Managing Future Liability At Petroleum Impacted Sites Through Proactive Strategic Environmental Baselining

An important consideration of any commercial and industrial property acquisition or divestiture—whether it is a single gasoline station or a suite of oil refineries—is the extant environmental conditions of the property(s) at the time of the transaction. Property sellers and prospective buyers each consider and negotiate how any existing or future liability associated with extant environmental conditions will be handled. In spite of this forethought and the agreed contract terms, future litigation over unanticipated environmental contamination remains a real possibility. Often precipitating future litigation are disagreements surrounding whether “newly realized” contamination is old (pre-sale) or new (post-sale). As a result, environmental forensic investigations are often faced with the issue of “age-dating” this newly discovered contamination in order to determine whether it was released pre- or post-sale. Age-dating contamination can be an inherently difficult task to perform and technically defend. Technical arguments between experts can be short-circuited if there was an irrefutable understanding of the nature of extant contamination that had existed at the time of the sale. Conventional environmental due diligence investigations (Phase I and II site assessments) fall short of providing this understanding. In this paper, we discuss Strategic environmental baselining (SEB), a cost-effective and pro-active form of environmental due diligence that incorporates a key component of environmental forensics, that is, advanced chemical fingerprinting using modified EPA Methods that are tailored for hydrocarbon fingerprinting. Sufficient sampling and advanced chemical fingerprinting performed at the time of a transaction (or, at least, properly archived samples analyzed in the future as needed) provides the evidence that eliminates the need to “age-date” contamination at some future date. Advanced chemical fingerprinting data also provides detailed characteristics of the extant contamination and thereby, helps distinguish “old” from “new” contamination, regardless of alteration of the chemicals of concern by weathering. Armed with this information both buyers and/or sellers can protect themselves in the event of any future claim(s).     

Characterizing the Source of Fugitive Middle Distillate Fuels—A Case Study Involving Railroad Diesel Fuel,Mandan, North Dakota

Middle distillate fuels are used in civilian and military jet engines, on-road (truck and bus) and off-road diesel (diesel-electric locomotives, heavy equipment, and farm machinery) engines, marine diesel engines, nonaviation gas turbines, and domestic and commercial furnaces. As such, these fuels are common environmental contaminants that may arise from multiple sources. The considerable liability associated with these fugitive fuels requires that their source(s) be defensibly determined. In this paper we describe the “chemical fingerprinting” features of middle distillate fuels that can be used in assessments of their source(s) in the environment. A case study in which railroad (off-road) diesel fuel #2 could be distinguished from nonrailroad fuels (e.g., on-road diesel fuel #2, fuel oil #2, and/or fuel oil #1) in Mandan, North Dakota, is presented.     

PyFlag – An advanced network forensic framework

Network forensics is an investigation technique looking at the network traffic generated by a system. PyFlag is a general purpose, open source, forensic package which merges disk forensics, memory forensics and network forensics.This paper describes the PyFlag architecture and in particular how that is used in the network forensics context. The novel processing of HTML pages is described and the PyFlag page rendering is demonstrated. PyFlag's novel processing of complex web applications such as Gmail and other web applications is described. Finally PyFlag's report generation capabilities are demonstrated.     

PyFlag – An advanced network forensic framework

Network forensics is an investigation technique looking at the network traffic generated by a system. PyFlag is a general purpose, open source, forensic package which merges disk forensics, memory forensics and network forensics.This paper describes the PyFlag architecture and in particular how that is used in the network forensics context. The novel processing of HTML pages is described and the PyFlag page rendering is demonstrated. PyFlag's novel processing of complex web applications such as Gmail and other web applications is described. Finally PyFlag's report generation capabilities are demonstrated.     

Detection and confirmation of fentanyls in high clay-content soil by electron ionization gas chromatography-mass spectrometry

Detection of illicit drugs in the environment, particularly in soils, often suggests the present or past location of a clandestine production center for these substances. Thus, development of efficient methods for the analysis and detection of these chemicals is of paramount importance in the field of chemical forensics. In this work, a method involving the extraction and retrospective confirmation of fentanyl, acetylfentanyl, thiofentanyl, and acetylthiofentanyl using trichloroethoxycarbonylation chemistry in a high clay-content soil is presented. The soil was spiked separately with each fentanyl at two concentrations (1 and 10 μg/g) and their extraction accomplished using ethyl acetate and aqueous NH₄OH (pH ~ 11.4) with extraction recoveries ranging from ~56% to 82% for the high-concentration (10 μg/g) samples while ranging from ~68% to 83% for the low-concentration (1 μg/g) samples. After their extraction, residues containing each fentanyl were reacted with 2,2,2-trichloroethoxycarbonyl chloride (Troc-Cl) to generate two unique and predictable products from each opioid that can be used to retrospectively confirm their presence and identity using EI-GC-MS. The method's limit of detection (MDL/LOD) for Troc-norfentanyl and Troc-noracetylfentanyl were estimated to be 29.4 and 31.8 ng/mL in the organic extracts. In addition, the method's limit of quantitation for Troc-norfentanyl and Troc-noracetylfentanyl were determined to be 88.2 and 95.5 ng/mL, respectively. Collectively, the results presented herein strengthen the use of chloroformate chemistry as an additional chemical tool to confirm the presence of these highly toxic and lethal substances in the environment.     

Humans Are Animals,Too: Critical Commonalities and Differences Between Human and Wildlife Forensic Genetics

Wildlife forensics has recently been recognized among the wide variety of forensic science disciplines. This review compares human and wildlife DNA forensics, which use the same genetic tools, but often for far different purposes. Human forensic genetics almost invariably attempts to identify individual perpetrators involved in a given crime. Wildlife forensics often determines whether a crime has occurred. In addition to techniques familiar in human laboratories, like individual matching with STRs, wildlife analysts may be asked to determine the taxonomic identity, geographic source, or sex of evidence items, or the familial relationships or minimum number of individuals among a group of samples. This review highlights the common questions, legal framework, databases, and similar validation requirements to foster understanding between disciplines. Based on this understanding, human and wildlife DNA practitioners may work together and learn from each other in order to elevate the discipline of forensic genetics.     

What does a digital forensics opinion look like? A comparative study of digital forensics and forensic science reporting practices

This study explores digital forensics (DF) reporting practices and compares the results with other forensic science disciplines. Forty reports were obtained from a quasi-experiment involving DF examiners, and a quantitative content analysis was performed to determine which conclusion types they applied and which content they included with relevance to the credibility of the reported results. A qualitative analysis was performed to examine the certainty expressions used in the conclusions. The results were compared to a study of eight forensic science disciplines performed by Bali et al. [24,26]. The results show that the DF examiners tend to present their conclusions either as Categorical conclusion or Strength of support (SoS) conclusion types and that they address source, activity, and offence level issues in their conclusions. The content analysis indicates deficiencies in DF reporting practices, and several of the challenges seem to be shared with other FS disciplines. The analysis of certainty expressions showed that a plethora of expressions was used, and that they lacked reference to an established framework. The results indicate that more research on DF evaluation and reporting practices is necessary and justifies a need for enhanced focus on quality control and peer review within the DF discipline.     

Automated computer forensics training in a virtualized environment

The CYber DEfenSe Trainer (CYDEST) is a virtualized training platform for network defense and computer forensics. It uses virtual machines to provide tactical level exercises for personnel such as network administrators, first responders, and digital forensics investigators. CYDEST incorporates a number of features to reduce instructor workload and to improve training realism, including: (1) automated assessment of trainee performance, (2) automated attacks that respond dynamically to the student's actions, (3) a full fidelity training environment, (4) an unrestricted user interface incorporating real tools, and (5) continuous, remote accessibility via the Web.     

电子数据司法鉴定主要类型及其定位简

电子数据司法鉴定已经成为当前司法鉴定研究热点问题之一。它是计算机司法鉴定的一种主要类型。根据鉴定性质不同，电子数据司法鉴定可以分为以“发现证据”为目标的鉴定和以“评估证据”为目标的鉴定。前者包括数据检索与固定、数据恢复、数据来源分析、数据内容分析、数据综合分析；后者包括同一鉴定、真伪鉴定、相似性鉴定、功能鉴定、复合鉴定等不同性质的鉴定项目。这两类鉴定在鉴定目标、程序、风险、意见主观性和证据审查等方面均存在显著差异。     

Study on the tracking revision history of MS Word files for forensic investigation

Document forensics remains an important field of digital forensics. To date, previously existing methods focused on the last saved version of the document file stored on the PC; however, the drawback of this approach is that this provides no indication as to how the contents have been modified. This paper provides a novel method for document forensics based on tracking the revision history of a Microsoft Word file. The proposed method concentrates on the TMP file created when the author saves the file and the ASD file created periodically by Microsoft Word during editing. A process whereby the revision history lists are generated based on metadata of the Word, TMP, and ASD files is presented. Furthermore, we describe a technique developed to link the revision history lists based on similarity. These outcomes can provide considerable assistance to a forensic investigator trying to establish the extent to which document file contents have been changed and when the file was created, modified, deleted, and copied.     

Study on the standard components of digital forensics laboratory

Recently, digital forensics has become increasingly important as it is used by investigation agencies, corporate, and private sector. To supplement the limitations of evidence capacity and be recognized in court, it is essential to establish an environment that ensures the integrity of the entire process ranging from collecting and analyzing to submitting digital evidence to court. In this study, common elements were extracted by comparing and analyzing ISO/IEC 17025, 27001 standards and Interpol and Council of Europe (CoE) guidelines to derive the necessary components for building a digital forensic laboratory. Subsequently, based on 21 digital forensic experts in the field, Delphi survey and verifications were conducted in three rounds. As a result, 40 components from seven areas were derived. The research results are based on the establishment, operation, management, and authentication of a digital forensics laboratory suitable for the domestic environment, with added credibility through collection of the opinions of 21 experts in the field of digital forensics in Korea. This study can be referred to in establishing digital forensic laboratories in national, public, and private digital forensic organizations as well as for employing as competency measurement criteria in courts to evaluate the reliability of the analysis results.     

Applying a forensic approach to incident response,network investigation and system administration using Digital Evidence Bags

This paper questions the current approach to forensic incident response and network investigations. Although claiming to be ‘forensic’ in nature it shows that the basic processes and mechanisms used in traditional computer forensics are rarely applied in the live incident investigation arena. This paper demonstrates how the newly proposed Digital Evidence Bag (DEB) storage format can be applied to a dynamic environment. A DEB is a universal container for digital evidence from any source. It allows the provenance to be recorded and continuity to be maintained throughout the life of the investigation. With a small amount of forethought a forensically rigorous approach can be applied to incident response, network investigations and system administration with minimal overhead.     

Comparison of gasolines using gas chromatography-mass spectrometry and target ion response

Gas chromatography-mass spectrometry was used to compare gasoline samples obtained from different sources based on the difference in amounts of certain components found in the headspace of gasoline using target response data. Many suspected arson cases involve comparing an ignitable liquid extracted from fire debris to a liquid found in a suspect's possession to determine if they could have had a common source. Various component ratios are proposed for determining if an unevaporated gasoline sample could have originated from the same source as an evaporated gasoline extracted from fire debris. Fifty and 75% evaporated gasoline samples were both found to contain similar ratios of certain components when compared with its unevaporated source gasoline. The results of the comparisons in this study demonstrate that for cases involving gasoline that has been evaporated up to 50% and extracted from pine, it is possible to eliminate comparison samples as originating from the same source. The results of the 75% comparisons suggest it may be possible to apply the same type of comparison to cases involving 75% evaporated gasoline.     

微生物物证检验

面对21世纪生物犯罪或生物恐怖活动的新挑战,物证鉴定的新专业--微生物物证检验将成为执法部门侦查和起诉生物犯罪必不可少的手段。微生物物证检验以用作犯罪武器的各种微生物为检验对象,获得微生物种类和能够提供来源信息的菌毒株细致分型结果,达到提供犯罪侦查线索和法庭证据的目的。本文综述了微生物物证检验的定义、特征、技术应用以及美国近年来在微生物物证检验的实践和值得借鉴的成功经验。并建议我国物证鉴定实验室应积极开展研究,建立能够满足生物犯罪侦查需求的微生物物证检验能力。     

An overall assessment of Mobile Internal Acquisition Tool

The smartphone market provides a great variety of manufacturers and models causing a strong (and mandatory) heterogeneity of the hardware tools adopted to retrieve smartphone contents in a forensically sound way. Thus, in order to lighten the burden for already overtaxed police operators, with possible increase of forensics productivity, we already identified, in a previous work, a new Mobile Equipment (ME) acquisition paradigm. In fact, it's possible to avoid the practical problems related to the USB/mobile phone plug heterogeneity, currently used by the mobile forensics tools, through the use of the MMC/SD slot, part of the hardware equipment of the target ME. This solution overcomes the problems related to the acquisition through the cables, simply relying on a piece of software installed stored into the SD/MMC. The contribution of this paper enriches the methodology already presented by the authors and presents some fundamental properties of the Mobile Internal Acquisition Tool (MIAT) in order to assess the performance with respect to the state of the art of the mobile forensics tools. The results of the assessment encourage the adoption of this tool, since integrity, performances and operational methodology mostly overall benefit from this approach, while, in the worst case, remain at the same level of the state of the art COTS. Finally, this tool, intended to be released under an Open Source license, proposes the paradigm where the acquisition source code is in the public domain, while the analysis and presentation are left to self-made/proprietary tools.     

An overall assessment of Mobile Internal Acquisition Tool

The smartphone market provides a great variety of manufacturers and models causing a strong (and mandatory) heterogeneity of the hardware tools adopted to retrieve smartphone contents in a forensically sound way. Thus, in order to lighten the burden for already overtaxed police operators, with possible increase of forensics productivity, we already identified, in a previous work, a new Mobile Equipment (ME) acquisition paradigm. In fact, it's possible to avoid the practical problems related to the USB/mobile phone plug heterogeneity, currently used by the mobile forensics tools, through the use of the MMC/SD slot, part of the hardware equipment of the target ME. This solution overcomes the problems related to the acquisition through the cables, simply relying on a piece of software installed stored into the SD/MMC. The contribution of this paper enriches the methodology already presented by the authors and presents some fundamental properties of the Mobile Internal Acquisition Tool (MIAT) in order to assess the performance with respect to the state of the art of the mobile forensics tools. The results of the assessment encourage the adoption of this tool, since integrity, performances and operational methodology mostly overall benefit from this approach, while, in the worst case, remain at the same level of the state of the art COTS. Finally, this tool, intended to be released under an Open Source license, proposes the paradigm where the acquisition source code is in the public domain, while the analysis and presentation are left to self-made/proprietary tools.     

A glance at digital forensic academic research demographics

Whilst the field of digital forensics is now well established, its research community can be considered relatively emerging in comparison to the associated areas of traditional forensic and computer sciences. As a result, this comment article takes a quick look at the demographics of digital forensics research over the last 20 years, with metadata from 6589 articles being extracted and analysed from Scopus in order to provide a brief insight into this field’s research activity.     

Augmented reality in forensics and forensic medicine – Current status and future prospects

Forensic investigations require a vast variety of knowledge and expertise of each specialist involved. With the increase in digitization and advanced technical possibilities, the traditional use of a computer with a screen for visualization and a mouse and keyboard for interactions has limitations, especially when visualizing the content in relation to the real world. Augmented reality (AR) can be used in such instances to support investigators in various tasks at the scene as well as later in the investigation process. In this article, we present current applications of AR in forensics and forensic medicine, the technological basics of AR, and the advantages that AR brings for forensic investigations. Furthermore, we will have a brief look at other fields of application and at future developments of AR in forensics.     

Likelihood ratio methods for forensic comparison of evaporated gasoline residues

In the investigation of arson, evidence connecting a suspect to the fire scene may be obtained by comparing the composition of ignitable liquid residues found at the crime scene to ignitable liquids found in possession of the suspect. Interpreting the result of such a comparison is hampered by processes at the crime scene that result in evaporation, matrix interference, and microbial degradation of the ignitable liquid.Most commonly, gasoline is used as a fire accelerant in arson. In the current scientific literature on gasoline comparison, classification studies are reported for unevaporated and evaporated gasoline residues. In these studies the goal is to discriminate between samples of several sources of gasoline, based on a chemical analysis. While in classification studies the focus is on discrimination of gasolines, for forensic purposes a likelihood ratio approach is more relevant.In this work, a first step is made towards the ultimate goal of obtaining numerical values for the strength of evidence for the inference of identity of source in gasoline comparisons. Three likelihood ratio methods are presented for the comparison of evaporated gasoline residues (up to 75% weight loss under laboratory conditions). Two methods based on distance functions and one multivariate method were developed. The performance of the three methods is characterized by rates of misleading evidence, an analysis of the calibration and an information theoretical analysis.The three methods show strong improvement of discrimination as compared with a completely uninformative method. The two distance functions perform better than the multivariate method, in terms of discrimination and rates of misleading evidence.     

Can analysis of a small clod of soil help to solve a murder case?

Soil forensics utilizes extensive soil information to answer legal questions and test hypotheses. The main difficulty often is the determination of different variables from a small amount of soil sample collected on the suspect. We developed a sequential mineralogical and chemical analyses to assess a limited quantity of soil vestiges (0.5 g) from a suspect's vehicle (adhered to the outside rear-view mirror and to the left front fender) involved in a murder case and compared them with the surface samples found at the victim's body disposal site at the Graciosa Road, Paraná State, Brazil. All results affirm that the suspect’s vehicle could have been in contact with the edge of the Graciosa Road, approximately the place where the victim’s body was located. As a result of the soil analysis and comparison, the results support the likely contact of the suspect’s vehicle with the crime scene.