Counterfeit Examina...
 
Notifications
Clear all

Counterfeit Examination  

  RSS
cloudy
(@cloudy)
Member

Hi

Currently working on a counterfeit case, and am drawing a bit of a blank.

We have checked jpeg, gif, bmp, doc, xls, ppt files etc and cant find any evidence of counterfeit notes. We have also searched unallocated files.

A printer scanner was seized, and we are thinking that it may have been used to scan the notes and then print them without saving them to the computer.

If this was the case would there be any evidence files on the computer showing this????

Cheers

Quote
Posted : 11/09/2007 4:42 pm
Rich2005
(@rich2005)
Senior Member

There can be many more types than that, on a recent similar job, there were a ton of files of different types AI (adobe illustrator), PSD (Adobe Photoshop), cpt (Corel PhotoPaint), cdr (Corel Draw), PDF files, and proprietary card reader image format files.
And yes, often there would be image files stored on the computer, whether as temp files or actually saved somewhere.
If my memory serves me correctly (it does very occasionally) i think you can keyword search for 8PSD for the start of PSDs in unallocated, and then attempt to view any hits as images.
Rich

ReplyQuote
Posted : 11/09/2007 6:24 pm
BitHead
(@bithead)
Community Legend

If you can grab some remnants of the spool files perhaps that would give you some information as to the source of the images, narrowing the search. As Rich points out, if you have good counterfeits they were likely produced in one of the more advanced image processing programs (Illustrator, FreeHand, Photoshop and InDesign being favorites).

ReplyQuote
Posted : 11/09/2007 6:40 pm
cloudy
(@cloudy)
Member

Thanks for the info

I have already checked the spooler files and can find no remnants of any relevance.

I have checked and there doesn't seem to be any software which would fit the bill so to speak.

Might be showing my naivety here but what are PSD??

ReplyQuote
Posted : 11/09/2007 6:57 pm
Rich2005
(@rich2005)
Senior Member

I described what the files were next to the extension in my post wink

ReplyQuote
Posted : 11/09/2007 7:23 pm
cloudy
(@cloudy)
Member

sorry, brain seems to be on a bit of a go slow today…… this week…. this month…. wink

ReplyQuote
Posted : 11/09/2007 7:44 pm
andy1500mac
(@andy1500mac)
Member

Hi,

You may want to try looking for TIF and MDI image formats as well.

ReplyQuote
Posted : 11/09/2007 8:27 pm
Rich2005
(@rich2005)
Senior Member

Oh yeah and thought i'd add whilst this isnt a 'file type' to look for, if you're drawing a blank, i always tend to have a look through the larger files on the drive,just in case theres stuff i haven't thought of, or proprietary formats etc, just sorting by logical size and seeing if there's anything out of the ordinary (as a high quality image file is likely to be a few MB - or much bigger if in an uncompressed form - there usually arent TOO many to flick through that aren't obviously recognisable).
Rich

ReplyQuote
Posted : 11/09/2007 10:41 pm
cloudy
(@cloudy)
Member

Thanks for the help i'll let you know what find

ReplyQuote
Posted : 12/09/2007 3:48 pm
j2222
(@j2222)
Junior Member

Cloudy, how about look at what apps are installed and what have been run recently? Prefetch and recent folders … then look to see what file types these use.

Hope this helps, James

ReplyQuote
Posted : 13/09/2007 8:44 pm
E5Pro
(@e5pro)
Member

A bit of work, but install the scanner on a new system, scan some images and looke for what is done.

ReplyQuote
Posted : 24/09/2007 6:02 am
kern
 kern
(@kern)
Member

cloudy,

If this was the case would there be any evidence files on the computer showing this????

Maybe grab a copy of the scanners supplied software and see where it would save files, what format they take (the image recorded may be proprietary format ) etc.

if they bypassed the PC altogether
do you have seized counterfeit notes ? you maybe able to tie them to a particular scanner or printer via analysis of noise marks (scratches on the glass / inkdrum etc) or colour analysis of the inks on paper, or the slight percentage size error.

Do a google or yellow pages for scientific analysis firms, or checkout www dot docev.co.uk under "guides for the investigator"

Kern

ReplyQuote
Posted : 24/09/2007 5:10 pm
Share: