disassembly and removal tools in a variety of nonmagnetic sizes and
types that include—
„
Flat-blade and cross-tip screwdrivers.
„
Hex-nut and secure-bit drivers.
„
Star-type nut drivers.
„
Needle-nose and standard pliers.
11-2 Computer Crimes
FM 3-19.13
„
Small tweezers.
„
Specialized screwdrivers (manufacturer specific).
„
Wire cutters.
z
Packaging and transporting supplies such as—
„
Antistatic bags and bubble wrap.
„
Cable ties.
„
Evidence bags.
„
Evidence and packing tape.
„
Packing materials
(avoid materials that can produce static
electricity, such as foam peanuts).
„
Sturdy boxes of various sizes.
z
Other items such as—
„
Evidence tags.
„
Evidence tape.
„
Forms (keystroke or mouse click log, photograph log, DA Forms
4137 [Evidence/Property Custody Document], and DA Forms
4002).
„
Gloves.
„
A hand truck.
„
Large rubber bands.
„
A list of contact telephone numbers for assistance.
„
A magnifying glass.
„
Printer paper.
„
A seizure disk.
„
A small flashlight.
„
Fully-formatted floppy diskettes (3 inch and 5 1/4 inch).
CRIME SCENE SECURITY AND EVALUATION
11-8. The investigator should take steps to ensure the safety of all persons at
the crime scene and protect the integrity of all evidence, both traditional and
electronic. All activities should be in compliance with Army policy and federal,
state, and local laws.
11-9. After securing the scene and all persons on the scene, the investigator
should visually identify potential evidence (both physical and electronic) and
determine if perishable evidence exists. He should then evaluate the scene
and formulate a search plan.
SECURE AND EVALUATE THE CRIME SCENE
11-10. The investigator should secure and evaluate the crime scene by—
z
Following jurisdictional policy for securing the crime scene. This
would include ensuring that all persons are removed from the
immediate area where evidence is to be collected. At this point in the
investigation, do not alter the condition of any electronic devices. If it
is off, leave it off. If it is on, leave it on.
Computer Crimes 11-3
FM 3-19.13
z
Protecting perishable data (physical and electronic). Perishable data
may be found on pagers, caller identification (ID) boxes, electronic
organizers, cell phones, and other similar devices. The first responder
should always keep in mind that any device containing perishable
data should be immediately secured, documented, and/or
photographed.
z
Identifying telephone lines attached to devices such as modems and
caller ID boxes. Document, disconnect, and label each telephone line
from the wall rather than the device, when possible. There may also
be other communications lines present for local area network (LAN),
wide area network (WAN), or other network technologies. Consult the
appropriate personnel or agency in these cases.
z
Preserving the computer mouse, keyboard, diskettes, compact disks
(CDs), or other components that may have latent fingerprints or other
physical evidence. Chemicals used in processing latent fingerprints
can damage equipment and data. Therefore, latent prints should be
collected after the completion of electronic evidence recovery.
CONDUCT PRELIMINARY INTERVIEWS
11-11. The investigator should conduct preliminary interviews by—
z
Separating and identifying all individuals (witnesses, subjects, or
others) at the scene and recording their location at the time of entry.
z
Being consistent with departmental policy and applicable laws in
obtaining information from these individuals, such as—
„
Passwords and user names of owners and/or users of electronic
devices found at the crime scene and the Internet service provider
(ISP). Obtain any passwords required to access the system,
software, or data. An individual may have multiple passwords,
such as basic input-output system (BIOS), system login, network
ISP, application files, encryption pass phrase, e-mail, access
token, scheduler, or contact list.
„
The purpose of the system.
„
Any unique security schemes or destructive devices.
„
Any off-site data storage.
„
Any documentation explaining the hardware or software installed
on the system.
CRIME SCENE DOCUMENTATION
11-12. Documentation of the crime scene creates a permanent historical
record of the crime scene. Documentation is an ongoing process throughout
the investigation. It is important to accurately record the location and
condition of computers, storage media, other electronic devices, and
conventional evidence. Moving of a computer system while the system is
11-4 Computer Crimes
FM 3-19.13
running may cause changes to system data. Therefore, the system should not
be moved until it has been safely powered down. The initial documentation of
the physical crime scene should include—
z
Observing and documenting the physical crime scene, such as the
position of the mouse and the location of components relative to each
other (a mouse on the left side of the computer may indicate a left-
handed user).
z
Documenting the condition and location of the computer system,
including the power status of the computer (on, off, or in sleep mode).
Most computers have status lights to indicate that the computer is on.
Likewise, if fan noise is heard, the system is probably on.
Furthermore, if the computer system is warm, it may also indicate
that it is on or was recently turned off.
z
Identifying and documenting related electronic components that will
not be collected.
z
Photographing the entire scene to create a visual record as noted by
the first responder. The complete room should be recorded with 360°
coverage, when possible.
z
Photographing the front of the computer, monitor screen, and other
components. Take written notes on what appears on the monitor
screen. Active programs may require videotaping or more extensive
documentation of monitor screen activity.
z
Performing additional documentation of the system during the
collection phase.
AUTHORIZATION TO SEIZE ELECTRONIC EVIDENCE
11-13. Search authorization may be obtained from a US magistrate, a civilian
judge at the state or federal level, or the property owner is required. However,
in almost all cases, courts have held a relatively high standard with regard to
the specificity of computer-related search authorizations. Investigative
personnel seeking search authorization must be able to articulate specific and
recent information pertaining to the individual items cited on the affidavit
and authorization in order to establish probable cause. In many instances,
information that is several months old cannot in and of itself be used to
generate probable cause. More recent information, gained through “pretext”
phone calls or online undercover operations, may be required to develop
current and reliable information (see Appendix E for a sample affidavit and
authorization). Additionally, if during the conduct of a search for one offense,
evidence of an unrelated or different type of offense is identified, the scope of
the search authorization must be expanded accordingly. If probable cause
cannot be developed, consideration should be given to requesting a consent
search. However, this may make the suspect aware of law enforcement
interest and cause investigators to lose potential evidence.
11-14. When information is required from private business computers,
investigators must take the appropriate measures to avoid any financial
liability to the government by determining if the seizure of these computers
will cause the business to lose money in any way. If it is determined that the
seizure will create liabilities to the government, coordination must be made
Computer Crimes 11-5
FM 3-19.13
with CCIU or USACIL to have an expert image the appropriate drive
information on the site. Additionally, investigators must take reasonable
steps to determine if copyrighted information is contained on a computer to be
seized. If a determination is made that such data is stored on a target
computer, consult with CCIU or USACIL, as appropriate, to seize the required
information without collecting the copyrighted information. Failure to comply
with this requirement will likely result in the suppression of all collected
evidence from courtroom presentation and could possibly leave the Army
legally liable.
EVIDENCE COLLECTION
11-15. Computer evidence, like all other evidence, must be handled carefully
and in a manner that preserves its evidentiary value. This relates not just to
the physical integrity of an item or device, but also to the electronic data it
contains. Certain types of computer evidence, therefore, require special
collection, packaging, and transportation. Consideration should be given to
protect data that may be susceptible to damage or alteration from
electromagnetic fields, such as those generated by static electricity, magnets,
radio transmitters, and other devices.
11-16. Electronic evidence should be collected according to departmental
guidelines. In the absence of departmental procedures for electronic evidence
collection, use the procedures outlined below.
NONELECTRONIC EVIDENCE COLLECTION
11-17. Recovery of nonelectronic evidence can be crucial in the investigation
of electronic crimes. Take proper care to ensure that such evidence is
recovered and preserved. Items relevant to subsequent examination of
electronic evidence may exist in other forms (written passwords and other
handwritten notes, blank pads of paper with indented writing, hardware and
software manuals, calendars, literature, text or graphical computer printouts,
and photographs) and should be secured and preserved for future analysis.
These items are frequently in close proximity to the computer or related
hardware items. All evidence should be identified, secured, and preserved in
compliance with departmental procedures.
STAND-ALONE AND LAPTOP COMPUTER EVIDENCE COLLECTION
11-18. Multiple computers may indicate a computer network. Likewise,
computers located at businesses are often networked. In these situations,
specialized knowledge about the system is required to effectively recover
evidence and reduce your potential for civil liability. When a computer
network is encountered, contact the forensic computer expert in your
department or an outside consultant identified by your department for
assistance. Computer systems in a complex environment are addressed later
in this chapter.
11-19. A stand-alone personal computer (PC) is a computer that is not
connected to a network or another computer. Stand-alones may be desktop
machines or laptops.
11-6 Computer Crimes
FM 3-19.13
11-20. Laptops incorporate a computer, monitor, keyboard, and mouse into a
single portable unit. Laptops differ from other computers in that they can be
powered by electricity or a battery source. Therefore, they require the removal
of the battery in addition to stand-alone, power-down procedures.
11-21. If the computer is on, document existing conditions and call your
expert or consultant. If an expert or consultant is not available, document all
actions taken and any changes observed in the monitor, computer, printer, or
other peripherals that result from actions taken. Observe the monitor and
determine if it is on, off, or in sleep mode. Then decide which of the following
situations applies and follow the steps for that situation.
z
Situation 1: The monitor is on and the work product and/or desktop
are visible.
Step 1. Photograph the screen and record the information displayed.
Step 2. Proceed to situation 3, step 3.
z
Situation 2: The monitor is on and the screen is blank (sleep mode) or
the screensaver (picture) is visible.
Step 1. Move the mouse slightly (without pushing buttons). The
screen should change and show the work product or request a
password.
Step 2. Do not perform any other keystrokes or mouse operations if
mouse movement does not cause a change in the screen.
Step 3. Photograph the screen and record the information displayed.
Step 4. Proceed to situation 3, step 3.
z
Situation 3: The monitor is off.
Step 1. Make a note of the “off” status.
Step 2. Turn the monitor on, then determine if the monitor status is
as described in either situation 1 or 2 above and follow those steps.
Step 3. Regardless of the power state of the computer (on, off, or sleep
mode), remove the power source cable from the computer, not from the
wall outlet. If dealing with a laptop, in addition to removing the power
cord, remove the battery pack. The battery is removed to prevent any
power to the system. Some laptops have a second battery in the
multipurpose bay instead of a floppy drive or CD drive. Check for this
possibility and remove that battery as well.
Step 4. Check for outside connectivity (telephone modem, cable,
integrated services digital network [ISDN], and digital subscriber line
[DSL]). If a telephone connection is present, attempt to identify the
telephone number.
Step 5. Avoid damage to potential evidence by removing any floppy
disks that are present, packaging the disk separately, and labeling the
package. If available, insert either a seizure disk or a blank floppy
disk. Do not remove CDs or touch the CD drive.
Step 6. Place tape over all the drive slots and over the power
connector.
Step 7. Record the make, model, and serial numbers.
Step 8. Photograph and diagram the connections of the computer and
the corresponding cables.
Computer Crimes 11-7
FM 3-19.13
Step 9. Label all connectors and cable ends (including connections to
peripheral devices) to allow for exact reassembly at a later time. Label
unused connection ports as “unused.” Identify laptop computer
docking stations in an effort to identify other storage media.
Step 10. Record or log evidence according to departmental
procedures.
Step 11. Package any components as fragile, if transport is required.
COMPUTERS IN A COMPLEX ENVIRONMENT
11-22. Business environments frequently have multiple computers connected
to each other, to a central server, or both. Securing and processing a crime
scene where the computer systems are networked poses special problems,
because an improper shutdown may destroy data. This can result in loss of
evidence and potential severe civil liability. When investigating criminal
activity in a known business environment, the presence of a computer
network should be planned for in advance, if possible, and the appropriate
expert obtained. It should be noted that computer networks can also be found
in a home environment and the same concerns exist.
11-23. The possibility of various operating systems and complex hardware
configurations requiring different shutdown procedures make the processing
of a network crime scene beyond the scope of this chapter. However, it is
important that computer networks be recognized and identified, so that an
expert can be obtained if one is encountered.
11-24. Indications that a computer network may be present include
z
Multiple computer systems.
z
Cables and connectors running between computers or central devices,
such as hubs.
z
Any information provided by informants or individuals at the scene.
z
Network components.
EXAMINATION REQUEST
11-25. At the point when the USACIL laboratory request is prepared, the
initial report and all documentation related to the efforts undertaken by the
investigator should be forwarded to USACIL with the items of evidence. It is
important that all actions, including every keystroke and mouse click, be
recorded by the investigator to ensure that the laboratory examiner can fully
appreciate what impact the investigator’s actions could have had on the
operating system. Additionally, special consideration should be undertaken
when shipping computer-related items to USACIL; they should be
containerized separate from fungible evidence that will require special
treatment, such as refrigeration.
ON-SITE SEARCHES WITHOUT SEIZURE AUTHORIZATION
11-26. In some instances, investigative personnel will find themselves in a
situation where there is an authorization to search a computer, but the agent
lacks the authorization to seize it. Typically, this occurs in one of two
11-8 Computer Crimes
FM 3-19.13
situations. The first is when consent to search is authorized by a suspect who
agrees to allow the investigator to search the computer; however, he does not
agree to allow the investigator to seize or ship it to the laboratory for
examination. The second situation frequently results when a commander
suspects that criminal activity has been committed using a government
computer, but he has no means to verify it and does not want to deprive the
organization of the use of the computer while it is awaiting examination.
Investigators in the field should never conduct a search of a computer or open
electronic files under any circumstance other than when it is impossible or
impractical to seize the device for laboratory examination.
11-27. If an investigator conducts a consent type search of a computer, based
on the scenario indicated above, it is essential for him to terminate the search
as soon as the first file containing evidence of a crime is identified. At this
point, probable cause has been met, and a formal search authorization should
be obtained from a competent authority. The subsequent seizure of the
computer is not based on the consent to search, but rather the evidence
identified during the search and the authority of a formal search
authorization or warrant. The investigator must then document all of his
activities including every keystroke and mouse click that led to the discovery
of the criminal material. It is important that additional files not be accessed,
because the date-time group of the accessed file are modified and will likely
result in the suppression of them in the prosecutorial process.
EVIDENCE PACKAGING, TRANSPORTING, AND STORING
11-28. Computers are fragile electronic instruments that are sensitive to
temperature, humidity, physical shock, static electricity, and magnetic
sources. Therefore, special precautions should be taken when packaging,
transporting, and storing electronic evidence. To maintain the chain of
custody of electronic evidence, document its packaging, transporting, and
storing.
PACKAGING
11-29. If multiple computer systems are collected, label each system so that it
can be reassembled as found (system A: mouse, keyboard, monitor, and main
base unit; system B: mouse, keyboard, monitor, and main base unit).
11-30. When packaging evidence at a crime scene—
z
Ensure that all collected electronic evidence is properly documented,
labeled, and inventoried before packing.
z
Pay special attention to latent or trace evidence and take action to
preserve it.
z
Pack magnetic media in antistatic packaging (paper or antistatic
plastic bags). Avoid using materials that can produce static electricity,
such as standard plastic bags.
z
Avoid folding, bending, or scratching computer media, such as a
diskette, compact disk-read only memory (CD-ROM), or tape.
z
Ensure that all containers used to hold evidence are properly labeled.
Computer Crimes 11-9
FM 3-19.13
TRANSPORTING
11-31. Ensure that computers and other components that are not packaged in
containers are secured in the vehicle to avoid shock and excessive vibrations.
For example, computers may be placed on the vehicle floor and monitors
placed on the seat with the screen down and secured by a seat belt. When
transporting evidence—
z
Keep all electronic evidence away from magnetic sources. Radio
transmitters, speaker magnets, and heated seats are examples of
items that can damage electronic evidence.
z
Avoid storing electronic evidence in vehicles for prolonged periods of
time. Conditions of excessive heat, cold, or humidity can damage
electronic evidence.
z
Maintain the chain of custody on all evidence transported.
STORING
11-32. Ensure that evidence is inventoried according to AR 195-5. Store
evidence in a secure area away from temperature and humidity extremes.
Protect it from magnetic sources, moisture, dust, and other harmful particles
or contaminants.
11-33. Be aware that potential evidence, such as dates, times, and system
configurations may be lost as a result of prolonged storage. Since batteries
have a limited life, data could be lost if they fail. Therefore, appropriate
personnel (such as the evidence custodian, laboratory chief, and forensic
examiner) should be informed that a device powered by batteries is in need of
immediate attention.
11-10 Computer Crimes
Chapter 12
Death Scene Investigations
Many agencies are responsible to the commander for investigating
suspicious deaths. Close liaison must be made within commands between
investigative, medical, and related forensic personnel to have an effective
death investigation. Matters of mutual interest include jurisdiction,
investigative responsibilities, local agreements with the civil authorities,
SOFAs, and legal issues to be considered by military police, USACIDC,
medical personnel, and pathologists.
RESPONSIBILITIES
12-1. Many people have inherent responsibilities to a death scene
investigation. The interest of the crime goes beyond the involvement of law
enforcement personnel and requires the special qualifications of certain
individuals, such as a medical officer, a pathologist, and even an intelligence
officer from the decedent's organization.
PROVOST MARSHAL
12-2. The PM and USACIDC are responsible for obtaining all facts pertinent
to deaths occurring under suspicious circumstances. An investigator must
determine the manner of death to be a homicide, a suicide, or an accidental or
natural death. Regardless of the initial manner of death, all circumstances
concerning that death must be developed to ensure that the facts support the
initial finding of the manner of death.
MEDICAL OFFICER
12-3. The medical officer is responsible for conducting a medicolegal (forensic)
autopsy of the decedent. It is important to understand that there are several
components of the autopsy. These include a complete review of the medical
history, a complete crime scene examination, and the prosecution of the
defendant. This autopsy is a joint venture in which the investigator and
pathologist must work together. The purpose of the medicolegal autopsy is to
determine—
z
The cause of death.
z
The manner of death.
z
The identification of the decedent.
z
The location of the decedent. Determine if the decedent was moved.
z
The identification or presence of physical evidence. If such is present,
it should be collected.
Death Scene Investigations 12-1
FM 3-19.13
CRIMINAL INVESTIGATOR
12-4. Investigators are encouraged to set up a liaison with the pathologist
who does the autopsy. Investigators must tell the pathologist the known facts
of the death and the initial investigative findings before the autopsy. This
enables the pathologist to select the proper ways to determine the cause of
death and to give an opinion about the manner of death. The medical officer
must complete certain military records and official certificates of death. The
investigator works with the medical officer to collect and preserve evidence.
The investigator's direct responsibilities include photographing and obtaining
full record fingerprints of the decedent. He should obtain two complete sets.
12-5. Appendix F contains checklists for various violent crimes. They will
assist the investigator in keeping track of the minute details concerning even
the most complicated investigation.
LINE-OF-DUTY AND SAFETY INVESTIGATING OFFICER
12-6. The LOD investigating officer determines the duty status and personal
conduct of the deceased. The LOD officer has no jurisdiction with the criminal
investigation. The safety officer determines any safety factors, or lack of them,
in an accident. His interest in accidents is limited to safety.
INTELLIGENCE LIAISON
12-7. Close intelligence liaison is needed and directed by AR 195-2. A report of
death due to a homicide, an accident, or a suicide must be relayed at once to
the nearest intelligence agency. If the victim had access to classified material,
the intelligence officer determines if any of the material is missing. The
intelligence officer is responsible for security measures. His main concern is to
ensure that classified material is not compromised. This is very important if
the death is a suicide. Ensure that intelligence officials are kept fully advised
until no further security interest exists.
12-8. In some instances, the post commander or higher authority may call a
board of inquiry to find out the facts connected with a death. Such a board has
broad powers and may check into all areas of the matter.
INVESTIGATIVE PROCEDURES
12-9. The basic aim of the investigation is to determine if the death was
natural, an accident, a suicide, or a homicide and, in the case of a homicide, to
collect evidence leading to the conviction of the guilty party. The technique of
investigating any violent death is basically the same. The circumstances,
conditions, and events leading to and following the death are investigated.
Learning and tracing the events and actions involving the victim before his
death can show the likelihood of an accident or a clear intent for suicide or
homicide.
12-10. Accidental deaths often occur under suspicious conditions. Many of
these deaths will look violent but will lack criminal likelihood. Circumstances
may show, for example, a logical reason for the presence of a weapon and the
likelihood of it being an accident. On the other hand, circumstances may
strongly suggest a death by suicide. Prior suicide attempts, earlier written or
12-2 Death Scene Investigations
FM 3-19.13
oral statements of intent, and suicide notes at the scene are strong evidence of
suicide.
12-11. Homicide is often shown by conditions and events leading to and
following the death. A disturbed scene, wounds to nonvital areas, punctured
clothing, no weapon at the scene, no signs of suicidal intent or hazardous
conditions, lack of hesitation wounds, signs of a fight, and signs of flight or
surprise are all factors pointing to homicide.
12-12. The lack of a visible weapon at the scene most often suggests that the
death was homicidal, but a suicide victim may live long enough to dispose of a
weapon, or he may arrange a contraption to cause the weapon to disappear
after being fired. Relatives fearing social disgrace or having an interest in the
life insurance of a suicide victim may try to hide the deceased's suicidal intent
and circumstances. Similarly, a murderer may try to make things look like a
suicide or an accident. When distinguishing between a suicide and a homicide,
it is very important to learn motive. Opportunity is also a factor to be
considered where there are signs that an apparent or alleged suicide may be a
homicide.
ARRIVE AT THE SCENE
12-13. Upon arrival at the scene and before entering the scene, the
investigator should—
z
Identify the lead investigator at the scene and present his
identification.
z
Identify other essential officials at the scene (such as law enforcement,
fire, EMS, or social or child protective services) and answer any
questions about his activities at the crime scene.
z
Identify and document the identity of the first essential official (the
first “professional” arriving at the scene for investigative follow-up) to
the scene to ascertain if any artifacts or contamination may have been
introduced to the death scene.
z
Determine the safety of the scene (before entry).
DETERMINE SCENE SAFETY
12-14. Determining scene safety for all investigative personnel is essential to
the investigative process. The risk of environmental and physical injury must
be removed before initiating a scene investigation. Risks can include hostile
crowds, collapsing structures, traffic, and environmental and chemical
threats. The investigator must attempt to establish scene safety before
entering the scene to prevent injury or loss of life to include contacting
appropriate agencies for assistance with other scene safety issues.
12-15. Upon arrival at the scene, the investigator should—
z
Secure his vehicle and park as safely as possible.
z
Obtain a clearance or authorization to enter the crime scene from the
individual responsible for scene safety, such as the fire marshal or
disaster coordinator.
Death Scene Investigations 12-3
FM 3-19.13
z
Protect the integrity of the scene and the evidence (to the extent
possible) from contamination or loss by people, animals, and elements
while exercising scene safety.
z
Assess and/or establish physical boundaries.
z
Identify the incident command.
z
Use personal protective safety devices (physical and biochemical).
z
Arrange for the removal of any animals or secure them (if they are
present and if it is possible).
z
Have the body removed before the scene investigation continues
because of potential scene hazards, such as crowd control, collapsing
structures, poisonous gases, or traffic.
CONFIRM OR PRONOUNCE DEATH
12-16. Appropriate personnel must make a determination of death before the
initiation of a death investigation. The confirmation or pronouncement of
death determines jurisdictional responsibilities.
12-17. Upon arrival at the scene, the investigator should—
z
Locate and view the body.
z
Check for a pulse, respiration, and reflexes, as appropriate.
z
Identify and document the name of the individual who made the
official determination of death (include the date and time of the
determination).
z
Ensure that the death is pronounced, as required.
12-18. Once death has been determined, rescue and/or resuscitative efforts
cease and medicolegal jurisdiction can be established. It is vital that this occur
before the medical examiner or coroner assumes any responsibilities.
PARTICIPATE IN THE SCENE BRIEFING
12-19. Scene investigators must recognize the varying jurisdictional and
statutory responsibilities that apply to individual agency representatives,
such as law enforcement, fire, EMS, and judicial or legal. Determining the
investigative responsibility of each agency at the scene is essential in
planning the scope and depth of each scene investigation and the release of
information to the public.
12-20. The investigator should identify specific responsibilities, share
appropriate preliminary information, and establish the investigative goals of
each agency present at the scene.
12-21. When participating in a scene briefing, the investigator should—
z
Locate the staging area (such as the entry point to the scene or the
command post).
z
Document the scene location (such as the address, mile marker, and
building name) consistent with other agencies.
12-4 Death Scene Investigations
FM 3-19.13
z
Determine the nature and scope of the investigation by obtaining
preliminary investigative details (such as suspicious versus
nonsuspicious death).
z
Ensure that initial accounts of the incident are obtained from the first
witnesses.
12-22. A scene briefing allows for initial and factual information exchange.
This includes scene location, time factors, initial witness information, agency
responsibilities, and investigative strategy.
CONDUCT A SCENE WALK-THROUGH
12-23. Conducting a scene walk-through provides the investigator with an
overview of the entire scene. The walk-through provides the investigator with
the first opportunity to locate and view the body, identify valuable and/or
fragile evidence, and determine initial investigative procedures providing for
a systematic examination and documentation of the scene and the body. The
investigator should conduct a scene walk-through to establish pertinent scene
parameters.
12-24. Upon arrival at the scene, the investigator should—
z
Reassess scene boundaries and adjust, as appropriate.
z
Establish a path of entry and exit.
z
Identify visible, physical, and fragile evidence.
z
Document and photograph fragile evidence immediately and collect, if
appropriate.
z
Locate and view the decedent.
12-25. The initial scene walk-through is essential to minimize scene
disturbance. It will also prevent the loss and/or contamination of physical and
fragile evidence.
ESTABLISH A CHAIN OF CUSTODY
12-26. Ensuring the integrity of the evidence by establishing and maintaining
a chain of custody is vital to an investigation. This will safeguard against
subsequent allegations of tampering, theft, planting, and contaminating
evidence. Before the removal of any evidence, the evidence custodian should
be designated and should generate and maintain a chain of custody for all
evidence collected.
12-27. Throughout the investigation, those responsible for preserving the
chain of custody should—
z
Document the scene location and the arrival time of the death
investigator at the scene.
z
Determine the evidence custodian, the agency responsible for the
collection of specific types of evidence, and the evidence collection
priority for fragile or fleeting evidence.
z
Identify, secure, and preserve the evidence with the proper containers,
labels, and preservatives.
Death Scene Investigations 12-5
FM 3-19.13
z
Document the collection of the evidence by recording its location at the
scene.
z
Develop the personnel and witness lists and document the arrival and
departure times of personnel.
FOLLOW LAWS FOR THE COLLECTION OF EVIDENCE
12-28. The investigator must follow AR 195-5 and state and federal laws for
the collection of evidence to ensure its admissibility. The investigator must
work with law enforcement, the office of the SJA, and other legal authorities
to determine laws regarding the collection of evidence.
12-29. The investigator, before or upon arrival at the death scene, should
work with other agencies to—
z
Determine the need for a search warrant and discuss this with the
appropriate agencies.
z
Identify local, state, federal, and international laws and discuss them
with the appropriate agencies.
z
Identify medical examiner and coroner statutes and/or office SOPs
and discuss them with the appropriate agencies.
SCENE DOCUMENTATION AND EVALUATION
12-30. The process of documenting and evaluating the scene must be
meticulous and timely. The process includes photographing, writing
descriptive documentation, and establishing the probable location of the
incurred injury or illness of the deceased. It also includes the collecting,
inventorying, and safeguarding of property and evidence and documenting
interviews or comments of witnesses at the scene.
OBTAIN PHOTOGRAPHIC DOCUMENTATION
12-31. The photographic documentation of the scene creates a permanent
historical record. Photographs provide detailed corroborating evidence that
constructs a system of redundancy should questions arise concerning the
report, witness statements, or position of the evidence at the scene. The
investigator should obtain detailed photographic documentation of the scene
that provides both instant and permanent high-quality (35-millimeter)
images. Chapter 6 provides technical guidance on crime scene photography.
12-32. Upon arrival at the scene and before moving the body or evidence, the
investigator should—
z
Remove all nonessential personnel from the scene.
z
Obtain an overall (wide-angle) view of the scene to spatially locate the
specific scene to the surrounding area.
z
Photograph specific areas of the scene to provide more detailed views
of specific areas within the larger scene.
z
Photograph the scene from different angles to provide various
perspectives that may uncover additional evidence.
12-6 Death Scene Investigations
FM 3-19.13
z
Obtain some photographs with scales to document specific evidence.
z
Obtain photographs even if the body or other evidence has been moved
or removed.
12-33. If evidence has been moved before photography, it should be noted in
the report. The body or other evidence should not be reintroduced into the
scene in order to take photographs.
DEVELOP DESCRIPTIVE DOCUMENTATION OF THE SCENE
12-34. Written documentation of the scene provides a permanent record that
may be used to correlate with and enhance photographic documentation,
refresh recollections, and record observations. Investigators should provide
written scene documentation.
12-35. After photographic documentation of the scene and before removal of
the body or other evidence, the investigator should—
z
Diagram or describe
(in writing) items of evidence and their
relationship to the body with any necessary measurements.
z
Describe and document (with any necessary measurements) blood and
body fluid evidence including volume, patterns, spatters, and other
characteristics.
z
Describe scene environments including odors, lights, temperatures,
and other fragile evidence.
12-36. If physical evidence is moved or tampered with, this also needs to be
documented. The investigator should document the original state of the
evidence as reported by whomever moved it, and the state it was in when
observed by the investigator.
ESTABLISH PROBABLE LOCATION OF INJURY OR ILLNESS
12-37. The location where the decedent is found may not be the actual
location where the injury or illness that contributed to the death occurred. It
is imperative that the investigator attempts to determine the locations of any
and all injuries or illnesses that may have contributed to the death. Physical
evidence at any and all locations may be pertinent in establishing the cause,
manner, and circumstances of a death.
12-38. The investigator should obtain detailed information regarding any and
all probable locations associated with the individual's death. The investigator
should—
z
Document the location where the death was confirmed.
z
Determine the location from which the decedent was transported and
how the body was transported to the scene.
z
Identify and record any discrepancies in rigor mortis, livor mortis, and
body temperature.
z
Check the body, clothing, and scene for consistencies or
inconsistencies of trace evidence and indicate the locations where any
artifacts were found.
z
Check for any drag marks on the body, clothes, and ground.
Death Scene Investigations 12-7
FM 3-19.13
z
Establish postinjury activity.
z
Obtain any dispatch records, such as police and ambulance.
z
Interview family members and associates, as needed.
COLLECT, INVENTORY, AND SAFEGUARD PROPERTY AND EVIDENCE
12-39. The decedent's valuables or property must be safeguarded to ensure
proper processing and eventual return to the next of kin. Evidence on or near
the body must be safeguarded to ensure its availability for further evaluation.
The investigator should ensure that all property and evidence is collected,
inventoried, safeguarded, and released as required by law.
12-40. After personal property and evidence have been identified at the scene,
the investigator (with a witness) must inventory, collect, and safeguard the
following at the scene and/or the office:
z
Illicit drugs and paraphernalia.
z
Prescription medication.
z
Over-the-counter medications.
z
Money.
z
Personal valuables or property.
INTERVIEW WITNESSES AT THE SCENE
12-41. The documented comments of witnesses at the scene allow the
investigator to obtain primary source data regarding the discovery of the
body, witness corroboration, and terminal history. The documented interview
provides essential information for the investigative process. The investigator's
report should include the source of the information, including specific
statements and information provided by the witness.
12-42. Upon arriving at the scene, the investigator should—
z
Identify possible witnesses.
z
Collect all available identifying data on witnesses, such as full name,
address, date of birth (DOB), and work and home telephone numbers.
z
Establish the relationship and/or association of the witness to the
deceased.
z
Establish the basis of the knowledge of the witness. (For example, how
does the witness have knowledge of the death?)
z
Obtain information from each witness.
z
Note discrepancies from the scene briefing (challenge, explain, and
verify statements).
z
Tape statements when equipment is available and retain the tapes.
BODY DOCUMENTATION AND EVALUATION
12-43. The process of documenting and evaluating the body is intricate and
demands the attention of the investigator to ensure that even the most minute
detail is documented. The following paragraphs describe the requirements to
document and evaluate the body.
12-8 Death Scene Investigations
FM 3-19.13
PHOTOGRAPH THE BODY
12-44. The photographic documentation of the body at the scene creates a
permanent record that preserves essential details of the position, appearance,
identity, and final movements of the body. Photographs allow the sharing of
information with other agencies investigating the death. The investigator
should obtain detailed photographic documentation of the body that provides
both instant and permanent high-quality (35-millimeter) images.
CONDUCT AN EXTERNAL BODY EXAMINATION (SUPERFICIAL)
12-45. Conducting the external body examination provides the investigator
with objective data regarding the single most important piece of evidence at
the scene, the body. This documentation provides detailed information
regarding the decedent's physical attributes; his relationship to the scene; and
the possible cause, manner, and circumstances of his death.
12-46. The investigator should properly and thoroughly document the body
before it is moved. Documentation includes photographing and making
detailed notes concerning the condition and location.
12-47. After arriving at the scene and before moving the decedent, the
investigator should do the following without removing the decedent's clothing:
z
Photograph the scene. Include the decedent as initially found and the
surface beneath the body after the body has been removed.
z
Photograph the decedent with and without measurements, as
appropriate. Include a photograph of the decedent's face.
z
Document the decedent's position with and without measurements, as
appropriate.
z
Document the decedent's physical characteristics.
z
Document the presence or absence of clothing and personal effects.
z
Document the presence or absence of any items or objects that may be
relevant.
z
Document the presence or absence of marks, scars, and tattoos.
z
Document the presence or absence of petechiae, injury, or trauma, and
so forth.
z
Document the presence of any treatment or resuscitative efforts.
z
Determine the need for further evaluation or assistance of forensic
specialists (such as pathologists and/or odontologists) based on the
findings.
PRESERVE ANY EVIDENCE ON THE BODY
12-48. The photographic and written documentation of evidence on the body
allows the investigator to obtain a permanent historical record of that
evidence. To maintain a chain of custody, evidence must be collected,
preserved, and transported properly. In addition to all of the physical evidence
visible on the body, blood and other body fluids that are present must be
photographed and documented before collection and transport. Fragile
evidence (that which can be easily contaminated, lost, or altered) must also be
Death Scene Investigations 12-9
FM 3-19.13
collected and/or preserved to maintain the chain of custody and to assist in the
determination of the cause, manner, and circumstances of death.
12-49. Once evidence on the body is recognized, the investigator should—
z
Photograph the evidence.
z
Document any blood or body fluids (such as froth, purge, or substances
from orifices) found on the body. Also, document the location and
pattern before transporting the body.
z
Place the decedent's hands and/or feet in unused paper bags
(determined by the scene).
z
Collect trace evidence before transporting the body (such as blood,
hair, and fibers).
z
Arrange for the collection and transport of evidence at the scene, when
necessary.
z
Ensure the proper collection of blood and body fluids for subsequent
analysis if the body is to be released from the scene to an outside
agency without an autopsy.
ESTABLISH THE IDENTIFICATION OF THE DECEDENT
12-50. The establishment or confirmation of the decedent's identity is
paramount to the death investigation. Proper identification allows notification
of the next of kin, settlement of estates, resolution of criminal and civil
litigation, and proper completion of the death certificate. The investigator
should engage in a diligent effort to establish or confirm the decedent's
identity.
12-51. To establish the identity of the decedent, the investigator should
document and/or use the following methods:
z
Direct visual or photographic identification of the decedent, if visually
recognizable.
z
Scientific methods, such as fingerprints, dental, radiographic, and
DNA comparisons.
z
Circumstantial methods, such as (but not restricted to) personal
effects, circumstances, physical characteristics, tattoos, and
anthropologic data.
DOCUMENT POSTMORTEM CHANGES
12-52. Documenting postmortem changes to the body assists the investigator
in explaining body appearance in the interval following death. Inconsistencies
between postmortem changes and the body's location may indicate that the
body was moved and can validate or invalidate witness statements. In
addition, postmortem changes to the body, when correlated with
circumstantial information, can assist the investigators in estimating the
approximate time of death. The investigator should document all postmortem
changes relative to the decedent and the environment.
12-10 Death Scene Investigations
FM 3-19.13
12-53. Upon arriving at the scene and before moving the body, the
investigator should note the presence of each of the following in his report:
z
Livor that is consistent or inconsistent with the position of the body
(include the color, location, and blanchability, and if Tardieu spots are
present).
z
Rigor (include the stage and/or intensity and location on the body if it
is broken or inconsistent with the scene).
z
Decomposition (include the degree, such as putrefaction, adipocere,
mummification, or skeletonization).
z
Insect and animal activity.
z
Scene temperature (document the method used and time estimated).
z
Description of the body temperature (such as warm, cold, or frozen)
and the measurement of body temperature (document the method
used and time of the measurement).
PARTICIPATE IN THE SCENE DEBRIEFING
12-54. The scene debriefing helps investigators from all participating
agencies to establish postscene responsibilities by sharing data regarding
particular scene findings. The scene debriefing provides each agency the
information, special examinations, and requests requiring interagency
communication, cooperation, and education.
12-55. The investigator should participate in or initiate an interagency scene
debriefing to verify specific postscene responsibilities. When participating in a
scene debriefing, the investigator should—
z
Determine postscene responsibilities
(identification, notification,
press relations, and evidence transportation).
z
Determine and/or identify the need for a specialist (such as crime
laboratory technicians, social services, entomologists, and
Occupational Safety and Health Administration [OSHA]).
z
Communicate with the pathologist about responding to the scene or to
the autopsy schedule, as needed.
z
Share investigative data, as required, to further the investigation.
z
Communicate special requests to appropriate agencies being mindful
of the necessity for confidentiality.
DETERMINE NOTIFICATION PROCEDURES (NEXT OF KIN OR CHAIN OF
COMMAND)
12-56. Every reasonable effort should be made to notify the appropriate
persons as soon as possible. Notification initiates closure for the family and
disposition of the remains and facilitates the collection of additional
information relative to the case. The investigator should ensure that the
appropriate individuals are notified of the death and that all failed and
successful attempts at notification are documented.
Death Scene Investigations 12-11
FM 3-19.13
ENSURE THE SECURITY OF THE REMAINS
12-57. Ensuring the security of the body requires the investigator to
supervise the labeling, packaging, and removal of the remains. An
appropriate identification tag is placed on the body to preclude
misidentification upon receipt at the examining agency. This function also
includes safeguarding all potential physical evidence and/or property and
clothing that remain on the body. The investigator should supervise and
ensure the proper identification, inventory, and security of evidence or
property and its packaging and removal from the scene.
12-58. Before leaving the scene, the investigator should—
z
Ensure that the body is protected from any further trauma or
contamination (if not, document it). Document any unauthorized
removal of therapeutic and resuscitative equipment.
z
Inventory and secure any property, clothing, and personal effects that
are on the body. Remove them in a controlled environment with a
witness present.
z
Identify property and clothing to be retained as evidence
(in a
controlled environment).
z
Recover blood and/or vitreous samples before the release of the
remains.
z
Place identification on the body and body bag.
z
Ensure and/or supervise the placement of the body into the bag.
z
Ensure and/or supervise the removal of the body from the scene.
z
Secure the transportation.
DECEDENT PROFILE INFORMATION ESTABLISHMENT AND
RECORD
12-59. Establishing and recording the decedent's profile information is
important to a death scene investigation. This information will help
determine if the death occurred by natural means or if criminal activity was
involved.
DOCUMENT THE DISCOVERY HISTORY
12-60. Establishing a decedent profile includes documenting the discovery
history and circumstances surrounding the discovery. The basic profile will
dictate subsequent levels of investigation, jurisdiction, and authority. The
focus (breadth and depth) of further investigation is dependent on this
information. The investigator should document the discovery history,
available witnesses, and apparent circumstances leading to the death.
12-61. For an investigator to correctly document the discovery history, he
should—
z
Establish and then record the name of the person or persons who
discovered the body and when.
z
Document the circumstances surrounding the discovery (who, what,
where, when, and how).
12-12 Death Scene Investigations
FM 3-19.13
DETERMINE THE TERMINAL-EPISODE HISTORY
12-62. Preterminal circumstances play a significant role in determining the
cause and manner of death. Documentation of medical intervention and/or
procurement of antemortem specimens help to establish the decedent's
condition before death. The investigator should document known
circumstances and medical intervention preceding death. In order for the
investigator to determine the terminal-episode history, he should—
z
Document when, where, how, and by whom the decedent was last
known to be alive.
z
Document the incidents before the death.
z
Document complaints and/or symptoms before the death.
z
Document and review the complete EMS records including the initial
electrocardiogram.
z
Obtain copies of relevant medical records.
z
Obtain relevant antemortem specimens.
DOCUMENT THE DECEDENT'S MEDICAL HISTORY
12-63. The majority of deaths that are referred to the medical examiner or
coroner are natural deaths. Establishing the decedent's medical history helps
to focus the investigation. Documenting the decedent's medical signs or
symptoms before death determines the need for subsequent examinations.
The relationship between disease and injury may play a role in the cause,
manner, and circumstances of death. The investigator should obtain the
decedent's past medical history.
12-64. Through interviews and review of the written records, the investigator
should document the decedents—
z
Medical history including medications taken, alcohol and drug use,
and family medical history from family members and witnesses.
z
Information from the treating physicians and/or hospitals to confirm
history and treatment.
z
Physical characteristics and traits
(such as left or right handed,
missing appendages, or tattoos).
DOCUMENT THE DECEDENT'S MENTAL HEALTH HISTORY
12-65. The decedent's mental health history can provide insight into the
behavior or state of mind of the individual. This insight may produce clues
that will aid in establishing the cause, manner, and circumstances of the
death. The investigator should obtain information pertaining to the decedent's
mental health history from sources familiar with the decedent. The
investigator should document—
z
The decedent's mental health history. Include hospitalizations and
medications.
z
Any history of suicidal ideations, gestures, and/or attempts.
z
The names of the decedent's mental health professionals (such as
psychiatrists, psychologists, and counselors).
z
Any family mental health history.
Death Scene Investigations 12-13
FM 3-19.13
DOCUMENT SOCIAL HISTORY
12-66. Social history includes marital, family, sexual, educational,
employment, and financial information. Daily routines, habits, and activities,
and friends and associates of the decedent help in developing the decedent's
profile. This information will aid in establishing the cause, manner, and
circumstances of death. The investigator should obtain social history
information from sources familiar with the decedent.
12-67. When collecting relevant social history information, the investigator
should document the decedent's—
z
Marital or domestic history.
z
Family history (similar deaths or significant dates).
z
Sexual history.
z
Employment history.
z
Financial history.
z
Daily routines, habits, and activities.
z
Relationships, friends, and associates.
z
Religious, ethnic, or other pertinent information (such as religious
objection to an autopsy).
z
Educational background.
z
Criminal history.
INVESTIGATION COMPLETION
12-68. Completing the investigation of a death scene includes measures
necessary for maintaining jurisdiction over and releasing the body,
performing exit procedures, and assisting the family. These measures, like the
previous, require accurate documentation.
MAINTAIN JURISDICTION OVER THE BODY
12-69. Maintaining jurisdiction over the body allows the investigator to
protect the chain of custody when the body is transported from the scene for
autopsy, specimen collection, or storage. To maintain jurisdiction over the
body, the investigator should use a secure conveyance to transport the body.
12-70. When maintaining jurisdiction over the body, the investigator
should—
z
Arrange for and then document secure transportation of the body to a
medical or autopsy facility for further examination or storage.
z
Coordinate and document procedures to be performed when the body
is received at the facility.
RELEASE JURISDICTION OF THE BODY
12-71. Before releasing jurisdiction of the body to an authorized receiving
agent or funeral director, it is necessary to determine the person responsible
for certification of the death. Information to complete the death certificate
includes demographic information and the date, time, and location of death.
12-14 Death Scene Investigations
FM 3-19.13
The investigator should obtain sufficient data to enable the completion of the
death certificate and the release of jurisdiction over the body.
12-72. When releasing jurisdiction over the body, the investigator should—
z
Determine who will sign the death certificate (such as the individual's
name or the agency).
z
Confirm the date, time, and location of the death.
z
Collect (when appropriate) blood, vitreous fluid, and other evidence
before the release of the body from the scene.
z
Document and arrange with the authorized receiving agent to
reconcile all death certificate information.
z
Release the body to a funeral director or other authorized receiving
agent.
PERFORM EXIT PROCEDURES
12-73. Bringing closure to the scene investigation ensures that important
evidence has been collected and the scene has been processed. In addition, a
systematic review of the scene ensures that artifacts or equipment is not
inadvertently left behind (such as used disposable gloves, paramedical debris,
or film wrappers.) and any dangerous materials or conditions have been
reported. At the conclusion of the scene investigation, the investigator should
conduct a postinvestigative walk-through and ensure that the scene
investigation is complete.
12-74. When performing exit procedures, the investigator should—
z
Identify, inventory, and remove all evidence collected at the scene.
z
Remove all personal equipment and materials from the scene.
z
Report and document any dangerous materials or conditions.
ASSIST THE FAMILY
12-75. The investigator provides the family with a timetable so they can
arrange for the final disposition. The investigator should offer the decedent's
family information regarding available community and professional resources
that may assist the family.
12-76. When the investigator is assisting the family, it is important to—
z
Inform the family if an autopsy is required.
z
Inform the family of available support services
(such as victim
assistance, police, or social services).
z
Inform the family of appropriate agencies to contact with questions
(such as medical examiner's or coroner's office, law enforcement, or
sudden infant death syndrome [SIDS] support groups).
z
Ensure that the family is not left alone with the body (if circumstances
warrant).
z
Inform the family of the approximate body release timetable.
z
Inform the family of the information release timetable, such as
toxicology or autopsy results (as required).
z
Inform the family of available reports. Include any costs.
Death Scene Investigations 12-15
FM 3-19.13
TYPES OF DEATH
12-77. This section describes methods of death through criminal means. In
the type of investigations in which footwear, tire wear, or other
distinguishable marks are identified, the investigator must carefully
document the impressions, photograph the impressions both with and without
a measuring device, and collect a cast impression (if appropriate). The
photographs and impressions can be used to make forensic identification at
the crime laboratory between the suspect's objects and the collected
impressions.
FIREARMS
12-78. Homicides and suicides occur most commonly as a result of the
discharge of a firearm. Accidental death from the discharge of a firearm is also
common. These violent deaths are often not witnessed. Unlike other forms of
violent or unnatural death, deaths from firearms will often have trace
evidence left by the weapon in or near the victim's body. This evidence can be
scientifically compared with the suspect's weapon. It can often provide
information about the circumstances surrounding the death.
12-79. In a medicolegal investigation of death by firearms, scientific evidence
is very important. Deciding the manner of the death and solving the homicide,
if there is one, often hinges on that evidence. Thus, the investigator must take
every precaution to ensure that such evidence is not lost. For example,
gunshot residue (GSR) must always be collected from the victim's hands at the
scene, if possible. The residue is easily lost when a body is moved. If the
residue cannot be collected at the scene, personnel transporting the suspect
must be told to touch and move the hands as little as possible. This includes
preventing the suspect from moving his hands freely. (See Chapter 25 for
GSR.)
12-80. A study of gunshot wounds in a body can tell a lot about the type of gun
involved. It can identify the ammunition, the range of fire, and the direction
and angle of fire. Sometimes it can tell the number of shots that hit the body.
It can also give an idea of the fatal or disabling effects of an injury.
SHOOTINGS
12-81. For self-inflicted gunshot wounds, unless some special contraption is
arranged, the victim generally must hold the gun close to his or her body.
Rifles and shotguns are sometimes fired by using a stick or string hooked to
the trigger guard or by pushing the trigger with a toe or a device. Riggings
made to pull the trigger or the removal of a shoe, strongly suggest suicide.
12-82. Suicide wounds are usually single, close-range, and/or contact wounds
on a part of the body that is easily reached. Sometimes an individual who
commits suicide will shoot himself more than once before being disabled or
dying. The presence of misfired rounds in or ejected from a weapon may also
suggest suicide. An individual who commits suicide will sometimes fire shots
to check the weapon while working up the nerve to complete the act.
12-83. An individual who commits suicide will often expose the part of his
body that he plans to shoot. For example, an individual who commits suicide
12-16 Death Scene Investigations
FM 3-19.13
will tend to open his shirt before placing the muzzle against his chest. The
chest and abdomen is often the target when a rifle or shotgun is used. The
temple, the mouth, and the chest (over the heart) are common sites for
suicidal attacks with a handgun. Many individuals who commit suicide with a
handgun will shoot at the head area just in front of or over the ear.
12-84. An individual who commits suicide may guide the gun by holding the
barrel with his nonfiring hand. In which case, the nonfiring hand of a suicide
victim will have burns caused by the flame from the muzzle and breach. His
hand may also have singed hairs and powder residue. Finding GSR on a
victim's hands is not in itself conclusive proof of a suicide. It must be
considered in light of other facts in the case. Residue can be present on a
victim's hands because they were close to the muzzle blast of a shot fired by
someone else.
12-85. The condition of the weapon can suggest the manner of death. The gun
may be defective. The gun's safety may be defective. The gun may not have a
safety catch or perhaps dropping it can discharge the gun. Evidence may show
that the trigger caught on something, discharging it accidentally. Finding a
serviceable weapon that needs normal force to pull the trigger and has a good
safety device may help rule out an accidental shooting.
12-86. Most accidental shootings occur because of a victim's careless handling
of or unfamiliarity with a gun. Perhaps the victim was on a hunting trip or
was cleaning, loading, or otherwise working on the weapon. Evidence may
show that the victim was handling the weapon unsafely, showing how another
person killed himself, or that he was playing “quick-draw.” Children and
young people often become accident victims by playing with guns.
12-87. Accidental deaths are often witnessed and reported. Often, the person
who fired the gun makes a report of the shooting. Accidental gunshot deaths
that are not witnessed may look like a suicide. But the known attitude and
lifestyle of the victim (in most cases), plus the lack of a clear case for suicide or
homicide, are strong signs of an accident.
12-88. Most deaths that are due to multiple gunshot wounds have proven to
be homicides. The murderer is usually related to or closely acquainted with
the victim and fires a gun in a fit of rage, panic, or other strong emotions.
12-89. The location and number of empty shell cases at the scene may
indicate the number of shots fired and the relative positions of the gun and
victim. Lining up the final resting point of the bullet, the position of the
victim, and the entry and exit holes on the victim can help tell the position
from which a gun was fired. A gun may have been fired close to a surface or
while resting on a surface. If so, it will have left powder residue. This also may
show the position from which the gun was fired. All feasible surfaces of
weapons, shells, and magazines must be checked for fingerprints.
12-90. When bullets are recovered at a crime scene, the investigator must
record the exact details. These details include—
z
The location and condition of the bullet.
z
The type of material the bullet pierced and its depth of penetration.
Death Scene Investigations 12-17
FM 3-19.13
z
Irregularities in the size and shape of the bullet and the approximate
angle of impact.
z
Any other information that may help the lab examiner.
z
The crime scene sketch documenting the point at which each
discharged bullet or fired cartridge case was found.
12-91. Markings may be placed on a bullet by the bore of the weapon. Other
marks may be placed on the cartridge case by the firing pin, breach block,
chamber extractor, or ejector. Also, a lead bullet impacting on cloth may
receive a patterned impression of the weave of the fabric. This may be useful
in proving that a particular bullet passed through the victim.
12-92. At the laboratory, powder residue on evidence is tested chemically and
microscopically. Bloodstains, hairs, fibers, and similar trace evidence is
identified and compared. The lab may be able to tell from the GSR or burns on
the clothing the approximate range from which the bullet was fired.
BULLET WOUNDS
12-93. A bullet passing through a body makes a wound with traits that can be
recognized. All wounds must be medically confirmed during an autopsy. An
investigator can usually tell entry wounds from exit wounds, however,
sometimes the distinction is hard to make. External determination is hard if a
body has started to decompose or has been mangled. The uneven surface and
tumbling action of ricocheting bullets may make ragged punctures. Bullets
passing across a body can cut gashes that may look like knife wounds. The
energy of a high-speed bullet destroys tissue as the shock waves of its impact
radiate away from the bullet. This makes a track of permanently disrupted
tissue much wider than the bullet.
12-94. In tough cases, inspecting marks and effects on clothing may be the
best way to tell the direction of the flight of the bullet. An autopsy
examination of the track of the bullet may show the path of travel by pieces of
cloth, metal, and bone fragments carried forward by the bullet. Metal debris is
scientifically detectable by spectrography and X-ray methods. The nature of
bone damage may show the travel path of the bullet. Determining which
wounds are exit wounds and eliminating them from consideration helps locate
entrance wounds. The wounds associated with bullets are—
z
Entrance wounds.
z
Contact wounds.
z
Intermediate-range wounds.
z
Distant wounds.
z
Exit wounds.
Entrance Wounds
12-95. Entrance wounds are commonly round holes showing minor bleeding.
Often, skin resistance is stretched by the impact of the bullet. This makes the
hole somewhat smaller than the bullet. Sometimes a narrow ring around the
entrance shows grayish soiling from carbon and oils on the bullet and a
reddish-brown abrasion collar caused by the impact of the bullet. Some bullet
entry wounds are inconspicuous or hidden. Small caliber bullets often cause
12-18 Death Scene Investigations
FM 3-19.13
such wounds. They may be hidden under clothing, in hair, in body folds or
openings, or behind closed eyelids.
12-96. Identifying entrance wounds does not always tell the number of shots
fired into the body. A single bullet can sometimes account for a number of
entry wounds by piercing the body more than once. For example, a bullet may
go through an arm before entering the torso. One of the aims of a pathologist
tracing the path of the bullet is to try to match multiple wounds to the same
bullet. A bullet striking a bony surface at an angle may split into two or more
projectiles. The multiple projectiles can cause many exit and reentry holes.
Ricocheting bullet pieces may also cause several wounds from a single bullet.
On the other hand, more than one bullet may go through the same entrance
wound. For example, in one rare suicide case, a defective round failed to exit
the barrel and a second round pushed the first in tandem through a single
entrance.
12-97. Bullets and other products from the discharge of a weapon have
characteristic effects on skin and clothing. These effects can indicate the
distance from which the gun was fired.
Contact Wounds
12-98. Contact wounds are wounds that are incomplete or have partial
contact with the victim's body. Contact wounds, especially the ones on bony
surfaces, are likely to be large, ragged stellate wounds. The explosive force of
gases from the discharge often tears skin and tissue around the bullet hole,
producing ragged lacerations radiating from the hole called stellate tearing. A
contact wound made when exploding gases are received and expended by a
large body cavity like the chest may not be large or irregular. On the other
hand, a contact wound to the head made by a high-powered rifle may show
massive bursting fractures of the skull from the explosive effect of gas forced
into the skull where it has no chance to expand. Contact wounds from small
caliber guns like a .25- or .22-caliber pistol tend to be smaller and less
devastating than wounds from larger caliber weapons. This is because the
discharge from small caliber weapons may not be forceful enough to disrupt
the surrounding tissues.
12-99. Contact wounds are categorized as either hard contact (complete
contact) that normally leaves a pattern impression in the shape of the weapon
muzzle or loose contact (partial contact) that leaves a more irregular shape.
Contact wounds leave an abrasion collar that is normally obscured. The edges
of the contact wound and the bullet track are burned. If the gun is fired
through clothing, the surrounding fabric is also burned. The flame and smoke
may cause a sooty, grimy halo around the wound. When the muzzle of the gun
is held tightly against the skin, the bullet hole is not “tattooed” with powder
grains embedded in the surrounding skin like it is in intermediate-range
wounds. This is because most of the unburned powder and other explosive
products are blown right into the bullet track. The contact wound may also
show a bruise pattern from swelling gases blowing the skin back against the
muzzle of the gun. It may be shaped like the muzzle end of the gun, sights, or
extractor spring rod.
Death Scene Investigations 12-19
FM 3-19.13
Intermediate-Range Wounds
12-100. Intermediate-range wounds are made when the muzzle is held
between 1 and 48 inches from the victim. The wounds are often round, but
their edges may show minor splitting. They differ from contact or longer-range
wounds by having burns and powder tattooing in the skin around the bullet
hole. Powder residues and other discharge products are projected onto the
victim in ample amounts when a gun is fired within 2 feet of the target.
Recognizing powder marks and residues can help distinguish entrance
wounds from exit wounds. Their pattern and composition help determine the
range of fire and the kind of ammunition used. Precise range of fire tests can
be made by laboratory test firing the same weapon and ammunition. The type
of powder used in the ammunition will affect the distance it travels in the air.
Types of powder residues can also be distinguished by chemical, photographic,
radiographic, and spectrographic tests.
12-101. The burned and tattooed area is roughly circular. It becomes larger
and more diffused as the distance between the weapon and the victim grows.
The area has three zones. The first zone, known as the flame zone, is the zone
of burned skin around and in the bullet hole. The second zone surrounds this
zone and is where most tattooing powder grains and combustion products
burn and stick to the skin. The last zone is under the skin where sparsely
scattered powder grains and residues are embedded in the dermis. Washing
will not remove powder grains in the dermis.
12-102. If the burned, tattooed, and abraded areas form a
concentric-symmetric margin around the entry wound, the bullet probably
struck the body at a right angle. A bullet striking at a shallower angle shows
marginal bruising and abrasions at the point where the bullet first meets the
surface. A bullet striking at an extreme angle may cause a shallow-furrowed
wound.
12-103. If a gun is fired at close range and at an angle to the body, powder
residues will seem to spread away from the bullet hole in an uneven V-shape.
The point of the V will point toward the weapon. The size of the ammunition
and the type of powder also affect the nature and extent of powder residues.
At a distance of 3 to 4 feet, powder residues may not be present on a victim
shot with a handgun.
Distant Wounds
12-104. Distant wounds are made by muzzles held more than 48 inches from
the victim. The wounds are generally round holes with circular abrasion
collars. There are no burns or powder tattooing. Small caliber contact wounds
and other contact wounds over soft-tissue areas may look like long-range
wounds. They can be distinguished deep in the tissues in the bullet track by
the powder residues.
Exit Wounds
12-105. Exit wounds often show more damage than entrance wounds. Exit
wounds are ragged and rough in shape. They are often larger than the bullet.
Tissues compressed in front of the bullet burst when the bullet breaks
through and exits the body. The bullet is often fragmented, deformed, and
12-20 Death Scene Investigations
FM 3-19.13
tumbled by impact. It is, therefore, more destructive. Thus, exit wounds may
bleed more than entrance wounds, and pieces of internal tissue may protrude
from the wound.
12-106. Because a bullet loses momentum as it passes through the body and
its tough, elastic skin, it sometimes uses up its remaining energy at the point
of exit. For that reason, a bullet may be found protruding from the skin or
loose in a victim's clothing. It may also be found under the skin, where it has
caused swelling or bruising. If a bullet is lodged in a body, advise the surgeon
of its potential value as evidence. Request that he not probe for the bullet
except as a last resort. If probing is needed, request that rubber-tipped forceps
be used to remove the bullet.
SHOTGUN PELLET WOUNDS
12-107. Shotgun wounds are very different from wounds caused by other
firearms. The destructive force of a shotgun blast at close range is great. If the
wound is to the head, the shape of the head may be greatly changed. Large
sections of the head or face may be destroyed. Close-range wounds of the
trunk and abdomen may cause loops of intestine or other organs to hang out of
the body, or it may remove a large portion of the victim's body.
12-108. When a shotgun is fired from a distance of about 10 feet or less, the
shot strikes as a fairly compact mass. It leaves a large central, circular hole
with very ragged edges from the many single and overlapping punctures made
by the shotgun pellets. This is known as the cookie-cutter effect. Scattered
around the large central hole are smaller holes made by individual shot
beginning to disperse in flight. When a shotgun is fired at close range, the
wounds are grossly burned and tattooed. As the distance increases between
the weapon and the victim, the wound shows less tattooing and no burning.
Beyond 10 feet, the shot spreads in flight and strikes the body in a more
scattered grouping so that no central hole occurs.
12-109. The length of the shotgun barrel and the type of ammunition also
influence the dispersion of the shot and the scattered pattern of the wound. A
sawed-off barrel allows quicker spreading. The dispersion may be cut if the
shotgun is choke-bored. The slightly narrowed muzzle focuses the shot and
delays its dispersion. Bird shot, even when fired at close range, usually does
not go through the trunk or abdomen of an adult. But when the shot load goes
through a thinner portion of the body like the neck, limb, or shoulder, it
makes large lacerated exit wounds. Sometimes small, ragged exit wounds are
made when only some of the bird shot exits the body. At close range, buckshot
(having a greater weight and energy) causes wounds similar to those made by
large bullets. A general rule of thumb in shotgun spread is that for every 1
yard of distance, the wound will grow by 1 inch in diameter. This can only be
verified through specific firearms testing at the crime lab.
12-110. Shotgun pellets cannot be linked to a certain gun by ballistics
markings as rifled bullets can. However, the size of shot may be learned from
printed material on the top wad or by marks left in the wadding. It can also be
learned from printed information in the shot column. One may learn the
gauge of a gun by comparing the diameter of the wad with other wads. If the
wadding has not struck an intervening zone, it can be found within 50 feet of
Death Scene Investigations 12-21
FM 3-19.13
where the gun was fired. If the gun is fired within 10 feet of the victim, the
wadding is often carried into the body with the shot. Investigators must be
aware that, during the crime scene search, the shot cup wadding may contain
evidence of the lands and grooves of weapons that maintain a rifled barrel.
ASPHYXIA
12-111. When the body or any vital part of it is deprived of oxygen, asphyxia
occurs. Death from asphyxia alone is most often due to natural or accidental
causes. Many diseases and infections can hinder airways. Foreign bodies like
meat or bone can become trapped in the throat, causing asphyxia. Food
particles are often the cause of accidental choking deaths in adults. Choking
deaths of children are common from food and small plastic or metal toys.
Pressure on the outside of the chest that restricts breathing can also cause
asphyxia. This pressure can occur in cave-ins, building collapses, or traffic
accidents.
12-112. Inhaling chemicals like ammonia, chloroform, carbon monoxide, and
carbon dioxide also may cause asphyxia. Sometimes these chemicals are the
cause of suicidal or homicidal deaths. Homicide and suicide by asphyxia alone
are rare. In learning the reasons for death by asphyxia, anything suspicious
must be pursued through a background investigation and an autopsy. The
death may be ruled accidental or natural only after a thorough investigation.
Strangulations
12-113. Strangulation is asphyxiation from compression of either the jugular
vein or the carotid artery in the neck. Many times, when strangulation occurs,
the trachea is not obstructed. Strangulation can be done manually or with a
ligature like a binder, a rope, or a necktie. Hard blows to the neck may also
cause strangulation. Open-handed strikes to the throat may cause damage to
the larynx, followed by suffocation.
12-114. Manual strangulation is normally a homicide. A person cannot kill
himself with his hands because when he loses consciousness his hands relax
and his breathing resumes. In manual strangulation, the attacker's
fingernails often make small telltale bruises or marks on the neck. Marks on
the neck will not normally show the direction from which the victim was
attacked. Another sign of manual strangulation is hemorrhaging in the throat
area. This can be seen in an autopsy. Sometimes a fracture of the hyoid bone,
a U-shaped bone at the base of the tongue, is also found.
12-115. Strangulation by ligature may be homicidal, suicidal, or accidental.
Strangulation is a fairly common form of suicide but it is a rare form of
homicide. The ligature is often made from something handy at the scene.
Pajamas, neckties, belts, electrical cords, ladies' stockings, and other items
can be used. Strangulation by a garrote of rope or wire sometimes is used in
homicidal strangulation but it is not seen very often. Close inspection of the
marks left on the skin may show the type of garrote used. If possible, leave the
ligature in place for a pathologist to remove during the examination. If the
ligature is removed from the body, leave the knots in place and cut the
ligature on the opposite side of the knot.
12-22 Death Scene Investigations
FM 3-19.13
12-116. When investigating strangulation, search the scene and the victim for
signs of struggle. Check the body for signs of defense wounds that may
suggest homicide. Also look for the presence of hesitation marks, which hint at
attempted suicide by other means before ruling it a homicide.
Hangings
12-117. Hanging is asphyxiation by strangulation using a line of rope, cord, or
similar material to work against the hanging weight of the body. Hanging is
most often suicidal. But can sometimes be accidental. It is seldom homicidal,
except in a lynching. A person does not have to be fully suspended to die from
hanging. Hanging may occur if a victim jumps or is pushed from a height
while tied by a line to a rafter or a tree limb. If the height is more than just a
few feet, the victim's neck may break. The neck is seldom broken in suicidal or
accidental hangings.
12-118. At the scene, an investigator—
z
Checks the beam or rafter over which the line is laid for marks
showing the direction of travel of the line. This must be checked.
z
Inspects the scene for signs of a fight and signs of defensive marks or
rope burns. Bears in mind that an unconscious victim may convulse,
knocking over items in the immediate area.
z
Does not untie the knots when taking the body down. The type of knot
may provide an investigative lead.
z
Removes the hanging line from the victim's neck by cutting the line on
the side opposite to the knot.
z
Makes a careful inspection of the groove around the neck. A close look
at the edges of the groove will often show black and blue marks from
minute bleeding. Ruptured blood vessels in the skin mean that the
victim was alive at the time of the hanging. The lack of these marks
does not necessarily mean the victim was dead at the time of hanging.
Combined with other conditions, however, it could raise suspicions.
z
Notes the position of the groove as it relates to the location of the knot.
The mark of the ligature should agree with the location of the knot.
For example, if the knot is in front of the face, the deepest part of the
groove should be on the nape of the neck. Anything different suggests
homicide.
12-119. When a fixed knot is used in a hanging, the groove will form an
inverted V on the side of the knot. The bruise on the skin in the groove is
greatest opposite the knot. It tapers off as it reaches the knot. If a slipknot is
used, the groove may be uniform around the neck; however, it will still be up
in directionality.
12-120. An accidental hanging from sexual activity may be suspected when a
victim is nude and is suspended before a mirror or is suspended in an unusual
manner. Accidental deaths may occur from autoerotic sexual acts using
restraints like ropes, cords, chains, and handcuffs. The victim, trying to reach
sexual contentment, uses these items to restrain his or her hands, arms, legs,
and neck. When strain on the neck causes unconsciousness or when the victim
loses balance during the act, an accident results. The victim is unable to
Death Scene Investigations 12-23
FM 3-19.13
release himself because of the binding on his hands, arms, and legs.
Sometimes, when a victim uses binding material or plastic bags on his face, he
suffocates. A notable feature of this type of death is the presence of female
attire and articles on or near a male body. Erotic material and evidence of
masturbation is often present. In the past, these deaths were often incorrectly
labeled suicides. But they are accidental and they must be listed as such.
12-121. Other accidental hangings differ from autoerotic deaths in the lack of
female attire, erotic material, or constrained hands or feet. Accidental
hangings often involve infants and young children. Infants can get caught in
restraining devices, or they can get their clothing caught on things. They may
also get their heads caught between crib or fence slots. If they are unable to
get themselves free, they may strangle. For no known reason, young children
(especially boys) will put nooses around their necks. They too may strangle to
death.
Drownings
12-122. Drowning is asphyxiation from water or liquid being inhaled into the
airways, blocking the passage of air to the lungs. Water inhaled into the
windpipe causes violent choking. The choking irritates the mucous
membranes of the airways causing a large amount of sticky mucus to form.
The mucus, mixed with the water and agitated by violent attempts to breathe,
turns into thick, sticky foam that fills the windpipe.
12-123. Most drownings occur when the victim submerges in a body of water.
A small number of “drowning” deaths among swimmers are actually caused by
their hearts stopping from the shock of submersion. Most commonly, a
drowning victim has a violent spasm of the neck, throat, and chest muscles.
This prevents breathing. The victim submerges, inhaling water. The victim
may stay submerged the first time he goes under, or he may go under and
surface many times until he can no longer struggle to the surface. The loss of
consciousness often occurs quickly. Because the human body is heavier than
water, when unconsciousness occurs, the victim sinks and tends to lay at the
bottom with his head down. Breathing may continue briefly with varying
amounts of water inhaled. The heart may beat briefly after breathing stops.
Death by asphyxia occurs within a few minutes. Banning strong currents, a
body sinks fast. It often comes to rest at a point close to where it was last seen
on the surface.
12-124. Rigor mortis may start earlier than in other deaths because of violent
muscular struggle. Postmortem lividity occurs but is often light red in color
and is noted mostly in the head and upper body. This is because of the
tendency of the body to sink head down. The foam that forms in the airway
may exude from the mouth and nose. Often, the victim's hands will be
grasping gravel, mud, or grass. The hands and fingertips may be scratched
from violent grasping efforts. The victim's palms may have cuts caused by his
fingernails during the violent clenching motion of the hands. These factors are
good circumstantial signs that the victim was alive when he entered the
water.
12-125. After a few hours, depending on the temperature and movement of
the water, postmortem changes peculiar to submersion begin to occur. The
12-24 Death Scene Investigations
FM 3-19.13
skin, especially on the hands and feet, becomes bleached and waterlogged.
The palms develop a very wrinkled condition called “washerwoman” hands.
The constant churning of water currents or long periods of submersion may
cause maceration. This is the wearing away of skin and flesh, especially of the
hands and feet. Mutilation may occur from propellers of boats. This causes the
appearance of postmortem dismemberment. Parts of the body, notably the
face, may be eaten by marine life. As bacteria mounts in the body,
putrefaction begins. As putrefaction progresses, gases build up in the tissues,
organs, and body cavities. The body becomes distended with gas. This makes
the white foam in the airway come out of the nose and mouth. As the gases
build up, the body becomes buoyant. Warm water speeds putrefaction and cold
water slows it. In warm water, buoyancy may occur in a couple of days. In
winter, the action may be slowed for weeks or until spring. As putrefaction
advances, the skin loosens from the tissues. Sections of skin, especially hands,
feet, and scalp may fall from the body.
12-126. Unless a body is heavily weighted down or firmly caught on
underwater debris, buoyancy will eventually cause it to rise to the top and
float. If a body is prevented from rising, the gases eventually escape. Then
buoyancy leaves and a body may stay down forever. When a “floater” rises and
is exposed to the air, decomposition proceeds at a much faster rate.
12-127. Prolonged submersion and decaying may dim or destroy the external
signs of asphyxia. Signs of violence or another cause of death may also be lost.
Prolonged submergence makes death by drowning medically difficult to
diagnose. Medical evidence may show signs of asphyxia like foam in the
airways and an enlarged heart. It may also show changes in the blood from
water absorbed during drowning. Algae and other substances from water may
be found in the stomach or airways. Chemical tests conducted during an
autopsy can show if the person was alive when he entered the water.
However, chemical tests are nonspecific and none are diagnostic of drowning.
12-128. Suicidal drownings in places like bathtubs are hard to distinguish
from accidents unless a reason is suggested or some other means of suicide
was also attempted. Check for marks that may show suicidal intent. A
weighted body strongly suggests homicide. Persons who commit suicide may
weight their bodies to speed drowning and stop recovery. Weighted bodies
should be inspected carefully for injuries that suggest homicide. It should be
determined if the binding and weighting method was used by the victim. An
assessment for self-inflicted injuries, such as cut wrists or other sign of
suicide, should also be made.
12-129. Homicidal drownings are rare. Unless accompanied by signs of
homicidal violence or other such conditions, the autopsy shows only signs of
asphyxia by drowning. There have been times when submerged bodies have
shown no signs of violence but, after the body dried out, bruise marks and
small abrasions appeared that could not be seen when wet.
Electric Shocks
12-130. Death by asphyxiation can occur as a result of electric shock. The
shock stops the action of the heart, and the brain (deprived of oxygen) ceases
to function. The effect of electric shock on a person depends on many things. It
Death Scene Investigations 12-25

 

 

 

 

 

 

 

Content      ..     3      4      5      6     ..