Placing the suspect at a PC: A preliminary study involving fingerprints on keyboards and mice

Digital devices now play an important role in the lives of many in society. Whilst they are used predominantly for legitimate purposes, instances of digital crime are witnessed, where determining their usage is important to any criminal investigation. Typically, when determining who has used a digital device, digital forensic analysis is utilised, however, biological trace evidence or fingerprints residing on its surfaces may also be of value. This work provides a preliminary study which examines the potential for fingerprint recovery from computer peripherals, namely keyboards and mice. Our implementation methodology is outlined, and results discussed which indicate that print recovery is possible. Findings are intended to support those operating at-scene in an evidence collection capacity.     

Triaging digital device content at-scene:- Formalising the decision-making process

The prominence of technology usage in society has inevitably led to increasing numbers of digital devices being seized, where digital evidence often features in criminal investigations. Such demand has led to well documented backlogs placing pressure on digital forensic labs, where in an effort to combat this issue, the ‘at-scene triage’ of devices has been touted as a solution. Yet such triage approaches are not straightforward to implement with multiple technical and procedural issues existing, including determining when it is actually appropriate to triage the contents of a device at-scene. This work remains focused on this point due to the complexities associated with it, and to support first responders a nine-stage triage decision model is offered which is designed to promote consistent and transparent practice when determining if a device should be triaged.     

Information assurance in a distributed forensic cluster

When digital forensics started in the mid-1980s most of the software used for analysis came from writing and debugging software. Amongst these tools was the UNIX utility ‘dd’ which was used to create an image of an entire storage device. In the next decade the practice of creating and using ‘an image’ became established as a fundamental base of what we call ‘sound forensic practice’. By virtue of its structure, every file within the media was an integrated part of the image and so we were assured that it was wholesome representation of the digital crime scene. In an age of terabyte media ‘the image’ is becoming increasingly cumbersome to process, simply because of its size. One solution to this lies in the use of distributed systems. However, the data assurance inherent in a single media image file is lost when data is stored in separate files distributed across a system. In this paper we assess current assurance practices and provide some solutions to the need to have assurance within a distributed system.     

The COLLECTORS ranking scale for ‘at‐scene’ digital device triage

As digital evidence now features prominently in many criminal investigations, such large volumes of requests for the forensic examination of devices has led to well publicized backlogs and delays. In an effort to cope, triage policies are frequently implemented in order to reduce the number of digital devices which are seized unnecessarily. Often first responders are tasked with performing triage at scene in order to decide whether any identified devices should be seized and submitted for forensic examination. In some cases, this is done with the assistance of software which allows device content to be “previewed”; however, in some cases, a first responder will triage devices using their judgment and experience alone, absent of knowledge of the devices content, referred to as “decision‐based device triage” (DBDT). This work provides a discussion of the challenges first responders face when carrying out DBDT at scene. In response, the COLLECTORS ranking scale is proposed to help first responders carry out DBDT and to formalize this process in an effort to support quality control of this practice. The COLLECTORS ranking scale consists of 10 categories which first responders should rank a given device against. Each devices cumulative score should be queried against the defined “seizure thresholds” which offer support to first responders in assessing when to seize a device. To offer clarify, an example use‐case involving the COLLECTORS ranking scale is included, highlighting its application when faced with multiple digital devices at scene.     

Defining event reconstruction of digital crime scenes

Event reconstruction plays a critical role in solving physical crimes by explaining why a piece of physical evidence has certain characteristics. With digital crimes, the current focus has been on the recognition and identification of digital evidence using an object's characteristics, but not on the identification of the events that caused the characteristics. This paper examines digital event reconstruction and proposes a process model and procedure that can be used for a digital crime scene. The model has been designed so that it can apply to physical crime scenes, can support the unique aspects of a digital crime scene, and can be implemented in software to automate part of the process. We also examine the differences between physical event reconstruction and digital event reconstruction.     

Swedish crime scene technicians: facilitations,epistemic frictions and professionalization from the outside

ABSTRACT

This article investigates the role of crime scene technicians in the Swedish criminal justice system, and particularly how Swedish crime scene technicians not only examine crime scenes but also facilitate the criminal justice system’s joint production of forensic evidence. It proposes thinking about the criminal justice system as a conglomeration of epistemic cultures, that is, of communities with different ways of producing and understanding forensic evidence. Such a perspective makes it possible to understand interprofessional frictions as epistemic frictions as well as to draw attention to the facilitations, mediations and translations that crime scene technicians perform. This perspective also makes it possible to illuminate how the crime scene technicians’ professionalization – a professionalization from the outside – affects both their future crime scene work and their facilitations.     

Decision support for using mobile Rapid DNA analysis at the crime scene

Mobile Rapid DNA technology is close to being incorporated into crime scene investigations, with the potential to identify a perpetrator within hours. However, the use of these techniques entails the risk of losing the sample and potential evidence, because the device not only consumes the inserted sample, it is also is less sensitive than traditional technologies used in forensic laboratories. Scene of Crime Officers (SoCOs) therefore will face a ‘time/success rate trade-off’ issue when making a decision to apply this technology.In this study we designed and experimentally tested a Decision Support System (DSS) for the use of Rapid DNA technologies based on Rational Decision Theory (RDT). In a vignette study, where SoCOs had to decide on the use of a Rapid DNA analysis device, participating SoCOs were assigned to either the control group (making decisions under standard conditions), the Success Rate (SR) group (making decisions with additional information on DNA success rates of traces), or the DSS group (making decisions supported by introduction to RDT, including information on DNA success rates of traces).This study provides positive evidence that a systematic approach for decision-making on using Rapid DNA analysis assists SoCOs in the decision to use the rapid device. The results demonstrated that participants using a DSS made different and more transparent decisions on the use of Rapid DNA analysis when different case characteristics were explicitly considered. In the DSS group the decision to apply Rapid DNA analysis was influenced by the factors “time pressure” and “trace characteristics” like DNA success rates. In the SR group, the decisions depended solely on the trace characteristics and in the control group the decisions did not show any systematic differences on crime type or trace characteristic.Guiding complex decisions on the use of Rapid DNA analyses with a DSS could be an important step towards the use of these devices at the crime scene.     

The persistence of memory: Forensic identification and extraction of cryptographic keys

The increasing popularity of cryptography poses a great challenge in the field of digital forensics. Digital evidence protected by strong encryption may be impossible to decrypt without the correct key. We propose novel methods for cryptographic key identification and present a new proof of concept tool named Interrogate that searches through volatile memory and recovers cryptographic keys used by the ciphers AES, Serpent and Twofish. By using the tool in a virtual digital crime scene, we simulate and examine the different states of systems where well known and popular cryptosystems are installed. Our experiments show that the chances of uncovering cryptographic keys are high when the digital crime scene are in certain well-defined states. Finally, we argue that the consequence of this and other recent results regarding memory acquisition require that the current practices of digital forensics should be guided towards a more forensically sound way of handling live analysis in a digital crime scene.     

论计算机取证相关问题——现场动态分析，获取“易挥发”数字证据

由于目前计算机专业取证人员数量的不足，当前司法实践中对于现场中正处于运行状态的计算机大多采用“二步式”取证的方式来搜集数字证据。即先由侦查人员对涉案计算机实施关机分离和保全。尔后再移交专业机构进行数字证据司法鉴定。这种方式虽然保障了数字证据的原始性和证明力。但无形之中造成了存储在RAM中的“易挥发”数据以及其他形式的潜在数字证据的丢失。而计算机信息系统中的这些“易挥发数据”可以为案件的侦破提供重要线索和潜在的数字证据。因此通过对侦查人员的专业培训．实现“易挥发数据”的现场动态获取和合理保全对数字案件侦查取证意义重大。     

Digital evidence strategies for digital forensic science examinations

Given the size and complexity of many digital forensic science device examinations, there is a need for practitioners to formally and strategically determine a course of conduct which allows them to undertake the most robust and efficient examination possible. This work outlines both the need for practitioners to have a digital evidence strategy (DES) when tackling any given examination scenario, how to construct one and the concerns which exist when no formal DES is in place. Approaches to DES development are examined and the context to which they should be deployed are analysed, with focus being on the use of DESs at the examination/processing stage of the investigative workflow. Finally, a ‘DES skeleton’ is offered to guide practitioners as they seek to create their own DES.     

Visualization of Latent Fingerprint Corrosion on a Discharged Brass Shell Casing

Abstract:  Latent fingerprint visualization on discharged shell casings can provide good forensic evidence, particularly if the casing is recovered at the scene of a crime where a firearm has been discharged. Unfortunately, visualization of such latent fingerprints when they were deposited prior to discharge of the firearm is problematic as both increased temperature and abrasive friction can inhibit fingerprint visualization with conventional techniques. We present a case study that demonstrates latent fingerprint visualization on a discharged shell casing recovered 14 years ago from the scene of a homicide. Previous cyanoacrylate fuming of the casing had failed to reveal any fingerprints. We use a visualization technique in which a conducting carbon powder adheres preferentially to latent fingerprint corrosion of the casing surface, following the application of a potential of 2.5 kV to the casing. This technique presents opportunities for the review of old cases and for consideration of its use in current cases.     

When finding nothing may be evidence of something: Anti-forensics and digital tool marks

There are an abundance of measures available to the standard digital device users which provide the opportunity to act in an anti-forensic manner and conceal any potential digital evidence denoting a criminal act. Whilst there is a lack of empirical evidence which evaluates the scale of this threat to digital forensic investigations leaving the true extent of engagement with such tools unknown, arguably the field should take proactive steps to examine and record the capabilities of these measures. Whilst forensic science has long accepted the concept of toolmark analysis as part of criminal investigations, ‘digital tool marks’ (DTMs) are a notion rarely acknowledged and considered in digital investigations. DTMs are the traces left behind by a tool or process on a suspect system which can help to determine what malicious behaviour has occurred on a device. This article discusses and champions the need for DTM research in digital forensics highlighting the benefits of doing so.     

The Hierarchy of Case Priority (HiCaP):- A proposed method for case prioritisation in digital forensic laboratories

The need for digital forensic science (DFS) services has grown due to widespread and consistent engagement with technology by members of society. Whilst digital evidence often plays an important role in many inquiries, available investigative resources have failed to keep pace with such demand for them. As a result, the use case prioritisation models for backlog/workload management are of increasing importance to ensure the effective deployment of laboratory resources. This work focuses on the concept of ​​case prioritisation in a digital forensic laboratory setting, following the submission of exhibits for examination, where this workflow is described. The challenges of case management and prioritisation in laboratories are discussed, with both ‘case acceptance’ and ‘case prioritisation’ procedures explained. Finally, the ‘Hierarchy of Case Priority’ (HiCaP) - a transparent, risk-based approach for the prioritisation of cases for examination, is proposed and described using examples.     

Governing ghostbots

This article discusses the legal implications of a novel phenomenon, namely, digital reincarnations of deceased persons, sometimes known as post-mortem avatars, deepfakes, replicas, holographs, or chatbots. To elide these multiple names, we use the term 'ghostbots'. The piece is an early attempt to discuss the potential social and individual harms, roughly grouped around notions of privacy (including post-mortem privacy), property, personal data and reputation, arising from ghostbots, how they are regulated and whether they need to be adequately regulated further. For reasons of space and focus, the article does not deal with copyright implications, fraud, consumer protection, tort, product liability, and pornography laws, including the non-consensual use of intimate images (‘revenge porn’). This paper focuses on law, although we fully acknowledge and refer to the role of philosophy and ethics in this domain.We canvas two interesting legal developments with implications for ghostbots, namely, the proposed EU Artificial Intelligence (AI) Act and the 2021 New York law amending publicity rights to protect the rights of celebrities whose personality is used in post-mortem ‘replicas’. The latter especially evidences a remarkable shift from the norm we have chronicled in previous articles of no respect for post-mortem privacy to a growing recognition that personality rights do need protection post-mortem in a world where pop stars and actors are routinely re-created using AI. While the legislative motivation here may still be primarily to protect economic interests, we argue it also shows a concern for dignitary and privacy interests.Given the apparent concern for the appropriation of personality post-mortem, possibly in defiance or ignorance of what the deceased would have wished, we propose an early solution to regulate the rise of ghostbots, namely an enforceable ‘do not bot me’ clause in analogue or digital wills.     

That tool is rubbish!…or is it?

Digital forensic practitioners often utilise a range of tools throughout their casework in order to access, identify and analyse relevant data, making them a vital part of conducting thorough, efficient and accurate digital examinations of device content and datasets. Whilst their importance cannot be understated, there is also no guarantee that their functionality is free from error, where similarly, no practitioner can 100% assure that their performance is flawless. Should an error occur during an investigation, assuming that it has been identified, then determining the cause of it is important for the purposes of ensuring quality control in both the immediate investigation and for longer-term practice improvements. Perhaps anecdotally, a starting position in any postmortem review of an error may be to suspect that any tools used may be at fault, where recent narratives and initiatives have enforced the need to evaluate all tools prior to them being used in any live investigation. Yet, in addition, an error may occur as a result of a practitioner’s investigative conduct. This work discusses the concept of ‘fault-attribution’, focusing on the roles of the forensic tool and practitioner, and proposes a series of principles for determining responsibility for an investigative error.     

Detection and visualization of human tears using alternate light sources for forensic purposes

The current scientific techniques for locating body fluids focus on quick and effective methodologies for easy and reliable identification. Efficient detection and identification of body fluids play a vital role in establishing the ‘corpus delecti’ of a crime. Non-destructive techniques such as the use of Alternate Light Sources (ALS) have been exploited for crime scene searches over large areas and detection of body fluids such as blood, semen, vaginal secretions, and saliva on a range of substrates. Tears are rarely found but can be considered as potential body fluid evidence due to their unique biochemical and molecular properties. Tears are secreted in response to physical or emotional stimuli. Due to the small volume of secretions, they are often overlooked in the crime scene. Tears may be found on surfaces such as clothing, bedding, tissue, handkerchief, or balaclava. The use of ALS to locate tears on tissue paper and fabric surfaces was tested which were not apparent to the naked eye. Tears stains were successfully detected on surfaces of forensic interest with varying sample ages up to three months with a broad excitation spectrum between 254 nm and 410 nm. Dried stains on tissue paper and fabric substrates were better detected with sharp margins, clear stain pattern visibility, and fluorescence intensity in comparison with moist and fresh stains. Tears stains can hence be detected with the use of ALS and suitable filter combinations under normal conditions and do not require any specific settings to locate them. These findings are suggestive for easy and quick identification of tears on large surfaces and as a presumptive test for forensic casework evidence examination.     

A Rapid,Confirmatory Test for Body Fluid Identification,

We have developed a technique that allows investigators to confirm the presence of blood, semen, and/or saliva in a crime scene sample. It is a confirmatory test where multiple samples can be processed in less than an hour, and it is potentially portable, permitting samples to be processed at the crime scene. Samples at a scene giving a positive result can be further processed while those failing to do so may be ignored. There is a large and growing backlog of DNA evidence in the USA, slowing down the criminal justice system. This backlog has continued to grow despite an increase in the ability to process evidence faster. This technique uses quantum dot molecular beacons to test for tissue‐specific RNA species, identifying particular body fluids. We have demonstrated the tissue specificity of molecular beacons for blood, semen, and saliva.     

The relationship between antisocial stereotypes and public CCTV systems: exploring fear of crime in the modern surveillance society

Abstract

Situational crime deterrence measures like CCTV are not always associated with reductions in fear of crime. This study explores this unexpected finding by investigating the interaction between target type and the presence of a CCTV camera, in order to test the effect this has on impressions of the target and corresponding fear of the location the target was shown in. Participants (n=120) were shown either a picture of a male ‘skinhead’, a ‘studious’ female, or no one within an urban setting in which an obvious CCTV camera was either present or absent. Participants then rated the scene using scales estimating crime frequency, worry and target activity. Estimates of location safety fell for the male ‘skinhead’ target and activity impressions were more negative, but only when a CCTV camera was also present. Ironically, in some circumstances, public crime deterrence measures may prime pre-existing negative stereotypes about others and so foster suspicion, undermine trust in others, and increase fear of crime.