Toward a General Ontology for Digital Forensic Disciplines

Ontologies are widely used in different disciplines as a technique for representing and reasoning about domain knowledge. However, despite the widespread ontology‐related research activities and applications in different disciplines, the development of ontologies and ontology research activities is still wanting in digital forensics. This paper therefore presents the case for establishing an ontology for digital forensic disciplines. Such an ontology would enable better categorization of the digital forensic disciplines, as well as assist in the development of methodologies and specifications that can offer direction in different areas of digital forensics. This includes such areas as professional specialization, certifications, development of digital forensic tools, curricula, and educational materials. In addition, the ontology presented in this paper can be used, for example, to better organize the digital forensic domain knowledge and explicitly describe the discipline's semantics in a common way. Finally, this paper is meant to spark discussions and further research on an internationally agreed ontological distinction of the digital forensic disciplines. Digital forensic disciplines ontology is a novel approach toward organizing the digital forensic domain knowledge and constitutes the main contribution of this paper.     

Forensic analysis of social networking applications on mobile devices

The increased use of social networking applications on smartphones makes these devices a goldmine for forensic investigators. Potential evidence can be held on these devices and recovered with the right tools and examination methods. This paper focuses on conducting forensic analyses on three widely used social networking applications on smartphones: Facebook, Twitter, and MySpace. The tests were conducted on three popular smartphones: BlackBerrys, iPhones, and Android phones. The tests consisted of installing the social networking applications on each device, conducting common user activities through each application, acquiring a forensically sound logical image of each device, and performing manual forensic analysis on each acquired logical image. The forensic analyses were aimed at determining whether activities conducted through these applications were stored on the device's internal memory. If so, the extent, significance, and location of the data that could be found and retrieved from the logical image of each device were determined. The results show that no traces could be recovered from BlackBerry devices. However, iPhones and Android phones store a significant amount of valuable data that could be recovered and used by forensic investigators.     

Bayesian networks and probabilistic reasoning about scientific evidence when there is a lack of data

Bayesian networks (BNs) are a kind of graphical model that formally combines elements of graph and probability theory. BNs are a mathematically and statistically rigorous technique allowing their user to define a pictorial representation of assumed dependencies and influences among a set of variables deemed to be relevant for a particular inferential problem. The formalism allows one to process newly acquired evidence according to the rules of probability calculus. Applications of BNs have been reported in various forensic disciplines. However, there seems to be some reluctance to consider BNs as a more general framework for representing and evaluating sources of uncertainties associated with scientific evidence. Notably, BNs are widely thought of as an essentially numerical method, requiring "exact" numbers with a high "accuracy". The present paper aims to draw the reader's attention to the point that the availability of hard numerical data is not a necessary requirement for using BNs in forensic science. An abstraction of quantitative BNs, known as qualitative probabilistic networks (QPNs), and sensitivity analyses are presented and their potential applications discussed. As a main difference to their quantitative counterpart, QPNs contain qualitative probabilistic relationships instead of numerical relations. Sensitivity analyses consist of varying the probabilities assigned to one or more variables and evaluating the effect on one or more other variables of interest. Both QPNs and sensitivity analyses appear to be useful concepts that permit one to work in contexts with acute lack of numerical data and where reasoning consistent with the laws of probability should nevertheless be performed.     

Humans Are Animals,Too: Critical Commonalities and Differences Between Human and Wildlife Forensic Genetics

Wildlife forensics has recently been recognized among the wide variety of forensic science disciplines. This review compares human and wildlife DNA forensics, which use the same genetic tools, but often for far different purposes. Human forensic genetics almost invariably attempts to identify individual perpetrators involved in a given crime. Wildlife forensics often determines whether a crime has occurred. In addition to techniques familiar in human laboratories, like individual matching with STRs, wildlife analysts may be asked to determine the taxonomic identity, geographic source, or sex of evidence items, or the familial relationships or minimum number of individuals among a group of samples. This review highlights the common questions, legal framework, databases, and similar validation requirements to foster understanding between disciplines. Based on this understanding, human and wildlife DNA practitioners may work together and learn from each other in order to elevate the discipline of forensic genetics.     

Forensic drug intelligence: an important tool in law enforcement

Organised criminality is a great concern for national/international security. The demonstration of complex crimes is increasingly dependant on knowledge distributed within law-enforcement agencies and scientific disciplines. This separation of knowledge creates difficulties in reconstructing and prosecuting such crimes. Basic interdisciplinary research in drug intelligence combined with crime analysis, forensic intelligence, and traditional law enforcement investigation is leading to important advances in crime investigation support. Laboratory results constitute one highly dependable source of information that is both reliable and testable. Their operational use can support investigation and even provide undetected connections or organisation of structure. The foremost difficulties encountered by drug analysts are not principally of a chemical or analytical nature, but methodologies to extract parameters or features that are deemed to be crucial for handling and contextualising drug profiling data. An organised memory has been developed in order to provide accurate, timely, useful and meaningful information for linking spatially and temporally distinct events on a national and international level (including cross-border phenomena). Literature has already pointed out that forensic case data are amenable for use in an intelligence perspective if data and knowledge of specialised actors are appropriately organised, shared and processed. As a particular form of forensic case data, the authors' research focuses on parameters obtained through the systematic physical and chemical profiling of samples of illicit drugs. The procedure is used to infer and characterise links between samples that originate from the same and different seizures. The discussion will not, however, focus on how samples are actually analysed and compared as substantial literature on this topic already exists. Rather, attention is primarily drawn to an active and close collaboration between magistrates, forensic scientists, law enforcement investigators and crime analysts from different institutions with the aim of generating, using and validating relevant profiling case data as integral part of investigative and crime analysis processes. Original advances are highlighted through experiences from criminal investigations of offences related to the unlawful importation, exportation, supply and possession of illicit drugs.     

Validation studies of the ParaDNA® Intelligence System with artificial evidence items

Short tandem repeat (STR) profiling is one of the mostly used systems for forensic applications. In certain circumstances, STR profiling is time-consuming and costly, which potentially leads to delays in criminal investigations. LGC (Laboratory of the Government Chemist, UK) Forensics has developed a robust STR profiling platform called the ParaDNA^® Intelligence Test System which can provide early tactical intelligence and aid investigators in making informed decisions on sample prioritization for detection. Here, we validated the ParaDNA intelligence test for its application in forensic cases using a range of mock evidence items following guidelines set by the Scientific Working Group on DNA Analysis Methods (SWGDAM). Specifically, we tested the sensitivity and accuracy of the ParaDNA intelligence test, as well as the success rates for detecting mock samples and for use in case scenarios. Our findings demonstrate that the ParaDNA intelligence test generates useful DNA profiles, especially for samples such as blood, saliva, and semen that contain ample DNA, indicating the benefits of including ParaDNA as a prior step in forensic STR profiling pipelines.     

On the use of IRMS in forensic science: proposals for a methodological approach

The flourishing number of publications on the use of isotope ratio mass spectrometry (IRMS) in forensic science denotes the enthusiasm and the attraction generated by this technology. IRMS has demonstrated its potential to distinguish chemically identical compounds coming from different sources. Despite the numerous applications of IRMS to a wide range of forensic materials, its implementation in a forensic framework is less straightforward than it appears. In addition, each laboratory has developed its own strategy of analysis on calibration, sequence design, standards utilisation and data treatment without a clear consensus. Through the experience acquired from research undertaken in different forensic fields, we propose a methodological framework of the whole process using IRMS methods. We emphasize the importance of considering isotopic results as part of a whole approach, when applying this technology to a particular forensic issue. The process is divided into six different steps, which should be considered for a thoughtful and relevant application. The dissection of this process into fundamental steps, further detailed, enables a better understanding of the essential, though not exhaustive, factors that have to be considered in order to obtain results of quality and sufficiently robust to proceed to retrospective analyses or interlaboratory comparisons.     

Some Examples of Applications of a Microthermal Desorption Device in the Forensic Laboratory

Abstract:  Several applications of a microthermal desorption device for analysis of small forensic samples are presented. The method uses a solid phase microextraction holder with the fiber removed. In addition to samples of inks on paper, this device was successfully used for analysis of toners, various stains on bank notes, and lipstick stains on paper. Other small items encountered in a forensic science laboratory were also analyzed: particles of smokeless powder, particles of coffee, and automotive clear topcoat layer. The desorbed compounds were analyzed by gas chromatography with a flame ionization detector or by gas chromatography–mass spectrometry. This device can be used in connection with any kind of gas chromatograph. By selection of different injector temperatures, fractionated thermal desorption of samples is achieved. The procedure was demonstrated on samples of ballpoint pen ink of various age.     

Capturing high-resolution digital images for use in forensic document examination

In the past, pattern disciplines within forensic science have periodically faced criticism due to their subjective and qualitative nature and the perceived absence of research evaluating and supporting the foundations of their practices. Recently, however, forensic scientists and researchers in the field of pattern evidence analysis have developed and published approaches that are more quantitative, objective, and data driven. This effort includes automation, algorithms, and measurement sciences, with the end goal of enabling conclusions to be informed by quantitative models. Before employing these tools, forensic evidence must be digitized in a way that adequately balances high-quality detail and content capture with minimal background noise imparted by the selected technique. While the current work describes the process of optimizing a method to digitize physical documentary evidence for use in semi-automated trash mark examinations, it could be applied to assist other disciplines where the digitization of physical items of evidence is prevalent. For trash mark examinations specifically, it was found that high-resolution photography provided optimal digital versions of evidentiary items when compared to high-resolution scanning.     

Tasks of research in forensic medicine - different study types in clinical research and forensic medicine

In the last years the research output of forensic medicine has sometimes been regarded as insufficient and as of poor quality, especially when parameters as impact factors and external funding were taken into account. However, forensic medicine has different tasks compared to clinical medicine. The main difference between basic subjects, clinical and forensic medicine is not a lack of scientific efficiency in forensic medicine but is a result of the questions asked, the available methods and specific aims. In contrast to natural-scientific research, forensic science has furthermore important intersections with arts and socio-scientific disciplines. Etiologic and pathogenetic research is of only limited relevance in forensic medicine. Thus, forensic medicine is excluded from these research fields, which are mainly supported by external funding. In forensic medicine research mainly means applied research regarding findings, the probative value and reconstruction as well as examination at different points of intersection between medicine and law. Clinical types of research such as controlled randomised, prospective cross-sectional, cohort or case-control studies can only rarely be applied in forensic medicine due to the area specific research fields (e.g. thantatology, violent death, vitality, traffic medicine, analytical toxicology, hemogenetics and stain analysis). The types of studies which are successfully established in forensic medicine are comparison of methods, sensitivity studies, validation of methods, kinetic examinations etc. Tasks of research in forensic medicine and study types, which may be applied will be addressed.     

The contribution of forensic science to crime analysis and investigation: forensic intelligence

The debate in forensic science concentrates on issues such as standardisation, accreditation and de-contextualisation, in a legal and economical context, in order to ensure the scientific objectivity and efficiency that must guide the process of collecting, analysing, interpreting and reporting forensic evidence. At the same time, it is recognised that forensic case data is still poorly integrated into the investigation and the crime analysis process, despite evidence of its great potential in various situations and studies. A change of attitude is needed in order to accept an extended role for forensic science that goes beyond the production of evidence for the court. To stimulate and guide this development, a long-term intensive modelling activity of the investigative and crime analysis process that crosses the boundaries of different disciplines has been initiated. A framework that fully integrates forensic case data shows through examples the capital accumulated that may be put to use systematically.     

Automatic screening in postmortem toxicology

The systematic analysis of postmortem samples is one of the most challenging tasks in forensic toxicology. For determining cause of death, analysis of different tissues can be indispensable. Automation of these analyses would increase reproducibility and therefore lead to more reliable and comparable results. Recent developments in analytical toxicology and the availability of automation devices for various analytical stages, such as sampling, preliminary testing, sample extraction, chromatographic separation, identification, and data processing are examined and discussed. At present only parts of the analytical procedure have been automated-however, the goal should be the integration of these parts into a single, continuous process. Currently, only one "fully-automated" procedure for the comprehensive screening of blood and urine (excluding sample pretreatment, which remains separate) has been published. But it can be expected that automation of analytical procedures in forensic toxicology will indeed progress, even with regard to the very complex screening of postmortem samples.     

Revelation and Rhetoric: A Critical Model of Forensic Discourse

Over the past thirty years or so, theoretical work in such fields as legal semiotics and law and literature has argued that the legal process is profoundly rhetorical. At the same time, a number of communication-based disciplines such as semiotics, sociolinguistics and linguistic anthropology have provided, particularly in interdisciplinary combination with law, a wealth of empirical evidence on, and insight into, the micro-contexts of language and communication in the legal process. However, while these invaluable nitty-gritty analyses provide empirical support for a rhetorical thesis, work in these areas has tended to ignore rhetoric as an explanatory principle. This article introduces an overarching rhetorical framework for the discursive construction and management of cases in contemporary Anglo-American legal processes. Taking ‘forensic’ as relating to the conduct of cases and ‘discourse’ as semiosis-in-practice, I argue that the practices within which forensic discourse is embedded are not, as the received legal view would have it, aimed at revealing an impartial truth but are deeply rhetorical practices aimed at persuading decision-makers to provide a remedy for a claimed wrong. By looking across forensic texts and contexts, I identify common elements of forensic discourse that can be found both in classical forensic orations and throughout the modern legal process and consider how these intersect with critical forces of agency and structure and the particularities of semiosis in situated context. An awareness of commonalities across forensic discourse can help sharpen our focus on the critical causes and consequences of individual and structural difference and point to consequential suggestions for reform.     

The forensic examination of structural fires in Victoria,Australia: Decision-making processes and impact on judicial outcomes

There is a body of published research that has evaluated the contribution of forensic science to the criminal justice system, but many disciplines of forensic science remain unexplored in this regard. The aim of this study was to examine the contribution that forensic fire examination services provide to criminal investigations and court processes in arson cases. Forensic fire examination services differ in a number of ways to the disciplines covered in previous research on the impact of forensic evidence on justice outcomes. Forensic fire examinations involve a combination of scene examination and laboratory analyses, and the results can provide critical evidence of whether an incident that has occurred is a criminal offence (i.e. whether a fire has occurred as the result of an act of arson). Forensic fire examination is also a discipline that has faced challenges and undergone development in recent decades regarding its scientific basis and the issue of contextual bias. In this study, data were collated for 273 structural fires that were examined by the forensic fire services in Victoria, Australia. In this jurisdiction, scene and laboratory forensic services are delivered within short time frames with a focus on providing impartial scientific and investigative services to assist criminal investigations conducted by police. The current dataset was highly skewed in terms of criminal justice outcomes and was not suitable for conducting the planned statistical analyses. Nonetheless, the pattern of findings obtained suggested that the inclusion of forensic evidence which supported the prosecution of arson may be associated with an increased likelihood of suspects being charged and defendants found guilty. Examination of the decision-making process of the forensic fire examiners has provided insight into the variety of evidence that is considered by forensic experts in reaching the important conclusion about the origin and cause of structural fires.     

Control systems/SCADA forensics,what's the difference?

Immature IT security, increasing network connectivity and unwavering media attention is causing an increase in the number of control system cyber security incidents. For forensic examinations in these environments, knowledge and skills are needed in the field of hardware, networks and data analysis. For forensic examiners, this paper is meant to be a crash course on control systems and their forensic opportunities, focussing on the differences compared to regular IT systems. Assistance from experienced field engineers during forensic acquisition of control systems seems inevitable in order to guarantee process safety, business continuity and examination efficiency. For people working in the control system community, this paper may be helpful to get an idea about specific forensic issues about which they would normally not bother, but may be crucial as soon as their systems are under attack or become part of a law enforcement investigation. For analysis of acquired data, existing tools for network security monitoring have useful functionality for forensic applications but are designed for real-time acquisition and often not directly usable for post-mortem analysis of acquired data in a forensically sound way. The constant and predictable way in which control systems normally behave makes forensic application of anomaly-based threat detection an interesting topic for further research.     

Multiple stable isotope characterization as a forensic tool to distinguish acid scavenger samples

Acid scavengers are frequently used as stabilizer compounds in a variety of applications. When used to stabilize volatile compounds such as nerve agents, the lower volatility and higher stability of acid scavengers make them more persistent in a post-event forensic setting. Compound-specific isotope analysis of carbon, nitrogen, and hydrogen in three acid-scavenging compounds (N,N-diethylaniline, tributylamine, and triethylamine) were used as a tool for distinguishing between different samples. Combined analysis of multiple isotopes improved sample resolution, for instance differentiation between triethylamine samples improved from 80% based on carbon alone to 96% when combining with additional isotope data. The compound-specific methods developed here can be applied to instances where these compounds are not pure, such as when mixed with an agent or when found as a residue. Effective sample matching can be crucial for linking compounds at multiple event sites or linking a supply inventory to an event.     

二代测序技术在法医遗传学中的应用研究进展(2011～2016)

对生物检材进行DNA分型是解决法医遗传学实践中个体识别和亲权鉴定问题的重要步骤,法医学实践中复杂生物检材和复杂亲缘关系鉴定等一直是现有的检测分析技术的难点和挑战。随着DNA技术的发展,新的检测分析技术不断引入到法医遗传学领域,以期提高检测效能。二代测序技术具有测序通量高、成本低等特点,能够获得样本DNA详细序列和相对含量等信息,有助于生物检材的检测和案件的分析。二代测序技术在法医遗传学领域的应用受到广泛关注,相关的应用研究逐渐增多。本文就目前法医遗传学领域借助二代测序技术对遗传标记分析的研究进展进行总结,希望能为相关研究和应用提供参考。     

The Microbiome Forensics Database UZH

Microbial communities in biological stains can provide valuable information to assist forensic scientists identify the body fluid/tissue present in these. As these microbial communities are characteristic of body habitats, DNA sequencing of microbes can be used to predict bodily origin. Promising predictive results have been obtained with supervised machine learning algorithms trained on bacterial abundance data from human body sites. Importantly, prediction accuracy is dependent on the training dataset, yet compiling a large and comprehensive training reference is a non-trivial issue requiring substantial efforts. Here we present a new online database and associated data-mining platform which is, to our knowledge, the first one customised for forensic scientists investigating body fluids/tissues. Our database features samples originating from ten human body sites, with selection options through an online platform. Users can download bacterial abundance as well as taxonomic data, which can then be used to train predictive models and test their accuracy. Future stages of the development of the platform will include curation of the samples to decrease potential errors in sample labelling, as well as access to an online tool to conduct exploratory analyses.     

The application of dual energy X-ray soil screening in forensic archaeology

The need to forensically search soil for small artefacts at a burial site or traces of evidence in a deposition site is a common task shared by investigators and forensic archaeologists. In forensic casework, the importance of finding small pieces of evidence, such as personal effects or ballistic fragments, cannot be overstated as it can assist in the positive identification of the deceased, give an insight into the manner and cause of death, and identify any perpetrators. The soil search methods known as wet and dry sieving, are cumbersome, time-consuming and have limited success for some soil types. This often leads to the decision not to search, resulting in missed opportunities to identify potential evidence.The primary aim of this study was to investigate if a dual energy X-ray baggage scanner could be used to search for items of potential forensic interest in soil. A trial was conducted using a Smiths Detection ScanTrailer 100100 V-2is mobile X-ray inspection system to establish if it could be used to detect organic, inorganic, and metallic items located within soil. The soil type and natural variables such as water and organic content were adjusted to simulate different environments. The baggage scanner was found to provide a quick and easy way to detect items contained within various soil types, particularly in a sand rich matrix. It is estimated that using this method to search 1 m³ of soil, when broken down into samples that are < 13 cm in depth, would take around one hour to complete, compared with 100 to 150 person-hours by manual sieving. This is believed to be the first use of dual energy X-ray technology for this purpose and shows the potential for further research and use of this method in forensic archaeology.