握奇数据推出“警务通”移动警务添利器

广西桂林的公安系统引入了一种高科技的手机SIM卡，民警们使用装有这种SIM卡的手机。随时可与公安部公安数据中心安全连线，获取所需的信息和数据。这种特殊的SIM卡被称为“警务通”。     

手机物证检验及其在刑事侦查中的应用

随着移动通信技术的迅速发展和广泛应用,手机内部包含的信息已经成为犯罪侦查重要的线索和证据来源。采用专门的符合物证鉴定原理要求的技术方法检验手机的SIM卡存储器、主板存储器和闪存卡,可以获得大量的手机使用者个人信息、通信内容信息、通信发生信息、使用者写入存储信息和手机设置信息等大量信息资料。手机检验结果给出的这些信息具有非常高的侦查和证据价值的,手机也因此成为物证鉴定领域内一个新的检验对象。     

司法鉴定视域下嵌入式DVR系统的数据恢复可行性探究

目的 嵌入式数字视频录像机（digital video recorder, DVR）系统中的多媒体（视频/音频）数据往往是电子数据司法鉴定领域的重要证据,然而在司法鉴定实践中,DVR被意外删除、恶意删除或遭受损坏导致DVR中数据无法访问的现象屡见不鲜,这无疑使得电子数据鉴定过程变得更加困难。方法 结合司法鉴定工作实务,主要以存储于Micro SD卡中无法访问的DVR视频文件为例,开展了基于文件分配表（file allocation table, FAT）32文件系统和H.264相关文件格式的DVR数据恢复研究。结果 通过探讨的两种方法恢复的视频文件可以正常访问,同时还可通过运行脚本文件实现DBR的自动重建。结论 探讨的两种方法可有效恢复FAT32文件系统的DVR数据和H.264格式的DVR数据。此外,通过运行脚本文件自动重构DBR,可有效提高司法鉴定效率。相关鉴定技术的研究对嵌入式DVR视频的鉴定技术研究具有重要的理论研究意义和实践应用价值。     

一种针对MongoDB数据库的证据获取方法

根据MongoDB文件型数据库的特点,提出了一种针对MongoDB文件型数据库的证据获取方法。在研究GridFS文件系统原理的基础上,详细阐述了MongoDB和GirdFS文件系统结构,对MongoDB存放数据的文件进行了分析,进而获取被删除的文件数据。实验结果表明该方法能有效地从MongoDB数据库中获取电子证据。     

统计学方法在微量物证数据处理中的应用

统计学方法在微量物证理化检验工作中受到越来越多的重视,采用有效的统计学方法对检验数据进行分析,不仅能够深度挖掘复杂数据背后信息,还能不断提高数据的应用价值和证据本身的证据价值。本文对目前微量物证领域常用统计学方法进行归纳总结,简要介绍了常用统计方法的应用,对各类方法优缺点进行说明。最后,对法庭科学工作者都比较感兴趣的贝叶斯统计与似然比方法在理化检验数据统计分析中的应用进行了介绍。     

从保密到安全:数据销毁义务的理论逻辑与制度建构

我国现行立法规定了自然人有请求信息处理者删除个人信息的权利,但这并不等于承认数据生命周期的最后环节是“删除”,因为“删除权”是“信息处理的合法性与必要性基础丧失”的必然结果,而“数据销毁”才是“数据归于消灭”的处理流程末端。数据销毁义务的理论基础在于信息保密方式的扩张,即从维持信息保密状态转向维持数据安全风险的可控性。在数据安全风险评估过程中,倘若义务主体无法保障暂时不使用的重要数据和个人信息处于安全状态,则应当采取适当的数据销毁范式降低数据泄露或非法复原的安全风险。在未来立法活动中,我国应当明确数据销毁义务的义务主体、销毁方式和销毁范围等具体制度内容,完成数据安全立法的“最后闭环”。     

电子证据的一种来源——数据恢复及实践

在司法实践中,有大量的案件需要电子文件、图形图像、影音视频等信息作为证据使用,于是经常遇到犯罪嫌疑人使用的存储设备出现损坏或被故意删除犯罪证据,造成关键证据无法读取、甚至丢失。公安机关侦查部门就需要采用特殊手段设法将其恢复或将其转化为正常状态的文件,从而形成有法律效力的电子证据。本文介绍了运用几种有效的数据恢复工具,通过数据恢复的方式,提取由于各种因素导致的电子证据被删除情况,这为对电子证据的来源提供增加了一个渠道。     

知识产权民事诉讼证据保全制度理论探析

知识产权民事纠纷案件较之其它民事纠纷案件而言,具有取证难、举证难、证据技术性高以及隐蔽性较强等特点,而其证据往往具有短暂易失性、隐蔽性和不易取得性,如计算机网络传播的信息、计算机软件、数据库、技术和经营信息、财务账册、销售合同等容易被篡改、销毁或删除。当事人如想收集并固定对方侵权的证据较困难。因此,当事人     

为民航插上法治的翅膀——民航法施行20年将大修

“有的乘客说,他手机使用的是飞行模式.” “还有的乘客说,手机里没插SIM卡.” “我们在劝阻过程中,乘客会以很多理由拒绝关闭手机.但按照规定,无论是飞行模式下的手机,还是没有SIM卡的手机,都是不允许在飞行中开机使用的.”     

浅议计算机数据之证据价值

计算机数据的法律价值和证据价值是目前倍受关注的问题,应该说计算机数据作为法庭证据不存在障碍,但计算机数据证据归属值得深究,作者认为分类归属比较合理,证据单列提高了计算机数据的法律地位,其中也存在许多不易解决的理论和技术问题,在证据形式不影响法律进程的前提下,尽快提高证据价值有更大的现实意义。     

Development and validation of a liquid chromatography-mass spectrometry assay for hair analysis of methylphenidate

Examination of various SIM cards and smart card devices indicates that data may be retained in SIM card memory structures even after heating to temperatures up to 450 degrees C, which the National Institute of Standards and Technology (NIST) has determined to be approximately the maximum average sustained temperature at desk height in a house fire. However, in many cases, and certainly for temperatures greater than 450 degrees C, the SIM card chip has suffered structural or mechanical damage that renders simple probing or rewiring ineffective. Nevertheless, this has not necessarily affected the data, which is stored as charge in floating gates, and alternative methods for directly accessing the stored charge may be applicable.     

伪造信用卡犯罪中的伪造行为内涵与对象研究

刑法中伪造信用卡犯罪中的伪造不仅包括仿制其物理外观的形式伪造,还应包括将权利人信息写入磁条介质、芯片等的内容伪造。作为伪造对象的信用卡应当是具有物理载体的实体卡片,事实上不存在对虚拟信用卡的伪造。以虚假身份骗领无对应实体卡的虚拟信用卡应视为妨害信用卡管理罪中的骗领信用卡行为;利用权利人既有实体卡信息,复制虚拟信用卡的行为系对他人信用卡信息资料的非法使用而非伪造。有关伪造信用卡犯罪刑法规定的立法原意并不包含伪造空白信用卡,伪造空白信用卡具有严重的社会危害性,理应将其纳入刑法规制范围,以保持与妨害信用卡管理罪刑法规定的协调。不能通过司法解释改变立法原意,现行刑法中伪造信用卡犯罪的伪造含义应有相应的调整。     

Android智能手机的取证

作为一种新兴的智能手机,Android手机发展势头极为迅猛,并越来越多的受到人们的关注。通过对Android智能手机的取证研究,在介绍了Android手机的基本工作原理后,详细描述了取证方式。通过Android SDK工具对手机内外置存储进行镜像备份,逻辑分析利用文件系统分析,查找每个应用程序自带的数据库文件来获得有价值信息,物理分析通过对内存镜像进行数据恢复以寻找删除的文件,两者互相结合。结果表明,能够从Android手机中有效寻找到潜在证据。     

Possibilities for using bedside cards as secondary comparison in trace element studies with the PCR technique]

When fresh blood is not available as a control in stain investigations extracted teeth, hair, preserved tissue samples, histological slides, cigarette butts or used stamps can also be used. This paper reports on a stain investigation performed 7 months after the death of the victim, where a bedside card from the medical records was successfully employed as a control blood sample. In a series of 10 bedside cards up to 9 years old, the investigation with the PCR method showed recognizable patterns in the STR systems SE 33 and TC 11. Matching patterns could be found from the 4 sections of each card (anti A, anti B, anti AB and anti D). A comparison of the oldest card with a fresh blood sample of the patient also showed matching patterns. AMPFLPs were successful with more recent cards. Using the PCR method typing of bedside cards from medical records up to 10 years old can be used in stain investigations.     

Feasibility of Canine Detection of Mass Storage Devices: A Study of Volatile Organic Compounds Emanating from Electronic Devices Using Solid Phase Microextraction

Detection of canines are well‐known to be valuable in the location of contraband, such as explosives or narcotics. More recently, canines have been trained and utilized in the detection of concealed mass storage devices that might contain evidence of illegal activity such as child pornography. To lay the analytical foundation for this detection work, research was carried out to determine the volatile organic compounds associated with mass storage devices (MSD) that could be used by trained canines for detection. Headspace analysis of a variety of electronic devices was performed using solid phase microextraction (SPME) with gas chromatography/mass spectrometry (GC/MS). Analyses found several volatile compounds common to SIM and SD cards, as well as USB drives, including 2‐propenenitrile, styrene, isophorone, hydroxycyclohexyl phenyl ketone, and 2‐furanmethanol, tetrahydro. Results indicated that mass storage devices do have a characteristic odor profile making detection with minimal false alerts feasible for trained canines.     

Forensic data recovery and examination of magnetic swipe card cloning devices

Magnetic swipe card technology is used for many purposes including credit, debit, store loyalty, mobile phone top-up and security identification cards. These types of cards and the details contained on them are often relied upon as a form of identification and personal authentication. As such reliance is placed upon them it is surprising that they do not incorporate more stringent security features, and because of this lack of features it is not surprising that they attract the attention of people who wish to exploit them for illegal gain. The paper introduces the type of technology, and range of devices available for manipulating magnetic swipe card data. It proposes the use of Digital Evidence Bags as a suitable format for the evidential storage of information obtained from them, thus further illustrating the flexibility of the format and demonstrating the diverse range of devices that have to be handled within the digital investigation and law enforcement community.     

The QR code in society, economy and medicine--fields of application, options and chances

2D codes like the QR Code ("Quick Response") are becoming more and more common in society and medicine. The application spectrum and benefits in medicine and other fields are described. 2D codes can be created free of charge on any computer with internet access without any previous knowledge. The codes can be easily used in publications, presentations, on business cards and posters. Editors choose between contact details, text or a hyperlink as information behind the code. At expert conferences, linkage by QR Code allows the audience to download presentations and posters quickly. The documents obtained can then be saved, printed, processed etc. Fast access to stored data in the internet makes it possible to integrate additional and explanatory multilingual videos into medical posters. In this context, a combination of different technologies (printed handout, QR Code and screen) may be reasonable.     

Pinpointing TomTom location records: A forensic analysis

TomTom GPS navigation devices are one of the most popular kinds of satellite navigation devices in the UK, and are increasingly being examined in criminal cases to identify data of evidential value. This article outlines the format of TomTom location records and shows how these can be automatically extracted, enabling deleted location entries to be recovered. In addition, it shows how the type of a record – e.g. home or favourite location – can be determined and how to identify locations where the TomTom has actually been, as opposed to destinations which have been entered into the device. This information has been used in a number of different investigations including cases of kidnap, grooming, murder and terrorism, and can be of vital importance in cases where hundreds or even thousands of location entries are recovered from a TomTom device.