A local variance based approach to alleviate the scene content interference for source camera identification

Identifying the source camera of images is becoming increasingly important nowadays. A popular approach is to use a type of pattern noise called photo-response non-uniformity (PRNU). The noise of image contains the patterns which can be used as a fingerprint. Despite that, the PRNU-based approach is sensitive towards scene content and image intensity. The identification is poor in areas having low or saturated intensity, or in areas with complicated texture. The reliability of different regions is difficult to model in that it depends on the interaction of scene content and the characteristics of the denoising filter used to extract the noise. In this paper, we showed that the local variance of the noise residual can measure the reliability of the pixel for PRNU-based source camera identification. Hence, we proposed to use local variance to characterize the severeness of the scene content artifacts. The local variance is then incorporated to the general matched filter and peak to correlation energy (PCE) detector to provide an optimal framework for signal detection. The proposed method is tested against several state-of-art methods. The experimental results show that the local variance based approach outperformed other state-of-the-art methods in terms of identification accuracy.     

Assessment of Silicone Polymer Composites for Environmental Forensic Applications: A Proof of Concept Study*

Abstract: This study evaluates the use of polydimethylsiloxane polymer composites (PDMS, Fe–PDMS) as a passive sampling media to preconcentrate analytes found in environmental settings. Samplers were made using commercially available silicone products. The composite samplers were assessed for their sorption properties using Atrazine and Irgarol 1051 as model compounds. The initial study assessed the utility of PDMS sheets as adsorption material by following analyte depletion from spiked water samples by solid‐phase microextraction gas chromatography/mass spectrometry (GC/MS). Follow‐up studies conducted at high and low concentrations using lab manufactured iron‐ PDMS rods (Fe–PDMS) showed effective uptake at differential rates from concentrations ranging between 1 μg/L and 10 μg/L. Adsorption mechanism was reversible, and compounds were recovered from the exposed materials and analyzed by liquid–liquid extraction‐GC/MS. Both composites showed better affinity for Irgarol 1051, 100% removal, than for Atrazine, 30% removal, likely representing their K_OW differences, 3.6 and 2.6, respectively. This “proof of concept” study demonstrates the positive implications for the use of silicon polymer composites as a monitoring tool for environmental forensic purposes.     

基于ATT-3000的动态仿真取证技术研究

本文首先介绍了ATT-3000动态仿真取证系统的概念及特点,然后给出了利用该系统进行仿真和密码破解的过程,最后分析了其在仿真系统快速取证方面的典型应用。     

Cascading Bias of Initial Exposure to Information at the Crime Scene to the Subsequent Evaluation of Skeletal Remains,

Thirty‐eight participants took part in a study that investigated the potential cascading effects of initial exposure to extraneous context upon subsequent decision‐making. Participants investigated a mock crime scene, which included the excavation of clandestine burials that had a male skeletal cast dressed either in female or gender neutral clothing. This was followed by a forensic anthropological assessment of the skeletal remains, with a control group assessing the same male skeletal cast without any clothing context. The results indicated that the sex assessment was highly dependent upon the context in which participants were exposed to prior to the analysis. This was especially noticeable in the female clothing context where only one participant determined the male skeletal cast to be male. The results demonstrate the importance of understanding the role of context in forensic anthropology at an early stage of an investigation and its potential cascading effect on subsequent assessments.     

Web Content Management Systems: An Analysis of Forensic Investigatory Challenges

With an increase in the creation and maintenance of personal websites, web content management systems are now frequently utilized. Such systems offer a low cost and simple solution for those seeking to develop an online presence, and subsequently, a platform from which reported defamatory content, abuse, and copyright infringement has been witnessed. This article provides an introductory forensic analysis of the three current most popular web content management systems available, WordPress, Drupal, and Joomla! Test platforms have been created, and their site structures have been examined to provide guidance for forensic practitioners facing investigations of this type. Result's document available metadata for establishing site ownership, user interactions, and stored content following analysis of artifacts including Wordpress's wp_users, and wp_comments tables, Drupal's “watchdog” records, and Joomla!'s _users, and _content tables. Finally, investigatory limitations documenting the difficulties of investigating WCMS usage are noted, and analysis recommendations are offered.     

Accuracy and Repeatability of Trajectory Rod Measurement Using Laser Scanners

Three‐dimensional (3D) technologies contribute greatly to bullet trajectory analysis and shooting reconstruction. There are few papers which address the errors associated with utilizing laser scanning for bullet trajectory documentation. This study examined the accuracy and precision of laser scanning for documenting trajectory rods in drywall for angles between 25° and 90°. The inherent error range of 0.02°–2.10° was noted while the overall error for laser scanning ranged between 0.04° and 1.98°. The inter‐ and intraobserver errors for trajectory rod placement and virtual trajectory marking showed that the range of variation for rod placement was between 0.1°–1° in drywall and 0.05°–0.5° in plywood. Virtual trajectory marking accuracy tests showed that 75% of data values were below 0.91° and 0.61° on azimuth and vertical angles, respectively. In conclusion, many contributing factors affect bullet trajectory analysis, and the use of 3D technologies can aid in reduction of errors associated with documentation.     

Soil forensics: How far can soil clay analysis distinguish between soil vestiges?

Soil traces are useful as forensic evidences because they frequently adhere to individuals and objects associated with crimes and can place or discard a suspect at/from a crime scene. Soil is a mixture of organic and inorganic components and among them soil clay contains signatures that make it reliable as forensic evidence. In this study, we hypothesized that soils can be forensically distinguished through the analysis of their clay fraction alone, and that samples of the same soil type can be consistently distinguished according to the distance they were collected from each other. To test these hypotheses 16 Oxisol samples were collected at distances of between 2 m and 1.000 m, and 16 Inceptisol samples were collected at distances of between 2 m and 300 m from each other. Clay fractions were extracted from soil samples and analyzed for hyperspectral color reflectance (HSI), X-ray diffraction crystallographic (XRD), and for contents of iron oxides, kaolinite and gibbsite. The dataset was submitted to multivariate analysis and results were from 65% to 100% effective to distinguish between samples from the two soil types. Both soil types could be consistently distinguished for forensic purposes according to the distance that samples were collected from each other: 1000 m for Oxisol and 10 m for Inceptisol. Clay color and XRD analysis were the most effective techniques to distinguish clay samples, and Inceptisol samples were more easily distinguished than Oxisol samples. Soil forensics seems a promising field for soil scientists as soil clay can be useful as forensic evidence by using routine analytical techniques from soil science.     

‘The Sky is Falling!’ – Responses to the ‘Going Dark’ problem

The shared concern expressed in the two quotes below is that modern technologies provide criminals with a capability to evade investigation. This comment piece examines some of the policy and legal options available to governments and law enforcement agencies to try to address this concern. While accepting the claim that this phenomenon represents a real challenge to law enforcement agencies, we currently have insufficient evidence to show the true extent of the problem. What this piece does not accept is the implication contained in the quotes, and often made explicit by others, that the use of encryption represents a fundamental and irreversible shift in the balance of power between criminals and their investigators from what previously prevailed. Such claims tend to lack historical perspective, which is one of the themes of this 200th issue of Computer Law and Security Review.     

论刑事诉讼中的电子数据

2012年修改的《刑事诉讼法》将电子数据首次规定为法定证据种类,但电子数据的相关证据规则仍不够完善。我国现有关于电子数据的研究多集中于电子数据取证、鉴定等技术方法,缺少对电子数据证据能力、证明力及证据规则的研究。从电子数据在司法实践中存在的问题出发,在电子数据的证据属性,电子数据的鉴真、鉴定,非法证据排除规则等几个方面探讨如何加强对电子数据的证据限制问题。     

Out of sight,but not out of mind: Traces of nearby devices' wireless transmissions in volatile memory

An IEEE 802.11 wireless device can leave traces of its presence in the volatile memories of nearby wireless devices. While the devices need to be in radio range of each other for this to happen, they do not need to be connected to the same network—or to any network at all. Traces appear in the form of full wire-type frames; a residue of the signals in the ether. We examine types of information that can be extracted from such residual frames and explore the conditions under which traces develop and persist. Their availability is determined by factors in both in the external environment (the types of signals in the ether) and the internal environment (the configuration and particulars of a device's wifi stack). To isolate some of these factors, we have created memory dumps of devices in various environments and configurations. Analysis of the dumps has offered insights into the conditions determining creation and decay of the traces. The results indicate that they will be available in a limited number of real-world scenarios. We conclude with practical advice on triaging and preservation.