Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results

Current digital forensic text string search tools use match and/or indexing algorithms to search digital evidence at the physical level to locate specific text strings. They are designed to achieve 100% query recall (i.e. find all instances of the text strings). Given the nature of the data set, this leads to an extremely high incidence of hits that are not relevant to investigative objectives. Although Internet search engines suffer similarly, they employ ranking algorithms to present the search results in a more effective and efficient manner from the user's perspective. Current digital forensic text string search tools fail to group and/or order search hits in a manner that appreciably improves the investigator's ability to get to the relevant hits first (or at least more quickly). This research proposes and empirically tests the feasibility and utility of post-retrieval clustering of digital forensic text string search results – specifically by using Kohonen Self-Organizing Maps, a self-organizing neural network approach.This paper is presented as a work-in-progress. A working tool has been developed and experimentation has begun. Findings regarding the feasibility and utility of the proposed approach will be presented at DFRWS 2007, as well as suggestions for follow-on research.     

Author gender identification from text

Text is still the most prevalent Internet media type. Examples of this include popular social networking applications such as Twitter, Craigslist, Facebook, etc. Other web applications such as e-mail, blog, chat rooms, etc. are also mostly text based. A question we address in this paper that deals with text based Internet forensics is the following: given a short text document, can we identify if the author is a man or a woman? This question is motivated by recent events where people faked their gender on the Internet. Note that this is different from the authorship attribution problem.In this paper we investigate author gender identification for short length, multi-genre, content-free text, such as the ones found in many Internet applications. Fundamental questions we ask are: do men and women inherently use different classes of language styles? If this is true, what are good linguistic features that indicate gender? Based on research in human psychology, we propose 545 psycho-linguistic and gender-preferential cues along with stylometric features to build the feature space for this identification problem. Note that identifying the correct set of features that indicate gender is an open research problem. Three machine learning algorithms (support vector machine, Bayesian logistic regression and AdaBoost decision tree) are then designed for gender identification based on the proposed features. Extensive experiments on large text corpora (Reuters Corpus Volume 1 newsgroup data and Enron e-mail data) indicate an accuracy up to 85.1% in identifying the gender. Experiments also indicate that function words, word-based features and structural features are significant gender discriminators.     

Language translation for file paths

Forensic examiners are frequently confronted with content in languages that they do not understand, and they could benefit from machine translation into their native language. But automated translation of file paths is a difficult problem because of the minimal context for translation and the frequent mixing of multiple languages within a path. This work developed a prototype implementation of a file-path translator that first identifies the language for each directory segment of a path, and then translates to English those that are not already English nor artificial words. Brown's LA-Strings utility for language identification was tried, but its performance was found inadequate on short strings and it was supplemented with clues from dictionary lookup, Unicode character distributions for languages, country of origin, and language-related keywords. To provide better data for language inference, words used in each directory over a large corpus were aggregated for analysis. The resulting directory-language probabilities were combined with those for each path segment from dictionary lookup and character-type distributions to infer the segment's most likely language. Tests were done on a corpus of 50.1 million file paths looking for 35 different languages. Tests showed 90.4% accuracy on identifying languages of directories and 93.7% accuracy on identifying languages of directory/file segments of file paths, even after excluding 44.4% of the paths as obviously English or untranslatable. Two of seven proposed language clues were shown to impair directory-language identification. Experiments also compared three translation methods: the Systran translation tool, Google Translate, and word-for-word substitution using dictionaries. Google Translate usually performed the best, but all still made errors with European languages and a significant number of errors with Arabic and Chinese.     

Enhancing security of fingerprints through contextual biometric watermarking

This paper presents a novel digital watermarking technique using face and demographic text data as multiple watermarks for verifying the chain of custody and protecting the integrity of a fingerprint image. The watermarks are embedded in selected texture regions of a fingerprint image using discrete wavelet transform. Experimental results show that modifications in these locations are visually imperceptible and maintain the minutiae details. The integrity of the fingerprint image is verified through the high matching scores obtained from an automatic fingerprint identification system. There is also a high degree of visual correlation between the embedded images, and the extracted images from the watermarked fingerprint. The degree of similarity is computed using pixel-based metrics and human visual system metrics. The results also show that the proposed watermarked fingerprint and the extracted images are resilient to common attacks such as compression, filtering, and noise.     

从能指到所指?——文学翻译个案研究

在文学文本的阐释中,语言的解码对于译者而言具有不同于读者的特殊性,译者往往专注于原语文本———目的语文本的深层解码———编码,而忽略目的语文本的表层编码,正是这后一个缺项,压缩了目的语读者应有的解码空间。因而,译者在面临以能指为特征的文本时,应尽量再现目的语文本能指的指涉空间,即还能指以能指。     

Radiographic Identification Using Midline Medical Sternotomy Wires,

Forensic anthropologists are regularly asked to assist with the identification of unknown individuals using comparative medical radiography. This study addressed the use of midline medical sternotomy wires as a means for personal identification. Antemortem and postmortem radiographic comparisons were completed by 46 professional forensic anthropologists and anthropology graduate students familiar with comparative medical radiography as a technique for assessing identification. Participants were asked to make five radiographic matches from a pool of 20 radiographs. Participants also completed an anonymous survey detailing their education level and experience making radiographic comparisons. Participants were 99.5% accurate in matching the radiographs. Sensitivity was 98.7%, and specificity was 99.7%. Logistic regression analysis found no statistically significant differences in the participants' ability to make a correct match. As the high accuracy rates indicate, the shape, size, and various characteristics of the sternotomy wires are individualizing and can confidently be used when assisting with personal identification cases.     

Computation of likelihood ratios in fingerprint identification for configurations of any number of minutiae

Recent court challenges have highlighted the need for statistical research on fingerprint identification. This paper proposes a model for computing likelihood ratios (LRs) to assess the evidential value of comparisons with any number of minutiae. The model considers minutiae type, direction and relative spatial relationships. It expands on previous work on three minutiae by adopting a spatial modeling using radial triangulation and a probabilistic distortion model for assessing the numerator of the LR. The model has been tested on a sample of 686 ulnar loops and 204 arches. Features vectors used for statistical analysis have been obtained following a preprocessing step based on Gabor filtering and image processing to extract minutiae data. The metric used to assess similarity between two feature vectors is based on an Euclidean distance measure. Tippett plots and rates of misleading evidence have been used as performance indicators of the model. The model has shown encouraging behavior with low rates of misleading evidence and a LR power of the model increasing significantly with the number of minutiae. The LRs that it provides are highly indicative of identity of source on a significant proportion of cases, even when considering configurations with few minutiae. In contrast with previous research, the model, in addition to minutia type and direction, incorporates spatial relationships of minutiae without introducing probabilistic independence assumptions. The model also accounts for finger distortion.     

Knowledge on DNA Success Rates to Optimize the DNA Analysis Process: From Crime Scene to Laboratory

DNA analysis has become an essential intelligence tool in the criminal justice system for the identification of possible offenders. However, it appears that about half of the processed DNA samples contains too little DNA for analysis. This study looks at DNA success rates within 28 different categories of trace exhibits and relates the DNA concentration to the characteristics of the DNA profile. Data from 2260 analyzed crime samples show that cigarettes, bloodstains, and headwear have relatively high success rates. Cartridge cases, crowbars, and tie‐wraps are on the other end of the spectrum. These objective data can assist forensics in their selection process.The DNA success probability shows a positive relation with the DNA concentration. This finding enables the laboratory to set an evidence‐based threshold value in the DNA analysis process. For instance, 958 DNA extracts had a concentration value of 6 pg/μL or less. Only 46 of the 958 low‐level extracts provided meaningful DNA profiling data.     

Source Camera Identification for Heavily JPEG Compressed Low Resolution Still Images*

Abstract: In this research, we examined whether fixed pattern noise or more specifically Photo Response Non‐Uniformity (PRNU) can be used to identify the source camera of heavily JPEG compressed digital photographs of resolution 640 × 480 pixels. We extracted PRNU patterns from both reference and questioned images using a two‐dimensional Gaussian filter and compared these patterns by calculating the correlation coefficient between them. Both the closed and open‐set problems were addressed, leading the problems in the closed set to high accuracies for 83% for single images and 100% for around 20 simultaneously identified questioned images. The correct source camera was chosen from a set of 38 cameras of four different types. For the open‐set problem, decision levels were obtained for several numbers of simultaneously identified questioned images. The corresponding false rejection rates were unsatisfactory for single images but improved for simultaneous identification of multiple images.     

FINEX: a Probabilistic Expert System for forensic identification

A series of recent papers have shown how to formulate complex problems of forensic DNA identification inference, such as occur in disputed paternity or criminal identification cases, in terms of Probabilistic Expert Systems (PESs). However, at the present time, general purpose PES software is not particularly well suited to the repetitive tasks of: specifying an appropriate set of marker networks for a specific problem; for editing the many local conditional probability tables; and combining evidence from several genetic markers to evaluate likelihoods. Here, I describe a user-friendly prototype software tool called FINEX developed both to automate such tasks and also to evaluate likelihoods of interest. Ease of use is achieved by a graphical specification language that enables a user to quickly specify a range of forensic DNA problems. I describe the algorithms by which FINEX converts the user input in the graphical specification language and data on observed markers to the Bayesian networks used in PES.     

Fingerprint error rate on close non‐matches

The accuracy of fingerprint identifications is critically important to the administration of criminal justice. Accuracy is challenging when two prints from different sources have many common features and few dissimilar features. Such print pairs, known as close non‐matches (CNMs), are increasingly likely to arise as ever‐growing databases are searched with greater frequency. In this study, 125 fingerprint agencies completed a mandatory proficiency test that included two pairs of CNMs. The false‐positive error rates on the two CNMs were 15.9% (17 out of 107, 95% C.I.: 9.5%, 24.2%) and 28.1% (27 out of 96, 95% C.I.: 19.4%, 38.2%), respectively. These CNM error rates are (a) inconsistent with the popular notion that fingerprint evidence is nearly infallible, and (b) larger than error rates reported in leading fingerprint studies. We conclude that, when the risk of CNMs is high, the probative value of a reported fingerprint identification may be severely diminished due to an elevated false‐positive error risk. We call for additional CNM research, including a replication and expansion of the present study using a representative selection of CNMs from database searches.     

Percentage of body recovered and its effect on identification rates and cause and manner of death determination

Anthropologists frequently encounter cases in which only partial human remains are recovered. This study reports how the percentage of the body recovered affects identification (ID) rates and cause and manner of death determination. A total of 773 cases involving anthropology consults were drawn from the New Mexico medical examiner's office (1974-2006). Results indicate a significant correlation between body percent recovered and ID rates, which ranged from 89% for complete bodies to 56% when less than half the body was present. Similar patterns were evident in cause/manner determination, which were the highest (83% and 79%, respectively) in complete bodies but declined to 40% when less than half the body was found. The absence of a skull also negatively impacted ID and ruling rates. Findings are compared with general autopsy ID rates (94-96%) and cause/manner determination rates (96-99%) as well as prior published rates for individual casework and mass death events.     

The Reliability of Visually Comparing Small Frontal Sinuses*

Abstract: Several studies have investigated frontal sinus comparison for personal identification. One study addressed the statistical reliability of correct identification using automated digital methods and resulted in a 96% accuracy rate. Missed matches with the digital methods generally involved small, less featured sinuses. This study investigates the hypothesis that human examiners may be able to more accurately identify correct matches than digital methods, even when the comparisons involve small frontal sinuses. Participants were provided two sets of 28 radiographs and were instructed to identify matching radiographs and list the radiographs that did not have a corresponding match. Overall, error rates were low, with correct associations identified at a rate of 0.983. No incorrect associations (“false positives”) were made. Correct association rates were highest among participants “experienced” examining radiographs. Results support previous assertions that frontal sinus radiographs are a reliable means of personal identification even when the frontal sinuses are small.     

Suspect/Foil Identification in Actual Crimes and in the Laboratory: A Reality Monitoring Analysis

Four reality monitoring variables were used to discriminate suspect from foil identifications in 183 actual criminal cases. Four hundred sixty-one identification attempts based on five and six-person lineups were analyzed. These identification attempts resulted in 238 suspect identifications and 68 foil identifications. Confidence, automatic processing, eliminative processing and feature use comprised the set of reality monitoring variables. Thirty-five verbal confidence phrases taken from police reports were assigned numerical values on a 10-point confidence scale. Automatic processing identifications were those that occurred “immediately” or “without hesitation.” Eliminative processing identifications occurred when witnesses compared or eliminated persons in the lineups. Confidence, automatic processing and eliminative processing were significant predictors, but feature use was not. Confidence was the most effective discriminator. In cases that involved substantial evidence extrinsic to the identification 43% of the suspect identifications were made with high confidence, whereas only 10% of the foil identifications were made with high confidence. The results of a laboratory study using the same predictors generally paralleled the archival results. Forensic implications are discussed.     

The reliability of digitized radiographs for dental identification: a Web-based study

In the era of Daubert and other judicial rulings pertaining to the acceptability of forensic evidence, it is increasingly important that experts are able to testify that their methods have been scientifically tested and that error rates and other factors relating to reliability have been published. The purpose of this study was to determine the reliability of digitized radiographic comparisons for the purposes of dental identification. Participants with various forensic backgrounds and experience levels were passively recruited to the website. Ten forensic identification cases composed of antemortem and postmortem dental radiographs were supplied to examiners using a bespoke website. Participants responded to the cases on two occasions after a one-month washout interval using the ABFO conclusion levels for forensic identifications. A total of 115 first attempts and 87 matched second attempts were received. Of the total responses, 72% were dentally trained respondents who had completed at least one forensic identification case; of these, 38% were experienced forensic dentists who had completed more than 25 identifications. Data relating to accuracy, intra- and inter-examiner agreement, and the effect of case difficulty are presented. Mean accuracy was 85.5% for all cases, with the experienced forensic dentists obtaining a 91% success rate. The inter-examiner agreement on the negative identification cases was classified as poor. The data suggest that dental identifications resulting from the comparison of postmortem and antemortem radiographs are valid, accurate, and reliable when undertaken by experienced odontologists.     

Eyewitness Accuracy Rates in Police Showup and Lineup Presentations: A Meta-Analytic Comparison

Meta-analysis is used to compare identification accuracy rates in showups and lineups. Eight papers were located, providing 12 tests of the hypothesis and including 3013 participants. Results indicate that showups generate lower choosing rates than lineups. In target present conditions, showups and lineups yield approximately equal hit rates, and in target absent conditions, showups produce a significantly higher level of correct rejections. False identification rates are approximately equal in showups and lineups when lineup foil choices are excluded from analysis. Dangerous false identifications are more numerous for showups when an innocent suspect resembles the perpetrator. Function of lineup foils, assessment strategies for false identifications, and the potential impact of biases in lineup practice are suggested as additional considerations in evaluation of showup versus lineup efficacy.     

Design and use of a computer-assisted postmortem identification system

The organization and rationale for the design of a computer-assisted postmortem identification system are discussed along with results of the use of this system in extensive simulation trials on a database of 578 records. The selectivity of dental characteristics is so great that any individual with 4 or more characteristics (either fillings or missing teeth), can be separated from a group of 578 people for final verification of the identity match. The effects of errors in the database are discussed and the actual effects of different error rates on identification are shown. Error rates of up to 30% have only small effects on the ability of the system to pick out correct identity matches. The system is presently implemented on a portable microcomputer, a representative desktop computer, and a large minicomputer. The present efforts include statistical analysis of an enlarged database and testing of a data acquisition system to allow the building of a large identification database (25 000 records) in a quick and economical manner.     

On the Incoherence of Legal Language to the General Public

I will suggest, in this article, a possible explanation of the fact that legal language appears incoherent to the general public. I will present one legal text (an indictment), explaining why it appears incoherent to legal laypersons. I will argue that the traits making this particular text appear incoherent are, first, that a specialized legal meaning is conveyed implicitly and, second, that there are no key-words that could direct laypersons to the knowledge making this meaning obvious to legalists. I will conclude that any legal text having these traits is likely to appear incoherent to the general public and suggest that the traits making my example appear incoherent might be rather common among the various texts of the various legal systems. On this suggestion there is no need to assume any causal relation between lawyers’ social interests and the apparent incoherence of legal language as it entails that this incoherence is inevitable. (I will argue that it is a result of the facts that legal language is ordinary language used, in the ordinary way, in the special context of the legal discourse.)     

Eyewitness Identification in Actual Criminal Cases: An Archival Analysis

This study analyzed 271 actual police cases in order to address several prevalent issues in the eyewitness literature. Suspect identification (SI) rates were obtained for 289 photographic lineups, 258 field showups, 58 live lineups, and 66 lineup identifications preceded by earlier identifications. SI rates were assessed for 3 levels of extrinsic evidence: no extrinsic evidence, evidence of minimal probative value, and evidence of substantial probative value. The SI rates for the photographic lineups were assessed as a function of delay, same vs. cross-race conditions, witness type, and weapon presence. SI rates declined significantly over time; SI rates were significantly greater for the same-race condition. SI rates were much greater for field showups than photographic lineups, 76% vs. 48%. The SI rates for the field showups did not vary as a function of eyewitness conditions. The relation between confidence and suspect/foil identifications for the live lineups was significant and moderately high. The utility of archival identification studies for eyewitness testimony research is discussed.     

网络过滤技术的正当性批判——对美国网络法学界一个理论论争的观察

尽管立基于社会公共秩序的考虑的网络过滤技术有其合理的一面,但在互联网上设置网络过滤技术装置,即便是声称对信息自由流动损害最小、最大程度尊重网民自由选择、兼顾社会安定需求和言论自由的内容选择平台,但仍然无法避免恣意判断,并进而对公民言论自由权造成损害.其是否具有正当性,仍是一个富有争议的话题.尽管语境不同,但网络内容选择平台在美国引起的争议,应当成为我国在进行有关网络言论管制时所应当借鉴的参照系.