High tech crime fighters

When a detective with the Garfield County Sheriff's Office collects a computer, cell phone, digital camera, thumb drive, or any other technological device that potentially holds evidence pertaining to a case, they take it to one person — Detective Cpl. Eric Ashworth.

He's the one that sorts through the hundreds of gigabytes worth of files on a hard drive to uncover possible evidence to present to the investigator who's reviewing the case.

Sometimes that may involve countless hours of digging through upwards of half-a-million computer files.

“Then, I can say, ‘here is the 50,000 pictures that were found on this computer,” Ashworth said.

Then, it's up to the agent investigating the case to determine which photos are important to the investigation and prosecution of the case.

It's Ashworth's job to find the files wherever they may be stored, or in some cases hidden, on a device's hard drive.

“I know where to look for a lot of secret things that your computer can give up,” Ashworth said.

According to Ashworth, 60 percent of all cases the sheriff's office investigates includes some type of digital involvement, be it a computer, cell phone, camera, or use of the Internet. Likewise, the equipment in the newly constructed Computer Forensic and Internet Investigation Laboratory at the new Sheriff's Office Annex in Rifle, is used in more than half of all department investigations.

“Computers are involved in every aspect of everyone's life,” he said. “This room is heavily used.”

Computer Forensics

Ashworth said that the county now has one of the most high-tech computer forensic processing facilities on the Western Slope.

While the sheriff's office had limited computer forensic capabilities at its Glenwood Springs facility, the new facility allowed for the expansion of a full-fledged laboratory.

“Opening of the Annex gave us the space needed to create a separate function,” said Garfield County Sheriff Lou Vallario.

Ashworth explained that the sheriff's office, with the addition of nearly $100,000 worth of state-of-the-art computer forensic technology for the lab, now allows the them to perform the computer forensic investigations in-house.

“It just makes our job a little easier,” Ashworth said about the new lab.

This facility, as far as technology, is very similar to the Rocky Mountain Regional Computer Forensics Laboratory in Denver, Ashworth said. Which is where Garfield County's computer evidence used to be processed.

“A lot of what they do, we are able to do here,” Ashworth said.

The lab is equipped with four Forensic Recovery of Evidence Devices (FREDs), one computer dedicated to Internet investigations, and one 16 Terabyte Raid Array server that has the ability to store more data than most people can comprehend.

The FREDs are high-end computers built on a server platform, designed for heavy multitasking and high-end graphics. They allow Ashworth to copy all the files from a hard drive for investigation in order to preserve the original piece of evidence in it's original state.

“At no time do we work on original evidence,” he said. “That way if something were to happen to your evidence, if the copy gets corrupted, then you still have the original.”

All of the evidence is stored on the Raid Array and is accessible only by one of the four FREDs within the lab. There is only one computer in the lab that has an Internet connection which is only used for Internet investigations.

“That is how we maintain a secure network,” he said. “It's just another layer of security.”

The four FREDs allow for quicker processing time. For example, one hard drive may have upwards of 500,000 files of video, audio, photo, or other type of file that have to be sorted through as evidence, which used to take 16 hours or more in some cases. The FREDs have cut the processing time in half, leaving more time for Ashworth to sift through the sometimes thousands of remaining files that are potential evidence in a case.

“All of our software and all of our computers, all that does is just puts the evidence in an easier to view site format,” he said. “You still have to spend the man hours to go through and determine what is important to a case, and what is not.”

The lab will also be available for neighboring agencies who need to utilize the lab's technology.

“We can, and already have, assisted several local agencies, as well as (the Colorado Bureau of Investigation) with providing electronic evidence for cases that occur within their jurisdictions,” Vallario said.

According to Ashworth, Garfield County has done computer forensic work for every Police Department in the county and has also done work for Eagle, Rio Blanco, Moffat and Park counties, as well as the Colorado Bureau of Investigation. He said, in some instances that the sheriff's office is able to work some of the cases quicker than the Colorado Bureau of Investigation which is often a backlogged with case work.

Internet investigations

A detective who has worked with computers since the global blowup of the Microsoft Windows operating system in the early 1990s, Ashworth began working for the Sheriff's Office in 1999 as a deputy. He'd always wanted to be in law enforcement but never imagined the type of investigations that he would be working on. A facility like the lab was also a distant dream.

“Never in a million years did I think that we would ever have anything like this facility,” he said.

Besides being an active investigator and one of two Sheriff's Office Computer Forensic Examiners, Ashworth is also a cyber detective that investigates crimes committed via the Internet.

Ashworth investigates all sorts of Internet crimes involving burglary, drugs, financial cases, crimes against people and property, fraud and even homicides and suicides. Some of the most frequent crimes involves sex and child pornography.

“It's a big problem,” Ashworth said.

Internet crimes are a growing problem creating challenges for law enforcement with ever-advancing technology that provides new and innovative ways for criminals to commit their crimes. However, Vallario and Ashworth say, the sheriff's office is now able to be more proactive investigating such crimes.

“It's extremely valuable,” Vallario said. “This gives us the ability to get ahead of these crimes rather than wait until they have grown out of control.”

Ashworth mostly performs two types of Internet investigation: Peer to peer investigation, and chatting. Peer to peer investigations involve online file sharing which is popular for those looking to acquire or distribute child pornography, or pirated video or music files.

Chatting investigations are more of an online undercover operation where the detective will actually go online and create an persona and chat with people who are often times looking for sex from underage partners.

Ashworth is now equipped to conduct Internet investigations whereas he used to rely on other agencies for tips on local cases.

“We relied on cyber tips from other agencies,” Ashworth said. “Now, we can develop our own and we can be part of that circle that develops the case.”

While these types of investigation tactics are not new to law enforcement, they are a new addition to the Garfield County Sheriff's Office. That is where Ashworth's new role allows him to be more proactive in these types of cases.

“We will be doing more and more of those as well,” he said. “(The lab) will generate a lot more proactive enforcement for us.”