Forensic Significance of Gunshot Impact Marks on Inanimate Objects: The Need for Translational Research

Wherever an impact mark is found, either on the surface or on the recovered projectile, it is important for forensic investigators to extract useful information in solving shooting-related cases. This article reviews a collection of works on examination of impact marks upon striking of projectiles on inanimate objects, emphasizing on the retrievable information from a shooting scene and their forensic significance in shooting event reconstruction. Literature suggested that impact marks on target surfaces and the degree of deformation on striking projectiles vary according to different combinations of ammunition and surface materials. It was noted that conditions in real-case scenarios further differed unpredictably in comparison with controlled studies, where forensic investigation should be treated as case-specific basis. Furthermore, the way forensic science is researched and applied operationally has to be reconsidered to reduce the gap via translational approach for more effective use of forensic evidence.     

The use of self-organising maps for anomalous behaviour detection in a digital investigation

The dramatic increase in crime relating to the Internet and computers has caused a growing need for digital forensics. Digital forensic tools have been developed to assist investigators in conducting a proper investigation into digital crimes. In general, the bulk of the digital forensic tools available on the market permit investigators to analyse data that has been gathered from a computer system. However, current state-of-the-art digital forensic tools simply cannot handle large volumes of data in an efficient manner. With the advent of the Internet, many employees have been given access to new and more interesting possibilities via their desktop. Consequently, excessive Internet usage for non-job purposes and even blatant misuse of the Internet have become a problem in many organisations. Since storage media are steadily growing in size, the process of analysing multiple computer systems during a digital investigation can easily consume an enormous amount of time. Identifying a single suspicious computer from a set of candidates can therefore reduce human processing time and monetary costs involved in gathering evidence. The focus of this paper is to demonstrate how, in a digital investigation, digital forensic tools and the self-organising map (SOM)--an unsupervised neural network model--can aid investigators to determine anomalous behaviours (or activities) among employees (or computer systems) in a far more efficient manner. By analysing the different SOMs (one for each computer system), anomalous behaviours are identified and investigators are assisted to conduct the analysis more efficiently. The paper will demonstrate how the easy visualisation of the SOM enhances the ability of the investigators to interpret and explore the data generated by digital forensic tools so as to determine anomalous behaviours.     

Forensic analysis of social networking applications on mobile devices

The increased use of social networking applications on smartphones makes these devices a goldmine for forensic investigators. Potential evidence can be held on these devices and recovered with the right tools and examination methods. This paper focuses on conducting forensic analyses on three widely used social networking applications on smartphones: Facebook, Twitter, and MySpace. The tests were conducted on three popular smartphones: BlackBerrys, iPhones, and Android phones. The tests consisted of installing the social networking applications on each device, conducting common user activities through each application, acquiring a forensically sound logical image of each device, and performing manual forensic analysis on each acquired logical image. The forensic analyses were aimed at determining whether activities conducted through these applications were stored on the device's internal memory. If so, the extent, significance, and location of the data that could be found and retrieved from the logical image of each device were determined. The results show that no traces could be recovered from BlackBerry devices. However, iPhones and Android phones store a significant amount of valuable data that could be recovered and used by forensic investigators.     

A framework for post-event timeline reconstruction using neural networks

Post-event timeline reconstruction plays a critical role in forensic investigation and serves as a means of identifying evidence of the digital crime. We present an artificial neural networks based approach for post-event timeline reconstruction using the file system activities. A variety of digital forensic tools have been developed during the past two decades to assist computer forensic investigators undertaking digital timeline analysis, but most of the tools cannot handle large volumes of data efficiently. This paper looks at the effectiveness of employing neural network methodology for computer forensic analysis by preparing a timeline of relevant events occurring on a computing machine by tracing the previous file system activities. Our approach consists of monitoring the file system manipulations, capturing file system snapshots at discrete intervals of time to characterise the use of different software applications, and then using this captured data to train a neural network to recognise execution patterns of the application programs. The trained version of the network may then be used to generate a post-event timeline of a seized hard disk to verify the execution of different applications at different time intervals to assist in the identification of available evidence.     

Fourier transform infrared analyses of some particulate drug mixtures using a diamond anvil cell with a beam condenser and an infrared microscope.

Although the diamond anvil cell (DAC) has been used in many forensic science laboratories for the analysis of trace evidence, few applications of this technique for the analysis of controlled substances have been reported. This may be due to both an unfamiliarity on the part of forensic drug chemists with this accessory and the nature and quality of spectra that result from use of a DAC on a dispersive instrument. Along with low energy throughput, which results in relatively high noise levels, strong broad diamond absorptions occur. With the use of a Fourier transform infrared instrument, these do not present a problem and nanogram quantities of materials can be analyzed when the DAC is used with an infrared microscope. Since single crystals can be sampled with the DAC, simple physical separations (involving particle-picking) can be used in certain cases to isolate drugs from particulate mixtures for infrared analysis. This method is especially useful for some "difficult" mixtures and residues, and several examples of such analyses involving samples of forensic science interest are presented.     

Hyperspectral imaging in forensic science: An overview of major application areas

Analysis of evidence is a challenge. Crime scene materials are complex, diverse, sometimes of an unknown nature. Forensic science provides the most critical applications for their examination. Chemical tests, analytical methods, and techniques to process the evidence must be carefully selected by the forensic scientist. Ideally, it may be interpreted, analyzed, and judged in the original context of the crime scene. In this sense, hyperspectral imaging (HSI) has been employed as an analytical tool that maintains the integrity of the samples/objects for multiple and sequential analysis and for counter-proof exams. This paper is an overview of forensic science trends for the application of HSI techniques in the last ten years (2011–2021). The examination of documents was the main area of exploration, followed by bloodstain analysis aging process; trace analysis of explosives and gunshot residue. Chemometric tools were also addressed since they are crucial to obtain the most important information from the samples. There are great challenges in applying HSI in forensic science, but there have been clear technological and scientific advances, and a solid foundation has been built for the use of HSI in real-life cases.     

Photographic Image Comparison of Vegetation

Images and videos are common types of evidence in crime scene investigations and laboratory analysis. Images may be taken by the suspect and/or by crime scene investigators and may serve as crucial elements in forensic laboratory analysis. Forensic photographic image comparison is the process of comparing one or more objects or persons in photographs/images when at least one image is known to be related to a crime. The forensic examiner usually compares the images in order to determine whether or not an association between the exhibits in the images can be made. This paper proposes an extension to the currently prevalent photographic image examination method. The extension introduces comparison of landscape and vegetation over time. It is revealed that similarities between images may still be found between the period of time the suspect photograph was taken and the period the crime scene investigator took the photograph from the same area. In this case report, two suspects to be involved in growing a marijuana field were arrested by the police. The forensic experts were asked to examine images taken by the crime scene investigators and to compare them to the images found in the suspects’ phones. They then tried to determine whether the suspects could be linked to the specific locations. While applying techniques derived from morphological comparison methodologies, the plants at the scene provided significant additional information. A tree trunk, branches, and twigs on a hedge in the photographs revealed specific individual characteristics that led the examiner to reach a conclusive decision.     

Forensic palynology in Canada: an overview with emphasis on archaeology and anthropology

Palynological analysis is shown from published and unpublished Canadian examples to be a useful tool in forensic investigation, although the technique is almost unknown and therefore under-utilized by forensic investigators. The techniques of pollen and spore identification and interpretation are continually improving, indicating that the potential for forensic applications is real. Focus in this paper is on an updated interpretation of palynological data that was presented during a trial involving a scientific test of oral history as part of a claim for aboriginal title to a large area of British Columbia (BC) (Delgamuukw versus the Queen). Although the original decision in British Columbia Supreme Court was decided in favor of the government defendants, an appeal to the Supreme Court of Canada overturned the original decision, and established new principles and rights for aboriginal peoples.     

Investigation of cremations and severely burned bodies

Among the most difficult cases for law enforcement and medicolegal investigators to investigate are those in which victims have been deliberately burned to cover up a crime, or those in which cremation has resulted from an accident or suicide. This difficulty arises from the fact that the bodies may be destroyed or fragmented. The major objective in these investigations are twofold: The first task is to identify the body using every means available, including the aid of such experts as forensic pathologists, forensic anthropologists, dentists, toxicologists, and serologists as well as fire investigators, who can contribute to the investigation by providing information about the course of the fire.     

Forensic medicine and medicolegal investigation in Sri Lanka

In a small country such as Sri Lanka, very interesting applications of forensic medicine and medicolegal investigation exist. We present information that provides an important addition to the knowledge of medicolegal investigators all over the world.     

MEGA: A tool for Mac OS X operating system and application forensics

Computer forensic tools for Apple Mac hardware have traditionally focused on low-level file system details. Mac OS X and common applications on the Mac platform provide an abundance of information about the user's activities in configuration files, caches, and logs. We are developing MEGA, an extensible tool suite for the analysis of files on Mac OS X disk images. MEGA provides simple access to Spotlight metadata maintained by the operating system, yielding efficient file content search and exposing metadata such as digital camera make and model. It can also help investigators to assess FileVault encrypted home directories. MEGA support tools are under development to interpret files written by common Mac OS applications such as Safari, Mail, and iTunes.     

MEGA: A tool for Mac OS X operating system and application forensics

Computer forensic tools for Apple Mac hardware have traditionally focused on low-level file system details. Mac OS X and common applications on the Mac platform provide an abundance of information about the user's activities in configuration files, caches, and logs. We are developing MEGA, an extensible tool suite for the analysis of files on Mac OS X disk images. MEGA provides simple access to Spotlight metadata maintained by the operating system, yielding efficient file content search and exposing metadata such as digital camera make and model. It can also help investigators to assess FileVault encrypted home directories. MEGA support tools are under development to interpret files written by common Mac OS applications such as Safari, Mail, and iTunes.     

Forensic investigation of OOXML format documents

MS Office documents could be illegally copied by offenders, and forensic investigators still face great difficulty in investigating and tracking the source of these illegal copies. This paper mainly proposes a forensic method based on the unique value of the revision identifier (RI) to determine the source of suspicious electronic documents. This method applies to electronic documents which use Office Open XML (OOXML) format, such as MS Office 2007, Mac Office 2008 and MS Office 2010. According to the uniqueness of the RI extracted from documents, forensic investigators can determine whether the suspicious document and another document are from the same source. Experiments demonstrate that, for a copy of an electronic document, even if all the original characters are deleted or formatted by attackers, forensic examiners can determine that the copy and the original document are from the same source through detecting the RI values. Additionally, the same holds true if attackers just copy some characters from the original document to a newly created document. As long as there is one character left whose original format has not been cleared, forensic examiners can determine that the two documents are from the same source using the same method. This paper also presents methods for OOXML format files to detect the time information and creator information, which can be used to determine who the real copyright holder is when a copyright dispute occurs.     

The introduction of forensic advisors in Belgium and their role in the criminal justice system

Forensic advisors (FA) at the National Institute for Criminalistics and Criminology (NICC), generalists in forensic science, act as an advising body to the magistrate to improve communication between the various parties involved in the investigation: magistrate, police and crime scene investigators, and forensic experts. Their role is manifold, but their main objectives are to optimise trace processing by selecting the most pertinent traces in the context of the case and by advising magistrates on the feasibility of forensic analyses in particular circumstances in regards to the latest technical advances.Despite the absence of a legal framework governing their role and involvement in judicial cases, the demand for their services has increased over the years. Initially, forensic advisors were called for complex homicide cases. Due to the proximity with the Public Prosecutor's Office, the types of offences for which their expertise was sought have become more diverse (mainly including robbery, burglary and sexual assault cases), leading to a diversity in the types of cases handled by the forensic advisors (complex, simple and review).In many of the cases they are requested for, in addition to consulting on the best analytical strategy, forensic advisors also assume the role of case coordinator regarding the seized objects and their respective analyses. Indeed, in the majority of cases treated by the FAs, two or more types of expertise have been requested and performed, either at the internal laboratories of NICC or at external laboratories.This paper explains the role of the forensic advisors in Belgium, the path that let to their current status and problems encountered.     

Discrimination of 1990s original automotive paint systems: a collaborative study of black nonmetallic base coat/clear coat finishes using infrared spectroscopy

The 1990s saw the introduction of significantly new types of paint binder chemistries into the automotive finish coat market. Considering the pronounced changes in the binders that can now be found in automotive paints and their potential use in a wide variety of finishes worldwide, the Paint Subgroup of the Scientific Working Group for Materials (SWGMAT) initiated a validation study to investigate the ability of commonly accepted methods of forensic paint examination to differentiate between these newer types of paints. Nine automotive paint systems typical of original equipment applications were acquired from General Motors Corporation in 1992. They consisted of steel panels coated with typical electrocoat primers and/or primer surfacers followed by a black nonmetallic base coat and clear coat. The primary purpose of this study was to evaluate the discrimination power of common forensic techniques when applied to the newer generation original automotive finishes. The second purpose was to evaluate interlaboratory reproducibility of automotive paint spectra collected on a variety of Fourier transform infrared (FT-IR) spectrometers and accessories normally used for forensic paint examinations. The results demonstrate that infrared spectroscopy is an effective tool for discriminating between the major automotive paint manufacturers' formulation types which are currently used in original finishes. Furthermore, and equally important, the results illustrate that the mid-infrared spectra of these finishes are generally quite reproducible even when comparing data from different laboratories, commercial FT-IR instruments, and accessories in a "real world," mostly uncontrolled, environment.     

司法会计鉴定对象探讨

关于司法会计鉴定及其对象存在不同观点,尚未形成较一致的认识,影响了司法会计鉴定工作的规范。对司法会计鉴定的内涵进行分析,将其界定为向委托人报告其委托的财务会计事项的财务、会计相关信息以及提供鉴定意见的一项社会专业活动;梳理并评价司法会计鉴定对象的不同观点,提出司法会计鉴定对象是法律事项中涉及的财务会计事实,财务会计事实分为财务事实和会计事实;并将会计学与法学结合起来分析财务事实与会计事实的构成。     

Cybercrime investigation in Finland

Nordic police cooperation concerning cybercrimes has been developed during the last few years, e.g. through the Nordic Computer Forensics Investigators (NCFI) and Nordplus training programmes. More empirical research is needed in order to enhance cybercrime investigation and address the training needs of police officers. There is a knowledge gap concerning organizational models for the police’s cybercrime investigation: How the function is organized, what the professional characteristics of the staff are and how to combine computer forensics with crime investigation? The purpose of this paper was to study the organization of cybercrime investigation in Finland. Data were collected by a questionnaire from all 11 local police districts and the National Bureau of Investigation in July–August 2014. In addition, six thematic interviews of cybercrime investigators were conducted in 2014. Three investigation models of computer integrity crimes were found: (1) Computer forensic investigators conduct the entire pre-trial examination, (2) Computer forensic investigators conduct only the computer forensics, and tactical investigation is done by an occasional investigator, (3) Computer forensic investigators conduct only the computer forensics and tactical investigation is centralized to designated investigators. The recognition of various organizational models and educational backgrounds of investigators will help to develop cybercrime investigation training.     

Atomic force microscopy as a biophysical tool for nanoscale forensic investigations

The atomic force microscope (AFM) has found its way to the arsenal of tools available to the forensic practitioner for the analysis of samples at the nano and microscales. As a non-destructive probing tool that requires minimal sample preparation, the AFM is very attractive, particularly in the case of minimal or precious sample. To date, the use of the AFM has primarily been in the arena of imaging where it has been complementary to other microscopic examination tools. Forensic applications in the visual examination of evidence such as blood stains, questioned documents, and hair samples have been reported. While a number of reviews have focused on the use of AFM as an imaging tool for forensic analyses, here we not only discuss these works, but also point to a versatile enhancement in the capabilities of this nanoscale tool – namely its use for force spectroscopy. In this mode, the AFM can determine elastic moduli, adhesion forces, energy dissipation, and the interaction forces between cognate ligands, that can be spatially mapped to provide a unique spatial visualization of properties. Our goals in this review are to provide a context for this capability of the AFM, explain its workings, cover some exemplary works pertaining to forensic sciences, and present a critical analysis on the advantages and disadvantages of this modality. Equipped with this high-resolution tool, imaging and biophysical analysis by the AFM can provide a unique complement to other tools available to the researcher for the analysis and characterization of forensic evidence.     

A reference database of Windows artifacts for file-wiping tool execution analysis

Anti-forensic technology can play an effective role in protecting information, but it can make forensic investigations difficult. Specifically, file-wiping permanently erases evidence, making it challenging for investigators to determine whether a file ever existed and prolonging the investigation process. To address this issue, forensic researchers have studied anti-forensic techniques that detect file-wiping activities. Many previous studies have focused on the effects of file-wiping tools on $MFT, $LogFile, and $DATA, rather than on Windows artifacts. Additionally, previous studies that have examined Windows artifacts have considered different artifacts, making it difficult to study them in a comprehensive manner. To address this, we focused on analyzing traces in 13 Windows artifacts of 10 file-wiping tools' operations in the Windows operating system comprehensively. For our experiments, we installed each file-wiping tool on separate virtual machines and checked the traces that the tools left behind in each artifact. We then organized the results in a database format. Our analysis revealed that most of the tools left traces on other artifacts, except for JumpList, Open&SavePidlMRU, and lnk. There were also some cases where traces remained on the other three artifacts. Based on our research, forensic investigators can quickly identify whether a file-wiping tool has been used, and it can assist in decision-making for evidence collection and forensic triage.     

Challenges in Producing Defensible Environmental Chemistry Measurements for Litigation

The quality, integrity, interpretation and proper use of environmental forensic chemistry measurements should be a paramount concern to investigators, claims professionals and litigators. These issues are complicated for forensic chemists who often use nonstandard methods to discern unique chemical contaminant attributes. In addition, data fraud remains a constant, if not increasing, problem. The evolving interpretation of the Daubert ruling further complicates litigators' strategies in designing an effective forensic chemistry study which will be admissible in court. The purpose of this paper is to advise forensic investigators and litigators to the potential pitfalls in producing defensible environmental measurements, and provide perspectives for generating data that will not wither under scrutiny.