Interview with an Expert

Comprehensive digital-image management
and the growing need for deep-archiving

David Knoerlein digital image management DIGINEG FAS Foray evidence forensic

An exclusive Evidence Technology Magazine interview with
David Knoerlein
President of Forensic Digital Imaging, Inc. (www.FDIFlorida.com)
Forensic Photographer and Digital-Imaging Consultant

EVIDENCE MAGAZINE: Crime-scene photography has always been a major issue as far as storage and retrieval is concerned. But now, with everyone moving to digital photography, how are law-enforcement agencies saving all of those images?

KNOERLEIN: Well, that depends on the individual agency’s needs and the number of images they are dealing with. If they have a huge number of images, then they are obviously going to need to think about both short- and long-term storage for their images.

EVIDENCE MAGAZINE: And who is in charge of making those decisions? Who is actually in charge of digital-image management?

KNOERLEIN: In some agencies, the person in charge of photography will make decisions about how the images are stored. But recently, the IT (information technology) departments in some agencies have been taking a lot of the responsibilities for image storage, archiving, and distribution.

EVIDENCE MAGAZINE:
How did all of this digital emphasis evolve?

KNOERLEIN: My own involvement with digital-image management goes back a number of years to when I was working in the photo lab at the Baltimore County (Maryland) Police Department as a forensic photographer. Back then, we were responsible for all of the film that was shot with conventional 35mm cameras. We had a full-service photo lab where we processed the negatives, made prints, and filed the negatives. When images were needed for court, we would pull the negatives from a file cabinet where they were filed under a case number. That was it. Later—maybe years after the pictures were taken—if someone asked for a picture showing bloody footprints next to a particular victim, we would ask for the case number, go to the file cabinet, pull that envelope, and go through all of the negatives. If we couldn’t determine by looking at the negatives whether we had a suitable image, then we would have to print every one of them. Eventually, we got a viewer that converted images from negative to positive so you could look at them on a TV screen. For us at that time, that was the state of the art!

EVIDENCE MAGAZINE: But things were starting to improve, right?

KNOERLEIN: In the early 1990s, the vendors of photographic equipment began introducing film scanners that would let us take the negatives and scan them to a digital format and put them on a computer. Kodak and Nikon were offering things like that. And then, digital cameras became affordable enough that even the smaller police agencies could afford them. That was the beginning of law-enforcement’s involvement with digital photography.

EVIDENCE MAGAZINE: So you were there to help make the conversion…?

KNOERLEIN: Yes. We immediately saw the benefits of digital. Not just the ability to shoot and view the images immediately, but the storage and the retrieval of digital images was wonderful compared with the old method of going to a file cabinet, pulling out the negatives, holding them up to a light source, and trying to find the image you needed. It was just a much more efficient process. And it continued on to where we are now. Today, a large percentage of police agencies across the country are using complete digital—or at least hybrid digital—configurations in their evidence image-capturing capabilities.

EVIDENCE MAGAZINE: So, today you just snap a picture and it is stored on the camera’s memory card. Later, you copy it to your main memory device and name it, categorize it, and classify it. Is there a set of procedures?

KNOERLEIN: Yes. There are some widely accepted protocols and procedures that should be followed. The entity that almost everyone looks to for advice on those basic procedures is SWGIT (Scientific Working Group on Imaging Technology). They have set up what they think are the basic guidelines. An agency that is just starting to get into digital imaging might want to look to SWGIT for setting up its guidelines and standard operating procedures.

EVIDENCE MAGAZINE: What kind of procedures are you talking about?

KNOERLEIN: Most agencies have their own procedures for who is responsible for shooting what. They have policies for the proper resolution you should use when you are shooting a blood impression—or a shoe impression or a fingerprint—as opposed to a general reference photo of a crime scene. Those details are left to the individual agency to determine. There are basic guidelines and best-practices, but there are no overall standard rules. Any police agency that is using digital imaging as their method of capturing images of evidentiary value should have established these procedures before they even started. They should have procedures that cover everything from the moment they snap the picture and capture the image all the way up to archiving and deep-archiving and the retrieval of images for trial. I can’t sit here and tell you exactly the best way to do it. I can only tell you what has worked for me. But the best way to do it depends on the individual agency’s needs, the equipment they are using, and the people they have appointed to be responsible for managing the images.

EVIDENCE MAGAZINE: And what are they doing to manage the images?

KNOERLEIN: A lot of the agencies are using software that is available out there for image management. There are software programs that can track an image from the point of capture all the way through the process of archiving. And that sort of thing takes off a lot of the pressure.

EVIDENCE MAGAZINE: In what way?

KNOERLEIN: In one of my projects—the work we did in Iraq to document the recovery of evidence from mass gravesites—we needed to create and manage a system that had to be flexible (because we were working in a war zone) but also secure (because the images would have to stand up to any challenges in world court). And so I established some very strict procedures for image management. The people who were involved in the project had to follow the procedures step by step. A lot of these guys working with me said, “This is ridiculous. How come we have to follow this tight, repetitive procedure?” And my answer was that the repetitive nature of the procedure is one of the security steps. We do the same thing the same way all the time.

EVIDENCE MAGAZINE: And was it all manually done…or did you use some computer software programs, too?

KNOERLEIN: We used computerized image-management software that allowed us to customize it for the project we were doing. I have used software from several vendors in the past. Foray is one of them. And DataWorks is another. And I would consider both of them to be leaders in forensic image management. There are undoubtedly others out there, but these are the two that I am very familiar with. Their image-management software covers virtually everything from the image-capture to the archiving.

EVIDENCE MAGAZINE: And what does this image-management software do?

KNOERLEIN: Digital cameras allow you to capture an image to a memory card. From that point on, if you don’t have any image-management software, the only thing you can do is take the card out, download the image onto your computer, put it into a folder, and label the folder. That’s it. But if you have image-management software, you take the image from the card and put it into the software that allows you to encrypt each of the images for security purposes, sort the images, and label them according to whatever customized labeling procedure you have set up with the software. You can give it a case number as you have always done in the past—but you can do much, much more. You can set up search fields within the software for case number and other specific descriptions. For example: You may want to tag certain images as weapons—knife or handgun or whatever—so that down the road, you can pull up all the digital images that show weapons of a particular kind. You can tag each of the images according to the type of crime: arson, burglary, homicide…there are many options. You can tag individual images, groups of images, or groups of cases. You can set up the software to categorize the images in a variety of ways that will give you an amazing number of search capabilities. And the software gives you the options to set up your own search fields based on your agency’s needs.

EVIDENCE MAGAZINE: And all of this software is supplied by vendors?

KNOERLEIN: Not necessarily. When I was doing some research to find out how much digital photography is being done out there in the field, I found that there are some agencies that have developed their own image-management software. Of course, those agencies have someone on staff who can write the software program or who can take an existing program and customize it to their own needs.

EVIDENCE MAGAZINE: How is all of this digital photography being stored by law-enforcement agencies?

KNOERLEIN:
When I did the research, I found that a lot of the agencies are archiving everything on CDs and DVDs, depending on how many images they have in their files.

EVIDENCE MAGAZINE: Isn’t that a bit dangerous as far as the shelf life of the media is concerned?

KNOERLEIN: Absolutely. There is some interesting information out there about the shelf life of CD and DVD media. Some of your readers probably saved something to a CD or DVD several years ago…but when they tried recently to open them up, the images just wouldn’t open. The storage media deteriorates. File formats also change. And software changes. We have to keep up with all of those changes. We need to think seriously about archiving for the present and the future. But for long-term storage, we need to start thinking about what is true archiving.

EVIDENCE MAGAZINE: What do you mean: “true archiving”?

KNOERLEIN: Well, some people say a RAID (redundant array of independent disks) system is one of the best methods of archiving. But you still have the real possibility of human error, or a mechan-ical malfunction, or a catastrophic event. That’s why I am so involved now with this issue of deep-archiving for long-term storage. I’m not suggesting that an agency should abandon whatever it is that it is doing now for short-term storage. But for long-term storage—years and years down the road—everyone really needs to start thinking about where these images will be stored and how they will be stored. Look at it this way: In the digital format, an image is nothing but ones and zeroes—and those ones and zeroes don’t degrade or get weak. You just either have them or you lose them. And if you lose them, you don’t have an image any more.

EVIDENCE MAGAZINE: Nothing…

KNOERLEIN: Nothing. But that is what we are doing in the law-enforcement community, today. We take images of evidentiary value—a fingerprint that could make or break a major case, for example—and we make a digital image, archive it digitally, and simply hope that when and if the case goes to court, we can retrieve that image without any problems. Well, for the short-term, I am sure that most of the systems that are being used out there are not creating any problems. But what about long-term storage? What if a cold-case image is needed 30 years from now? In the past, we had film and we could go back to the negative and make a print. Now, we have to ask ourselves a lot of questions: Where are those images sitting? What format are they? How are they being managed? Has anyone bothered to help them migrate up through the technology changes so they will match the current technology? An agency really needs to incorporate all of those questions into whatever kind of image-management procedures it uses.

EVIDENCE MAGAZINE: You sound like you are worried about this problem. What can be done?

KNOERLEIN: I am getting more concerned about it almost every day. What can be done? First of all, you need to determine what is the retention period for those digital photographs that are collected as evidence. I’m not talking about computer hard-drives…unless that’s where digital photos are kept. What I am talking about are digital photos when no film was used and when there is no other method of archiving the evidence except for the digital images. Quite often, when I talk with agencies, they tell me that they are not really sure how long they should keep digital images. They wonder whether they should periodically purge their files like they used to do when they used film: misdemeanors and non-high-profile cases would be purged based on their agency’s procedures or their state’s requirements. The files would be either purged or sent off to some other storage location. Back in the days of film, that was done simply because there was a problem with having enough storage space. Today, we have to consider that same scenario, except with the use of digital technology. If the images are stored on hard-drives, CDs, or servers, are they going to be available in the distant future—20, 30, or 50 years from now? What if those images have historical value, like the genocide images I worked with in Iraq? As historical images, those images will probably need to be available 100 years from now or more.

EVIDENCE MAGAZINE: So what are we to do? What can be done?

KNOERLEIN: The long-term retention of evidentiary images is something that we don’t really have a universal grasp on, yet. Today’s digital-image management seems to differ from state to state and from agency to agency. Long-term digital-image management even differs within an agency’s jurisdiction. As evidence, the images might move from the agency’s storage facility to the court’s facility during the trial—and stay there until after the trial. Then they go back to the agency’s storage facility.

EVIDENCE MAGAZINE: Who makes the rules on how long images are kept?

KNOERLEIN: Across the country, it seems like almost every agency says they keep homicide images forever. Those images are so important that they might have a need to refer to them at some point in the future. I have even talked with one or two agencies that say they keep everything…forever!

EVIDENCE MAGAZINE:
Earlier, you briefly mentioned “deep-archiving”. What is that?

KNOERLEIN: Deep-archiving is an entirely different topic. It’s another step in the chain of digital-image management that is provided by a company called DIGINEG Ltd. Deep-archiving is a way to store your images securely and still be able to retrieve them years down the road—and not be concerned with what kind of digital technology is in place at the time. I don’t want to sound like I’m promoting any one vendor. What I am trying to do is make the forensic digital-imaging world become aware of the issue of deep-archiving. For me, the term means having these images available when you need them years—or even decades—down the road. Right now, there is only one kind of deep-archiving that I know of that seems to have a proven track record: DIGINEG FAS. The acronym FAS is used as a short way of saying Forensic Archive Service.

EVIDENCE MAGAZINE: How does this system of deep-archiving work?

KNOERLEIN: The basic explanation of the forensic archive service offered by DIGINEG FAS is this: The company uses high-tech laser film recorders to transfer digital images and data to archive-grade 35mm film. They use the same equipment that they use to archive digitally produced motion-picture imagery for major Hollywood production companies. The 35mm film with the images is stored in secure vaults right next to film footage from Hollywood’s most famous movies. The archival service includes storing the film, but the film can be returned to the police agency if it has the ability to store the film securely at its own location. Hollywood production companies obviously have a lot of money invested in those movies and they want to have them available so they can show them to future generations.

EVIDENCE MAGAZINE: Archiving on film makes sense. After all, we are still able to view prints from negatives that were shot 100 years ago—but some of the digital photography is gone because the storage media has deterioriated…

KNOERLEIN: Deep-archiving is really a backup. It is an insurance policy, so to speak. If an agency is hit by a tornado or hurricane or flood, there is a good chance that the server containing the digital-image files will be destroyed. But if there is a copy of those image files somewhere in an analog format, the images can be converted back to a useable digital format. Deep-archiving is insurance because you know those images will always be there.

EVIDENCE MAGAZINE: Should this be a big issue for law enforcement?

KNOERLEIN: I think it already is a big issue. Of course, this does not mean that an agency should stop doing what they are doing now. They should continue to follow their current procedures. But this deep-archiving technology takes it a step further: It extends the useful life of the digital-image evidence. I know it sounds like we are going in a circle: We started with film and now we are going back to film. But film is basic. All you need is light to view an image on film. You can hold it up and if you have light, you can see the image. So no matter what the digital-image technology is 100 years from now or 200 years from now, you will still be able to convert that film image to a digital image. You will just need a light source
—and whatever digital technology is being used there in the future.

EVIDENCE MAGAZINE: So the actual image is stored on film…?

KNOERLEIN: Yes. And in addition to the image, all of the metadata is stored on a frame of the film right next to the image itself. Any search criteria data that the agency chooses to associate with the image is also archived on the film. Of course, it is in analog format and it would have to be scanned to make it digital again. But at least, it is there. Hopefully, you will never have to go to the film, but you will have the confidence of knowing that you can go to the film and retrieve the needed images. The key thing for the agency to decide is this: Is it worth it to have those images available in a deep-archive format in case the other storage formats fail? When digital photography first appeared, it was apparent that it was an effective way to capture, share, and manage images. But at that time, we never really thought too far into the future about long-term storage or deep-archiving. But today, we should be thinking about it…very seriously.

EVIDENCE MAGAZINE: Thank you for speaking with us today.


A brief look at the background and experience of David Knoerlein

Knoerlein has more than 25 years of experience in the area of forensic photography. He began his career with the Baltimore County (Maryland) Police Department as a forensic photographer. Later, he was a forensic analyst for the Broward County (Florida) Sheriff’s Office and was in charge of the crime-scene unit’s digital-imaging section. While there, he qualified as an expert witness in digital imaging and testified in a prominent murder case: State of Florida vs. Victor Reyes. The Reyes case is one of the few cases in the United States that have passed a Frye hearing specifically for the use of digital imaging in law enforcement. (See the July-August 2003 issue of Evidence Technology Magazine.) In the fall of 2004, Knoerlein worked in Iraq as a member of the Mass Graves Investigation Team that was charged with assembling photographic evidence of genocide that had been committed by the Saddam Hussein regime. His job was to direct and coordinate the capturing, processing, and management of more than 90,000 digital images that could later be used in international courts. (See the May-June 2008 issue of Evidence Technology Magazine.) Knoerlein developed his own useful set of standard operating procedures and has shared them with numerous police departments across North America. Knoerlein’s e-mail address is This e-mail address is being protected from spam bots, you need JavaScript enabled to view it


For information about vendors or topics mentioned in this interview:

SWGIT (Scientific Working Group on Imaging Technology)

Foray

DataWorks

DIGINEG FAS


ORIGINALLY PUBLISHED:
"Comprehensive digital-image management
and the growing need for deep-archiving."
Interview with David Knoerlein

September-October 2008 (Volume 6, Number 5)
Evidence Technology Magazine
Buy Back Issue

 
< Prev   Next >






Forensic Podiatry (Part Two of Two)

THE DISCIPLINE of forensic podiatry—or, in other words, the examination of pedal evidence—has progressed significantly over the past ten years. It is no longer a question of “What can you do with a footprint?” but rather, “Who can we use to evaluate the footprint?” Cases involving pedal evidence, especially bloody footprints and issues of determining shoe sizing or fit issues compared to questioned footwear, have become more common over the past two or three years.

Read more...