Forensic acquisition and analysis of palm webOS on mobile devices

The emergence of webOS on Palm devices has created new challenges and opportunities for digital investigators. With the purchase of Palm by Hewlett Packard, there are plans to use webOS on an increasing number and variety of computer systems. These devices can store substantial amounts of information relevant to an investigation, including digital photographs, videos, call logs, SMS/MMS messages, e-mail, remnants of Web browsing and much more. Although some files can be obtained from such devices with relative ease, the majority of information of forensic interest is stored in databases on a system partition that many mobile forensic tools do not acquire. This paper provides a methodology for acquiring and examining forensic duplicates of user and system partitions from a device running webOS. The primary sources of digital evidence on these devices are covered with illustrative examples. In addition, the recovery of deleted items from various areas on webOS devices is discussed.     

Forensic analysis of newer TomTom devices

Today many investigations involve TomTom devices due to the wide-spread use of these navigation systems. The process of acquiring a memory dump from the first generation of TomTom devices was relatively easy by utilising the USB-connection and standard forensic tools. Newer devices, however, do not provide this or any other readily available data connection, making the task much more complex. In addition to existing and relatively complex chip-extraction procedures, an easier data acquisition method was developed without the need to de-solder flash memory chips. The presence of new files and the differences in data formats found in these devices meant that new methods of data analysis and decoding also needed to be developed.     

Forensic DNA analysis on microfluidic devices: a review

The advent of microfluidic technology for genetic analysis has begun to impact forensic science. Recent advances in microfluidic separation of short-tandem-repeat (STR) fragments has provided unprecedented potential for improving speed and efficiency of DNA typing. In addition, the analytical processes associated with sample preparation--which include cell sorting, DNA extraction, DNA quantitation, and DNA amplification--can all be integrated with the STR separation in a seamless manner. The current state of these microfluidic methods as well as their advantages and potential shortcomings are detailed. Recent advances in microfluidic device technology, as they pertain to forensic DNA typing, are discussed with a focus on the forensic community.     

Forensic applications of pyrolysis capillary gas chromatography

A simple system of pyrolysis capillary gas chromatography has been used to improve discrimination and long-term reproducibility in the analysis of polymers particularly alkyd based paints typically encountered in forensic casework. This involved the coupling of a Pye Curie-point pyrolyser to the inlet port of a capillary gas chromatograph operated in the splitless mode. Examples of pyrograms demonstrating improved differentiation of alkyd paints, and also examples of other architectural and automotive paints, automobile rubbers, adhesives, polyurethane foams and fibres are shown.     

手术治疗不当的法医学鉴定分析

医疗纠纷中由于手术治疗不当或失误而导致医患纠纷不在少数。手术治疗需要考虑的因素包含 :手术适应证 (指征 )、手术禁忌证、手术时机选择、手术方案 (方式 )确定、手术前准备、手术操作过程、术后的处理和并发症预防等等。涉及医疗纠纷的法医学鉴定均属法医临床学的范畴 ,其鉴定理论基础是临床医学。鉴定内容包括医院在诊疗过程中有无过错 ,患者的后果与医方过错有无因果关系。在诉讼阶段还可根据实际需要进行伤残评定 ,从而是为民事审判提供科学证据。手术治疗是疾病治疗过程中的一种重要治疗手段。如破损器官组织的修补、止血 ,梗阻的解…     

手术治疗不当的法医学鉴定分析

医疗纠纷中由于手术治疗不当或失误而导致医患纠纷不在少数.手术治疗需要考虑的因素包 含:手术适应证(指征)、手术禁忌证、手术时机选择、手术方案(方式)确定、手术前准 备、手术操作过程、术后的处理和并发症预防等等.涉及医疗纠纷的法医学鉴定均属法医临 床学的范畴,其鉴定理论基础是临床医学.鉴定内容包括医院在诊疗过程中有无过错,患者 的后果与医方过错有无因果关系.在诉讼阶段还可根据实际需要进行伤残评定,从而是为民事审判提供科学证据.     

Forensic analysis of WeChat on Android smartphones

WeChat is one of the most popular instant-messaging smartphone applications in the world. At the end of 2015, WeChat had 697 million monthly active users from over 200 countries. Although WeChat was designed originally for communication between relatives and friends, its abundant social functions are now also used by criminals for communication, and even for the organization and coordination of criminal acts. Therefore, communication records of social networking services like WeChat extracted from the smartphones of criminals are always the vital digital evidences for the investigation and prosecution of criminal cases. At present, only a few literatures focused on WeChat forensics. This paper describes several common questions that arise in forensic examinations of Android WeChat and provides corresponding technical methods that are useful to address these questions. This paper is intended to provide vital references for the investigators and researchers working on the digital forensics.     

Forensic data recovery and examination of magnetic swipe card cloning devices

Magnetic swipe card technology is used for many purposes including credit, debit, store loyalty, mobile phone top-up and security identification cards. These types of cards and the details contained on them are often relied upon as a form of identification and personal authentication. As such reliance is placed upon them it is surprising that they do not incorporate more stringent security features, and because of this lack of features it is not surprising that they attract the attention of people who wish to exploit them for illegal gain. The paper introduces the type of technology, and range of devices available for manipulating magnetic swipe card data. It proposes the use of Digital Evidence Bags as a suitable format for the evidential storage of information obtained from them, thus further illustrating the flexibility of the format and demonstrating the diverse range of devices that have to be handled within the digital investigation and law enforcement community.     

116例女性杀人案件法医学分析

本文通过对1993~2014年连云港地区116例女性杀人案件的受害人年龄分布、嫌疑人与受害人关系、现场特征、损伤工具及致命伤位置等进行统计分析,发现男女性之间由于心理、生理特征和性格等多种因素的影响,女性杀人案件呈现出自身特点:女犯罪嫌疑人与被害人的关系多为家庭内部成员,尤以夫妻或男女朋友居多;现场常位于室内,以卧室居多;工具多是居家常用的生产或生活用具;多选择受害人熟睡、酒后时作案,采用窒息、投毒、溺水等方式;损伤集中于要害部位,分布范围集中,打击次数多,致命性损伤、濒死伤和死后损伤多。     

Forensic analysis of Telegram Messenger on Android smartphones

In this paper we present a methodology for the forensic analysis of the artifacts generated on Android smartphones by Telegram Messenger, the official client for the Telegram instant messaging platform, which provides various forms of secure individual and group communication, by means of which both textual and non-textual messages can be exchanged among users, as well as voice calls.Our methodology is based on the design of a set of experiments suitable to elicit the generation of artifacts and their retention on the device storage, and on the use of virtualized smartphones to ensure the generality of the results and the full repeatability of the experiments, so that our findings can be reproduced and validated by a third-party.In this paper we show that, by using the proposed methodology, we are able (a) to identify all the artifacts generated by Telegram Messenger, (b) to decode and interpret each one of them, and (c) to correlate them in order to infer various types of information that cannot be obtained by considering each one of them in isolation.As a result, in this paper we show how to reconstruct the list of contacts, the chronology and contents of the messages that have been exchanged by users, as well as the contents of files that have been sent or received. Furthermore, we show how to determine significant properties of the various chats, groups, and channels in which the user has been involved (e.g., the identifier of the creator, the date of creation, the date of joining, etc.). Finally, we show how to reconstruct the log of the voice calls made or received by the user.Although in this paper we focus on Telegram Messenger, our methodology can be applied to the forensic analysis of any application running on the Android platform.     

Digital evidence from mobile telephone applications

In this paper we examine the legal aspects of the forensic investigation of mobile telephone applications. Mobile telephone applications might be involved with a variety of types of computer misuse including fraud, theft, money laundering, dissemination of copyrighted materials or indecent images, or instances where mobile telephone applications have been involved in the transmission of malware for malicious or criminal purposes. In this paper we examine the process of the forensic investigation of mobile telephone applications, and the issues relating to obtaining digital evidence from mobile telephone applications.     

Location privacy: The challenges of mobile service devices

Adding to the current debate, this article focuses on the personal data and privacy challenges posed by private industry's use of smart mobile devices that provide location-based services to users and consumers. Directly relevant to personal data protection are valid concerns about the collection, retention, use and accessibility of this kind of personal data, in relation to which a key issue is whether valid consent is ever obtained from users. While it is indisputable that geo-location technologies serve important functions, their potential use for surveillance and invasion of privacy should not be overlooked. Thus, in this study we address the question of how a legal regime can ensure the proper functionality of geo-location technologies while preventing their misuse. In doing so, we examine whether information gathered from geo-location technologies is a form of personal data, how it is related to privacy and whether current legal protection mechanisms are adequate. We argue that geo-location data are indeed a type of personal data. Not only is this kind of data related to an identified or identifiable person, it can reveal also core biographical personal data. What is needed is the strengthening of the existing law that protects personal data (including location data), and a flexible legal response that can incorporate the ever-evolving and unknown advances in technology.     

Forensic oral imaging quality of hand-held dental X-ray devices: Comparison of two image receptors and two devices

Recently, different portable hand-held and battery-powered dental X-ray units have become available. Especially for forensic odontological purposes, they offer diverse advantages such as for use in disaster areas and crime-scene locations as also in autopsy rooms and mortuaries. For any application, the most important feature of these hand-held devices is the delivered image quality. The aim of this study is to evaluate the radiographic image quality acquired by two portable X-ray devices in combination with two types of image receptors and to compare the findings with the image quality of a standard intra-oral X-ray device.Eleven samples consisting of eight teeth, two dry skeletal specimens and one formalin-fixed mandible part were mounted on blocks for standardised (re)positioning. Radiological images were acquired with two hand-held (AnyRay^® 60 kVp, 0.02–4.00 mAs and NOMAD^® 60 kVp, 0.023–2.277 mAs) and one wall-mounted (MinRay^® 60/70 kVp 0.14–22.4 mAs) X-ray device combined with two image receptor systems (VistaScan^® phosphor storage plate (PSP) and SIGMA^® M CMOS Active Pixel technology sensor). The effect of X-ray source-to-object distance (SOD) was checked at 20 cm in conjunction with object to image receptor distances (OIDs) of 0.8 and 2.5 cm. For each parameter setup, the exposure times were run from low till high. An expert consent statement was achieved by agreement of four expert observers selecting the optimal images based on a developed four point quality rating system. Next, a selection of the images was assembled in a set of 198 observation screens and scored by seven observers. The observation screens were designed to compare observer scores, relations between devices, receptors and OIDs and images obtained from the different devices at equal exposure levels (mAs). All results were statistically analysed.Radiological image quality was significantly higher for phosphor plate compared with the CMOS digital receptor system (p < 0.0001). Furthermore, a significantly superior image quality was obtained for OID = 0.8 than for OID = 2.5 (p = 0.039). A significant difference in image quality between the three devices was also established (p = 0.02). The present study demonstrated the feasibility of portable X-ray systems for forensic odontological applications based on rendering optimal image quality, provided an in vitro guideline of optimal parameter settings and offered a radiological image database usable in further research.     

Forensic applications of infrared chemical imaging: multi-layered paint chips

This paper examines the potential of infrared chemical (hyperspectral) imaging as a technique for the forensic analysis of automotive paint chips in particular, and multicomponent (e.g., layered) samples in general. Improved sample preparation procedures for the infrared analysis of paint chips are detailed, with the recommendation that where mounting resins are chemically incompatible with the sample, it is better to mount and section the sample in a soft wax from which the sections can be removed and pressed into a KBr disk for transmission analysis. Infrared chemical images of multilayered paint chips have been successfully obtained, with the chief advantage over conventional infrared analysis being that thousands of infrared spectra are collected in a few minutes across the whole sample, at a spatial resolution of around 5 microm. As with conventional infrared spectroscopy, chemical species can be identified from their spectra, but the wealth of information available can be also extracted in a number of different ways that make multicomponent spectral (and hence chemical) comparisons between two samples easy to visualize and understand. In one approach, the infrared chemical images of two paint chips being compared side-by-side can be viewed as a "movie," in which each frame is an intensity map of the two samples at a given wavenumber (frequency) value. In another approach, the spectra (pixels) in the image files are classified into chemically similar groups, resulting in a "cluster" image that makes it possible to simultaneously compare all of the layers in two paint chips. These methods are applicable to other multicomponent samples, and also to other chemical imaging techniques.