Microsoft SQL Server数据库中删除数据的恢复

目的恢复Microsoft SQL Server数据库中删除数据。方法解析SQL Server的数据文件和日志文件结构,使用Lumigent Log Explorer软件分析提取的日志中的记录。结果从某案件提取的数据库日志文件中提取有效记录70万余条。结论该方法可以分析并且提取Microsoft SQL Server日志文件中的记录,恢复被删除数据,具有很强的实用性。     

A LOG‐MULTIPLICATIVE ASSOCIATION MODEL FOR ALLOCATING HOMICIDES WITH UNKNOWN VICTIM‐OFFENDER RELATIONSHIPS*

This research note critically evaluates conventional methods for allocating homicides with an unknown victim/offender relationship to meaningful categories, and it proposes an alternative approach. We argue that conventional methods are based on a problematic assumption, namely, that the missing data mechanism is “ignorable.” As an alternative to these methods, we propose an imputation algorithm derived from a log‐multiplicative model that does not require this assumption. We apply this technique to estimate levels of homicides disaggregated by victim/offender relationship using the Federal Bureau of Investigation's Supplementary Homicide Report (SHR) data for 1996 and 1997, and we compare the resulting estimates with those obtained from the application of conventional procedures. Our results yield a larger proportion of stranger homicides than are obtained from the conventional methods.     

鉴定与司法鉴定概念的引入及其演进研究

本文结合史料,对汉语和我国法律中的“鉴定”与“司法鉴定”两个词语的来源与演变进行了回顾和分析。同时,还对鉴定一词当初引入法律和司法鉴定法律界定产生的历史和现实意义进行了初步阐述。     

两大法系司法鉴定制度之比较与评析

以当今英美法系和大陆法系具有代表性几个国家的司法鉴定制度为样本,从比较宏观的角度分析了两大法系司法鉴定制度的异同。通过比较与分析,归纳出了两者之间的异同点及各自的优劣势,得出的结论是:现代司法鉴定制度的发展趋势是混合型鉴定模式,同时亦指出了其对我国司法鉴定制度改革的启示。     

中国司法鉴定的古代史

公元前7世纪至公元前5世纪,是我国司法物证出现的萌芽时期,我国司法鉴定活动中以法医学为代表的最早时期也是出现在周朝。秦代在审理案件时,已相当重视和广泛使用各种司法物证,指纹的运用就出现在该时代。东汉时已形成简单的法医检验初步方法。三国时期司法物证检验的范围较前代有所发展扩大,从死因检验、伤痕鉴定,到笔迹检验、弹丸鉴定均有出现。以后各代出现了大量法医学著作。     

论物证理化检验中的种属认定和同一认定

传统的观点认为物证理化检验只能进行种属认定。物证理化检验中的种属认定和同一认定仅仅是依据了不同层次的物证反映体所导致的来源(或个体)同一认定范围上的区别。随着科学技术的发展和人类认识世界能力的不断加强,物证理化检验一定可以实现从种属认定向同一认定的转化。必须坚持物证检验与案件性质和侦查过程相结合的方法,以促使物证理化检验中的种属认定转变为事实上的同一认定。     

意见证据规则要义——以美国为视角

意见证据规则是证据规则的重要组成部分。尽管意见证据规则在我国的立法层面已初步确立,但相关的理论研究仍然十分薄弱。鉴于意见证据规则在美国适用最为广泛,发展最为成熟,本文力图以美国为例,全面介绍意见证据规则的基本内容,分析其价值内涵、法理基础,阐释其适用的难点,探讨专家意见可靠性的属性定位,研究意见证据规则下终极问题原则基本被废弃的根本原因及专家意见受到的限制,进而就意见证据规则在我国的适用提出管见。     

保安服务业改革势在必行

目前，保安服务业已经成为上海城市公共安全一支不可缺少的重要力量。但随着社会主义市场经济的进一步发展和市场规则的逐渐成熟，对保安服务业的市场需求进一步加大，对保安服务业的质量要求日益提高。同时，保安服务业的各种弊端和问题也在新的形势下日益显现和暴露出来，队伍整体素质和服务质量偏低已成为保安服务业发展的瓶颈。我们应当尽快在现有规范性文件规定的框架内对保安服务业的体制、机制、投资进行改革，按市场要求建立保卫人员职业资格认证和培训体系。     

论电子数据提取笔录的属性与适用

电子数据的获取程序是否规范直接影响电子数据真实性的认定。电子数据提取笔录由于能够客观反映电子数据获取的过程而成为对电子数据进行鉴真的重要依据,它既能够连接电子数据与案件事实,又反映了取证过程的合法性和保管链条的完整性。从属性上看,电子数据提取笔录具有独立的证据属性,它不仅有别于物证、书证和证人证言,而且有别于其他笔录类证据。对电子数据提取笔录的证据资格和证明力的判断也具有特殊性。当前,可通过同步录音录像、引入外部监督、明确制作人员义务等方式规范电子数据提取笔录的适用。     

Graph clustering and anomaly detection of access control log for forensic purposes

Attacks on operating system access control have become a significant and increasingly common problem. This type of security threat is recorded in a forensic artifact such as an authentication log. Forensic investigators will generally examine the log to analyze such incidents. An anomaly is highly correlated to an attacker's attempts to compromise the system. In this paper, we propose a novel method to automatically detect an anomaly in the access control log of an operating system. The logs will be first preprocessed and then clustered using an improved MajorClust algorithm to get a better cluster. This technique provides parameter-free clustering so that it automatically can produce an analysis report for the forensic investigators. The clustering results will be checked for anomalies based on a score that considers some factors such as the total members in a cluster, the frequency of the events in the log file, and the inter-arrival time of a specific activity. We also provide a graph-based visualization of logs to assist the investigators with easy analysis. Experimental results compiled on an open dataset of a Linux authentication log show that the proposed method achieved the accuracy of 83.14% in the authentication log dataset.