Digital detective brought Vandy rape evidence to light

The call came in as a robbery and shooting at a tobacco store. It was 2001.

Metro police robbery Detective Chad Gish went to the scene to get the surveillance tape. He ended up in a standoff.

"It took me nine hours to figure out that DVR and how to download that," Gish said, "not to a thumb drive, but to a disk."

That was 14 years and 2,000 hours of training ago. Gish now specializes in recovering digital evidence, most often from computers and cellphones, when needed in criminal cases.

In the case against two former Vanderbilt University football players accused of rape, Gish's work unearthed what jurors said was damning evidence that led to convictions: Photos and videos of the attack that the players thought they deleted.

Thought they had deleted for good.

At least until the phones ended up in Gish's hands in the surveillance and investigative support unit at Metro Police Department.

Two kinds of photos

Down the hall from Gish's office at police headquarters downtown, in a room constantly cooled to 60 degrees, is a humming 50-terabyte server storing digital evidence. Hard drives from old cases are stacked and numbered on a shelf nearby.

Gish, 42, spends long hours in his office in front of three 27-inch computer screens that frame his desk. A laptop and another screen wait to his right. On a nearby workstation are two cellphones yet to be examined. There's a tray holding 49 anti-static screw drivers.

"Even the screwdrivers in here are important," Gish said. The smallest static shock when taking apart a device could do damage. Gish and Assistant District Attorney Jan Norman, who specializes in technical evidence, met so many times during the recently-ended rape case Gish brought a small round table into the room so they could be more comfortable.

In a corner under a window, a shelf is filled with a Hulk glove, Hulk statuettes, a Hulk coffee cup. Gish's three children, ages 9, 13 and 16, think their father is Marvel Comics' big green superhero.

In this office, Gish has uncovered horrific images of crimes, often crimes committed against children.

It's the other pictures, the ones of his family, that he relies on for strength:

His daughter, resting her head on her big brother's shoulder at a baseball game in 2009. A moment when they're not fighting, captured with Gish's 500mm lens.

Gish, his wife, Colie, their three children, all in blue. All smiling for a photo on a trip to Myrtle Beach in 2011.

"You've got to surround yourself with family when you're here," he said.

Gish, who has been with Metro police for 17 years, is a hobby photographer. But his Canon lenses — he spreads his arms out wide to describe the gear — have been gathering dust for about three years.

He has an iPhone in his pocket now.

Digital expertise

Around 2004 or 2005, Gish said, police departments nationwide saw a shift and demand for digital forensics. Chief Steve Anderson — a deputy chief at the time — came into the unit where Gish was working. Anderson talked about the role digital evidence could play in child pornography and financial cases, among others.

"It was probably within three months that we started our own lab," Gish said. Some smaller agencies rely on the Tennessee Bureau of Investigation for processing digital evidence, because an in-house unit can be costly. But Metro Nashville has three dedicated detectives. A fourth detective recently retired.

The demand for the recovery of digital evidence has only increased.

"What case doesn't have some type of digital evidence, with video, and phones?" Gish said. "I mean everybody's got a phone in their pocket."

Gish recalled his first digital evidence training about a decade ago. The instructor talked about hash algorithms (a digital fingerprint for a given file).

"I thought they were talking about potatoes," Gish said, his face cracking a big grin below his bald dome. Now when he goes to training, he recognizes the same overwhelmed look on the faces of newbies.

In this field, training is key. Tracking files exchanged by child pornographers used to take weeks. Now it takes days.

"I still have a basis of knowledge for classes I attended four years ago," Gish said. "Do all of those practices stay in place? No. Because every time the iPhone changes, we have to change."

But Gish hasn't only had to train himself. Each time anyone from the unit wants to search a suspect's phone or tablet or computer, they first need a judge's permission.

"I think the judges learn something about digital forensics and digital data every time we go talk to them," the detective said. "Many judges want us to explain, how did you get this and what does it mean?"

Dream career

Gish wanted to be a police officer since he was young and interacted with two officers who lived in the neighborhood.

"I saw the good things that they did," he said. "They took me under their wing a little bit, being a neighborhood kid."

Gish and Colie, whom he would later marry, went to the same high school in Henderson, Ky. Though their circles overlapped, they did not meet until he was 23. She was 21.

She was working in a bank, and he came in each week to cash his paycheck. One day, he asked her to lunch.

"He ate the other half of my sandwich," Colie Gish said with a laugh. "He said, 'Hey, are you going to finish that?' It's like he finished my sandwich and he took my heart."

Major life moments from then on seemed to coincide with developments in Gish's career.

Gish graduated from the police academy four days after the couple's first son, now 16, was born. He transferred to the armed robbery unit at Metro police the year his middle son was born, and then to the surveillance unit the year his daughter was born.

"We always joke you better be happy with your job, because I'm not having any other children," said Colie, who stayed home when the children were younger but now works fulltime at a Vanderbilt University medical clinic.

On weekends, Gish golfs with his youngest son or talks plot lines with his oldest, who goes to an art school. The family takes a Saturday trip or gathers around the table for a meal together. They discuss each others' days, but when it's Gish's turn, there is not a lot of detail.

"They all know if something gets down to this unit, someone got hurt real bad," Gish said.

Gish sometimes misses dinners, misses tucking in his kids.

One night about a year and a half ago, Colie rolled over in bed about 3 a.m. and found the other side empty. She called her husband.

"He's like, 'I got it, I got it. '"

'Gut feeling'

It was the breakthrough moment in the Vanderbilt rape investigation.

It was about a week after the case first landed on detectives' desks downtown.

In days earlier, Vanderbilt University police were looking at surveillance video trying to determine how a dormitory door was damaged. They saw a man carrying a woman who looked to be unconscious into a room. There were three other men with them.

Vanderbilt police called Metro Sgt. Mike Shreeve on June 26, 2013.

He and Detective Jason Mayo interviewed the woman the same day. She did not remember what happened.

But it was not case-closed.

"Honestly, experience, that gut feeling told you there's something here," Shreeve said. "We just didn't know what it was yet."

On surveillance video turned over by the university, the detectives saw one man appearing to take pictures of the incapacitated woman. The next day, the detectives went and got cellphones from the woman, four football players in the video and another player who lived in the room.

Using timestamps on the surveillance video as a guide, Gish began looking for information on the cellphones. On July 1 and 2, 2013, Gish, Mayo and Shreeve spent 18-hour days at the police station. Gish pulled a half-million text messages from the phones, and the trio sorted through them.

On one man's phone, Gish found messages about a "gang bang" and "she could call rape." He found indicators that pictures had been sent and calls made. But there was a gap: No photos taken during the time of the rape were on the phones.

Late on July 3, 2013, Gish was sitting in the lab, slightly stumped, thinking about how to get those pictures. He was looking at his own phone, at pictures of his daughter, when the thumbnails caught his eye.

He returned to the then-suspects' phones, using technology to pull deleted images — "artifacts" — from the phones' thumbnail databases. He found 30 graphic images of the rape.

Detectives spent four days in California collecting more evidence from a computer the suspects had tried to wipe clean. Eighteen months later, Gish took two steps up to the witness stand in Courtroom 5A of the criminal courthouse in downtown Nashville.

His daughter picked out the tie he would wear that day.

Norman, the prosecutor, asked him to identify the people in the images and describe the actions in them. Gish spoke slowly, hesitated, his voice dropped.

"About every fifth image, I could feel myself wanting, could this be over?," Gish recalled.

He looked at the victim and Don Aaron, the department's spokesman, who were in the courtroom.

"I saw both of them there, it just kind of gave me strength to go on and do this," Gish said. "That was the hardest thing I've ever had to do, to describe those images."

The verdict came down 11 days later: Guilty on all 16 counts.

Gish went home, and his oldest son came running down the stairs. He knew. They exchanged a high-five.

The rape victim called Gish, Mayo and Shreeve her heroes.

"We'd like to be heroes to anybody that's involved in a crime," Gish said. "The drive is not for us at all. This was a very important case, but in sex crime cases and child porn cases, every single victim is important."

Reach Stacey Barchenger at 615-726-8968 or on Twitter @sbarchenger.

The team

One of the smallest units within Metro Nashville police is the surveillance and investigative support unit. The unit specializes in recovering digital evidence. Normally made up of four detectives, one position is vacant because of a recent retirement. Gish works in the unit along with:

Detective Jason Moyer

•15-year department veteran with eight years in the unit

•Specializes in video, audio and IP/analog camera systems

•Hundreds of hours of training in digital forensics, video and audio clarification and camera systems

Detective Jeff Weaver

•30-year department veteran with nine years in the unit

•Specializes in video, audio and mobile devices

•Hundreds of hours of training in digital forensics, video and audio clarification and mobile device extraction and repair