Age determination of blood spots in forensic medicine by force spectroscopy

We present a new tool for the estimation of the age of bloodstains, which could probably be used during forensic casework. For this, we used atomic force microscopy (AFM) for high-resolution imaging of erythrocytes in a blood sample and the detection of elasticity changes on a nanometer scale. For the analytic procedure we applied a fresh blood spot on a glass slide and started the AFM detection after drying of the blood drop. In a first step, an overview image was generated showing the presence of several red blood cells, which could easily be detected due to their typical "doughnut-like" appearance. The consecutively morphological investigations in a timeframe of 4 weeks could not show any alterations. Secondly, AFM was used to test the elasticity by recording force-distance curves. The measurements were performed immediately after drying, 1.5 h, 30 h and 31 days. The conditions were kept constant at room temperature (20 degrees C) and a humidity of 30%. The obtained elasticity parameters were plotted against a timeline and repeated several times. The elasticity pattern showed a decrease over time, which are most probably influenced by the alteration of the blood spot during the drying and coagulation process. The preliminary data demonstrates the capacity of this method to use it for development of calibration curves, which can be used for estimation of bloodstain ages during forensic investigations.     

Cloud forensics–Tool development studies & future outlook

In this work, we describe our experiences in developing cloud forensics tools and use them to support three main points:First, we make the argument that cloud forensics is a qualitatively different problem. In the context of SaaS, it is incompatible with long-established acquisition and analysis techniques, and requires a new approach and forensic toolset. We show that client-side techniques, which are an extension of methods used over the last three decades, have inherent limitations that can only be overcome by working directly with the interfaces provided by cloud service providers.Second, we present our results in building forensic tools in the form of three case studies: kumodd–a tool for cloud drive acquisition, kumodocs–a tool for Google Docs acquisition and analysis, and kumofs–a tool for remote preview and screening of cloud drive data. We show that these tools, which work with the public and private APIs of the respective services, provide new capabilities that cannot be achieved by examining client-side artifacts.Finally, we use current IT trends, and our lessons learned, to outline the emerging new forensic landscape, and the most likely course of tool development over the next five years.     

Atomic force microscopic investigation of commercial pressure sensitive adhesives for forensic analysis

Pressure sensitive adhesive (PSA), such as those used in packaging and adhesive tapes, are very often encountered in forensic investigations. In criminal activities, packaging tapes may be used for sealing packets containing drugs, explosive devices, or questioned documents, while adhesive and electrical tapes are used occasionally in kidnapping cases. In this work, the potential of using atomic force microscopy (AFM) in both imaging and force mapping (FM) modes to derive additional analytical information from PSAs is demonstrated. AFM has been used to illustrate differences in the ultrastructural and nanomechanical properties of three visually distinguishable commercial PSAs to first test the feasibility of using this technique. Subsequently, AFM was used to detect nanoscopic differences between three visually indistinguishable PSAs.     

Analysis of microtraces in invasive traumas using SEM/EDS

Scanning electron microscopy in combination with energy-dispersive X-ray spectrometry (SEM/EDS) is a proven forensic tool and has been used to analyze several kinds of trace evidence. A forensic application of SEM/EDS is the examination of morphological characteristics of tool marks that tools and instruments leave on bone. The microtraces that are left behind by these tools and instruments on the bone are, however, often ignored or not noticed at all. In this paper we will describe the use of SEM/EDS for the analysis of microtraces in invasive sharp-force, blunt-force and bone-hacking traumas in bone. This research is part of a larger multi-disciplinary approach in which pathologists, forensic anthropologists, toolmark and microtrace experts work together to link observed injuries to a suspected weapon or, in case of an unknown weapon, to indicate a group of objects that could have been used as a weapon. Although there are a few difficulties one have to consider, the method itself is rather simple and straightforward to apply. A sample of dry and clean bone is placed into the SEM sample chamber and brightness and contrast are set such that bone appears grey, metal appears white and organic material appears black. The sample is then searched manually to find relevant features. Once features are found their elemental composition is measured by an energy dispersive X-ray spectrometer (EDS). This method is illustrated using several cases. It is shown that SEM/EDS analysis of microtraces in bone is a valuable tool to get clues about an unknown weapon and can associate a specific weapon with injuries on the basis of appearance and elemental composition. In particular the separate results from the various disciplines are complementary and may be combined to reach a conclusion with a stronger probative value. This is not only useful in the courtroom but above all in criminal investigations when one have to know for what weapon or object to look for.     

Hyperspectral imaging in forensic science: An overview of major application areas

Analysis of evidence is a challenge. Crime scene materials are complex, diverse, sometimes of an unknown nature. Forensic science provides the most critical applications for their examination. Chemical tests, analytical methods, and techniques to process the evidence must be carefully selected by the forensic scientist. Ideally, it may be interpreted, analyzed, and judged in the original context of the crime scene. In this sense, hyperspectral imaging (HSI) has been employed as an analytical tool that maintains the integrity of the samples/objects for multiple and sequential analysis and for counter-proof exams. This paper is an overview of forensic science trends for the application of HSI techniques in the last ten years (2011–2021). The examination of documents was the main area of exploration, followed by bloodstain analysis aging process; trace analysis of explosives and gunshot residue. Chemometric tools were also addressed since they are crucial to obtain the most important information from the samples. There are great challenges in applying HSI in forensic science, but there have been clear technological and scientific advances, and a solid foundation has been built for the use of HSI in real-life cases.     

“I couldn't find it your honour,it mustn't be there!” – Tool errors,tool limitations and user error in digital forensics

The field of digital forensics maintains significant reliance on the software it uses to acquire and investigate forms of digital evidence. Without these tools, analysis of digital devices would often not be possible. Despite such levels of reliance, techniques for validating digital forensic software are sparse and research is limited in both volume and depth. As practitioners pursue the goal of producing robust evidence, they face the onerous task of both ensuring the accuracy of their tools and, their effective use. Whilst tool errors provide one issue, establishing a tool's limitations also provides an investigatory challenge leading the potential for practitioner user-error and ultimately a grey area of accountability. This article debates the problems surrounding digital forensic tool usage, evidential reliability and validation.     

Differentiation of blue ballpoint pen inks by positive and negative mode LDI-MS

Usually, the differentiation of inks on questioned documents is carried out by optical methods and thin layer chromatography (TLC). Therefore, spectrometric methods were also proposed in forensic literature for the analysis of dyes. Between these techniques, laser desorption/ionization mass spectrometry (LDI-MS) has demonstrated a great versatility thanks to its sensitivity to blue ballpoint ink dyes and minimal sample destruction. Previous researches concentrated mostly on the LDI-MS positive mode and have shown that this analytical tool offers higher discrimination power than high performance TLC (HPTLC) for the differentiation of blue ballpoint inks. Although LDI-MS negative mode has already been applied in numerous forensic domains like the studies of works of art, automotive paints or rollerball pens, its potential for the discrimination of ballpoint pens was never studied before. The aim of the present paper is therefore to evaluate its potential for the discrimination of blue ballpoint inks. After optimization of the method, ink entries from 33 blue ballpoint pens were analyzed directly on paper in both positive and negative modes by LDI-MS. Several cationic and anionic ink components were identified in inks; therefore, pens were classified and compared according to their formulations. Results show that additional information provided by anionic dyes and pigments significantly increases the discrimination power of positive mode. In fact, it was demonstrated that classifications obtained by the two modes were, to some extent, complementary (i.e., inks with specific cationic dyes not necessarily contained the same anionic components).     

Digital imaging methods as an aid in dental identification of human remains

The physical comparison of known (K) and questioned (Q) evidence samples is an accepted tool in numerous forensic identification disciplines (1). A subset of this process is the use of antemortem and postmortem dental radiographs to identify unidentified human remains. This method has been generally accepted for decades (2). The outcome is performed with a considerable degree of accuracy, due in part to a finite pool of possible candidates for identification derived via the NCIC database, passenger lists, and law enforcement Missing Persons reports. This paper describes a dental identification comparison protocol that incorporated digital imaging technology in this process. The computer was used to create digital exemplars of the K and Q evidence that were spatially and quantitatively compared (3). The digital mode allowed direct metric and morphologic comparison through the aid of a digital camera, desktop computer, monitor, and printer. The well-known computer program Adobe Photoshop 5.0 (4) was used to process the digital information in two forensic cases described in this paper. It is a commercially available digital imaging editing program that is operated on laptop and desktop computers possessing sufficient chip speed and RAM (Pentium II or equivalent and at least 76MB RAM) to open the large-size files generated by high-resolution digital capture devices. This program accepts raster-based image formats (e.g. .JPG, .BMP). Photoshop is noted for its diverse imaging functions, which allow the computer monitor to be used as a comparison microscope when Q and K sample images are tiled side-by-side and/or superimposed. Two and three-dimensional Q and K evidence samples can be individually digitized and then independently resized to allow two-dimensional comparison. The investigator also has the ability to create magnified images (200% to 300%) when the original digital image has been captured at near photoquality resolution (300 dpi). The visual comparison of physical features on the computer monitor permits a large field of view and robust digital control over image quality. Photographic measurement and enhancement features of Adobe Photoshop mimics and in some circumstances surpasses the historic use of conventional photographic manipulation in forensic casework. This paper presents two cases processed via routine forensic odontology identification protocols. These protocols had minimal results due to limitations described in the case histories. The additional application of digital methods proved useful in the ultimate identification of these human remains.     

Virtopsy: postmortem imaging of the human heart in situ using MSCT and MRI

The rapid further development of computed tomography (CT) and magnetic resonance imaging (MRI) induced the idea to use these techniques for postmortem documentation of forensic findings. Until now, only a few institutes of forensic medicine have acquired experience in postmortem cross-sectional imaging. Protocols, image interpretation and visualization have to be adapted to the postmortem conditions. Especially, postmortem alterations, such as putrefaction and livores, different temperature of the corpse and the loss of the circulation are a challenge for the imaging process and interpretation. Advantages of postmortem imaging are the higher exposure and resolution available in CT when there is no concern for biologic effects of ionizing radiation, and the lack of cardiac motion artifacts during scanning. CT and MRI may become useful tools for postmortem documentation in forensic medicine. In Bern, 80 human corpses underwent postmortem imaging by CT and MRI prior to traditional autopsy until the month of August 2003. Here, we describe the imaging appearance of postmortem alterations--internal livores, putrefaction, postmortem clotting--and distinguish them from the forensic findings of the heart, such as calcification, endocarditis, myocardial infarction, myocardial scarring, injury and other morphological alterations.     

The accuracy and validity of the Sheffield Features of Gait Tool

Gait is now widely used in the UK as a contributor to identification, and increasing interest is being shown in its use in both Europe and the US. One of the long standing criticisms of the use of gait as evidence has been the lack of a validated standard methodology. With the publication of the ‘Code of practice for forensic gait analysis’, and the adoption of the code as part of the ‘Codes of Practice and Conduct for forensic science providers and practitioners in the Criminal Justice System’ by the Forensic Science Regulator, forensic gait analysts are now required to provide evidence of the testing of the methods used. The Sheffield Features of Gait Tool is specifically designed to assist observational gait analysis in the forensic context, and was developed by forensic gait analysis practitioners based on their casework and trial experience. Birch et al 2019 reported the findings of a study undertaken to assess the repeatability and reproducibility of the tool. This paper reports the findings of a study undertaken to assess the accuracy with which analysts identified features of gait when using the tool.Fourteen participants, with experience in observational gait analysis, viewed footage of computer generated avatars walking, and completed the features of gait tool on multiple occasions. The results showed a mean accuracy score of 134.92 out of a possible 180 (74.96%), a standard deviation of 9.49 (5.27%) and a coefficient of variation of 7.03%, demonstrating a good degree of consistency between the scores (Cronbach’s alpha <0.90; ANOVA p-value <0.05).The findings of this study, coupled with those of the Birch et al 2019 study which showed there to be good levels of both repeatability and reproducibility of observations of features of gait made by the participants, suggest that the Sheffield Features of Gait Tool is a valid and fit for purpose method of observing and recording features of gait in the forensic context. The use of the tool provides the basis of a standardised methodology for observational gait analysis in the forensic context.     

OpenLV: Empowering investigators and first-responders in the digital forensics process

The continuing decline in the cost-per-megabyte of hard disk storage has inevitably led to a ballooning volume of data that needs to be reviewed in digital investigations. The result: case backlogs that commonly stretch for months at forensic labs, and per-case processing that occupies days or weeks of analytical effort. Yet speed is critical in situations where delay may render the evidence useless or endanger personal safety, such as when a suspect may flee, a victim is at risk, criminal tactics or control infrastructure may change, etc. In these and other cases, investigators need tools to enable quick triage of computer evidence in order to answer urgent questions, maintain the pace of an investigation and assess the likelihood of acquiring pertinent information from the device.This paper details the design and application of a tool, OpenLV, that not only meets the needs for speedy initial triage, but also can facilitate the review of digital evidence at later stages of investigation. With OpenLV, an investigator can quickly and safely interact with collected evidence, much as if they had sat down at the computer at the time the evidence was collected. Since OpenLV works without modifying the evidence, its use in triage does not preclude subsequent, in-depth forensic analysis. Unlike many popular forensics tools, OpenLV requires little training and facilitates a unprecedented level of interaction with the evidence.     

Forensic genetic value of 27 Y-STR loci (Y-Filer® Plus) in the South African population

South Africa has one of the highest rape statistics in the world, with an average of 117 rapes reported daily. Y-STR genotyping is becoming a popular tool in the analysis of DNA evidence collected after a crime of a sexual nature has been committed, but has yet to be implemented in South Africa’s forensic laboratories. This study aimed to investigate the forensic value of the 27 Yfiler™ Plus loci in the South African population. A total of 271 samples from the African, Asian/Indian, Mixed Ancestry¹, and Caucasian populations at the University of the Free State in Bloemfontein, South Africa were amplified and analysed using ThermoFisher Scientific’s Yfiler™ Plus PCR Amplification kit. Of the 271 samples, 261 were identified to be unique, with an overall discrimination capacity of 98.15%. Discrimination capacities ranged from 91.67% for the Asian/Indian population to 100% for the Mixed Ancestry population. The haplotype diversity across the four populations is 0.9999, with an average gene diversity across all loci of 0.717. The forensic parameters estimated in this study provide evidence for the potential use of the commercial Yfiler™ Plus PCR amplification kit in a forensic application in South Africa.     

High-speed search using Tarari content processor in digital forensics

Recently, “Speed” is one of the hot issues in digital forensics. Thanks to a recent advanced technology, today we can get bigger hard drive disks at a lower price than previously. But unfortunately, it means for forensic investigators that they need tremendous time and effort in the sequence of process of creating forensic images, searching into them and analyzing them. In order to solve this problem, some methods have been proposed to improve performance of forensic tools. One of them getting attention is a hardware-based approach. However, such a way is limited in the field of evidence cloning or password cracking while it is rarely used in searching and analysis of the digital evidence. In this paper, we design and implement a high-speed search engine using a Tarari content processor. Furthermore, we show feasibility of our approach by comparing its performance and features to those of a popular forensic tool currently on the market.     

Y-chromosome STR-haplotype typing in El Salvador

Eight Y-chromosome STRs were investigated in a male population sample from El Salvador. Complete Y-chromosomal STRs haplotypes were obtained in 121 individuals, among which 107 different haplotypes were observed. The two most common haplotypes were shared by approximately 4% of the sample, while 100 haplotypes were unique. The gene diversity was 0.9883 and the discrimination capacity was 0.8926. The combined Y-chromosome STR polymorphisms provide a powerful discrimination tool for routine forensic applications.     

Automated Windows event log forensics

This paper proposes methods to automate recovery and analysis of Windows NT5 (XP and 2003) event logs for computer forensics. Requirements are formulated and methods are evaluated with respect to motivation and process models. A new, freely available tool is presented that, based on these requirements, automates the repair of a common type of corruption often observed in data carved NT5 event logs. This tool automates repair of multiple event logs in a single step without user intervention. The tool was initially developed to meet immediate needs of computer forensic engagements.Automating recovery, repair, and correlation of multiple logs make these methods more feasible for consideration in both a wider range of cases and earlier phases of cases, and hopefully, in turn, standard procedures. The tool was developed to fill a gap between capabilities of certain other freely available tools that may recover and correlate large volumes of log events, and consequently permit correlation with various other kinds of Windows artifacts. The methods are examined in the context of an example digital forensic service request intended to illustrate the kinds of civil cases that motivated this work.     

Taphonomic mycota: fungi with forensic potential

Forensic archaeologists and criminal investigators employ many different techniques for the location, recovery, and analysis of clandestine graves. Many of these techniques are based upon the premise that a grave is an anomaly and therefore differs physically, biologically, or chemically from its surroundings. The work reviewed in this communication demonstrates how and why field mycology might provide a further tool towards the investigation of scenes of crime concealed in forest ecosystems. The fruiting structures of certain fungi, the ammonia and the postputrefaction fungi, have been recorded repeatedly in association with decomposed mammalian cadavers in disparate regions of the world. The ecology and physiology of these fungi are reviewed briefly with a view to their potential as a forensic tool. This application of mycology is at an interface with forensic archaeology and forensic taphonomy and may provide a means to detect graves and has the potential to estimate postburial interval.     

High-speed search using Tarari content processor in digital forensics

Recently, “Speed” is one of the hot issues in digital forensics. Thanks to a recent advanced technology, today we can get bigger hard drive disks at a lower price than previously. But unfortunately, it means for forensic investigators that they need tremendous time and effort in the sequence of process of creating forensic images, searching into them and analyzing them. In order to solve this problem, some methods have been proposed to improve performance of forensic tools. One of them getting attention is a hardware-based approach. However, such a way is limited in the field of evidence cloning or password cracking while it is rarely used in searching and analysis of the digital evidence. In this paper, we design and implement a high-speed search engine using a Tarari content processor. Furthermore, we show feasibility of our approach by comparing its performance and features to those of a popular forensic tool currently on the market.     

多层螺旋CT与三维重建技术在法医损伤学中的应用

影像学技术发展迅速．已经成为临床诊断、治疗不可或缺的有效工具。利用MSCT与三维重建技术进行虚拟解剖,因为具有非破坏性、可显示特殊部位损伤形态、分析快速且便捷、便于证据保存和出示等特点在法医学尸体解剖中日益凸显优势．在法医损伤学研究及实践鉴定过程中具有较高的应用价值。文章综述了利用MSCT与三维重建技术在锐器伤、钝器伤、高坠伤、交通伤等实践领域的研究成果,并通过实践检案中遇到的典型案例,探讨多层螺旋CT与三维重建技术在法医学损伤鉴定中的应用价值。     

A reference database of Windows artifacts for file-wiping tool execution analysis

Anti-forensic technology can play an effective role in protecting information, but it can make forensic investigations difficult. Specifically, file-wiping permanently erases evidence, making it challenging for investigators to determine whether a file ever existed and prolonging the investigation process. To address this issue, forensic researchers have studied anti-forensic techniques that detect file-wiping activities. Many previous studies have focused on the effects of file-wiping tools on $MFT, $LogFile, and $DATA, rather than on Windows artifacts. Additionally, previous studies that have examined Windows artifacts have considered different artifacts, making it difficult to study them in a comprehensive manner. To address this, we focused on analyzing traces in 13 Windows artifacts of 10 file-wiping tools' operations in the Windows operating system comprehensively. For our experiments, we installed each file-wiping tool on separate virtual machines and checked the traces that the tools left behind in each artifact. We then organized the results in a database format. Our analysis revealed that most of the tools left traces on other artifacts, except for JumpList, Open&SavePidlMRU, and lnk. There were also some cases where traces remained on the other three artifacts. Based on our research, forensic investigators can quickly identify whether a file-wiping tool has been used, and it can assist in decision-making for evidence collection and forensic triage.     

A forensic image processing environment for investigation of surveillance video

We present an image processing software suite, based on the Matlab environment, specifically designed to be used as a forensic tool by law enforcement laboratories in the analysis of crime scene videos and images. Our aim is to overcome some drawbacks which normally appear when using standard image processing tools for this application, i.e. mainly the lack of full control and documentation on the operations which have been performed on the images, and the absence of new, more sophisticated algorithms which can provide improved performances and "make the difference" in critical cases.