Chapter No.

9
CRIMINAL INVESTIGATION

Criminal Investigation
A criminal investigation is an undertaking that seeks, collects, and gathers evidence of a crime for a
case or specific purpose. A criminal investigator looks for clues and evidence to determine whether
a crime has taken place. In investigation refers to the process of collecting information in order to reach
some goal; for example, collecting information about the reliability and performance of a vehicle prior to
purchase in order to enhance the likelihood of buying a good car. Applied to the criminal realm, a criminal
investigation refers to the process of collecting information (or evidence) about a crime in order to:
(1) Determine if a crime has been committed;
(2) Identify the perpetrator;
(3) Apprehend the perpetrator; and
(4) Provide evidence to support a conviction in court
If the first three objectives are successfully attained, then the crime can be said to be solved. Several
other outcomes such as recovering stolen property, deterring individuals from engaging in criminal
behaviors, and satisfying crime victims have also been associated with the process.
Criminal investigation is an applied science that involves the study of facts, used to identify, locate
and prove the guilt of an accused criminal. A complete criminal investigation can include searching,
interviews, interrogations, evidence collection and preservation and various methods of investigation.
Criminal investigation is all about the following diagram.

A useful perspective on the criminal investigation process is provided by information theory

(Willmer). According to information theory, the criminal investigation process resembles a battle between
the police and the perpetrator over crime-related information. In committing the crime, the offender emits
“signals,” or leaves behind information of various sorts (fingerprints, eyewitness descriptions, murder
weapon, etc.), which the police attempt to collect through investigative activities. If the perpetrator is able to
minimize the amount of information available for the police to collect, or if the police are unable to
recognize the information left behind, then the perpetrator will not be apprehended and therefore, the
perpetrator will win the battle. If the police are able to collect a significant number of signals from the
perpetrator, then the perpetrator will be identified and apprehended, and the police win. This perspective
clearly underscores the importance of information in a criminal investigation.
Principles of Criminal Investigation
These three are the major principles of criminal investigation.
1. Presumption of non-responsibility
 The investigation is a neutral, fact-finding process. Reports are presumed made in good faith.
Further, Respondents are presumed not responsible. This presumption is overcome only when a
preponderance of the evidence establishes that the Respondent committed the prohibited conduct charged.

2. Standard of proof

The standard of proof to find a violation of this policy is a preponderance of the evidence.
Preponderance of the evidence means that based on the totality of evidence and reasonable inferences drawn
there from, it is more likely than not that the Respondent committed the prohibited conduct charged.

Put another way, the preponderance of the evidence means such evidence that when weighed against
that opposed to it, has the more convincing force and the greater probability of truth.

3. Evidence

Rules of evidence and discovery used in state and federal proceedings are not applicable to the
investigatory process for prohibited conduct. The investigation will consider information that is relevant,
material, and temporally proximate to the conduct at issue; in other words, information that makes the
existence of a fact or inference more or less likely.

Information that is not relevant or is not considered reliable may be excluded during the investigative or
adjudicatory process. For instance, polygraph tests will not be considered in determining whether a fact
exists.

 Character evidence

Character witnesses, statements, or letters are not admissible as evidence and are not considered.
Examples of character evidence include statements, resumes, transcripts, and letters from friends, family, or
faculty.

Other principles of criminal investigation

1. The purpose of an investigation by the Investigative Office is to examine and determine the veracity of
allegations of corrupt or fraudulent practices as defined by each institution including with respect to, but not
limited to, projects financed by the organization, and allegations of misconduct on the part of the
organization’s staff members.
2. The Investigation Office shall maintain objectivity, impartiality and fairness throughout the investigative
process and conduct its activities competently and with the highest levels of integrity. In particular, the
Investigative Office shall perform its duties independently from those responsible for or involved in
operational activities and from staff members liable to be subject of investigations and shall also be free
from improper influence and fear of retaliation.
3. The staff of the Investigative Office shall disclose to a supervisor in a timely fashion any actual or
potential conflicts of interest.
4. Appropriate procedures shall be put in place to investigate allegations of Misconduct on the part of any
staff member of an Investigative Office.
5. The Investigative Office shall take reasonable measures to protect as confidential any non-public
information associated with an investigation.
6. Investigative findings shall be based on facts and related analysis, which may include reasonable
inferences.
7. The Investigative Office shall make recommendations, as appropriate, to the Organization’s management
that is derived from its investigative findings.
8. All investigations conducted by the Investigative Office are administrative in nature.
9. The confidentiality of an internal investigation should be established.
10. To build and maintain public confidence, the police have a responsibility to ensure that investigations are
carried out professionally, ethically, and to an agreed standard.
11. Investigators should have particular regard for vulnerable people and children
12. As far as is operationally practical and having regard to an individual’s right to confidentiality,
investigations should be carried out as transparently as possible victims, witnesses and suspects should be
kept up to date with developments in the case
13. The exercise of legal powers should not be oppressive and should be proportionate to the crime under
investigation
14. Investigations should be conducted with integrity, common sense and sound judgment
15. Effective investigators maintain a balance that recognizes the concerns of all the parties involved
16. Understanding the response to crime assists investigators to build this relationship
17. A professional approach to investigations benefits the victim, the public and the police.
18. Investigators must understand the ways in which victims, witnesses and offenders are likely to respond
when a crime is committed and how best to obtain material from them.
19. The personal and social needs of witnesses and offenders, bearing in mind the duty to provide reasonable
adjustments, which may be relevant when investigating crime
20. Investigators need to be skilled in the following areas:
 the planning required to conduct an investigation and the investigative process
 decision making and how it can be improved by applying the investigative mindset
 investigative and evidential evaluation (which can assist the investigator to determine the value of
material gathered during the investigation)
 creative thinking
 challenging experts
 victim and witness care
Good investigations are based on eight fundamental principles.

1. Investigators must be as independent as possible.

2. Investigators must be trained and experienced.
3. All potentially relevant issues must be identified and, where appropriate, pursued.
4. Investigations must be sufficiently resourced.
5. All relevant physical and digital evidence must be identified, preserved, collected and examined as
necessary.
6. All relevant documentation must be secured and reviewed.
7. All relevant witnesses must be identified, segregated where practical and thoroughly interviewed.
 8. The analysis of all the material gathered during the investigation must be objective and based solely
on the facts.

MANUAL OF PRELIMINARY INVESTIGATION

The preliminary investigation is the police agency’s first response to a report that a crime has
occurred. As in every investigative effort, the primary objective of the preliminary investigation is to
determine who committed the crime and to apprehend the offender. The preliminary investigation collects
evidence which supports that a crime has occurred the identification of the offender, and the arrest and
subsequent conviction of the offender. The framework of the preliminary investigation is based on the
following major tasks:

(1) Verification that an offense has occurred;

(2) Identification of the victim, the place of the crime, and the time of the crime;

(3) Identification of solvability factors;

(4) Communication of the circumstances of the crime; and

(5) The identification of those investigative tasks completed and those yet to be done.

Twelve solvability factors are

1. witnesses to the crime,

2. a suspect’s name,
3. knowledge of where a suspect can be located
4. description of a suspect,
5. identification of a suspect,
6. property with identifiable characteristics,
7. existence of a significant method of operation,
8. a description of the car used by the suspect,
9. positive results from a crime scene evidence search,
10. belief that the crime may be solved with publicity
11. reasonable additional investigative effort, and
12. Opportunity for but one person to have committed the crime.

Criminal Investigation Work Plan

Planning for the investigation phase after predication normally considers the following broad categories
of activity as part of the investigation work plan:
 Preservation of evidence
 Witnesses (including identified implicated personnel)
 Records
 Resources
  Forensics
 Equipment
 Logistics, e.g. international travel, travel to rural and remote locations, etc.
These categories are not exhaustive and the plan must be kept flexible so that adjustments can be
made as changes arise and any new information is discovered. The plan is, therefore, a living document that
anticipates and records developments in the investigative process.
Preservation of Evidence:
Since an investigation is a fact-finding process and the facts may be evidence of possible
misconduct, a fundamental element in the planning stage is the preservation of evidence.
Witnesses
Witness testimony is particularly important evidence to collect and critical to any investigation.
Because of the importance and special nature of witness testimony, careful planning is necessary. Witness
recollection fades quickly and can be influenced by external factors such as media reports, sympathy and
even office gossip. The investigation plan must, therefore, include a detailed interview schedule which
addresses issues of:
 Witness availability
 Order of testimony
 Special needs (interpreter, guardian)
 Re-interviews
These elements are inter-related and changes can affect the entire investigation. Accordingly, the
plan should be monitored and adjusted to compensate for scheduling and other factors related to witnesses.
Witness testimony also concerns more general planning issues, such as investigation support.
Records
Records are documentary evidence, regardless of physical form, created or received by a staff
member in connection with, or as a result of, the official work of the United Nations, and remain the
property of the United Nations. Records have the advantage of fixing information in time. However, records
can be lost, damaged, altered or changed for legitimate or sinister purposes. In addition, records can be
moved from initial storage/filing to the offices of individual staff members, other office facilities or even
off-site storage. This can impact the time it takes to trace and obtain those records. Identification of relevant
records is fundamental and the investigation plan must address the means of obtaining those records.
Particular consideration should be given to obtaining electronic records that may be kept on back-up media
that is periodically overwritten.
Resources
A preliminary resource plan must be developed as soon as practical to identify all personnel required
to participate in the investigation, required external expertise, as well as travel and investigation expenses.
The budget(s) to which such expenses should be charged must be checked for available funds and relevant
budget information recorded in the plan. Some locally incurred expenses may be covered at the mission or
on an out-of-pocket reimbursable basis. Nevertheless, financial contingency factors should be considered in
the investigation plan.
Forensic
 Forensic analysis should be conducted as soon as possible after discovery of an item to be analyzed
to avoid degradation, damage or loss of samples or information. Plans for examining computer hard drives,
file servers and communication devices that store data electronically should be considered when assessing
the need for preservation of evidence.
Equipment
Investigations may require certain equipment. This must be identified in the investigation plan to
ensure availability when required. The plan should also include pre-mission equipment check on
functionality
Intelligence Operations
Criminal Intelligence is information compiled, analyzed, and/or disseminated in an effort to
anticipate, prevent, or monitor criminal activity. Criminal intelligence is developed by using surveillance,
informants, interrogation, and research, or may be just picked up on the "street" by individual police
officers.
An intelligence operation is the process by which governments, military groups, businesses, and
other organizations systematically collect and evaluate information for the purpose of discovering the
capabilities and intentions of their rivals.
Tradecrafts a term used within the intelligence community to describe the methods, practices, and
techniques used in spying and underground investigations. Whether the practitioner is a covert agent for the
government or an identity thief and con man, the methods, practices, tactics, and techniques are often the
same and sometimes learned from the same sources. It reveals how intelligence officers and investigators
conduct their tradecraft. how to plan an operation, how to build an identity and cover story for deep cover
operations, and how to detect those who have created false identities for illegal purposes. It is also important
for technical aspects of intelligence, counterintelligence, and criminal investigations, and legal
considerations for conducting intelligence investigations.
Depending on the type of organization involved, intelligence operations can result in many different
types of information. Strategic or national intelligence is information about foreign nations that is collected
by governmental intelligence agencies. Strategic intelligence commonly encompasses national security,
political, economic, and social trends in the target nation. Military intelligence is produced by specially
trained military or civilian analysts and usually includes the strengths, weapons technology, and estimated
military capabilities of actual or potential enemies. Industrial intelligence is information gathered by a
business firm concerning its rivals in the marketplace.
Political intelligence, as practiced in the United States, is usually concerned with ascertaining the
campaign strategy of a political opponent. Political intelligence can also apply to the efforts of a ruler to
uncover conspiracies. Counterintelligence embraces the wide variety of activities undertaken to forestall an
adversary’s intelligence efforts. This is accomplished by physically protecting one’s own sensitive
information and by penetrating and disrupting hostile intelligence organizations.
Covert operations are often undertaken by intelligence agencies, but these are distinct from
intelligence operations whose purpose it is to gather information. Covert operations are activities aimed at
the disruption of another nation’s political process: they can include the dissemination of propaganda, the
encouragement of dissidents, acts of sabotage, and even assassination.
 Collection
Collection conducted by a governmental agency or a business firm, intelligence operations follow the
same pattern. The first step in generating intelligence is always the collection of information. Overt
collection is the acquisition of non-secret “open source” material. To obtain highly sensitive information,
however, it is usually necessary to resort to clandestine, or secret, collection.
Intelligence derived from clandestine collection generally falls into three categories: human
intelligence, signals intelligence, and photographic intelligence. Human intelligence is simply information
gathered by and from human agents. Espionage, or spying, is one time-honored method of obtaining human
intelligence. Whereas other forms of clandestine collection often provide a greater volume of information,
especially data of a technical nature, human intelligence is essential for uncovering the thinking, as opposed
to the activity, of the adversary.
A second form of clandestine collection is known as signals intelligence the interception of
electronic communications and other emissions. Signals are intercepted by a variety of methods, including
the tapping of telephone lines and the monitoring of radio transmissions. Messages intercepted in this
manner are often in code. Cryptology, the study of making and breaking codes, has become a science in
itself over the years.
 Evaluation and Utilization
The collection of raw intelligence is not an end in itself. Raw intelligence must be combined with
related data, significant information must be identified, and extraneous material (“noise”) deleted.
Computerized data storage systems aid greatly in bringing together the related pieces of information that
make up a complete intelligence picture. Human intuition and creativity play important roles in developing
the “informed guesses” that fill gaps in the picture. This process of digesting raw intelligence, known as
evaluation, yields a product that is usable by policymakers. It is up to the policymaker to utilize the
intelligence that he or she receives in a timely and responsible manner.
One of the greatest intelligence achievements in history, the British “Ultra secret” of World War II,
clearly illustrates the relationships that exist among collection, evaluation, and utilization of intelligence.
DATABASE INVESTIGATION
A database is a collection of data or information which is represented in the form of files or a
collection of files. Retrieving the data from the database can be done with a set of queries. Database
forensics can be defined as the application of computer investigation and the analysis techniques to gather
the evidences from the database to present them in a court of law. A forensic investigation needs to be done
on the databases, because a database has sensitive data where there is a high chance of a security breach by
the intruders to get this personal information.
Database investigation normally belongs to computers and databases.
Computer technology is the major integral part of everyday human life, and it is growing rapidly, as
are computer crimes such as financial fraud, unauthorized intrusion, identity theft and intellectual theft. To
counteract those computer-related crimes, Computer Forensics plays a very important role. “Computer
Forensics involves obtaining and analysing digital information for use as evidence in civil, criminal or
administrative cases.
Database Investigation generally investigates the data which could be taken from computer hard
disks or any other storage devices with adherence to standard policies and procedures to determine if those
devices have been compromised by unauthorized access or not. It Investigators work as a team to investigate
the incident and conduct the forensic analysis by using various methodologies.
Principles of Database Investigation
The following are the main principles for database investigation
1: Data stored in a computer or storage media must not be altered or changed, as those data may be later
presented in the court.
2: A person must be competent enough in handling the original data held on a computer or storage media if
it is necessary, and he/she also shall be able to give the evidence explaining the relevance and course of their
actions.
3: An audit trail or other documentation of all processes applied to computer-based electronic evidence
should be created and preserved. An independent third party should be able to examine those processes and
achieve the same result.
4: A person who is responsible for the investigation must have overall responsibility for accounting that the
law and principles are adhered to.
Model of database investigation
Database investigation is to identify the evidences, preserve those evidences, extract them, document
each and every process, and validate those evidences and to analyze them to find the root cause and by
which to provide the recommendations or solutions.
ELECTRONIC INVESTIGATION
Electronic Investigation refers to the scientific study and inquisition of electronic devices like
computers in a way that is accordant with the rules of evidence extraction and with the rules of litigation
procedure. To explain a lay man we can say that it can be considered as the application of electronic
methodologies to computer based materials. Although it is generally thought of as a part of the traditional
forensics arena. But it requires vast knowledge of computer software and hardware details for the purpose of
avoiding the destruction of important evidence.
Now the question that comes around is extraction of what kind of evidence? It refers to investigation
of culpable evidence which can be extracted from a computer’s hard drive and preparation of evidence for
presentation in the court. Here, the information is already present on the hard-drive of the system but it is in
hidden form. It also refers to the searching of data from unallocated disk space for retrieving copies of files
which has been damaged, deleted or encrypted. So basically, the investigators have to carve out data so as to
produce it as evidence in the court.
Methodology behind Electronic Investigation
Experts follow a set of standard rules while carrying out the investigation case. They physically
isolate the computer which is being suspected to ensure that it is not further contaminated. For this they also
make it a point to make a digital copy of the hard drive and all the investigation is carried out on this digital
copy.
The experts adopt well-defined procedures and work together as a team for a successful digital
investigation. While conducting the process of gathering data, the expert make it a point to document all
those valuable information in a well-structured format.
With the rapid growth experienced in technology, the technical skills needs to be also expanded. A
normal investigation procedure consists of the following parts.
 Detection of network intrusion
 Evaluation of threats and other vulnerabilities
 Forensic investigation on data
An electronic examination reveals lot of information like when a document first appeared on a computer, the
date on which it was last edited, etc. All these information can bring out a great change in investigation
procedures. To sum it all, the electronic procedure consists of the following basic steps.
 Identification of evidence
 Preservation of evidence
 Extraction of probative evidence
 Interpretation and necessary documentation
 Presentation of evidence in the court by adhering to the rule
FORENSIC INVESTIGATION
The term forensic investigation refers to the use of science or technology in the investigation and
establishment of facts or evidence to be used in criminal justice or other proceedings. Forensic investigation
is a rather broad field with many different subdivisions. One of the most important aspects of criminal
justice is forensic science, or the practice of scientifically examining physical evidence collected from the
scene of a crime or a person of interest in a crime. Many people consider forensic science the application of
science to law enforcement.
If there are no known witnesses to a crime, sometimes forensic evidence is all prosecutors have to
work with. For instance, if human remains are found dumped in a ravine and have decayed to the point
where they cannot be recognized, forensic scientists use DNA from the body, examine dental work and even
study the skeletal structure to determine who the person was. They use the evidence they have to narrow
down possibilities and determine if the person was a male or a female. Sometimes forensic scientists can
determine cause of death and if foul play may have been involved.
Two of the most common crimes that are determined in the forensic science lab are drug-related
crimes and sex crimes. It is in the crime lab that the chemical makeup of an unidentified substance recovered
from a suspect is determined to be cocaine, marijuana or a controlled substance. This is used as evidence in
court to prove that a person was in possession of illegal drugs. Forensic toxicology can determine if a person
was drunk or high behind the wheel of a car after a fatal accident, or if someone was poisoned to death.
DNA evidence recovered from a victim’s body can help determine who was responsible for a physical or
sexual assault. This evidence is commonly used in court to put sex offenders and child molesters behind
bars, and to set innocent people free.
Weapons testing, or ballistics, is another important part of forensic science. Forensic scientists use
their knowledge of ammunition and study the impact of a bullet to determine how many shots were fired,
where a shooter was standing when he or she fired, and even if a victim was shot at point blank.
Forensics is also important in identifying the culprits of various cyber crimes. Databases are
searched, IP addresses are traced and documents are recovered by computer forensic specialists to determine
who was responsible for stealing funds electronically. This evidence is used to prove a suspect’s guilt for
major white collar crime, such as Ponzi schemes, embezzlement and fraud.
Evidence and Forensic Investigation
At a crime scene, there are often tiny fragments of physical evidence such as hairs, fibers from
clothing or carpeting, or pieces of glass that can help tell the story of what happened. These are referred to as
trace evidence, and can be transferred when two objects touch or when small particles are disbursed by an
action or movement. For example, paint can be transferred from one car to another in a collision or a hair
can be left on a sweater in a physical assault. This evidence can be used to reconstruct an event or indicate
that a person or thing was present.
 Careful collection of materials from a crime scene can yield a wealth of information about where a
sample came from and how it helps to tell the story. Scientists examine the physical, optical and chemical
properties of trace evidence and use a variety of tools to find and compare samples, and look for the sources
or common origins of each item. Most test methods require magnification and/or chemical analysis.
The importance of trace evidence in the context of crime scene investigation is sometimes
understated, taking a back seat to more individualized evidence such as DNA or fingerprints. Much can be
learned about what happened at a scene through trace evidence, such as whether an item or body was moved
or whether someone was assaulted from behind or the side. Trace evidence can include a wide variety of
materials, but the most commonly tested are hair, fibers, paint and glass. Other, less frequently included
items are soil, cosmetics and fire debris. Some laboratories will consider fire accelerants as trace and others
will include them in chemistry, even though the same tests are conducted in both laboratories. For the
purposes of this series, paint, glass, fiber, and hair
Types of Forensic Evidence
The following are the main types of forensic evidence
Biological Evidence:
The two most common types of biological evidence are blood and saliva. Blood evidence comes in
the form of wet blood (e.g., a tube of blood from an autopsy) or swabs of bloodstains collected at crime
scenes. Buccal swabs are the most common way of collecting saliva evidence, usually from a victim or
suspect. Other types of biological evidence include seminal stains, urine, and perspiration. In each case, the
aim is to provide sufficient samples of biological evidence to allow DNA profiling.
Weapons Evidence:
Weapons evidence consists of firearms (handguns, rifles, assault weapons, etc.), ammunition (e.g.,
spent casings, fired projectiles, bullet fragments, and unfired bullets), gunshot residue (GSR) tests, and
knives. The purpose of a GSR kit is to determine whether an individual was close to a firearm at time of
discharge.
Fingerprint Evidence:
Fingerprint evidence will be divided into complete 10- prints (fingerprints are available for both
hands and palms as in the case of fingerprinting a victim or suspect) and latent prints (only partial prints of
one or more fingers are available, usually through a powdering technique on physical evidence such as a
weapon or vehicle).
Drug Evidence:
Drug evidence includes drugs (e.g., marijuana, cocaine, methamphetamine, and others), and drug
paraphernalia (pipes, spoons, etc.) found at a scene.
Impressions Evidence:
Impressions evidence includes shoeprint impressions, tire tracks, and tool marks.
Trace Evidence:
Trace evidence is a generic term for small, sometimes microscopic, material. It covers a wide variety
of evidence, including fibers, hair, building materials (asbestos, paint, etc.), cigarettes, tobacco, glass, and
others.
Natural/Synthetic Materials:
Natural and synthetic materials include clothing, bed and bath material, carpet cuttings, metal
objects, plastic, and paper.
Generic Objects:
Generic objects include vehicles, bicycles, containers, doors, wood, and concrete.
Electronic/Printed Data;
Electronic and printed data include documents and electronics (computers, cell phones, etc.).
Other Items:
Other items are a catchall category for evidence that does not fit in any of the above categories. This
typology for classifying forensic evidence proved beneficial in ILJ’s study. For the most part, forensic
evidence collected at crime scenes was easy to classify into the correct categories.