1. Investigators: Carrie Estes, Maria Shah, Courtney Wirtz

2. Overview Five murders took place in just under a year. The occurred between February of 2010 and January of 2011. All victims were recovered in the Gettysburg National Military Park. The bodies were staked into the ground and posed. This led to the assumption the killer was a sculptor. Later, Dorian’s head was found on a boulder in the park. After obtaining a search warrant, emails were read from Dorian’s computer which led to the Ranger Station within the park. Another search warrant was obtained and a computer from the Ranger station seized. Both are now in the lab for analysis.

3. Crime and elements of the Crime § 2501 Criminal Homicide Definition: A person is guilty of criminal homicide if he intentionally, knowingly, recklessly or negligently causes the death of another human being. Elements of the crime: Murder/Homicide; The corpses were posed which leads to the assumption that the murders were premeditated, but there is no proof as to if the accused knew who was to be killed or if the people were random strangers.

4. Crime and elements cont. § 2502 Murder (a) Murder of the first degree.-A criminal homicide constitutes murder of the first degree when it is committed by an intentional killing. (b) Murder of the second degree.-A criminal homicide constitutes murder of the second degree when it is committed while defendant was engaged as a principal or an accomplice in the perpetration of a felony. (c) Murder of the third degree.-All other kinds of murder shall be murder of the third degree. Murder of the third degree is a felony of the first degree.

5. What is to be proven Who was the original murderer? Were Dorian and the Ranger accomplices? Were certain people killed, or just random people. Who killed Dorian? If Dorian was the original murderer, is the person who killed Dorian a copycat?

6. Evidence searching for Emails on Dorian’s and the Ranger’s computers. Files to do with “Body Art” or “poses.” Files on Dorian’s computer with marked maps of the park. Pictures of the posed corpses (or news articles). Hidden files or folders on either computer.

7. Procedures of finding the evidence Used the Encase Digital Forensics Tool to capture an image of the suspected USB Used various search techniques such as the keyword search, cluster search, and web address search to find evidence Bookmarked the information that looks suspicious Matched up dates of e-mails with dates of murders and purchases made.

8. Location of Evidence in Masen’s bank statement purchases The ranger station computer held evidence linking John Masen to the murders both with documents and the emails that were sent and received from him Dorian’s computer wasn’t very helpful, but there were images of his artwork The sculptures showed the positions of the bodies in the national park and were extremely eye-opening

9. Relevance of evidence The evidence clearly shows that John Masen commited the murders and stole property from the ranger station in order to pay off his many debts and needs. John Masen was bankrupt, had his home foreclosed upon, was evicted from his current place of residence due to the inability to come up with the financial means to stay

10. Challenges and lessons learned Maria Shah Working in a group with one case In pro-discover I had issues with trying to do a search. There were a lot of deleted files and trying to figure out which ones were deleted because they decided they didn’t want to use them anymore or are relevant to the case. Looking back I wish we would have wiped our thumb drive before our final decision to say this is what goes on our thumb drive to be put in. A lot of duplicate files. Next time nominate group leader.

11. Challenges and lessons learned cont. Carrie Estes The next group project, sit down at the beginning and lay out what each person does. Have normal meetings where we can discuss what we have found or any issues that might have arisen. Set ground rules of outside things to be left out of the meeting. Really know what to look for before researching laws.

12. Challenges and lessons learned cont. Courtney Wirtz Challenges  ensuring that all the information/files on the computer were completely investigated and there was no hidden meaning/ codewords within the documents Lessons Learned  Digital investigations take longer than expected. You must read through everything even if it seems irrelevant. Time management is critical to the digital forensic investigation process.