Forensic carving of network packets and associated data structures

Using validated carving techniques, we show that popular operating systems (e.g. Windows, Linux, and OSX) frequently have residual IP packets, Ethernet frames, and associated data structures present in system memory from long-terminated network traffic. Such information is useful for many forensic purposes including establishment of prior connection activity and services used; identification of other systems present on the system’s LAN or WLAN; geolocation of the host computer system; and cross-drive analysis. We show that network structures can also be recovered from memory that is persisted onto a mass storage medium during the course of system swapping or hibernation. We present our network carving techniques, algorithms and tools, and validate these against both purpose-built memory images and a readily available forensic corpora. These techniques are valuable to both forensics tasks, particularly in analyzing mobile devices, and to cyber-security objectives such as malware analysis.     

Students’ foundational understanding of chemical reaction in the forensic science bachelor’s degree program at the National Autonomous University of Mexico

ObjectiveTo compare the understanding of the concept of chemical reaction—as operationalized by Bloom’s taxonomy of cognitive levels—of students in forensic science bachelor’s degree with that achieved by students majoring in chemistry, as a prerequisite for future professional collaboration and communication.Materials and methodsUsing previously validated and published tests developed to assess students’ knowledge, comprehension, and application of the concept of chemical reaction, we explored how conceptual understanding developed in students enrolled in (a) a forensic science degree program in a Mexican public university and in (b) chemistry undergraduate programs offered by the same university, and whether both groups achieved comparable attainment levels.Findings and implicationsDespite receiving considerably less chemical instruction, forensic science students achieved comparable levels of conceptual understanding of chemical reaction to those exhibited by chemistry students. This finding is encouraging because it might mean that future forensic scientists could graduate with a solid foundation of chemical knowledge. More research, particularly on the learning of other key concepts, will be needed to verify these initial findings.     

A Bayesian Item Response Theory Approach to Symptom Validity Detection: Evaluating Psychological Screening Inventory-2 Response Profile Likelihoods

Invalid data in forensic assessment are most often indicated by excessive endorsement of psychiatric symptoms. Although this method of identifying invalid profiles is generally effective, it does not make use of all conditional dependencies in data. Modern psychometric methodologies can be used to identify aberrant response profiles through model-based indices known as person fit statistics. Specifically, the likelihoods of examinees' response profiles can be compared against observed or simulated likelihoods that are derived from empirical models of emotional and psychiatric functioning. This study demonstrates how person fit indices based on item response theory models can be used to detect misfitting response profiles in forensic assessment. Archival data from the Psychological Screening Inventory-2 (R. I. Lanyon, 2010a) were evaluated with Bayesian estimation and posterior predictive model checking to compare the response profile log-likelihoods of 74 forensic participants with 1,046 normative participants. Results suggest 61 % of forensic examinees but only 5 % of normative examinees had misfitting data. Misfitting “fake bad” forensic profiles appeared to be associated with overly discrepant endorsement of symptoms, and misfitting “fake good” forensic profiles appeared to be associated with overly narrow endorsement of symptoms. The high rate of misfit among forensic examinees challenges the appropriateness of basing interpretations of forensic data on reliability and validity coefficients from normative samples. However, because aspects of the methodology are still untested in forensic and clinical assessment (e.g., the use of priors in this study), future research is needed to evaluate its appropriateness for clinical practice.     

Digitalization of dental recording

A short survey is given of the present status in the digitalization of dental recording, the initiative to which was taken by the Fédération Dentaire Internationale (FDI) in 1970. Apart from being an international ‘language’ for the dental profession which — among other things — will greatly facilitate epidemiological research, such digitalization is of particular interest to forensic dental experts in that it may simplify their comparisons of ante- and postmortem dental data for identification purposes.     

A review of experimental design in forensic taphonomy: moving towards forensic realism

Forensic taphonomy as a discipline requires standardization to satisfy Daubert criteria for scientific data to be admissible in court. In response, there has been a shift towards quantification of methodology and estimating the postmortem interval. Despite these advances, there are still biases and limitations within the discipline not explicitly addressed in the early stages of experimental design nor in final published works. In this article, unresolved debates with respect to the conductance and reporting of forensic taphonomic research are reviewed, beginning with the nature of experimental cadavers, human or animal analogues and their body size, and second, the forensic realism of experimental setups, specifically with respect to caging, clothing and number of carcases. Pigs, albeit imperfect, are a good model to gain a general idea of the trends that may be seen in humans in subsequent validation studies in facilities where human donors are available. To date, there is no consensus among taphonomists on the extent of the effect that body mass has on decomposition progression. More research is required with both human cadavers and non-human analogues that builds on our current knowledge of forensic taphonomy to answer these nagging questions. This will enable the discipline to make the reliable assumption that pigs and donor decomposition data can be applied to homicide cases. A suite of experimental design aspects is suggested to ensure systematic and standardized data collection across different biogeoclimatic circumstances to identify and quantify the effects of potential confounding variables. Such studies in multiple, varied biogeographic circumstances with standardized protocols, equipment and carrion will facilitate independent global validation of patterns. These factors are reviewed to show the need for adjustments in experimental design to ensure relevance and applicability of data within locally realistic forensic situations. The initiation of a global decomposition data network for forensic taphonomists is recommended.

Key points

• Pigs are a valuable, albeit imperfect, proxy for human decomposition studies.
• There are few or conflicting data on effects of carcase size, carrion ecology, exclusion cages and scavengers.
• We recommend single, clothed, uncaged carcases for baseline research to reflect regionally specific forensic casework.

     

Effects of language mismatch in automatic forensic voice comparison using deep learning embeddings

In forensic voice comparison, deep learning has become widely popular recently. It is mainly used to learn speaker representations, called embeddings or embedding vectors. Speaker embeddings are often trained using corpora mostly containing widely spoken languages. Thus, language dependency is an important factor in automatic forensic voice comparison, especially when the target language is linguistically very different from that the model is trained on. In the case of a low-resource language, developing a corpus for forensic purposes containing enough speakers to train deep learning models is costly. This study aims to investigate whether a model pre-trained on multilingual (mostly English) corpus can be used on a target low-resource language (here, Hungarian), not represented by the model. Often multiple samples are not available from the offender (unknown speaker). Samples are therefore compared pairwise with and without speaker enrollment for suspect (known) speakers. Two corpora are used that were developed especially for forensic purposes and a third that is meant for traditional speaker verification. Speaker embedding vectors are extracted by the x-vector and ECAPA-TDNN techniques. Speaker verification was evaluated in the likelihood-ratio framework. A comparison is made between the language combinations (modeling, LR calibration, and evaluation). The results were evaluated by Cllr_min and EER metrics. It was found that the model pre-trained on a different language but on a corpus with a significant number of speakers can be used on samples with language mismatch. Sample duration and speaking style also seem to affect the performance.     

Estimating Biological Characteristics With Virtual Laser Data

Laser scanning technology is increasingly being used in forensic anthropological research to obtain virtual data for archival purposes and post hoc measurement collection. This research compared the measurement accuracy of two laser scanners—the FARO Focus^3D 330X and the FARO Freestyle^3D—against traditionally obtained (i.e., by hand) control data (N = 454). Skeletal data were collected to address a novel question: the ability of laser scanning technology to produce measurements useful for biological characteristic estimation, such as sex and stature. Results indicate that both devices produced measurements very similar to control (c. 3‐mm average absolute error), but also illuminate a tendency to under‐measure. Despite these findings, the virtual data produced sex and stature estimates that varied little from control‐produced estimates, signifying the usefulness of virtual data for preliminary biological identification when the skeletal elements are no longer available for physical analysis.     

An evaluation of forensic similarity hashes

The fast growth of the average size of digital forensic targets demands new automated means to quickly, accurately and reliably correlate digital artifacts. Such tools need to offer more flexibility than the routine known-file filtering based on crypto hashes. Currently, there are two tools for which NIST has produced reference hash sets–ssdeep and sdhash. The former provides a fixed-sized fuzzy hash based on random polynomials, whereas the latter produces a variable-length similarity digest based on statistically-identified features packed into Bloom filters.This study provides a baseline evaluation of the capabilities of these tools both in a controlled environment and on real-world data. The results show that the similarity digest approach significantly outperforms in terms of recall and precision in all tested scenarios and demonstrates robust and scalable behavior.     

Digital forensic text string searching: Improving information retrieval effectiveness by thematically clustering search results

Current digital forensic text string search tools use match and/or indexing algorithms to search digital evidence at the physical level to locate specific text strings. They are designed to achieve 100% query recall (i.e. find all instances of the text strings). Given the nature of the data set, this leads to an extremely high incidence of hits that are not relevant to investigative objectives. Although Internet search engines suffer similarly, they employ ranking algorithms to present the search results in a more effective and efficient manner from the user's perspective. Current digital forensic text string search tools fail to group and/or order search hits in a manner that appreciably improves the investigator's ability to get to the relevant hits first (or at least more quickly). This research proposes and empirically tests the feasibility and utility of post-retrieval clustering of digital forensic text string search results – specifically by using Kohonen Self-Organizing Maps, a self-organizing neural network approach.This paper is presented as a work-in-progress. A working tool has been developed and experimentation has begun. Findings regarding the feasibility and utility of the proposed approach will be presented at DFRWS 2007, as well as suggestions for follow-on research.     

Intrusion detection: issues and challenges in evidence acquisition

As the dangers of hacking and cyber‐warfare for network security become a reality, the need to be able to generate legally admissible evidence of criminal or other illegal online behaviours has become increasingly important. While technical systems providing intrusion detection and network monitoring are constantly being improved, the security they provide is never absolute. As a result, when assessing the value and nature of the data that these systems produce, it becomes critical to be aware of a number of factors: these systems themselves are susceptible to attack and/or evasion; these systems may collect only a partial data set; and, these data sets may themselves be flawed, erroneous or may already have been tampered with. Additionally, the issue of privacy and data protection is emerging as a central debate in forensic computing research. In this context, this paper examines intrusion detection systems (IDS) and provides the results of a case study on the use of the SNORT IDS on a university department World Wide Web (WWW) server. The case study is analysed and discussed using a forensic computing perspective. This perspective considers the nature of the intrusion detection and network monitoring security provided and evaluates the system in terms of its evidence acquisition (‘forensic’) capabilities and the legal admissibility of the digital evidence generated.     

Impurities,adulterants and cutting agents in cocaine as potential candidates for retrospective mining of GC-MS data

Cocaine is one of the most widely used illicit drugs worldwide. Cocaine powders seized by the Police may contain numerous other substances besides the drug itself. These can be impurities originating from the coca plant or the production process, or be purposely added to the drug formulation as adulterants and cutting agents. In forensic laboratories, identification of cocaine is routinely done through GC-MS analysis, but other components are often ignored even if the method allows for their detection. Yet, they can provide valuable insight into the history of a seizure and its potential connection to other samples. To explore this idea, an extensive review of common impurities and adulterants encountered in cocaine is presented. Based on their incidence, concentration in the end product and compatibility with GC-MS methods, their overall usefulness as candidates for the statistical investigation of existing forensic data is evaluated. The impurities cis- and trans-cinnamoylcocaine, tropacocaine, norcocaine and N-benzoylnormethylecgonine as well as the adulterants lidocaine, procaine, tetracaine, benzocaine, caffeine, acetylsalicylic acid, phenacetin, ibuprofen, levamisole, hydroxyzine and diltiazem are promising candidates to provide additional forensic intelligence. Future research on optimized routine GC-MS methods, signal reproducibility, comparison, statistics and databases is suggested to facilitate this concept. Ultimately, such an approach may significantly advance the amount of information that is extracted from routine casework data, elucidate developments in the cocaine markets in the past and facilitate Police work in the future. Preliminary assessment of existing data from the forensic laboratory of the Amsterdam Police has been included to show that the detection of the identified target impurities is feasible, and that small adjustments to the analysis method could significantly increase the detectability of these analytes in prospective drug screenings. Forensic intelligence based on retrospective data mining of cocaine containing casework samples may thus be realized with minimal additional laboratory efforts by using already available instrumentation, samples and data.     

Android forensics: Automated data collection and reporting from a mobile device

In this research, a prototype enterprise monitoring system for Android smartphones was developed to continuously collect many data sets of interest to incident responders, security auditors, proactive security monitors, and forensic investigators. Many of the data sets covered were not found in other available enterprise monitoring tools. The prototype system neither requires root privileges nor the exploiting of the Android architecture for proper operation, thereby increasing interoperability among Android devices and avoiding a spyware classification for the system. An anti-forensics analysis on the system was performed to identify and further strengthen areas vulnerable to tampering. The contributions of this research include the release of the first open-source Android enterprise monitoring solution of its kind, a comprehensive guide of data sets available for collection without elevated privileges, and the introduction of a novel design strategy implementing various Android application components useful for monitoring on the Android platform.     

Reverse engineering--rapid prototyping of the skull in forensic trauma analysis

Rapid prototyping (RP) comprises a variety of automated manufacturing techniques such as selective laser sintering (SLS), stereolithography, and three-dimensional printing (3DP), which use virtual 3D data sets to fabricate solid forms in a layer-by-layer technique. Despite a growing demand for (virtual) reconstruction models in daily forensic casework, maceration of the skull is frequently assigned to ensure haptic evidence presentation in the courtroom. Owing to the progress in the field of forensic radiology, 3D data sets of relevant cases are usually available to the forensic expert. Here, we present a first application of RP in forensic medicine using computed tomography scans for the fabrication of an SLS skull model in a case of fatal hammer impacts to the head. The report is intended to show that this method fully respects the dignity of the deceased and is consistent with medical ethics but nevertheless provides an excellent 3D impression of anatomical structures and injuries.     

Lipidic compounds found in soils surrounding human decomposing bodies and its use in forensic investigations – A narrative review

Following decomposition of a human body, a variety of decomposition products, such as lipids, are released into the surrounding environment, e.g. soils. The long-lasting preservation in soils and their high diagnostic potential have been neglected in forensic research. Furthermore, little is known about the preservation, chemical transformation, or degradation of those human derived lipids in soils. To date, several studies identified various lipids such as long-chain free fatty acids and steroids in soils that contained decomposition fluids. Those lipids are preserved in soils over time and could serve as markers of human decomposition in forensic investigations, e.g. for estimating the post-mortem interval or identifying the burial location of a human body. Therefore, this review focuses on the current literature regarding fatty acid and steroid that have been detected in soils and associated with human body decomposition. After a short introduction about human decomposition processes, this review summarises fatty acid and steroid analysis applied in current case studies and studies related to taphonomic research. This review provides an overview of the available studies that have used fatty acids and steroids as identifiers of human decomposition fluid in soils in a forensic context and discusses the potential for developing this innovative field of research with direct application in a forensic context.     

The over-citation of Daubert in forensic anthropology

The 1993 US Supreme Court decision Daubert v. Merrell Dow Pharmaceuticals, Inc. presented new guidance for the judicial assessment of expert witness evidence and testimony in the determination of admissibility. Despite the rarity of admissibility challenges to forensic anthropology evidence, Daubert is frequently cited in published forensic anthropology research. This study undertook a qualitative thematic analysis of forensic anthropology articles published in the Journal of Forensic Sciences to assess why authors continue to cite Daubert and express concerns over potential exclusion. The results show a significant increase in the number of articles that cite legal admissibility standards over time (p < 0.001). Authors frequently cite these standards to contextualize their results within the Daubert framework or to justify the need for their research. Notably, many articles present Daubert as a constraining force, misinterpreting the guidelines as rigid criteria or that they require methods to be strictly quantitative. However, Daubert was intended to be a flexible tool for judges—not a standard or instruction for scientists. While it was reasonable to reflect on the scientific rigor of methods in the wake of the Daubert decision, a new perspective is warranted in which forensic anthropologists shift their focus from trying to “satisfy” admissibility guidelines to adopting quality assurance measures that minimize error and ensure confidence in analytical results, and developing and using methods that are grounded in good science—which is important regardless of whether or not the results are ever the subject of a trial.     

In search of identity: The field of forensic anthropology in Brazil—Profession and practice

The existing divergencies in the development of forensic anthropology (FA) around the world justify an analysis of its situation in each country/region. Our objective is to report information gathered directly from professionals acting in the field of forensic anthropology in Brazil, with the aim of highlighting the challenges of the discipline and contributing to its advancement. The research consisted of personal visits in Medico‐Legal Institutes (IMLs) in nine states of the country and semi‐structured interviews with 16 professionals. Detailed analysis of the Results suggests the field of forensic anthropology, despite the engagement and dedication of its professionals, cannot yet be considered a well‐structured discipline across the country. The academic background of professionals is highly heterogenous. The applied methods vary, and common protocol is not always followed. The demand highly exceeds the available human resources. The lack of comparative material Results in high percentage of cases remaining unsolved. Important divergences exist in terms of infrastructure and professional resources between the states. The limited cooperation between different IMLs and between different sections of the same IML—together with a general disbelief in the usefulness of anthropological examination in forensic cases—hampers FA’s development. There is a great openness for scientific collaboration and an abundance of material for research. Our research demonstrated structural, political, and academic limitations that affect the FA field in Brazil. However, the expertise and dedication of professionals point to human potential as the chief strength of this discipline that supports and enables research, providing high‐quality services in a challenging context.     

Communicating forensic scientific expertise: An analysis of expert reports and corresponding testimony in Tasmanian courts

Forensic criminology examines the use of forensic science in society. Justice can be hampered, for example, if the communication of forensic scientific findings is unclear or misleading, even if unintentionally. Although various recommendations guide the communication of forensic science, it is unclear whether they are reflected in practice. This study explored the communication of forensic biology in 10 cases of major crimes against the person heard in the Tasmanian Supreme Court, where the standard practice is to issue brief summary reports in the first instance. The content of expert reports and corresponding testimony was analysed to determine its adherence to recommendations outlined in standards, practice notes, and research. While reports were found to be very brief, testimony elaborated on all major elements. Mostly elicited by the prosecution, some elements were volunteered by expert witnesses, or raised by defence. Overall, expert evidence in courts—but not reports (due to the use of brief summary reports)—largely adhered to recommendations. Further research is needed to determine the prevalence and effectiveness of alternative approaches to communication that were identified in certain cases.     

Using purpose-built functions and block hashes to enable small block and sub-file forensics

This paper explores the use of purpose-built functions and cryptographic hashes of small data blocks for identifying data in sectors, file fragments, and entire files. It introduces and defines the concept of a “distinct” disk sector—a sector that is unlikely to exist elsewhere except as a copy of the original. Techniques are presented for improved detection of JPEG, MPEG and compressed data; for rapidly classifying the forensic contents of a drive using random sampling; and for carving data based on sector hashes.     

Assessing the Psychological Well-being and Coping Mechanisms of Law Enforcement Investigators vs. Digital Forensic Examiners of Child Pornography Investigations

Previous research indicates law enforcement investigators and digital forensic examiners working child exploitation cases are at an increased risk for experiencing psychological distress; however, the roles of digital forensic examiners and investigators often overlap substantially when working child pornography cases. Thus, the current study was the first to compare the psychological well-being, job satisfaction, coping mechanisms, and attitudes toward mental health services for individuals working as either digital forensic examiners and/or investigators of child pornography cases. Law enforcement officers were solicited from the Internet Crimes Against Children task force listserv, and based on their current self-reported duties, 20 were classified as digital forensic examiners-only, 71 as investigators-only, and 38 as both digital forensic examiners and investigators of cases involving Internet child pornography. Results showed significant differences between groups; individuals performing both duties scored significantly higher on secondary traumatic stress, higher on feelings of worthlessness, and lower on concentration compared to digital forensic examiners-only. Individuals performing both duties also reported significantly lower scores on job satisfaction compared to investigators-only. Finally, individuals working both duties were significantly more likely to know someone who sought counseling as a result of work-related stress. The study’s mental health implications and future research suggestions are discussed.     

Cognitive forensics and experimental research about bias in forensic casework

Understanding and coping with cognitive bias in forensic science requires multiple studies, utilizing both laboratory-based experiments and data from casework. Neither type of studies has ever been conducted to examine bias in mixture DNA interpretations. A study that includes both types of data has recently been published in Science and Justice. The data and statistical analysis clearly — at the very least — suggest that bias may potentially influence DNA mixture interpretation. This is due, in part, to the subjective elements in interpretation of mixture DNA. The issue of bias and other cognitive influences is of a sensitive nature and presents complex experimental challenges. Our study takes a step in examining these issues and calls for more research.