当前文件检验的热点问题

本文简要回顾了文件检验学的发展历程,着重总结了当今文件检验的热点问题,包括:笔迹的自动化检验,文件的制成时间,可疑文件的无损检验,可疑文件的综合检验、可疑文件的定量检验、计算机技术在文件检验中的应用以及今后的发展趋势,文件检验工作中存在的问题进行了阐述,并针对存在的问题提出了解决方案。     

系统检验方法在可疑文件鉴定中运用

通过对近年来成功解决的几起可疑文件鉴定的典型案例分析,较详细地阐述在文件鉴定实践中,如何运用系统检验的思想,通过可疑文件上留下的细微变造痕迹,巧妙识别可疑文件的伪造手段和方法,为法庭提供科学、可信的证据,取信于法官、律师及当事人,使得案件最终圆满审结.在面对某些疑难案件的鉴定中,在鉴定思路和方法上对文件检验人员,有一定的启示作用.     

基层办案人员提取可疑文件时常见错误分析

文件物证具有鲜明的物质性,提取、保存的方法不当,极易遭受污染和损坏,而且失不再来、无可弥补。实践中,最初接触可疑文件的基层办案人员由于缺乏常识或因粗心以及其他方面的失误,使可疑文件受到各种损害,给进一步研究案情、委托鉴定,甚至给整个侦查、审判工作造成无法弥补的损失。本文针对基层办案人员在提取、保存文件物证时存在的常见问题进行分析,并提出克服方法。     

火眼金睛的新式文检仪

一提到文件检验,人们普遍想到的可能就是对于文件上可疑笔迹的检验与鉴定。在很长一段时间里,鉴定专家的自身经验,加上一柄放大镜,成为了文件检验工作的"全部家当"。然而,随着现代科学技术的发展以及办公自动化程度的提升,文件检验远非笔迹检验就能全部包含在内。文     

通过辨别、对比和检验材料中的变化测定文件日期

对一份文件最早制成时间的检验一直以来都是全世界文检界的难题之一。核实可疑文件的制成时间没有统一的方法,目前主要通过对纸张、墨迹、打字机、复印机、打印机、传真机、印刷品,以及笔迹和签名等因素的检验来确定一份文件的制成时间。文件检验人员需要充分利用他们手中的文件的内容及文件周边信息所反映出来的条件和材料,进而得出结论。     

通过辨别、对比和检验材料中的变化测定文件日期

对一份文件最早制成时间的检验一直以来都是全世界文检界的难题之一。核实可疑文件的制成时间没有统一的方法,目前主要通过对纸张、墨迹、打字机、复印机、打印机、传真机、印刷品,以及笔迹和签名等因素的检验来确定一份文件的制成时间。文件检验人员需要充分利用他们手中的文件的内容及文件周边信息所反映出来的条件和材料,进而得出结论。     

金融机构大额交易和可疑交易报告管理办法

[公布机关]中国人民银行[文(令)号]〔2006〕第2号令[公布日期]2006.11.14[类别]经济法·金融管理[施行日期]2007.3.1[同时废止法规]2003年《人民币大额和可疑支付交易报告管理办法》等文件第一条为防止利用金融机构进行洗钱活动,规范金融机构大额交易和可疑交易报告行为,根据《     

标点符号时代性特征在佐证文件制成时间中的应用

汉语现代标点符号自诞生以来经过多次修订调整,具有一定的时代性特征,对我国标点符号数量、形态等变化情况进行梳理,理顺其大致出现时间范围,能为某些案件中可疑文件制成时间的分析提供参考。本文基于文献研究法,对民国以来不同阶段标点符号的变化情况进行概括,然后运用实证分析法,结合具体标点符号的一些用例和现实中的案例,分析了运用标点符号时代特征佐证文件制成时间的方法路径。由于标点符号存在出现时间早晚的差异,而且有的标点符号尽管在不同年代都存在,但是形态特征和用法也略有不同,因此具有鲜明的时间指向性。标点符号的时代特征,可以揭示某些文件中标点符号与文件标称时间的矛盾性,从而对推断文件的制成时间具有一定的佐证作用,特别是适用于那些标称是民国时期或新中国成立初期的文件的检验,但在运用时要注意检材的条件、标点符号的地区差异,同时也要运用系统检验思维进行综合分析判断。     

档案工作的规范化标准化

文件生命周期理论告诉我们,文件从其产生形成到最终销毁或作为档案永久保存是一个完整的生命过程。这一过程可分为若干阶段,由于各阶段有其不同的价值、作用和特点,各阶段文件存在着与之相对应的保管地点和存放方式。国内外学者对周期理论阶段划分不一、各执一词。笔者认为比较适合我国国情和比较合理的是国内学者陈兆的四阶段划分法:将文件的生命运动过程划分为制作阶段、现实使用阶段、暂时保存阶段和永久保存阶段。     

瑶海刑警利用旅馆业管理信息破案法

日常管理信息梳理法 日常管理信息梳理法，是指情报人员通过整理和综合分析旅馆业管理信息中的入住旅客、入住时间、入住次数、携带物品，所持可疑证件等信息，梳理出疑问进行查证，查明嫌疑对象的真实身份和活动情况，从而发现违法犯罪线索、抓获嫌疑人破获案件的方法。该方法可以细分为可疑人员摸排法、可疑物品排查法、可疑证件辨别法等等。     

Detecting file fragmentation point using sequential hypothesis testing

File carving is a technique whereby data files are extracted from a digital device without the assistance of file tables or other disk meta-data. One of the primary challenges in file carving can be found in attempting to recover files that are fragmented. In this paper, we show how detecting the point of fragmentation of a file can benefit fragmented file recovery. We then present a sequential hypothesis testing procedure to identify the fragmentation point of a file by sequentially comparing adjacent pairs of blocks from the starting block of a file until the fragmentation point is reached. By utilizing serial analysis we are able to minimize the errors in detecting the fragmentation points. The performance results obtained from the fragmented test-sets of DFRWS 2006 and 2007 show that the method can be effectively used in recovery of fragmented files.     

Detecting file fragmentation point using sequential hypothesis testing

File carving is a technique whereby data files are extracted from a digital device without the assistance of file tables or other disk meta-data. One of the primary challenges in file carving can be found in attempting to recover files that are fragmented. In this paper, we show how detecting the point of fragmentation of a file can benefit fragmented file recovery. We then present a sequential hypothesis testing procedure to identify the fragmentation point of a file by sequentially comparing adjacent pairs of blocks from the starting block of a file until the fragmentation point is reached. By utilizing serial analysis we are able to minimize the errors in detecting the fragmentation points. The performance results obtained from the fragmented test-sets of DFRWS 2006 and 2007 show that the method can be effectively used in recovery of fragmented files.     

Forensic investigation of OOXML format documents

MS Office documents could be illegally copied by offenders, and forensic investigators still face great difficulty in investigating and tracking the source of these illegal copies. This paper mainly proposes a forensic method based on the unique value of the revision identifier (RI) to determine the source of suspicious electronic documents. This method applies to electronic documents which use Office Open XML (OOXML) format, such as MS Office 2007, Mac Office 2008 and MS Office 2010. According to the uniqueness of the RI extracted from documents, forensic investigators can determine whether the suspicious document and another document are from the same source. Experiments demonstrate that, for a copy of an electronic document, even if all the original characters are deleted or formatted by attackers, forensic examiners can determine that the copy and the original document are from the same source through detecting the RI values. Additionally, the same holds true if attackers just copy some characters from the original document to a newly created document. As long as there is one character left whose original format has not been cleared, forensic examiners can determine that the two documents are from the same source using the same method. This paper also presents methods for OOXML format files to detect the time information and creator information, which can be used to determine who the real copyright holder is when a copyright dispute occurs.     

JPEG steganography detection with Benford's Law

In this paper we present a novel approach to the problem of steganography detection in JPEG images by applying a statistical attack. The method is based on the empirical Benford's Law and, more specifically, on its generalized form. We prove and extend the validity of the logarithmic rule in colour images and introduce a blind steganographic method which can flag a file as a suspicious stego-carrier. The proposed method achieves very high accuracy and speed and is based on the distributions of the first digits of the quantized Discrete Cosine Transform coefficients present in JPEGs. In order to validate and evaluate our algorithm, we developed steganographic tools which are able to analyse image files and we subsequently applied them on the popular Uncompressed Colour Image Database. Furthermore, we demonstrate that not only can our method detect steganography but, if certain criteria are met, it can also reveal which steganographic algorithm was used to embed data in a JPEG file.     

Race and the Construction of Evidence in Homicide Cases

Research that attempts to document racial or gender disparities in the criminal justice system inevitably paints a distorted picture if only one point in the criminal justice process is examined. For example, studies that look at who is sentenced to death among a group convicted of first-degree murder will miss exposure of biases that occur at earlier stages of the criminal justice process. In this paper, we looked at prosecutorial files on over 400 homicide cases from Caddo Parish, Louisiana (the Shreveport area). Results indicate that even after controlling for aggravating factors, cases with White female victims result in thicker files than other homicides, indicating more prosecutorial effort in attempting to secure convictions in such cases. This, in turn, was related to more severe sentencing of offenders convicted of killing whites and women. On the other hand, cases with black victims resulted in the thinnest case files and the least severe sentences.     

Mutation in the STR locus D21S1 1 of father causing allele mismatch in the child

We analyzed a case of paternity dispute with 15 autosomal STR loci and found a mismatch in one of the alleles of the locus D21S11 in the child. The composition of the alleles of this locus in the mother, suspicious father, and child were 29/32, 29/29, and 29/30, respectively. The combined paternity index (2.4 x 10(10)) and paternity probability (0.9999) suggest that the suspicious father is the biological father of the child. Further analysis of 6 Y chromosome STR loci revealed matching of all the Y chromosomal alleles of the child with that of the suspicious father. Since there was a perfect match of all the paternal alleles inherited (15 autosomal and 6 Y chromosomal) in the child with that of the suspicious father except the allele D21S11, it is suggested that this might be a case of mutation. Cloning and sequencing of all the alleles of the locus D21S11 of the suspicious father, mother, and the child helped in determining that the suspicious father contributed the mutated allele.     

行政执法案卷信息的解释与适用——以《政府信息公开条例》第16条为中心的初步观察

行政执法案卷信息从作为行政执法案卷评查的对象到作为政府信息公开的例外事由,“行政执法案卷信息”在司法实践中呈现出概念扩张的趋势,具体体现在案卷类型的溢出与案卷内容的形式化。反映出作为相对不予公开事项的行政执法案卷信息,在不予公开的实质的理由上存在模糊之处,使得法定公开与裁量公开的适用难以深入展开。与此同时,与之相关联的卷宗阅览权在行使方式上被进一步挤压。如何获得相对确定的内涵与外延,形成适当强度的司法审查路径,是行政执法案卷信息合理解释与适用中需要解决的问题。     

Social skills,distorted perception and being suspect: Studies in impression formation and the ability to deceive

Conclusion This paper dealt with the relation between social skills and a) making a suspicious impression, b) the ability to deceive. The results suggest that observers typically entertain perceptual distortion: introverted and socially anxious persons automatically impress them as less credible while extroverts establish more credibility. Introverts and socially anxious people are more likely to be designated as suspect in the sense of Article 27 of theCod of Penal Procedure-their extroverted and non-anxious counterparts run less risk on this point. The results further show that social skills are related to the ability to hide the truth. The introverted and socially anxious are poor liars. In sum, we may conclude that the likelihood of criminal stigmatization is appreciably greater if one's behavior is introverted or socially anxious because they impress others as suspicious (they run the risk of being apprehended more readily and they will more quickly succumb under questioning). Eysenck's theory (1984) states that crimes are more strongly correlated with extroversion. This means that extroverts have a double advantage. The double handicap for introverted and socially anxious persons could be undone if detection officers would pay somewhat greater attention to the extroverted and socially non-anxious. In addition, we would recommend that training programs for police officers include material on impression formation and impression management as aspects of social skills.     

刑事卷证与技术审判

从证据手段在审判中的运用来看,以卷证为基础的欧陆主要法治国家的刑事审判可以界定为一种技术审判,而英美以口证为主要手段的刑事审判大致属于一种经验审判。我国普遍运用卷证的刑事审判也可归为一种技术审判方式,但由于对卷证的过度依赖、司法者职业化和专业化程度不高和刑事卷证运用的程序性制约机制的欠缺,导致我国技术审判的异化。当下推行的以审判为中心的诉讼制度改革并非是对刑事卷证运用的根本否定,相反,为我国刑事卷证在审判中运用的制度改革奠定了基础。     

Bin-Carver: Automatic recovery of binary executable files

File carving is the process of reassembling files from disk fragments based on the file content in the absence of file system metadata. By leveraging both file header and footer pairs, traditional file carving mainly focuses on document and image files such as PDF and JPEG. With the vast amount of malware code appearing in the wild daily, recovery of binary executable files becomes an important problem, especially for the case in which malware deletes itself after compromising a computer. However, unlike image files that usually have both a header and footer pair, executable files only have header information, which makes the carving much harder. In this paper, we present Bin-Carver, a first-of-its-kind system to automatically recover executable files with deleted or corrupted metadata. The key idea is to explore the road map information defined in executable file headers and the explicit control flow paths present in the binary code. Our experiment with thousands of binary code files has shown our Bin-Carver to be incredibly accurate, with an identification rate of 96.3% and recovery rate of 93.1% on average when handling file systems ranging from pristine to chaotic and highly fragmented.