微生物物证检验

面对21世纪生物犯罪或生物恐怖活动的新挑战,物证鉴定的新专业--微生物物证检验将成为执法部门侦查和起诉生物犯罪必不可少的手段。微生物物证检验以用作犯罪武器的各种微生物为检验对象,获得微生物种类和能够提供来源信息的菌毒株细致分型结果,达到提供犯罪侦查线索和法庭证据的目的。本文综述了微生物物证检验的定义、特征、技术应用以及美国近年来在微生物物证检验的实践和值得借鉴的成功经验。并建议我国物证鉴定实验室应积极开展研究,建立能够满足生物犯罪侦查需求的微生物物证检验能力。     

电子物证检验

目的阐述电子物证检验技术的专业内容和组成,以及开展电子物证检验的作用和重要意义;方法研究美国、欧洲和国内电子证据及其检验鉴定的数据资料,结合国内物证检验技术发展现状和需求,论证电子物证检验技术;结果提出了电子物证检验定义、检验对象、技术方法、特点作用以及尽快在国内建立电子物证检验专业等观点;结论电子物证检验是关于识别、发现、提取、保存、恢复、展示、分析和鉴定电子设备中存在的电子信息(电子证据)的科学技术,其检验结果可以作案件侦查线索或法庭证据。开展电子物证检验可以有效提高犯罪侦查效率。     

物证时间信息检验

物证鉴定是犯罪侦查和法庭诉讼重建犯罪事实的重要手段,物证鉴定提供的时间信息是事实重建的核心要素。本文概述了现代物证时间信息检验的技术方法和结果应用,阐述了以“时点、时长和时序”为时间参数的物证时间信息检验技术和应用理论框架。     

手机取证研究概述

司法实践中,越来越多的案件需要从手机中提取各种信息,手机已经成为电子物证检验的新对象.本文结合手机取证的特点,讨论了手机犯罪、手机电子数据和手机取证的相关问题.     

电子物证特性研究

随着计算机和互联网技术的飞速发展,人们在El常生活中会越来越多地使用计算机等电子设备,由于这些电子设备中通常包含大量的与个人日常活动相关的信息,这些信息很可能会成为侦查办案中所使用的电子物证。如何更好地发挥电子物证在侦查办案中的作用,已经成为相关领域研究的一个热门话题,其中,全面、系统地认清电子物证不同于其它传统证据的特性,是我们研究电子物证的第一步。笔者将电子物证的特性概括归纳为“七个统一”。     

浅析法医物证检验工作中存在的几个问题

法医物证检验是物证鉴定的一个重要组成部分，在法庭科学领域具有重要作用。通过法医物证检验鉴定，确定这些生物类物质的性质、种属、血型、DNA指纹、性别和年龄等，对其属主进行个别识别及亲权关系确认，从而证实这些生物类物质与其案件的关联，为证实和揭露犯罪，分析案情提供依据，为侦查破案和诉讼提供证据。     

电子物证鉴定中的同一认定和种属认定

电子物证（电子证据）是与传统物证不同的新型证据。电子物证鉴定的送检材料一般是保存有数字电文的存储介质，其中存储的电子数据是鉴定分析的主要对象。电子物证鉴定有其特殊性，这体现在两个方面：第一是数字电文中很少包含人身的、信息系统的“特征信息”。传统物证中的指纹和DNA鉴定都可以对人身进行同一认定，而数字电文经过信息处理设备的处理、传输，其中不保留或者很少保留人身特征信息。第二是传统物证鉴定分析中的“物质交换原理”不适用于电子证据。数字电文在存储、处理、传输过程中是以光电信号的形式完成信息处理和传输，不发生物质的交换，没有物质成分的交流，只引起数字设备存储器中存储介质的存储状态变化。虽然电子物证鉴定与传统物证鉴定有很大不同，但传统物证鉴定的理论和方法对电子物证鉴定具有指导意义。本文借鉴传统物证鉴定中的同一认定、种属认定理论及方法，对电子物证鉴定中的同一认定和种属认定做一初步的探讨。     

利用物理检测技术提取高仿nokian8手机机身数据的方法

近年来，手机的取证工作已成为电子物证专业的一项重要内容。手机内所存储的通讯信息，图片信息、多媒体信息为侦破案件的工作提供了重要的线索。据笔者统计某市近两年检验的案件，在涉案手机中，国产山寨机的数量占一半以上。对于国产山寨手机的检验而言，通常方法是先获取到手机机身内存的镜像文件，然后对其进行解析。所以检验的关键是如何提取到手机内存的镜像文件。     

从呼格吉勒图案反思中国物证技术存在的问题

在中国,物证鉴定技术作为刑事科学技术工作的一项重要组成部分,是公安侦查机关不可缺少的基础性工作和重要的技术支撑,是实现和保障司法公正和社会稳定的重要工具.本文针对当前我国物证鉴定技术的发展现状及其发展过程中出现的诸多问题,讨论如何推动物证鉴定技术向更加专业化、规范化和现代化发展,加快提高我国物证检验鉴定技术水平.     

化学成像检验技术新发展

化学成像检验技术已经成为物证鉴定学科研究的重点和热点课题。化学成像检验技术结合了成像检验。光谱分析。图像处理等技术方法，能够为检验鉴定同时提供定量定性定位的准确信息。本文参考大量文献。总结归纳了化学成像检验的定义。介绍了化学成像检验技术应用于法庭科学研究现状与未来发展趋势。     

手机通话语音的实验研究

当前,手机通话语音已成为司法语音鉴定中最为常见的一种语音形式。本研究从手机通信系统的信道特点出发,分析手机通话语音的声谱特点和共振峰频率变化等情况;同时还比较了不同通话网络、不同通话方式及不同手机的通话语音特点。实验发现,手机通话语音与直接录音语音有明显的变化,主要表现在高低频信息的带宽滤波效应、高低频共振峰的漂移、语音质量、音色、韵律特征等方面;还发现,不同手机通话条件下的语音变化程度不同。最后,讨论了手机通话语音变化对说话人鉴定的影响及鉴定中的注意事项。     

Live memory forensics of mobile phones

In this paper, we proposed an automated system to perform a live memory forensic analysis for mobile phones. We investigated the dynamic behavior of the mobile phone’s volatile memory, and the analysis is useful in real-time evidence acquisition analysis of communication based applications. Different communication scenarios with varying parameters were investigated. Our experimental results showed that outgoing messages (from the phone) have a higher persistency than the incoming messages. In our experiments, we consistently achieved a 100% evidence acquisition rate with the outgoing messages. For the incoming messages, the acquisition rates ranged from 75.6% to 100%, considering a wide range of varying parameters in different scenarios. Hence, in a more realistic scenario where the parties may occasionally take turns to send messages and consecutively send a few messages, our acquisition can capture most of the data to facilitate further detailed forensic investigation.     

PDU结构分析在手机短信检验鉴定中的应用

PDU模式下的短信息编码方式,被GSM手机广泛运用。在实际检验鉴定工作中,涉案手机检验量大幅增加,并且手机检验分析系统无法解析镜像文件的情况时有发生,检验人员只有对PDU有足够的了解,才能对手机取证驾轻就熟。通过对PDU模式结构的实例分析,手工成功恢复出手机短信息,这种分析的方法和经验可以应用于所有GSM手机的短信息取证。     

Investigating the uses of mobile phone evidence in China criminal proceedings

Data from mobile phones are regularly used in the investigation of crime and court proceedings. Previously published research has primarily addressed technical issues or provided operational manuals for using forensic science evidence, rather than analysing human factors and the implementation of forensic tools in investigation settings. Moreover, previous research has focused almost entirely on western countries, and there is a dearth of research into the uses of forensic evidence in China. In this study, a review was carried out of court sentencing documents referring to mobile phone evidence in China over the period 2013–2018. Automated content analysis was used to identify the specific evidence types utilised and the sentencing outcome for each case. Results show that mobile phone evidence was used in 3.3% of criminal proceedings. Among various data types mentioned in criminal proceedings, call records sustained as the most frequently used type of data. After which, instant messaging tools (e.g. WeChat) are an increasing proportion of all mobile phone evidence, from 1% in 2015 to 25% in 2018. For cases that utilised mobile phone data, the analysis of instant messaging and online transaction tools is routine, with little variation in the use of each application (WeChat, Alipay, QQ) for investigations of different types of crime. However, in the majority of criminal cases, mobile phone data function as subsidiary evidence and posed limited impacts on verdict reached. The current findings indicate that a large amount of mobile phone evidence was transformed into other evidence formats or filtered out directly before court proceedings.     

An Android Communication App Forensic Taxonomy

Due to the popularity of Android devices and applications (apps), Android forensics is one of the most studied topics within mobile forensics. Communication apps, such as instant messaging and Voice over IP (VoIP), are one popular app category used by mobile device users, including criminals. Therefore, a taxonomy outlining artifacts of forensic interest involving the use of Android communication apps will facilitate the timely collection and analysis of evidentiary materials from such apps. In this paper, 30 popular Android communication apps were examined, where a logical extraction of the Android phone images was collected using XRY, a widely used mobile forensic tool. Various information of forensic interest, such as contact lists and chronology of messages, was recovered. Based on the findings, a two‐dimensional taxonomy of the forensic artifacts of the communication apps is proposed, with the app categories in one dimension and the classes of artifacts in the other dimension. Finally, the artifacts identified in the study of the 30 communication apps are summarized using the taxonomy. It is expected that the proposed taxonomy and the forensic findings in this paper will assist forensic investigations involving Android communication apps.     

Forensic Inspection of Sensitive User Data and Artifacts from Smartwatch Wearable Devices

Wearable devices allow users the ability to leave mobile phones behind while remaining connected to the digital world; however, this creates challenges in the examination, acquisition, identification, and analysis of probative data. This preliminary research aims to provide an enhanced understanding of where sensitive user data and forensic artifacts are stored on smartwatch wearable devices, both through utilization as a connected and standalone device. It also provides a methodology for the forensically sound acquisition of data from a standalone smartwatch wearable device. The results identify significant amounts of data on the Samsung^? Gear S3 Frontier, greater than that stored on the companion mobile phone. An Apple Watch^® Series 3 manual examination method which produces native screenshots was identified; however, the companion mobile phone was found to store the greatest amount of data. As a result of this research, a data extraction tool for the Samsung^? Gear S3 Frontier was created.     

Identification of Mobile Phone and Analysis of Original Version of Videos through a Delay Time Analysis of Sound Signals from Mobile Phone Videos

This study designs a method of identifying the camera model used to take videos that are distributed through mobile phones and determines the original version of the mobile phone video for use as legal evidence. For this analysis, an experiment was conducted to find the unique characteristics of each mobile phone. The videos recorded by mobile phones were analyzed to establish the delay time of sound signals, and the differences between the delay times of sound signals for different mobile phones were traced by classifying their characteristics. Furthermore, the sound input signals for mobile phone videos used as legal evidence were analyzed to ascertain whether they have the unique characteristics of the original version. The objective of this study was to find a method for validating the use of mobile phone videos as legal evidence using mobile phones through differences in the delay times of sound input signals.     

Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.     

A comparison of forensic evidence recovery techniques for a windows mobile smart phone

Acquisition, decoding and presentation of information from mobile devices is complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device; and that in some cases the information recovered is conflicting.     

Forensic analysis of social networking applications on mobile devices

The increased use of social networking applications on smartphones makes these devices a goldmine for forensic investigators. Potential evidence can be held on these devices and recovered with the right tools and examination methods. This paper focuses on conducting forensic analyses on three widely used social networking applications on smartphones: Facebook, Twitter, and MySpace. The tests were conducted on three popular smartphones: BlackBerrys, iPhones, and Android phones. The tests consisted of installing the social networking applications on each device, conducting common user activities through each application, acquiring a forensically sound logical image of each device, and performing manual forensic analysis on each acquired logical image. The forensic analyses were aimed at determining whether activities conducted through these applications were stored on the device's internal memory. If so, the extent, significance, and location of the data that could be found and retrieved from the logical image of each device were determined. The results show that no traces could be recovered from BlackBerry devices. However, iPhones and Android phones store a significant amount of valuable data that could be recovered and used by forensic investigators.