Cloud forensics–Tool development studies & future outlook

In this work, we describe our experiences in developing cloud forensics tools and use them to support three main points:First, we make the argument that cloud forensics is a qualitatively different problem. In the context of SaaS, it is incompatible with long-established acquisition and analysis techniques, and requires a new approach and forensic toolset. We show that client-side techniques, which are an extension of methods used over the last three decades, have inherent limitations that can only be overcome by working directly with the interfaces provided by cloud service providers.Second, we present our results in building forensic tools in the form of three case studies: kumodd–a tool for cloud drive acquisition, kumodocs–a tool for Google Docs acquisition and analysis, and kumofs–a tool for remote preview and screening of cloud drive data. We show that these tools, which work with the public and private APIs of the respective services, provide new capabilities that cannot be achieved by examining client-side artifacts.Finally, we use current IT trends, and our lessons learned, to outline the emerging new forensic landscape, and the most likely course of tool development over the next five years.     

Information assurance in a distributed forensic cluster

When digital forensics started in the mid-1980s most of the software used for analysis came from writing and debugging software. Amongst these tools was the UNIX utility ‘dd’ which was used to create an image of an entire storage device. In the next decade the practice of creating and using ‘an image’ became established as a fundamental base of what we call ‘sound forensic practice’. By virtue of its structure, every file within the media was an integrated part of the image and so we were assured that it was wholesome representation of the digital crime scene. In an age of terabyte media ‘the image’ is becoming increasingly cumbersome to process, simply because of its size. One solution to this lies in the use of distributed systems. However, the data assurance inherent in a single media image file is lost when data is stored in separate files distributed across a system. In this paper we assess current assurance practices and provide some solutions to the need to have assurance within a distributed system.     

中国公证制度的完善

世界两大公证体系的差别 ,实质上是不同国家对于公证制度功能预期的差异。学习、借鉴国外的经验 ,必须从我国的政治、经济社会制度和公证制度的现实基础出发 ,革除现行以大陆法系的独立、专职的强势公证组织形式与英美法系的弱势公证职能相搭配的体制弊端 ,通过公证立法 ,强化公证职能与法律效力 ,以实现其与强势公证组织形式的内在机制平衡和功能协调 ,赋予并完善我国公证制度在经济与社会生活中的适度干预功能。     

WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages

WhatsApp is a widely adopted mobile messaging application with over 800 million users. Recently, a calling feature was added to the application and no comprehensive digital forensic analysis has been performed with regards to this feature at the time of writing this paper. In this work, we describe how we were able to decrypt the network traffic and obtain forensic artifacts that relate to this new calling feature which included the: a) WhatsApp phone numbers, b) WhatsApp server IPs, c) WhatsApp audio codec (Opus), d) WhatsApp call duration, and e) WhatsApp's call termination. We explain the methods and tools used to decrypt the traffic as well as thoroughly elaborate on our findings with respect to the WhatsApp signaling messages. Furthermore, we also provide the community with a tool that helps in the visualization of the WhatsApp protocol messages.     

Mapping the development of China's data protection law: Major actors,core values,and shifting power relations

This Article seeks to map the possible paths of the development of China's data protection law by examining the changing power relations among three major actors - the State, digital enterprises and the public in the context of China's booming data-driven economy. We argue that focusing on different core values, these three major actors are the key driving forces shaping China's data protection regime. Their dynamic and multidimensional power relations have been casting the development of China's data protection law with various uncertainties. When persuing different, yet not always conflicting values, these three major actors may both cooperate and compete with each other. Based on our careful analysis of the shifting power relations, we identify and assess three possible paths of the development of China's data protection law. We are much concerned that the proposed comprehensive data protection law might be a new attempt of the State to win legitimacy abroad, while actually trying to reinforce massive surveillance besides economic goals. We argue that a modest alternative may be that this law might show some genuine efforts for protecting data privacy, but still with poor enforcement. Last, we argue that the most desirable development would be that this law could provide basic but meaningful and effective protection for data privacy, and lay a good foundation for further development.     

Encryption: A 21st Century National Security Dilemma

As the 21st century approaches, encryption is presenting a national security dilemma in the US. While the use of strong encryption for computerized data is essential in protecting our nation, widespread, unregulated encryption poses serious problems on two levels: encryption could inhibit the government's ability to enforce the law as well as gather foreign intelligence. As a result, the government has established export controls on encryption products and proposed a 'key recovery' system designed to enable law enforcement officers to access encrypted data in the course of lawful investigations. The export controls have been ineffective and counterproductive policy and are arguably unconstitutional under the First Amendment. However, export controls are the only viable solution to the intelligence gathering problem and will need to survive these political and legal attacks or our national security could be jeopardized. Key recovery will be difficult and costly to implement and has come under attack by civil liberties' groups. Nevertheless, a cost-effective compromise on key recovery is necessary to meet the needs of law enforcement. Such a system, if it mirrored current electronic surveillance law, would effectively balance individual privacy rights and governmental interests and thus should survive constitutional scrutiny. Congress and President Clinton ought to enact key recovery legislation soon before the use of encryption becomes commonplace. A failure to act intelligently and effectively on this critical, cutting-edge issue could compromise our nation's future.     

Nash bargaining solutions for international climate agreements under different sets of bargaining weights

Bargaining is a tool to share collaborative gains and to facilitate reaching agreement. To improve incentives to join an international climate agreement (ICA), the Nash bargaining solution can be used to distribute cooperative gains across signatories. In this paper, we examine how the formation of ICAs and their mitigation efficiency are impacted by the use of the Nash bargaining solution. In a Nash bargaining game with heterogeneous players, bargaining powers are unequal and may be driven by different characteristics of the players. We employ different sets of asymmetric bargaining weights in order to examine the effectiveness of climate coalitions that emerge as stable agreements. Using the Nash bargaining solution, we obtain results from the stability of coalition model (STACO). We find that the Nash bargaining solution can improve the participation incentives and performances of ICAs as compared to agreements that do not redistribute gains from cooperation, but its capacity to overcome free-riding incentives is limited. However, if Nash bargaining accounts for outside options of players, we find larger stable coalitions and higher global abatement levels. In fact, Nash bargaining with outside options can stabilise the largest coalitions that can possibly be stable in our game.     

IMPROVING THE ENFORCEMENT OF RESTRAINING ORDERS AFTER CASTLE ROCK V. GONZALES*

After the U.S. Supreme Court's decision in Castle Rock, reliance on domestic violence restraining orders does not offer the solution in and of itself. Our legal system needs to provide greater protection for victims of domestic violence. This note explores ways to use risk assessment tools to augment restraining orders, in addition to examining integrated domestic violence courts that take a proactive approach to aiding victims of abuse.     

Forensic discovery auditing of digital evidence containers

Current digital forensics methods capture, preserve, and analyze digital evidence in general-purpose electronic containers (typically, plain files) with no dedicated support to help establish that the evidence has been properly handled. Auditing of a digital investigation, from identification and seizure of evidence through duplication and investigation is, essentially, ad hoc, recorded in separate log files or in an investigator's case notebook. Auditing performed in this fashion is bound to be incomplete, because different tools provide widely disparate amounts of auditing information – including none at all – and there is ample room for human error. The latter is a particularly pressing concern given the fast growth of the size of forensic targets.Recently, there has been a serious community effort to develop an open standard for specialized digital evidence containers (DECs). A DEC differs from a general purpose container in that, in addition to the actual evidence, it bundles arbitrary metadata associated with it, such as logs and notes, and provides the basic means to detect evidence-tampering through digital signatures. Current approaches consist of defining a container format and providing a specialized library that can be used to manipulate it. While a big step in the right direction, this approach has some non-trivial shortcomings – it requires the retooling of existing forensic software and, thereby, limits the number of tools available to the investigator. More importantly, however, it does not provide a complete solution since it only records snapshots of the state of the DEC without being able to provide a trusted log of all data operations actually performed on the evidence. Without a trusted log the question of whether a tool worked exactly as advertised cannot be answered with certainty, which opens the door to challenges (both legitimate and frivolous) of the results.In this paper, we propose a complementary mechanism, called the Forensic Discovery Auditing Module (FDAM), aimed at closing this loophole in the discovery process. FDAM can be thought of as a ‘clean-room’ environment for the manipulation of digital evidence, where evidence from containers is placed for controlled manipulation. It functions as an operating system component, which monitors and logs all access to the evidence and enforces policy restrictions. This allows the immediate, safe, and verifiable use of any tool deemed necessary by the examiner. In addition, the module can provide transparent support for multiple DEC formats, thereby greatly simplifying the adoption of open standards.     

Lost in registration? Missing occupations of single women in the Bruges countryside,c.1814

The absence of occupational titles for women in historical censuses has stymied numerous scholars. Various authors have explained this phenomenon as carelessness or bias on the part of the census-takers. Women's work was of little interest to the authorities and census officials focused their efforts upon the activities of the head of household. While source triangulation can be a useful tool for uncovering ‘hidden’ employment of women, it is often a complex and time-consuming process. In this article we outline an alternative to deal with the issue of missing occupations of single women in censuses by exploring their living arrangements. We identify four aspects of co-residence that can highlight the roles played within the household by single women without registered employment: their relation to the head of the household, and that individual's occupation, property and marital status. Comparing data from the 1814 population census regarding two social agro-systems and the city of Bruges, we argue that occupational titles of single women were not randomly omitted by the census officials, but reflect the embeddedness of these women in the family economy and household. While we do not refute recent research that stresses single women's economic independence during the long eighteenth century, our findings suggest that for a subset of singles this was not the case. We claim that by studying registered labour only, the historical picture of single women's work is biased or at the very least incomplete.     

Addressing Infant and Toddler Issues in the Juvenile Court: Challenges for the 21st Century

To achieve the goal of permanency for children in the child welfare system, it is critical that different disciplines work together, improve communication, and understand each other's role and expertise in the process. Through a case study, this article attempts to show the problems, conflicts, and solutions in working to ensure a child's best interests from three points of view: a children's attorney from New York City, a judge from Miami, Florida, and an infant mental health specialist and interdisciplinary trainer from Los Angeles. First, we propose that emotional caregiving is a fundamental right of all children and includes a stable, nurturing, and permanent long‐term relationship. Conflicts between the timing of children's needs, parents' needs, and the judge's legal duties are discussed as a tension with which we all must struggle to resolve if we are to successfully address children's “irreducible needs” (Brazelton & Greenspan, 2000). If the provision of custodial care shifts toward including emotional care as a goal for the growing number of infants entering the foster care system, the ensuing conflicts will provide opportunities for all parts of the foster care system—including the courts—to rethink how infants' needs are evaluated and factored into decision making.     

Competence in caring in legal practice

This article is concerned with the stories of female solicitors working in Queensland, Australia, and their account of ethics in practice. These narratives were sought and made in the context of our project investigating complaints received against practitioners in this jurisdiction. Our interviews with female lawyers were intended to provide more insight into complaints matters. Yet this discussion revealed broader insights into ethical questions about the nature of lawyer–client relationships and legal professionalism. This article considers these accounts by reflecting on the concept of ‘care’ and its fit with legal practice requirements today. In doing so, we consider the difficult gendered question of the relationship between caring and ‘women's’ practice. We do not assert a true woman's working style; we seek to contextualise our empirical research by tracing the complex effect of gender on lawyering roles. Finally, we suggest that the adoption of caring practice is a valid approach to lawyering and call for a caring approach to be re-valued in the legal professional context as an ethical proposition.     

SELF-INTEREST,EQUITY, AND CRIME CONTROL: A GAME-THEORETIC ANALYSIS OF CRIMINAL DECISION MAKING

Employing the analytic technique of game theory, we attempt to answer questions about how individuals with different proclivities to use crime to accomplish ends, and different beliefs about society's fairness, are likely to respond to different incentives and disincentives that are derived from strain and neoclassical deterrence theories. Our analysis indicates that the crime control policies typically recommended by adherents of both theories are often logically invalid, given the premises upon which they are supposedly based. For example, our analysis suggests why punishment strategies like “three strikes and you're out” and “entitlement strategies” such as welfare and other short-term redistributive payment programs fail to deter crime. Finally, after including notions of equity with traditional rational choice assumptions, our analysis identifies a mix of theoretically derived strategies that may more effectively deter crime.     

The use of hair as a toxicological tool in DFC casework

When drugging related offences are cited, most people think of sexual assault. However, the law covers any crime committed whilst the complainant is under the influence of alcohol or drugs i.e. the use of a drug to modify a person's behaviour for criminal gain. The case types encountered include robbery, blackmail and of course sexual offences.Hair analysis for drugs is now well established in Forensic Toxicology. Its use as an analytical tool in workplace testing, post-mortem toxicology and criminal cases is expanding both in the UK and worldwide, and it is now widely accepted as an alternative or complimentary matrix for these cases. This paper will provide a brief overview of hair testing in cases of Drug Facilitated Crime stressing the importance of timely sample collection. Its usefulness in cases of this type will be highlighted through case examples.     

Identification of furosemide in hair in a post‐mortem case by UHPLC‐MS/MS with guidance on interpretation

Testing for drugs in hair raises several difficulties. Among them is the interpretation of the final concentration(s). In a post‐mortem case, analyses revealed the presence of furosemide (12 ng/mL) in femoral blood, although it was not part of the victim's treatment. The prosecutor requested our laboratory to undertake an additional analysis in hair to obtain information about the use of furosemide. A specific method was therefore developed and validated to identify and quantify furosemide in hair by UHPLC‐MS/MS. After decontamination of 30 mg of hair, incubation in acidic condition, extraction with ethyl acetate, the samples were analyzed by UHPLC‐MS/MS. Furosemide was found in the victim's hair at 225 pg/mg. However, it was not possible to interpret this concentration due to the absence of data in the literature. Therefore, the authors performed a controlled study in two parts. In order to establish the basis of interpretation, several volunteers were tested (four after a single 20 mg administration and twenty‐four under daily treatment). The first part indicated that a single dose is not detectable in hair using our method. The second part demonstrated concentrations ranging from 5 to 1110 pg/mg with no correlation between dosage and hair concentrations. The decedent's hair result was interpreted as repeated exposures. In the case of furosemide analysis, hair can provide information about its presence but cannot give information about dosage or frequency of use.     

Alf Ross on the Concept of a Legal Right

In this article, I discuss Alf Ross's claim that the concept of a legal right is best understood as a technical tool of presentation, which ties together a disjunction of operative facts and a conjunction of legal consequences, and that rights statements render the content of a number of legal norms in a convenient manner. I argue that while Ross's analysis is appealing, it is problematic in at least three respects. I also argue, however, that despite these difficulties Ross's analysis deserves our continued attention, because the fundamental idea—that the concept of a legal right must be understood functionally—is sound.     

Embracing Wikipedia as a research tool for law: to Wikipedia or not to Wikipedia?

Useful aspects of Wikipedia should be embraced as a research tool. Arguments are based upon a consideration of Wikipedia's purpose; policies and controlling mechanisms; commentator views on and academic use of Wikipedia as a teaching and learning tool; the fact that empirical research has found students will use Wikipedia. The results of a survey on the research preferences of a range of students engaged in various levels of legal study, from senior secondary school to second year law students, are presented and recommendations regarding educating students in the appropriate use of Wikipedia for research are made.     

PARENTS AND DRUGS REVISITED: SOME FURTHER EVIDENCE IN SUPPORT OF SOCIAL LEARNING THEORY*

Social control and social learning theories suggest divergent relationships between attachment to parents and children's drug use when level of parent drug use is considered. Social control theory proposes a uniformly negative relationship between children's drug use and attachment to parents whereas social learning theory proposes that the relationship is affected by parental drug use. The relationship between attachment to parents and children's drug use was investigated for each of three groups of low, moderate, and high parental drug use through estimation of a latent variable structural model of attachment to family on children's tobacco, alcohol, and marijuana use. Results indicate that attachment to parents related inversely, but with different magnitudes, to children's drug use for youths whose parents use drugs at low or moderate levels. No significant relationship exists between attachment to family and children's drug use for youths whose parents are relatively high-level users. Neither ethnicity nor sex affected these findings. The implications of these results supporting social learning theory are discussed.     

Effects of collaborative recall: Denying true information is as powerful as suggesting misinformation

We tested whether someone's ability to tell a good story, in terms of the Reality Monitoring (RM) tool, affects the way s/he judges the stories told by others. Forty participants (undergraduate students) wrote down two statements – one about activities they did 30 minutes ago, and the other about a past event. Subsequently, they rated the quality of a target statement written by someone else. We found that the tendency to provide a not so detailed or a very detailed statement was stable across the two statements the participants wrote. Furthermore, this tendency affected how they judged the target statements: The richer a participant's statements were compared to the target statement, the more critical the participant was in judging the target statement. These findings imply that RM is subject to biases which are related to individual differences. We discuss the implications of these findings for applying the RM lie detection tool in the field.     

Accounting for the "Second Assault": Legal Organizations'Framing of Rape Victims

What organizational and community conditions influence legal officials to treat rape victims “unresponsively”? Our analysis is guided by Goffman's theory of organizational frameworks and frames of activity and March and Olsen's institutional theory of organizations. Using data from 130 m-organizations in Florida that process rape cases, we compare six types of organizations (including hospital emergency rooms and rape crisis centers) on eight criteria and review their frameworks and frames of activity relative to unresponsiveness. We use the issue of victim legitimacy to illustrate the utility of our model. Our results show that well-meaning staff in legal organizations are oriented to routinely treat victims unresponsively. Their organizations routinely orient them to be concerned with, for example, public approval, the avoidance of losing, and expediency more than with victims' needs. In our conclusion, we identify ways legal officials and rape crisis centers can promote responsive treatment of victims. We also call for research on legal organizations that are responsive to victims and for a nationwide discourse on the “politics of rape victims' needs” as a means of addressing the gender inequality issues that underlie rape crimes and laws and orient legal officials to treat victims unresponsively .