Resurrecting the Dodo: Positive control DNA for species identification

Positive controls are necessary standards for inclusion in forensic tests. When working as expected they demonstrate that methods have been applied correctly, and therefore results can be interpreted with confidence. However, the requirement for positive controls can also introduce problems. For species identification in wildlife DNA forensic testing, it is possible that the DNA sequence of the case sample will be a 100% match to the positive control. Whilst clear results for negative controls will indicate that cross-contamination is unlikely, it would be preferable to have a positive control that will not appear in casework. In addition, for many endangered species, obtaining positive control DNA for species-specific testing can be problematic. Here we present a simple method to use artificially generated positive control DNA from the extinct Dodo, Raphus cucullatus, for four species-identification tests run routinely in UK wildlife forensic casework.     

Forensic Investigation of Cooperative Storage Cloud Service: Symform as a Case Study

Researchers envisioned Storage as a Service (StaaS) as an effective solution to the distributed management of digital data. Cooperative storage cloud forensic is relatively new and is an under‐explored area of research. Using Symform as a case study, we seek to determine the data remnants from the use of cooperative cloud storage services. In particular, we consider both mobile devices and personal computers running various popular operating systems, namely Windows 8.1, Mac OS X Mavericks 10.9.5, Ubuntu 14.04.1 LTS, iOS 7.1.2, and Android KitKat 4.4.4. Potential artefacts recovered during the research include data relating to the installation and uninstallation of the cloud applications, log‐in to and log‐out from Symform account using the client application, file synchronization as well as their time stamp information. This research contributes to an in‐depth understanding of the types of terrestrial artifacts that are likely to remain after the use of cooperative storage cloud on client devices.     

Forensic Taxonomy of Android Social Apps

An Android social app taxonomy incorporating artifacts that are of forensic interest will enable users and forensic investigators to identify the personally identifiable information (PII) stored by the apps. In this study, 30 popular Android social apps were examined. Artifacts of forensic interest (e.g., contacts lists, chronology of messages, and timestamp of an added contact) were recovered. In addition, images were located, and Facebook token strings used to tie account identities and gain access to information entered into Facebook by a user were identified. Based on the findings, a two‐dimensional taxonomy of the forensic artifacts of the social apps is proposed. A comparative summary of existing forensic taxonomies of different categories of Android apps, designed to facilitate timely collection and analysis of evidentiary materials from Android devices, is presented.     

Visualizing Digital Forensic Datasets: A Proof of Concept

Digital forensic visualization is an understudied area despite its potential to achieve significant improvements in the efficiency of an investigation, criminal or civil. In this study, a three‐stage forensic data storage and visualization life cycle is presented. The first stage is the decoding of data, which involves preparing both structured and unstructured data for storage. In the storage stage, data are stored within our proposed database schema designed for ensuring data integrity and speed of storage and retrieval. The final stage is the visualization of stored data in a manner that facilitates user interaction. These functionalities are implemented in a proof of concept to demonstrate the utility of the proposed life cycle. The proof of concept demonstrates the utility of the proposed approach for the storage and visualization of digital forensic data.     

Advanced Framework for Digital Forensic Technologies and Procedures*

Abstract: Recent trends in global networks are leading toward service‐oriented architectures and sensor networks. On one hand of the spectrum, this means deployment of services from numerous providers to form new service composites, and on the other hand this means emergence of Internet of things. Both these kinds belong to a plethora of realms and can be deployed in many ways, which will pose serious problems in cases of abuse. Consequently, both trends increase the need for new approaches to digital forensics that would furnish admissible evidence for litigation. Because technology alone is clearly not sufficient, it has to be adequately supported by appropriate investigative procedures, which have yet become a subject of an international consensus. This paper therefore provides appropriate a holistic framework to foster an internationally agreed upon approach in digital forensics along with necessary improvements. It is based on a top‐down approach, starting with legal, continuing with organizational, and ending with technical issues. More precisely, the paper presents a new architectural technological solution that addresses the core forensic principles at its roots. It deploys so‐called leveled message authentication codes and digital signatures to provide data integrity in a way that significantly eases forensic investigations into attacked systems in their operational state. Further, using a top‐down approach a conceptual framework for forensics readiness is given, which provides levels of abstraction and procedural guides embellished with a process model that allow investigators perform routine investigations, without becoming overwhelmed by low‐level details. As low‐level details should not be left out, the framework is further evaluated to include these details to allow organizations to configure their systems for proactive collection and preservation of potential digital evidence in a structured manner. The main reason behind this approach is to stimulate efforts on an internationally agreed “template legislation,” similarly to model law in the area of electronic commerce, which would enable harmonized national implementations in the area of digital forensics.     

Gamma Irradiation as a Biological Decontaminant and Its Effect on Common Fingermark Detection Techniques and DNA Profiling

Abstract:  The use of disease-causing organisms and their toxins against the civilian population has defined bioterrorism and opened forensic science up to the challenges of processing contaminated evidence. This study sought to determine the use of gamma irradiation as an effective biological decontaminant and its effect on the recovery of latent fingermarks from both porous and nonporous items. Test items were contaminated with viable spores marked with latent prints and then decontaminated using a cobalt 60 gamma irradiator. Fingermark detection was the focus with standard methods including 1,2-indanedione, ninhydrin, diazafluoren-9-one, and physical developer used during this study. DNA recovery using 20% Chelex extraction and quantitative real-time polymerase chain reaction was also explored. Gamma irradiation proved effective as a bacterial decontaminant with D -values ranging from 458 to 500 Gy for nonporous items and 797–808 Gy for porous ones. The results demonstrated the successful recovery of latent marks and DNA establishing gamma irradiation as a viable decontamination option.     

A review of quality procedures in the UK forensic sciences: What can the field of digital forensics learn?

With a reliance on the various forms of forensic science evidence in complex criminal investigations, the measures for ensuring its quality are facing increasing scrutiny. Improvements to quality management systems, to ensure both the robust application of scientific principles and the accurate interpretation and reporting of results, have arisen as a consequence of high-profile rebuttals of forensic science evidence, combined with process improvements driven by evaluation of current practice. These improvements are crucial to ensure validity of results as well as providing assurance for all those involved in the Criminal Justice System. This work first examines the quality management systems utilised for the examination and analysis of fingerprint, body fluid and DNA evidence. It then proceeds to highlight an apparent lack of comparable quality assurance mechanisms within the field of digital forensics, one of the newest branches of forensic science. Proposals are provided for the improvement of quality assurance for the digital forensics arena, drawing on the experiences of, and more well-established practices within, other forensic disciplines.     

Forensic investigation of cross platform massively multiplayer online games: Minecraft as a case study

Minecraft, a Massively Multiplayer Online Game (MMOG), has reportedly millions of players from different age groups worldwide. With Minecraft being so popular, particularly with younger audiences, it is no surprise that the interactive nature of Minecraft has facilitated the commission of criminal activities such as denial of service attacks against gamers, cyberbullying, swatting, sexual communication, and online child grooming. In this research, there is a simulated scenario of a typical Minecraft setting, using a Linux Ubuntu 16.04.3 machine (acting as the MMOG server) and Windows client devices running Minecraft. Server and client devices are then examined to reveal the type and extent of evidential artefacts that can be extracted.     

Comparison of Different Swabs for Sampling Inorganic Gunshot Residue from Gunshot Wounds: Applicability and Reliability for the Determination of Firing Distance

This study concentrates on samples of bare pork skin, with and without bristles, and dried bovine ribs shot with a semi‐automatic pistol to find the best methodology and sampling surface in the search for inorganic gunshot residues (IGSR). Four quadrants of known surface areas were sampled at different distances from the bullet's hole with different swabs: tapes in graphite, Leukosilk® white tape, 3M® transparent tape, and a cotton swab to assess the technique able to collect the highest amounts of IGSR with the lowest contribution of the blank. The cotton swab wet in 10% HNO₃ gave the best results. The highest amounts of IGSR, measured by ICP‐OES and MS, were detected on a surface of 3‐cm radius from the bullet's edge. The amount of metals collected decreased with the firing distance between 20 and 60 cm. The procedure was efficient for sampling different tissues like skin and bones.     

A Forensic Examination of Online Search Facility URL Record Structures

The use of search engines and associated search functions to locate content online is now common practice. As a result, a forensic examination of a suspect's online search activity can be a critical aspect in establishing whether an offense has been committed in many investigations. This article offers an analysis of online search URL structures to support law enforcement and associated digital forensics practitioners interpret acts of online searching during an investigation. Google, Bing, Yahoo!, and DuckDuckGo searching functions are examined, and key URL attribute structures and metadata have been documented. In addition, an overview of social media searching covering Twitter, Facebook, Instagram, and YouTube is offered. Results show the ability to extract embedded metadata from search engine URLs which can establish online searching behaviors and the timing of searches.