Rapid and non-destructive differentiation of Shahtoosh from Pashmina/Cashmere wool using ATR FT-IR spectroscopy

Shahtoosh, the most expensive and sought-after wool in the illegal wildlife trade is obtained from the underfur of a critically endangered species-the Tibetan Antelope (Pantholops hodgsonii). It is often adulterated or mixed with the wool of Pashmina goat (Capra aegagrus hircus) for making shawls, scarves and other woolen articles to maximize the profit. The comparable fineness, color and texture, makes it a challenging task in wildlife forensics to differentiate them. In this study, an attempt has been made to differentiate 50 reference unprocessed underfur hairs from five individuals of each species using ATR FT-IR spectroscopy in combination with chemometric tools such as PCA, and PLS-DA. Results of PCA model demonstrated slight overlap and thus failed to distinguish hairs of these two species. Subsequently, PLS-DA model was employed, and also validation tests (external and blind testing) were carried out to ensure the predictive ability of the model, which resulted in 100% accuracy. The results of PLS-DA model exhibited complete differentiation between Shahtoosh, Pashmina and Angora (Oryctolagus cuniculus domesticus) wool used for external validation study with highly significant predictive ability (R-square value 0.99). This proof-of-concept study illustrates the potential of ATR FT-IR spectroscopy to complement current forensic microscopic and DNA based technique to analyze hair evidence in wildlife investigations owing to its rapid and non-destructive nature with high degree of confidence, and its ease-of-use with minimal to no sample preparation.     

论行政诉讼被告举证时限制度

证据制度是诉讼制度的核心,证据制度的改革与完善不仅是建立现代司法制度的重要环节,也是实现司法公正的重要保证。举证时限制度作为证据制度不可或缺的组成部分,是实现程序公正的需要。在我国,刑事诉讼法与民事诉讼法并没有真正建立举证时限制度。由于现行的行政诉讼被告举证时限制度设立不久,无论理论还是实务,开掘深度与实践要求差距都较大,存在着许多缺陷和不足。文中在分析我国行政诉讼被告举证时限缺陷的基础上提出了完善我国行政诉讼被告举证时限制度的若干立法建议。     

Language translation for file paths

Forensic examiners are frequently confronted with content in languages that they do not understand, and they could benefit from machine translation into their native language. But automated translation of file paths is a difficult problem because of the minimal context for translation and the frequent mixing of multiple languages within a path. This work developed a prototype implementation of a file-path translator that first identifies the language for each directory segment of a path, and then translates to English those that are not already English nor artificial words. Brown's LA-Strings utility for language identification was tried, but its performance was found inadequate on short strings and it was supplemented with clues from dictionary lookup, Unicode character distributions for languages, country of origin, and language-related keywords. To provide better data for language inference, words used in each directory over a large corpus were aggregated for analysis. The resulting directory-language probabilities were combined with those for each path segment from dictionary lookup and character-type distributions to infer the segment's most likely language. Tests were done on a corpus of 50.1 million file paths looking for 35 different languages. Tests showed 90.4% accuracy on identifying languages of directories and 93.7% accuracy on identifying languages of directory/file segments of file paths, even after excluding 44.4% of the paths as obviously English or untranslatable. Two of seven proposed language clues were shown to impair directory-language identification. Experiments also compared three translation methods: the Systran translation tool, Google Translate, and word-for-word substitution using dictionaries. Google Translate usually performed the best, but all still made errors with European languages and a significant number of errors with Arabic and Chinese.     

A systematic approach to study electoral fraud

Integrity of elections relies on fair procedures at different stages of the election process, and fraud can occur in many instances and different forms. This paper provides a general approach for the detection of fraud. While most existing contributions focus on a single instance and form of fraud, we propose a more encompassing approach, testing for several empirical implications of different possible forms of fraud. To illustrate this approach we rely on a case of electoral irregularities in one of the oldest democracies: In a Swiss referendum in 2011, one in twelve municipalities irregularly destroyed the ballots, rendering a recount impossible. We do not know whether this happened due to sloppiness, or to cover possible fraudulent actions. However, one of our statistical tests leads to results, which point to irregularities in some of the municipalities, which lost their ballots: they reported significantly fewer empty ballots than the other municipalities. Relying on several tests leads to the well known multiple comparisons problem. We show two strategies and illustrate strengths and weaknesses of each potential way to deal with multiple tests.     

Integrity verification of user space code

We present a novel approach for the construction and application of cryptographic hashes to user space memory for the purposes of verifying the provenance of code in memory images. Several key aspects of Windows behaviour which influence this process are examined in-depth. Our approach is implemented and evaluated on a selection of malware samples with user space components as well as a collection of common Windows applications. The results demonstrate that our approach is highly effective at reducing the amount of memory requiring manual analysis, highlighting the presence of malicious code in all the malware sampled.     

Descrambling data on solid-state disks by reverse-engineering the firmware

Data recovery is an important component of digital forensic research. Although recovering data from hard drives or small-scale mobile devices has been well studied, solid-state disks (SSDs) have a very different internal architecture and some additional functions, and it is not clear whether these differences will have an effect on data recovery. Data scrambling is an additional function of an SSD controller which can improve data reliability, but makes data recovery difficult. In this research, the dedicated flash software was first introduced that can acquire the physical image of an SSD without destroying the device hardware. Based on the software, a validation experiment was presented to evaluate the effect of data scrambling on data recovery and the causes of the effect were analyzed. Then two approaches to descrambling the data in the flash chips were proposed and their advantages and disadvantages discussed. After that, a procedure to identify the scrambling seeds that are used to descramble the scrambled data was described. Finally, descrambling software was implemented based on the second descrambling method. The experiment shows that this software can successfully descramble the data from an SSD flash drive regardless of the internal structure of the scrambler in the SSD controller and can generate an unscrambled physical image on which most existing data-recovery techniques can be effective.     

手机物证检验及其在刑事侦查中的应用

随着移动通信技术的迅速发展和广泛应用,手机内部包含的信息已经成为犯罪侦查重要的线索和证据来源。采用专门的符合物证鉴定原理要求的技术方法检验手机的SIM卡存储器、主板存储器和闪存卡,可以获得大量的手机使用者个人信息、通信内容信息、通信发生信息、使用者写入存储信息和手机设置信息等大量信息资料。手机检验结果给出的这些信息具有非常高的侦查和证据价值的,手机也因此成为物证鉴定领域内一个新的检验对象。     

Microbial metagenome profiling using amplicon length heterogeneity-polymerase chain reaction proves more effective than elemental analysis in discriminating soil specimens

The combination of soil's ubiquity and its intrinsic abiotic and biotic information can contribute greatly to the forensic field. Although there are physical and chemical characterization methods of soil comparison for forensic purposes, these require a level of expertise not always encountered in crime laboratories. We hypothesized that soil microbial community profiling could be used to discriminate between soil types by providing biological fingerprints that confer uniqueness. Three of the six Miami-Dade soil types were randomly selected and sampled. We compared the microbial metagenome profiles generated using amplicon length heterogeneity-polymerase chain reaction analysis of the 16S rRNA genes with inductively coupled plasma optical emission spectroscopy analysis of 13 elements (Al, B, Ca, Cu, Fe, K, Mg, Mn, Na, P, S, Si, and Zn) that are commonly encountered in soils. Bray-Curtis similarity index and analysis of similarity were performed on all data to establish differences within sites, among sites, and across two seasons. These data matrices were used to group samples that shared similar community patterns using nonmetric multidimensional scaling analysis. We concluded that while chemical characterization could provide some differentiation between soils, microbial metagenome profiling was better able to discriminate between the soil types and had a high degree of reproducibility, therefore proving to be a potential tool for forensic soil comparisons.     

Using anisotropic diffusion for efficient extraction of sensor noise in camera identification

Each digital camera has an intrinsic fingerprint that is unique to each camera. This device fingerprint can be extracted from an image and can be compared with a reference device fingerprint to determine the device origin. The complexity of the filters proposed to accomplish this is increasing. In this note, we use a relatively simple algorithm to extract the sensor noise from images. It has the advantages of being easy to implement and parallelize, and working faster than the wavelet filter that is common for this application. In addition, we compare the performance with a simple median filter and assess whether a previously proposed fingerprint enhancement technique improves results. Experiments are performed on approximately 7500 images originating from 69 cameras, and the results are compared with this often used wavelet filter. Despite the simplicity of the proposed method, the performance exceeds the common wavelet filter and reduces the time needed for the extraction.     

从一起经济纠纷案看电子证据司法鉴定

随着信息技术的快速发展和普及,电子证据司法鉴定工作的综合性和复杂性特征日益突出。通过以一起经济纠纷案为例,综合论述了某公司商用计算机系统的检验鉴定过程,文中涉及的主要技术包括商用管理软件分析、硬盘阵列重组、数据库检验等,在这类案件司法鉴定工作中具有一定的代表性。