Automated mapping of large binary objects using primitive fragment type classification

Security analysts, reverse engineers, and forensic analysts are regularly faced with large binary objects, such as executable and data files, process memory dumps, disk images and hibernation files, often Gigabytes or larger in size and frequently of unknown, suspect, or poorly documented structure. Binary objects of this magnitude far exceed the capabilities of traditional hex editors and textual command line tools, frustrating analysis. This paper studies automated means to map these large binary objects by classifying regions using a multi-dimensional, information-theoretic approach. We make several contributions including the introduction of the binary mapping metaphor and its associated applications, as well as techniques for type classification of low-level binary fragments. We validate the efficacy of our approach through a series of classification experiments and an analytic case study. Our results indicate that automated mapping can help speed manual and automated analysis activities and can be generalized to incorporate many low-level fragment classification techniques.     

Advanced carving techniques

Carving is the term most often used to indicate the act of recovering a file from unstructured digital forensic images. The term unstructured indicates that the original digital image does not contain useful filesystem information which may be used to assist in this recovery.Typically, forensic analysts resort to carving techniques as an avenue of last resort due to the difficulty of current techniques. Most current techniques rely on manual inspection of the file to be recovered and manually reconstructing this file using trial and error. Manual processing is typically impractical for modern disk images which might contain hundreds of thousands of files.At the same time the traditional process of recovering deleted files using filesystem information is becoming less practical because most modern filesystems purge critical information for deleted files. As such the need for automated carving techniques is quickly arising even when a filesystem does exist on the forensic image.This paper explores the theory of carving in a formal way. We then proceed to apply this formal analysis to the carving of PDF and ZIP files based on the internal structure inherent within the file formats themselves. Specifically this paper deals with carving from the Digital Forensic Research Work-Shop's (DFRWS) 2007 carving challenge.     

Validation study of KPICS SpermFinder™ by NicheVision Forensics, LLC for the identification of human spermatozoa

Abstract: Microscopic analysis for the identification of spermatozoa is commonly performed during the forensic examination of sexual assault evidence. Two widely utilized methods for the confirmation of the presence of spermatozoa are visualization of the cells via phase‐contrast microscopy with wet mounted samples and bright field microscopy with histologically stained samples. The KPICS SpermFinder? by NicheVision Forensics, LLC accelerates this time‐consuming process via an automated microscope with an algorithm designed to locate spermatozoa on a Christmas tree histologically stained microscope slide. Upon a qualified scientist’s review of the generated data, the KPICS SpermFinder? was able to locate spermatozoa, typically finding on average 106.28% ± 115.37% more spermatozoa than with manual examinations. The KPICS SpermFinder? provided the location of identified cells with reproducible results.     

An Evaluation of Standardized Software for Processing GC/MS Data from Different Vendors' Instruments in a Forensic Laboratory

Forensic science laboratories perform analyses on a variety of materials using gas chromatography/mass spectrometry (GC/MS). Instruments from different vendors may be used, requiring analysts to be proficient in the use of multiple proprietary software packages for collecting and processing data. There is no standardized GC/MS software available that can acquire data from different vendors' instruments. However, there are third‐party processing software products that can import data files in different formats. The Centre of Forensic Sciences compared the data processing performance of one such product, ACD/MS Manager Suite, with three instrument vendors' software used for casework analysis. This product was tested for its compatibility with the existing software, its capability to load and present data, and to initiate searches of commercial libraries. The study shows that the MS Manager module provides a means for the forensic analyst to view, process, and report on data from different sources in one software package.     

Mitochondrial DNA typing screens with control region and coding region SNPs

Mitochondrial DNA (mtDNA) analysis has found an important niche in forensic DNA typing. It is used with highly degraded samples or low-copy number materials such as might be found from shed hair or bones exposed to severe environmental conditions. The primary advantage of mtDNA is that it is present in high copy number within cells and therefore more likely to be recovered from highly degraded specimens. A major disadvantage to traditional forensic mtDNA analysis is that it is time-consuming and labor-intensive to generate and review the 610 nucleotides of sequence information commonly targeted in hypervariable regions I and II (HVI and HVII) of the control region. In addition, common haplotypes exist in HVI/HVII mtDNA sequences that can reduce the ability to differentiate two unrelated samples. In this report we describe the utility of two newly available screening assays for rapid exclusion of non-matching samples. The LINEAR ARRAY mtDNA HVI/HVII Region-Sequencing Typing Kit (Roche Applied Science, Indianapolis, IN) was used to type 666 individuals from U.S. Caucasian, African American, and Hispanic groups. Processing of the LINEAR ARRAY probe panels "mito strips" was automated on a ProfiBlot workstation. Observable variation in 666 individuals is reported and frequencies of the mitotypes within and between populations are presented. Samples exhibiting the most common Caucasian mitotype were subdivided with a multiplexed amplification and detection assay using eleven single nucleotide polymorphisms in the mitochondrial genome. These types of screening assays should enable more rapid evaluation of forensic casework samples such that only samples not excluded would be subjected to further characterization through full HVI/HVII mtDNA sequence analysis.     

人线粒体DNA序列分析在法医学中的应用研究及其进展

综述人线粒体DNA(m tDNA)序列分析在法医学种属鉴别、个体识别,以及个体年龄推断中的应用研究及其进展,展望对m tDNA异质性的研究及建立人m tDNA数据库,并具有重要的法医学实践意义。     

mtDNAprofiler: A Web Application for the Nomenclature and Comparison of Human Mitochondrial DNA Sequences,

Mitochondrial DNA (mtDNA) is a valuable tool in the fields of forensic, population, and medical genetics. However, recording and comparing mtDNA control region or entire genome sequences would be difficult if researchers are not familiar with mtDNA nomenclature conventions. Therefore, mtDNAprofiler, a Web application, was designed for the analysis and comparison of mtDNA sequences in a string format or as a list of mtDNA single‐nucleotide polymorphisms (mtSNPs). mtDNAprofiler which comprises four mtDNA sequence‐analysis tools (mtDNA nomenclature, mtDNA assembly, mtSNP conversion, and mtSNP concordance‐check) supports not only the accurate analysis of mtDNA sequences via an automated nomenclature function, but also consistent management of mtSNP data via direct comparison and validity‐check functions. Since mtDNAprofiler consists of four tools that are associated with key steps of mtDNA sequence analysis, mtDNAprofiler will be helpful for researchers working with mtDNA. mtDNAprofiler is freely available at http://mtprofiler.yonsei.ac.kr .     

Human hair histogenesis for the mitochondrial DNA forensic scientist.

Analysis of mitochondrial DNA (mtDNA) sequence from human hairs has proven to be a valuable complement to traditional hair comparison microscopy in forensic cases when nuclear DNA typing is not possible. However, while much is known about the specialties of hair biology and mtDNA sequence analysis, there has been little correlation of individual information. Hair microscopy and hair embryogenesis are subjects that are sometimes unfamiliar to the forensic DNA scientist. The continual growth and replacement of human hairs involves complex cellular transformation and regeneration events. In turn, the analysis of mtDNA sequence data can involve complex questions of interpretation (e.g., heteroplasmy and the sequence variation it may cause within an individual, or between related individuals. In this paper we review the details of hair developmental histology, including the migration of mitochondria in the growing hair, and the related interpretation issues regarding the analysis of mtDNA data in hair. Macroscopic and microscopic hair specimen classifications are provided as a possible guide to help forensic scientists better associate mtDNA sequence heteroplasmy data with the physical characteristics of a hair. These same hair specimen classifications may also be useful when evaluating the relative success in sequencing different types and/or forms of human hairs. The ultimate goal of this review is to bring the hair microscopist and forensic DNA scientist closer together, as the use of mtDNA sequence analysis continues to expand.     

Automated PCR setup for forensic casework samples using the Normalization Wizard and PCR Setup robotic methods

Human genome, pharmaceutical and research laboratories have long enjoyed the application of robotics to performing repetitive laboratory tasks. However, the utilization of robotics in forensic laboratories for processing casework samples is relatively new and poses particular challenges. Since the quantity and quality (a mixture versus a single source sample, the level of degradation, the presence of PCR inhibitors) of the DNA contained within a casework sample is unknown, particular attention must be paid to procedural susceptibility to contamination, as well as DNA yield, especially as it pertains to samples with little biological material. The Virginia Department of Forensic Science (VDFS) has successfully automated forensic casework DNA extraction utilizing the DNA IQ(trade mark) System in conjunction with the Biomek 2000 Automation Workstation. Human DNA quantitation is also performed in a near complete automated fashion utilizing the AluQuant Human DNA Quantitation System and the Biomek 2000 Automation Workstation. Recently, the PCR setup for casework samples has been automated, employing the Biomek 2000 Automation Workstation and Normalization Wizard, Genetic Identity version, which utilizes the quantitation data, imported into the software, to create a customized automated method for DNA dilution, unique to that plate of DNA samples. The PCR Setup software method, used in conjunction with the Normalization Wizard method and written for the Biomek 2000, functions to mix the diluted DNA samples, transfer the PCR master mix, and transfer the diluted DNA samples to PCR amplification tubes. Once the process is complete, the DNA extracts, still on the deck of the robot in PCR amplification strip tubes, are transferred to pre-labeled 1.5 mL tubes for long-term storage using an automated method. The automation of these steps in the process of forensic DNA casework analysis has been accomplished by performing extensive optimization, validation and testing of the software methods.     

Automated DNA extraction using the QIAsymphony platform: Estimation of DNA recovery from simulated forensic stains

The aim of this study was to evaluate the forensic protocol recently developed by Qiagen for the QIAsymphony automated DNA extraction platform. Samples containing low amounts of DNA were specifically considered, since they represent the majority of samples processed in our laboratory. The analysis of simulated blood and saliva traces showed that the highest DNA yields were obtained with the maximal elution volume available for the forensic protocol, that is 200 μl. Resulting DNA extracts were too diluted for successful DNA profiling and required a concentration. This additional step is time consuming and potentially increases inversion and contamination risks. The 200 μl DNA extracts were concentrated to 25 μl, and the DNA recovery estimated with real-time PCR as well as with the percentage of SGM Plus alleles detected. Results using our manual protocol, based on the QIAamp DNA mini kit, and the automated protocol were comparable. Further tests will be conducted to determine more precisely DNA recovery, contamination risk and PCR inhibitors removal, once a definitive procedure, allowing the concentration of DNA extracts from low yield samples, will be available for the QIAsymphony.     

A silica-based mitochondrial DNA extraction method applied to forensic hair shafts and teeth

The purpose of this study is to evaluate the applicability of a nonorganic DNA extraction method for use in the analysis of environmentally compromised forensic hair shaft and tooth samples. The condition of the samples included cases of water decomposition, severe incineration, and varying stages of putrefaction. Enzymatic amplification and manual sequencing of the first segment of the mitochondrial hypervariable region were performed successfully on each of the 20 autopsied individuals. The results indicate that the silica-based extraction method produces mtDNA suitable for genetic identification from forensic samples including hair shafts and teeth.     

Validation of the barcoding gene COI for use in forensic genetic species identification

The application of forensics to wildlife crime investigation routinely involves genetic species identification based on DNA sequence similarity. This work can be hindered by a lack of authenticated reference DNA sequence data resulting in weak matches between evidence and reference samples. The introduction of DNA barcoding has highlighted the expanding use of the mtDNA gene, cytochrome c oxidase I (COI), as a genetic marker for species identification. Here, we assess the COI gene for use in forensic analysis following published human validation guidelines. Validation experiments investigated reproducibility, heteroplasmy, mixed DNA, DNA template concentration, chemical treatments, substrate variation, environmental conditions and thermocycling parameters. Sequence similarity searches using both GenBank BLASTn and BOLD search engines indicated that the COI gene consistently identifies species where authenticated reference sequence data exists. Where misidentification occurred the cause was attributable to either erroneous reference sequences from published data, or lack of primer specificity. Although amplification failure was observed under certain sample treatments, there was no evidence of environmentally induced sequence mutation in those sequences that were generated. A simulated case study compared the performance of COI and cytochrome b mtDNA genes. Findings are discussed in relation to the utility of the COI gene in forensic species identification.     

A new technology in mtDNA sequencing: Success rates vs time

Study of mitochondrial DNA (mtDNA) control region is a current practice in forensic genetics. In our service, mtDNA analysis is performed in many evidentiary specimens. Evaluation of this methodology is important to improve quality, increase efficiency and decrease artefacts, in order to reduce costs and time consuming.A case with 12 reference samples (bucal swabs) and 190 telogenic hair specimens extracted with DNA IQ™ System Tissue and Hair Extraction Kit (Promega) is reported. HVS-1 and HVS-2 control regions were sequenced with BigDye^® Terminator v1.1 Kit (Applied Biosystems), using BetterBuffer (Microzone Limited), followed by a simple bead purification method (XTerminator) to remove unincorporated terminators. Application of this procedure had success in 180 hair samples within a very short time comparing to dRhodamine/ethanolic precipitation sequencing strategy and also demonstrated that better results are achieved with clean sequence data closer to the primer.The quality of data produced by the BigDye/BetterBuffer/XTerminator (BDX) procedure has been demonstrated to be very high. Besides that the BDX procedure can significantly reduce overall processing time and cost per reaction. This new methodology has additional advantages like fewer reagent transfers and smaller amounts of DNA.     

A DNA microarray system for forensic SNP analysis

Forensic DNA analysis is routinely performed using polymorphic short tandem repeat (STR) markers. However, for degraded or minute DNA samples, analysis of autosomal single nucleotide polymorphisms (SNPs) in short fragments might be more successful. Furthermore, sequencing of mitochondrial DNA (mtDNA) is often performed on highly degraded or scarce samples due to the high copy number of mtDNA in each cell. Due to the increasing number of complete mtDNA genome sequences available, the limited discrimination power of an mtDNA analysis, may be increased by analysis of coding region polymorphisms in addition to the non-coding variation. Since sequence analysis of the coding region would require more material than generally present in forensic samples, an alternative SNP analysis approach is required. We have developed a one-colour microarray-based SNP detection system for limited forensic materials. The method is based on minisequencing in solution prior to hybridisation to universal tag-arrays. In a first outline of a forensic chip, a combination of 12 nuclear and 21 mitochondrial SNP markers are analysed simultaneously. The mitochondrial markers on the chip are polymorphisms within the hypervariable region as well as in the coding region. Even though the number of markers in the current system is limited, it can easily be extended to yield a greater power of discrimination. When fully developed, microarray analysis provides a promising system for efficient sensitive SNP analysis of forensic samples in the future.     

Mitochondrial DNA analysis of the presumptive remains of Jesse James

We report here the results of mtDNA analysis of remains exhumed in July, 1995 from Mt. Olivet Cemetery in Kearney, Nebraska, that are thought to be those of Jesse James. The remains were poorly preserved, presumably due to wet and slightly acidic soil conditions, and insufficient DNA for analysis was obtained from two bone samples. However, two of four teeth, and two hairs recovered in 1978 from the original burial site on the James Farm, did yield reproducible mtDNA sequences. These mtDNA sequences from the teeth and hairs were all identical, suggesting that they came from the same individual; furthermore, this mtDNA sequence was identical to mtDNA sequences determined from blood samples from two maternal relatives of Jesse James. Therefore, either the remains are indeed those of Jesse James, or they are from an unrelated individual who, by chance, happens to have the same mtDNA sequence. To assess the probability that an unrelated individual would have the same sequence, we searched the forensic mtDNA database, and found that this sequence does not appear among the 2426 mtDNA sequences therein. Hence, the mtDNA analysis supports the identification of the exhumed remains from Mt. Olivet Cemetery as those of Jesse James.     

Detection and quantification of the age-related point mutation A189G in the human mitochondrial DNA

Mutation analysis in the mitochondrial DNA (mtDNA) control region is widely used in population genetic studies as well as in forensic medicine. Among the difficulties linked to the mtDNA analysis, one can find the detection of heteroplasmy, which can be inherited or somatic. Recently, age-related point mutation A189G was described in mtDNA and shown to accumulate with age in muscles. We carried out the detection of this 189 heteroplasmic point mutation using three technologies: automated DNA sequencing, Southern blot hybridization using a digoxigenin-labeled oligonucleotide probe, and peptide nucleic acid (PNA)/real-time PCR combined method on different biological samples. Our results give additional information on the increase in mutation frequency with age in muscle tissue and revealed that the PNA/real-time PCR is a largely more sensitive method than DNA sequencing for heteroplasmy detection. These investigations could be of interest in the detection and interpretation of mtDNA heteroplasmy in anthropological and forensic studies.     

Forensic casework analysis using the HVI/HVII mtDNA linear array assay

The mitochondrial hypervariable regions I and II have proven to be a useful target for analysis of forensic materials, in which the amount of DNA is limited or highly degraded. Conventional mitochondrial DNA (mtDNA) sequencing can be time-consuming and expensive, limitations that can be minimized using a faster and less expensive typing assay. We have evaluated the exclusion capacity of the linear array mtDNA HVI/HVII region-sequence typing assay (Roche Applied Science) in 16 forensic cases comprising 90 samples. Using the HVI/HVII mtDNA linear array, 56% of the samples were excluded and thus less than half of the samples require further sequencing due to a match or inconclusive results. Of all the samples that were excluded by sequence analysis, 79% could be excluded using the HVI/HVII linear array alone. Using the HVI/HVII mtDNA linear array assay, we demonstrate the potential to decrease sequencing efforts substantially and thereby reduce the cost and the turn-around time in casework analysis.