Introducing the Microsoft Vista event log file format

Several operating systems provide a central logging service which collects event messages from the kernel and applications, filters them and writes them into log files. Since more than a decade such a system service exists in Microsoft Windows NT. Its file format is well understood and supported by forensic software. Microsoft Vista introduces an event logging service which entirely got newly designed. This confronts forensic examiners and software authors with unfamiliar system behavior and a new, widely undocumented file format.This article describes the history of Windows system loggers, what has been changed over time and for what reason. It compares Vista log files in their native binary form and in a textual form. Based on the results, this paper for the first time publicly describes the key-elements of the new log file format and the proprietary binary encoding of XML. It discusses the problems that may arise during daily work. Finally it proposes a procedure for how to recover information from log fragments. During a criminal investigation this procedure was successfully applied to recover information from a corrupted event log.     

Forensic investigation of OOXML format documents

MS Office documents could be illegally copied by offenders, and forensic investigators still face great difficulty in investigating and tracking the source of these illegal copies. This paper mainly proposes a forensic method based on the unique value of the revision identifier (RI) to determine the source of suspicious electronic documents. This method applies to electronic documents which use Office Open XML (OOXML) format, such as MS Office 2007, Mac Office 2008 and MS Office 2010. According to the uniqueness of the RI extracted from documents, forensic investigators can determine whether the suspicious document and another document are from the same source. Experiments demonstrate that, for a copy of an electronic document, even if all the original characters are deleted or formatted by attackers, forensic examiners can determine that the copy and the original document are from the same source through detecting the RI values. Additionally, the same holds true if attackers just copy some characters from the original document to a newly created document. As long as there is one character left whose original format has not been cleared, forensic examiners can determine that the two documents are from the same source using the same method. This paper also presents methods for OOXML format files to detect the time information and creator information, which can be used to determine who the real copyright holder is when a copyright dispute occurs.     

Interpersonal violent crime in Ghana: The case of assault in Accra

This study examined the trends, patterns, and socio-spatial conditions and factors that foster assaultive incidents and behaviors in Accra, Ghana. Specifically, the study examined how much assaults occurred over time, background characteristics of the victims and offenders, victim-offender relationships, and the housing units that recorded the most assaults. Among the triggers of assaults were females in familial settings and neighborhood propinquity, that is, disputants related through kinship, residential proximity, and contractual obligations. Arguments, drunkenness name-calling, jokes, funerals, inheritance, property, festivals, chieftaincy, communal living and sharing, such spatial factors as transient populations and routine activities were among the remote and immediate causes of the assaultive incidents. Among the housing units, the compound houses recorded the highest assaults. The majority of the victims and suspects were young males, between eighteen and thirty-four years, unemployed or in low paying blue-collar jobs. The majority of the assaults occurred in Accra Central, the precinct with the most compound homes and lower-class neighborhoods, followed by Nima, Kaneshie, and Kpeshie. Most assault incidents occurred in the morning, between 6:00 a.m. to 9:00 a.m. and in the afternoon, between 5:00 p.m. to 7:00 p.m.     

THE BOOK SHELF

Books reviewed in this article: 1. Amour, Richard. A Short History of Sex . Clinebell, Howard J ., Jr., and Charlotte H. Clinebell. The Intimate Marriage . 3. Mark, Vernon HA, M.D., and Frank R. Ervin, M.D. Violence and the Brain . 4. Gardner, Richard A., M.D. The Boys and Girls Book about Divorce . 5. Gordon, Thomas. Parent Effectiveness Training . 6. Kutscher, Austin &., Ed. But Not to Lose . 7. Mendel, Werner M., M.D. A Celebration of Laughter . 8. Ohlsen, Merle M. Group Counseling . 9. Reuben, David, M.D. Everything You Always Wanted to Know, etc. 10. Rogers, Carl. On Encounter Groups . 11. Shepard, Martin, M.D., and Marjorie Lee. Games Analysts Play . 12. Viseman, Jacqueline P. Stations of the Lost .     

BOOK REVIEW DEPARTMENT

Books Reviewed in this Article:
THE MONOPOLY MAKERS, Mark J. Green, Editor. New York, N.Y.: Grossman Publishers, 1973. Pp. 400. $3.50 (paper).
THE CASELOAD OF THE SUPREME COURT AND WHAT, IF ANYTHING, TO DO ABOUT IT, Alexander M. Bickel. Washington, D.C.: American Enterprise Institute for Public Policy Research, 1973. Pp. 37 (paper).
INTERNATIONAL TRADE & INVESTMENT, Franklin R. Root, Cincinnati, Ohio: Southwestern Publishing Co., 3rd ed. 1973. Pp. 663. $10.95.
ECONOMICS OF MANPOWER AND THE LABOR MARKET, Bevara D. Mabry. New York: Intext Education Publishers, 1973. Pp. 682, $14.00.
THE COLLEGES AND THE COURTS: FACULTY AND STAFF BEFORE THE BENCH, M. M. Chambers. Danville, Illinois: The Interstate Printers and Publishers, Inc., 1973. Pp. 266.
CORPORATE POWER AND SOCIAL CHANGE: THE POLITICS OF THE LIFE INSURANCE INDUSTRY, Karen Orr. Baltimore: The Johns Hopkins University Press, 1974. Pp. 204. $10.00.
NEPA IN THE COURTS: A LEGAL ANALYSIS OF THE NATIONAL ENVIRONMENTAL POLICY ACT, Frederick R. Anderson. Baltimore: The Johns Hopkins University Press, 1973. Pp. 350. $15.00 (clothbound), $6.95 (paper).     

BOOK REVIEW DEPARTMENT

Books reviewed in this article:
THE LEGAL ENVIRONMENT OF BUSINESS, Second Edition ROBERT N. CORLEY and ROBERT L. BLACK, New York, N.Y., McGraw-Hill, 1968, pp. 762, §9.95.
THE END OF OBSCENITY CHARLES REMBAR, New York, Random House, 1968, pp. 528, §8.95.
EMORY BUCKNER MARTIN MAYER, New York, Harper & Row, 1968, pp. 293, §7.95.
LAWYERS' ETHICS: A SURVEY OF THE NEW YORK CITY BAR JEROME E. CARLIN, New York, Russell Sage Foundation, 1966, xxix, pp. 267, §6.95.
DECADE OF DECISION G. THEODORE MITAU, New York, Charles Scribner's Sons, 1967, pp. 234, §5.95.
THE SUPREME COURT FROM TAFT TO WARREN ALPHEUS THOMAS MASON, Baton Rouge, La., Louisiana State University Press, 1968, pp. 282, §6.95.     

Allele frequencies and haplotypes of eight Y-short tandem repeats in Bantu population living in Central Africa

Eight Y chromosome short tandem repeats (STR) loci (DYS19, DYS389I, DYS389II, DYS390, DYS391, DYS392, DYS393, DYS385I/II) were used to assess haplotype distribution in non-selected, unrelated Bantu males living in Central Africa [N. Mathias, M. Bayes, C. Tyler-Smith, Highly informative compound haplotypes for the human Y chromosome, Hum. Mol. Genet. 3 (1994) 115-123; L. Roewer, J. Arnemann, N.K. Spurr, K.H. Grzeschik, J.T. Epplen, Simple repeat sequences on the human Y chromosome are equally polymorphic as their autosomal counterparts, Hum. Genet. 89 (1992) 389-394; P. De Knijff, M. Kayser, A. Caglia, D. Corach, N. Fretwel, C. Gehrig, G. Graziosi, F. Heidorn, S. Herrmann, B. Herzog, M. Hidding, K. Honda, M. Jobling, M. Krawczak, K. Leim, S. Meuser, E. Meyer, W. Oesterreich, A. Pandya, W. Parson, G. Penacino, A. Perez-Lezaun, A. Piccini, M. Prinz, C. Schmitt, P. M. Schneider, R. Szibor, J. Teifel-Greding, G. Weishold, L. Rower, Chromosome Y microsatellites: population genetic and evolutionary aspects, Int. J. Legal Med. 110 (1997) 134-149; M. Kayser, A. Caglia, D. Corach, N. Fretwel, C. Gehrig, G. Graziosi, F. Heidorn, S. Herrmann, B. Herzog, M. Hidding, K. Honda, M. Jobling, M. Krawczak, K. Leim, S. Meuser, E. Meyer, W. Oesterreich, A. Pandya, W. Parson, G. Penacino, A. Perez-Lezaun, A. Piccini, M. Prinz, C. Schmitt, P. M. Schneider, R. Szibor, J. Teifel-Greding, G. Weishold, P. de Knijff, L. Rower, Evaluation of Y chromosome STRs: a multicenter study, Int. J. Legal Med. 110 (1997) 125-133, 141-149]. One hundred and sixty-five full haplotypes were obtained from Bantu males. The most common haplotype (DYS19-15, DYS389I-13, DYS389II-30, DYS390-21, DYS391-10, DYS392-11, DYS393-13, DYS385I/II-15,17) was shared by 5.5% of individuals. In the Bantu population in Central Africa, the haplotype diversity and the discrimination capacity of Y-STR may be estimated at 99.14% and 0.5333, respectively.     

溴敌隆及其代谢物-苄叉丙酮在犬体内的死后分布

目的研究溴敌隆及其代谢物-苄叉丙酮在中毒致死犬体内死后分布规律,为溴敌隆中毒检材的采取提供实验依据。方法分别经口给予犬2倍和4倍LD_(50)溴敌隆,待其死亡后迅速解剖取材,气相色谱-质谱联用法测定心血、外周血、尿、胆汁、心、肝、脾、肺、肾、脑、左下肢肌、膀胱、胃、胃内容、胰等脏器和体液中溴敌隆和代谢物-苄叉丙酮的含量。结果犬经2倍和4倍LD_(50)溴敌隆灌胃染毒后3d开始出现出血症状,(178.40±20.94)h后死亡。溴敌隆和代谢物-苄叉丙酮在各组织脏器及体液中的死后分布为:溴敌隆2LD_(50)组溴敌隆:胆汁尿、肝、心、肾心血、外周血、脾、肺等;苄叉丙酮:胆汁、尿、心血、外周血、肺、胃内容中含量高于其他脏器。溴敌隆4LD_(50)组溴敌隆:胆汁、尿肝、外周血心血、胃内容物等脏器。苄叉丙酮:胆汁、尿、肺浓度高于其他脏器。结论溴敌隆及其代谢物-苄叉丙酮在中毒致死犬体内死后分布不均匀,溴敌隆在胆汁、尿、肝脏、心血和外周血含量较高,代谢物-苄叉丙酮在胆汁、尿、肺较高。胆汁、尿、肝脏、心血、外周血可作为疑似溴敌隆中毒毒物分析的检材。     

Human-type blood group activities on chimpanzee erythrocytes with special reference to M and N

Human-type blood group activities on the red blood cells (RBCs) of three chimpanzees were individually examined with commercial mouse monoclonal antibodies (anti-A, -B, -H, -M, -N, -Lea, and -Leb) as well as lectins (UEA-I and VGA) and conventional polyclonal antisera for the systems ABO, MN, Lewis, Rh-Hr, P, Kell, Kidd, Duffy, and Lutheran. For further analysis of the MN antigens, treatment of the RBCs with sialidase, trypsin, and chymotrypsin were employed. The activities recognized among the three chimpanzees were A, H, M, N, Leb, c, S, k, and Jka. The RBCs of the three individuals possessed the A antigen which showed the same serologic activity as the human A1. Those chimpanzee RBCs showed higher H-activity than the human A1 RBCs. The Lewis b activity was revealed by the absorption-elution method. The RBCs of the three individuals showed a reactivity to the polyclonal anti-M reagents, which was affected by both the sialidase and trypsin treatment. The RBCs of two individuals were agglutinated with the monoclonal anti-N. The receptor was sensitive to sialidase and chymotrypsin. The RBCs of the three individuals, however, did not react with the monoclonal anti-M or with one of the polyclonal anti-N. These results indicate structural differences in the glycophorins and MN antigens between the human and chimpanzee.     

Characterization and aging study of currency ink and currency canine training aids using headspace SPME/GC-MS

Solid-phase microextraction/gas chromatography-mass spectrometry (SPME/GC-MS) was used to characterize the volatile components associated with U.S. currency, U.S. currency inks, and Canadian currency. Compounds that can be attributed to the ink-curing process include series of straight-chain aldehydes, alkenals, acids, alcohols, and ketones and a series of lactones and 2-alkyl furans. Solvent compounds include naphthenic and paraffinic hydrocarbons with a profile typical of petroleum products, alkyl cyclohexanes, various ethylene glycol alkyl ethers, and traces of chlorinated solvents. Trace levels of 2-phenoxyethanol, a solvent often used in ink formulations, were also detected. Environmental contaminants, those compounds found in circulating currency but not in currency ink, include 2,2'-diethyl-1,1'-biphenyl, methyl benzoate and salicylate, menthol, limonene, dimethyl and diethyl phthalate, and ionol. Not including simple hydrocarbons, over 100 compounds were identified in the headspace of currency-related samples.     

A micromethod for the isolation of drugs from blood using amberlite XAD-2

The extraction of drugs from small blood samples (1 ml or less) for subsequent quantitative determination is described. Isolation was carried out by adsorption of the drugs to Amberlite XAD-2 resin utilizing a batch procedure that enabled the simultaneous extraction of up to 200 samples in approx. 5 hours. A new desorption technique yielded extracts of high purity that could be used directly for gas chromatographic or radioimmunological determinations, even if hemolyzed or putrid blood was to be examined. The following 26 substances were quantitated after addition to postmortem blood speciments at concentrations of 1-10 microgram/ml: tilidine, diphenhydramine, dibenzepine, imipramine, chlorpromazine, amphetamine, pentazocine, phenacetin, methaqualone, meprobamate, parathion, diazepam, digoxin, beta-methyldigoxin, carbromal, glutethimide, amobarbital, pentobarbital, cyclobarbital, phenobarbital, diphenylhydantoin, carbutamide, tolbutamide, glycodiazin, tolazamide and chlorpropamide. Thereby recoveries of 60-100% could be achieved. The reproducibility of the procedure was satisfactory as demonstrated by coefficients of variation of 3.7-8%.     

Development of a harmonised method for the profiling of amphetamines V: Determination of the variability of the optimised method

This paper is the fifth in a series of six in relation to the development of a harmonised method for the profiling of amphetamine [L. Aalberg, K. Andersson, C. Bertler, H. Borén, M.D. Cole, J. Dahlén, Y. Finnon, H. Huizer, K. Jalava, E. Kaa, E. Lock, A. Lopes, A. Poortman-van der Meer, E. Sippola, Development of a harmonised method for the profiling of amphetamines I. Synthesis of standards and compilation of analytical data, Forensic Sci. Int. 149 (2005) 219-229; L. Aalberg, K. Andersson, C. Bertler, M.D. Cole, Y. Finnon, H. Huizer, K. Jalava, E. Kaa, E. Lock, A. Lopes, A. Poortman-van der Meer, E. Sippola, J. Dahlén, Development of a harmonised method for the profiling of amphetamines II. Stability of impurities in organic solvents, Forensic Sci. Int. 149 (2005) 231-241]. The third paper [K. Andersson, K. Jalava, E. Lock, L. Aalberg, Y. Finnon, H. Huizer, E. Kaa, A. Lopes, A. Poortman-van der Meer, M.D. Cole, J. Dahlén, E. Sippola, Development of a harmonised method for the profiling of amphetamines III. Development of the gas chromatographic method, Forensic Sci. Int., in press] dealt with the optimisation of the gas chromatographic and detection methods whereas the fourth paper [K. Andersson, K. Jalava, E. Lock, Y. Finnon, S. Stevenson, L. Aalberg, H. Huizer, E. Kaa, A. Lopes, A. Poortman-van der Meer, M.D. Cole, J. Dahlén, E. Sippola, Development of a harmonised method for the profiling of amphetamines IV. Optimisation of sample preparation, Forensic Sci. Int., in press] concerned the optimisation of the extraction method prior to GC analysis. This paper is a study of the optimised method in order to determine its stability. Investigations of within and between day variations were carried out in four laboratories. Moreover, variations between laboratories were also determined. Both flame ionisation detector (FID) and MS detection were used. One laboratory studied nitrogen-phosphorous detector (NPD) detection as well. For this task, 12 batches of amphetamine were prepared. Six of them were synthesised via the Leuckart route, three via the nitrostyrene route and three via the reductive amination route [A.M.A. Verweij, Impurities in illicit drug preparations: amphetamine and methamphetamine, Forensic Sci. Rev. 1 (1989) 2-11]. Taking into account all studied target compounds and the average results from four laboratories, the within day variation was around 6% for FID and 5% for MS, the between days variation was around 10% for FID and 8% for MS. For NPD detection, within day variation was 5% and between days variation 9% (only one laboratory). Finally, the inter-laboratory variation was about 12% for FID (four laboratories) and 10% for MS (three laboratories).     

The detection of abortion agents in biological material]

Methods of extraction and detection of ascorbic acid, ergot alkaloids, cotarnine, microfollin, tinctures of marigold, peony, sage-brush, iodine, benzestrol, pachycarpine, hexestrol, folliculin, quinine, ethoxydiaminoacridine lactate were developed. Detection limits are 0.1-1 mg/100 g of object. Methods of manganese, iodine and soap detection are developed. Detection limits are 0.05-2 mg/100 g of object.     

Now you see it,now you don't

The Stevenson-Wydler Technology Innovation Act of 1980, at best, is now moribund. Events, in light of the Reagan Administration's budget cuts, have overtaken the times. Moreover, the principal advocates — Stevenson, Wydler and George Brown, Jr. — have departed for other climes, pursuits and interests. Fundamentally, the Act was doomed from its inception. It widely dispersed responsibilities among Federal agencies that in the past have shown, at best, a passivity towards technology transfer, or at worst, a disdain for it. Like so much Federal legislation in recent years, the Act lays out mandates broadly, badly defines terms and conditions, and omits the most important element of any law: penalties for violating it. Benign neglect, which seems to be the direction for at least the next four years, would appear to be its destiny. Section 11, Utilization of Federal Technology, however, might survive, but in a drastically truncated form, which should give precious little comfort to those who worked so hard for the passage of the Act.     

Book Reviews

Book review in this Article
Planning and Environmental Law, William Birtles and Richard Stein.
Biodiversity Prospecting: Using Genetic Resources for Sustainable Development, Walter V. Reid, Sarah A. Laird, Carrie A. Meyer, Rodrigo Gamez, Ana Sittenfeld, Daniel H. Janzen, Michael A. Gollin, and Calestous Juma
The Politics of Industrial Agriculture, Tracey Clunies-Ross and Nicholas Hildyard
Water Pollution Law and Liability, Patricia Thomas (ed.)     

Population genetic study in two Transylvanian populations using forensically informative autosomal and Y-chromosomal STR markers

Our study provides population genetic data on two population samples collected in a Hungarian speaking region of Transylvania, Romania. Allele frequency and profile databases were generated on 17 autosomal STR loci (D2S1338, D3S1358, D5S818, D7S820, D8S1179, D13S317, D16S539, D18S51, D19S433, D21S11, VWA, FGA, TH01, TPOX, CSF1PO, Penta E and Penta D) as well as at the 12 European Y-STR extended haplotype loci (DYS19, DYS389-I/II, DYS390, DYS391, DYS392, DYS393, DYS385 loci, DYS437, DYS438 and DYS439). Data were compared to a Central Hungarian (Budapest region) population sample [B. Egyed, S. Füredi, M. Angyal, L. Boutrand, A. Vandenberghe, J. Woller, Z. Padar, Analysis of eight STR loci in two Hungarian populations, Forensic Sci. Int. 113 (2000) 25-27] that was used as a reference group of the Hungarian population. Calculating the F(ST) indices and with the pairwise comparisons of interpopulation molecular variance (AMOVA) the two populations from Transylvania could be fit into the Hungarian population data showing less substructuring effects as compared to the previous findings in Hungary [B. Egyed, S. Füredi, M. Angyal, L. Boutrand, A. Vandenberghe, J. Woller, Z. Padar, Analysis of eight STR loci in two Hungarian populations, Forensic Sci. Int. 113 (2000) 25-27; B. Egyed, S. Füredi, M. Angyal, I. Balogh, L. Kalmar, Z. Padar, Analysis of the population heterogeneity in Hungary using fifteen forensically informative STR markers, Forensic Sci. Int. 158 (2005) 244-249].     

Educación jurídica,investigación y derechos humanos inteligentes

The recent studies on the genes, the neurons and the information, are influencing the form to know us and to know the reality. The opportunity is had, for this reason, to improve the formation of the professor and the students of the Right, to happen of an education of repetitions to one of new features, discovery, diversion, that is to say, investigation. One is to avoid “to transmit” information, but to explore it, to construct it, only to invent it, working in equipment, professor and students, inside and outside the hall classes. The contents to investigate can be placed in the past, the present or in the future, like the human rights. Thus, it is tried that the well-known or effective human rights, the products of the legal rationalism, are extended to protect the emotional human dignity: the respect, the confidence, the tolerance, the responsibility, the happiness, desire, the pleasure. Human intelligence is multiple, for that reason the human rights must be intelligent, that protect and develop the intellect, the affectivity, the corporal one, the energy, the environment and its cosmovisión.     

Capillary electrophoretic analysis of phosphorus species in clandestine methamphetamine laboratory samples

The clandestine manufacture of methamphetamine is a spreading epidemic. Manufacturing methods are constantly changing, necessitating the implementation of new analytical tools to identify materials from these labs. Characterization of phosphate, phosphite, and hypophosphite ions is necessary to distinguish the various phosphorus-iodine manufacturing methods that are popular methods for reducing pseudoephedrine to methamphetamine. This work describes a capillary electrophoresis method to separate acetate, azide, bromide, carbonate, chlorate, chloride, chromate, fluoride, hypophosphite, iodide, nitrate, nitrite, perchlorate, phosphate, phosphite, sulfate, sulfite, and thiocyanate. The CElixerOA 8.2 dynamic coating system was modified by lowering the capillary temperature to 15 degrees C and using an acid flush between runs to remove adsorbed materials. This allows detection of ions down to between 10 and 30 parts per million with percent relative standard deviations of normalized migration times under 0.1%. This method is a valuable tool for the characterization of phosphate, phosphite, and hypophosphite in routine analysis of clandestine methamphetamine manufacturing evidence and has a broader application in other areas of forensic analysis.     

校园暴力的形成与消解

校园暴力越来越明显地侵害到学生的安全和学校的教学秩序。校园暴力个案与暴力程度均有增长,帮派情形明显。校园暴力的形成和增长,与许多具体的相关因素如学生的低自尊、学生在学习或情绪困扰上的挫折、被排挤、逃学、帮派力量、药物和酒精滥用等有关系。学校过大、学生人数过多、缺乏人性化、缺乏交流、缺乏参与空间等,也有重要影响。家庭关爱缺失、影视与网络暴力影响、社会冲突、失业和贫困、医疗保健的缺乏等,也成为重要因素。政府在规划、财政支持和行政管理等方面,发挥着预防和处置校园暴力的重要职责。在政府的主导下,学校、社区与警察的三方合作,教师、学生与家庭的三方合作,是消解校园暴力的重要途径。