录音设备识别司法鉴定技术研究

目标随着手机和录音笔等数字录音设备的普及,数字录音已基本取代传统的模拟录音,成为录音司法鉴定主导性检材类型。数字录音资料作为视听资料的重要组成部分,其真实性司法鉴定新技术新方法的研究具有重要的理论意义和实际应用价值。方法研究基于录音设备识别的数字录音真实性鉴定技术,通过数字录音背景噪声片段的提取,计算录音设备相关的关键统计特征,包括采样直方图分布特征和平均频谱统计特征,并使用机器学习和模式分类方法对数字录音的载体即录音设备进行准确分类。结果实验中最高的分类准确性达到97.09%。在录音设备可分性研究成果基础上,提出应用于数字录音设备司法鉴定的可行实施方案。结论研究结果表明了基于信号统计特征分析的录音设备识别方法的可行性和准确性。     

数字录音真实性司法鉴定研究现状

随着数字录音设备的普及,以及音频编辑技术的大众化趋势,传统的检验方法和技术在当前数字录音真实性司法鉴定实践中面临着极大的挑战。模式识别和人工智能等领域的最新进展为数字录音真实性鉴定提供了有效的检验角度。通过分析和总结当前机器学习和模式识别等研究领域在数字录音真实性研究方面的前沿探索性成果,结合对当前录音真实性司法鉴定实践应用中的关键技术和方法的论述,分析和探讨数字录音真实性司法鉴定领域研究所面临的问题、挑战及未来发展趋势。指出专家经验判断分析技术和统计量化检验方法的协作并存是数字录音真实性鉴定的必然趋势和高效解决方案。     

An inconclusive digital audio authenticity examination: a unique case

This case report sets forth an authenticity examination of 35 encrypted, proprietary-format digital audio files containing recorded telephone conversations between two codefendants in a criminal matter. The codefendant who recorded the conversations did so on a recording system he developed; additionally, he was both a forensic audio authenticity examiner, who had published and presented in the field, and was the head of a professional audio society's writing group for authenticity standards. The authors conducted the examination of the recordings following nine laboratory steps of the peer-reviewed and published 11-step digital audio authenticity protocol. Based considerably on the codefendant's direct involvement with the development of the encrypted audio format, his experience in the field of forensic audio authenticity analysis, and the ease with which the audio files could be accessed, converted, edited in the gap areas, and reconstructed in such a way that the processes were undetected, the authors concluded that the recordings could not be scientifically authenticated through accepted forensic practices.     

Application of the Electrical Network Frequency (ENF) Criterion. A case of a digital recording

One of the new methods of investigating the authenticity of evidential digital audio recordings uses the Electrical Network Frequency (ENF) Criterion. It is based on analysing the signal corresponding to the fundamental frequency of the current in the electrical network, which is present in a recording and comparing it with appropriate, reliable reference. Studies carried out at the Institute of Forensic Research in Cracow were aimed at validating this method, that is, assessing its usefulness in forensic examinations of evidential digital recordings in Poland. These studies enabled us to develop and implement a procedure for using the ENF Criterion method to assess the integrity of digital recordings and to establish when these recordings were made.     

Study on the standard components of digital forensics laboratory

Recently, digital forensics has become increasingly important as it is used by investigation agencies, corporate, and private sector. To supplement the limitations of evidence capacity and be recognized in court, it is essential to establish an environment that ensures the integrity of the entire process ranging from collecting and analyzing to submitting digital evidence to court. In this study, common elements were extracted by comparing and analyzing ISO/IEC 17025, 27001 standards and Interpol and Council of Europe (CoE) guidelines to derive the necessary components for building a digital forensic laboratory. Subsequently, based on 21 digital forensic experts in the field, Delphi survey and verifications were conducted in three rounds. As a result, 40 components from seven areas were derived. The research results are based on the establishment, operation, management, and authentication of a digital forensics laboratory suitable for the domestic environment, with added credibility through collection of the opinions of 21 experts in the field of digital forensics in Korea. This study can be referred to in establishing digital forensic laboratories in national, public, and private digital forensic organizations as well as for employing as competency measurement criteria in courts to evaluate the reliability of the analysis results.     

The Average Direct Current Offset Values for Small Digital Audio Recorders in an Acoustically Consistent Environment

In this research project, nine small digital audio recorders were tested using five sets of 30‐min recordings at all available recording modes, with consistent audio material, identical source and microphone locations, and identical acoustic environments. The averaged direct current (DC) offset values and standard deviations were measured for 30‐sec and 1‐, 2‐, 3‐, 6‐, 10‐, 15‐, and 30‐min segments. The research found an inverse association between segment lengths and the standard deviation values and that lengths beyond 30 min may not meaningfully reduce the standard deviation values. This research supports previous studies indicating that measured averaged DC offsets should only be used for exclusionary purposes in authenticity analyses and exhibit consistent values when the general acoustic environment and microphone/recorder configurations were held constant. Measured average DC offset values from exemplar recorders may not be directly comparable to those of submitted digital audio recordings without exactly duplicating the acoustic environment and microphone/recorder configurations.     

法庭语音学

本文对法庭语音学进行了研究综述,主要介绍了该学科的核心内容：说话人鉴定。在实际办案中,当未找到嫌疑人,只有犯罪分子的检材语音时,可以使用说话人画像/说话人分类技术。若没有犯罪分子的录音证据时,可以让受害人和证人进行说话人的听觉辨认。具体的辨认形式有两种：对熟人辨认和对陌生人辨认,在对陌生人辨认时可以采用语音辨认的方法进行。当检材语音和样本语音都齐备的时候,法庭语音分析专家就可以对二者进行比对检验了。目前语音比对分析涉及到的问题和领域有：基于贝叶斯方法的法庭推理和似然比计算、共振峰频率的测量应用、非解析感知与样例理论、法庭说话人自动识别以及不同方法的综合应用等。     

Voicing concerns: The balance between data protection principles and research developments in forensic speech science

The status of forensic speech recordings among existing data protection guidance is not clear. The inherent nature of voice and the way in which forensic speech casework is currently allocated mean that there are additional barriers to incorporating real casework data into research activities. The key objective of this work is to explore data protection solutions that could enable the forensic speech science community to responsibly use real casework data for research and development purposes. While reviewing relevant guidance and rulings, issues such as proportionality, opportunism and data minimisation are addressed, as well as where voice sits in relation to the definition of “biometric data”. This paper ultimately places forensic speech recordings in the data protection context to illuminate the specific issues that arise for this data type.     

Advanced Framework for Digital Forensic Technologies and Procedures*

Abstract: Recent trends in global networks are leading toward service‐oriented architectures and sensor networks. On one hand of the spectrum, this means deployment of services from numerous providers to form new service composites, and on the other hand this means emergence of Internet of things. Both these kinds belong to a plethora of realms and can be deployed in many ways, which will pose serious problems in cases of abuse. Consequently, both trends increase the need for new approaches to digital forensics that would furnish admissible evidence for litigation. Because technology alone is clearly not sufficient, it has to be adequately supported by appropriate investigative procedures, which have yet become a subject of an international consensus. This paper therefore provides appropriate a holistic framework to foster an internationally agreed upon approach in digital forensics along with necessary improvements. It is based on a top‐down approach, starting with legal, continuing with organizational, and ending with technical issues. More precisely, the paper presents a new architectural technological solution that addresses the core forensic principles at its roots. It deploys so‐called leveled message authentication codes and digital signatures to provide data integrity in a way that significantly eases forensic investigations into attacked systems in their operational state. Further, using a top‐down approach a conceptual framework for forensics readiness is given, which provides levels of abstraction and procedural guides embellished with a process model that allow investigators perform routine investigations, without becoming overwhelmed by low‐level details. As low‐level details should not be left out, the framework is further evaluated to include these details to allow organizations to configure their systems for proactive collection and preservation of potential digital evidence in a structured manner. The main reason behind this approach is to stimulate efforts on an internationally agreed “template legislation,” similarly to model law in the area of electronic commerce, which would enable harmonized national implementations in the area of digital forensics.     

Digital behavioral-fingerprint for user attribution in digital forensics: Are we there yet?

the need for a reliable and complementary identifier mechanism in a digital forensic analysis is the focus of this study. Mouse dynamics have been applied in information security studies, particularly, continuous authentication and authorization. However, the method applied in security is void of specific behavioral signature of a user, which inhibits its applicability in digital forensic science. This study investigated the likelihood of the observation of a unique signature from mouse dynamics of a computer user. An initial mouse path model was developed using non-finite automata. Thereafter, a set-theory based adaptive two-stage hash function and a multi-stage rule-based semantic algorithm were developed to observe the feasibility of a unique signature for forensic usage. An experimental process which comprises three existing mouse dynamics datasets were used to evaluate the applicability of the developed mechanism. The result showed a low likelihood of extracting unique behavioral signature which can be used in a user attribution process. Whilst digital forensic readiness mechanism could be a potential approach that can be used to achieve a reliable behavioral biometrics modality, the lack of unique signature presents a limitation. In addition, the result supports the logic that the current state of behavioral biometric modality, particularly mouse dynamics, is not suitable for forensic usage. Hence, the study concluded that whilst mouse dynamics-based behavioral biometrics may be a complementary modality in security studies, more will be required to adopt it as a forensic modality in litigation. Furthermore, the result from this study finds relevance in other human attributional studies such as user identification in recommender systems, e-commerce, and online profiling systems, where the degree of accuracy is not relatively high.     

Proposing Problem-Based Learning for teaching future forensic speech scientists

In the last 10–15 years, Masters programmes and undergraduate modules have emerged in the UK that teach forensic speech science. Forensic speech science is the forensic subdiscipline concerned with analysing speech recordings, such as telephone calls of unknown speakers, when they arise as evidence. In order to answer questions surrounding the identity of the speakers in these recordings, forensic speech analysts draw on their expertise in phonetics and acoustics. Even though existing UK forensic speech science programmes do not claim to train students to a level where they are in a position to carry out real-life forensic casework, a proportion of the graduates from these programmes do go on to fill discipline-specific roles in security organisations or for private providers of forensic speech analysis. It is therefore surely in the community’s interests to review educational approaches to capitalise on the current training opportunities. This paper specifically proposes to explore the potential of a Problem-Based Learning (PBL) approach to forensic speech science teaching. PBL is a student-centred learning approach that heavily relies on the students’ independence in the solving of ill-structured problems. PBL has shown to be beneficial to programmes that directly lead on to discipline-specific professional roles, and has even become the standardised teaching approach in some of those areas (medicine being the flagship example). Given its reported success in other disciplines, the question arises as to whether PBL could bring similar benefits to prospective forensic speech practitioners and to forensic speech science as a whole.     

司法鉴定援助制度研究

鉴定结论作为三大诉讼法规定的法定证据之一,在诉讼中有着举足轻重的地位。《全国人民代表大会常务委员会关于司法鉴定管理问题的决定》实施后,对需要司法鉴定的弱势群体进行司法鉴定援助已成当务之急。本文从司法鉴定援助的基本概念、基础理论等方面作了分析,并对司法鉴定援助制度作了初步设想,以期对我国的司法鉴定改革有所裨益。     

A New Anti‐forensic Scheme—Hiding the Single JPEG Compression Trace for Digital Image

To prevent image forgeries, a number of forensic techniques for digital image have been developed that can detect an image's origin, trace its processing history, and can also locate the position of tampering. Especially, the statistical footprint left by JPEG compression operation can be a valuable source of information for the forensic analyst, and some image forensic algorithm have been raised based on the image statistics in the DCT domain. Recently, it has been shown that footprints can be removed by adding a suitable anti‐forensic dithering signal to the image in the DCT domain, this results in invalid for some image forensic algorithms. In this paper, a novel anti‐forensic algorithm is proposed, which is capable of concealing the quantization artifacts that left in the single JPEG compressed image. In the scheme, a chaos‐based dither is added to an image's DCT coefficients to remove such artifacts. Effectiveness of both the scheme and the loss of image quality are evaluated through the experiments. The simulation results show that the proposed anti‐forensic scheme can verify the reliability of the JPEG forensic tools.     

Taxonomy of Challenges for Digital Forensics

Since its inception, over a decade ago, the field of digital forensics has faced numerous challenges. Despite different researchers and digital forensic practitioners having studied and analysed various known digital forensic challenges, as of 2013, there still exists a need for a formal classification of these challenges. This article therefore reviews existing research literature and highlights the various challenges that digital forensics has faced for the last 10 years. In conducting this research study, however, it was difficult for the authors to review all the existing research literature in the digital forensic domain; hence, sampling and randomization techniques were employed to facilitate the review of the gathered literature. Taxonomy of the various challenges is subsequently proposed in this paper based on our review of the literature. The taxonomy classifies the large number of digital forensic challenges into four well‐defined and easily understood categories. The proposed taxonomy can be useful, for example, in future developments of automated digital forensic tools by explicitly describing processes and procedures that focus on addressing specific challenges identified in this paper. However, it should also be noted that the purpose of this paper was not to propose any solutions to the individual challenges that digital forensics face, but to serve as a survey of the state of the art of the research area.     

Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

Abstract: There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in‐depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three‐tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation.     

完善司法鉴定制度是科学证据时代的呼唤

司法鉴定是现代司法证明活动中查明案件事实的一种重要方法和手段.现代司法鉴定是司法证明方法进步的结果和体现.科学技术的进步使司法证明方法发生了两次重大的转变.以物证及其相关的鉴定结论等证据构成的"科学证据",应该成为司法证明最主要的手段.物证虽然是客观实在的,但其自身不能直接证明案件事实,需要人们的认识.司法鉴定是人们认识物证的途径.司法鉴定水平的提高可以帮助发现更多潜在的证据.科学技术是司法鉴定的生命.科学技术的进步是促进司法鉴定发展的最重要因素.司法鉴定制度改革应与审判体制改革相适应.司法鉴定制度改革应与证据法律制度相协调,既要赋予法官对鉴定结论的自由裁量权,又要对司法鉴定制度进行规范.司法鉴定制度改革应以提供"科学证据"为出发点,需要鉴定人出庭、技术方法标准化和建立行业协会等措施.     

司法鉴定改革：社会价值与发展方向

司法鉴定改革已经走过了极不平凡的十余年。全国人大常委会《关于司法鉴定管理问题的决定》（以下简称《决定》）实施以来。司法鉴定事业有了很大的发展，取得了可喜的成果。本文就司杀鉴定改革的社会价值与发展方向进行了有益的探索。展示了司法鉴定改革对其他社会改革的启迪价值。     

Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.