Empirical analysis of solid state disk data retention when used with contemporary operating systems

Data recovery techniques for platter-based disk drives have remained rather static due to the dominance of the hard disk for the last two decades. Solid State Disk drives have differing storage and recall functionality from platter-based disks and require special care when attempting data recovery. Manufacturers have varying implementations of garbage collection in each drive, which affects the amount of data retained on the disk. This paper presents an analysis of solid state disk data retention based off of empirical evidence of 16 different disks. It also discusses the data recovery problem faced by forensic examiners due to the ATA8 TRIM command, which can sanitize disks in seconds. The experiment shows that without TRIM, nearly all data is recoverable, but with TRIM enabled only up to 27% of blocks were recoverable dependent on the controller manufacturer.     

利用单片机设计IDE-USB只读硬盘接口

目的在对IDE接口硬盘中的电子数据进行检验时保证其被写保护。方法利用单片机芯片、相关电路和固化程序拦截对硬盘的写指令。结果将一块IDE硬盘通过此接口连接到PC机实验表明，在对其进行写操作时已被写保护。结论利用单片机可以实现IDE硬盘的写保护。     

A survey of main memory acquisition and analysis techniques for the windows operating system

Traditional, persistent data-oriented approaches in computer forensics face some limitations regarding a number of technological developments, e.g., rapidly increasing storage capabilities of hard drives, memory-resident malicious software applications, or the growing use of encryption routines, that make an in-time investigation more and more difficult. In order to cope with these issues, security professionals have started to examine alternative data sources and emphasize the value of volatile system information in RAM more recently. In this paper, we give an overview of the prevailing techniques and methods to collect and analyze a computer's memory. We describe the characteristics, benefits, and drawbacks of the individual solutions and outline opportunities for future research in this evolving field of IT security.     

Extending the advanced forensic format to accommodate multiple data sources,logical evidence,arbitrary information and forensic workflow

Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Format—an open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.     

Indian Health Service; statement of organization, functions, and delegations of authority--PHS

Part H, chapter HG (Indian Health Service) of the Statement of Organization, Functions, and Delegations of Authority of the Department of Health and Human Services, Public Health Service (PHS), chapter HG, Indian Health Service (IHS), 52 FR 47053-67, December 11, 1987, as most recently amended at 56 FR 22015-16, May 13, 1991, is amended to reflect the establishment of an organizational substructure for the Bemidji Area Office to more accurately reflect current activities in the Area Office.     

Contagious errors: Understanding and avoiding issues with imaging drives containing faulty sectors

When using certain tools to image drives that contain faulty sectors, the tool may fail to acquire a run of sectors even though only one of the sectors is really faulty. This phenomenon, which we have dubbed “contagious errors” was reported by James Lyle and Mark Wozar in a recent paper presented at DFRWS 2007 [Lyle, J., Wozar, M. Issues with imaging drives containing faulty sectors. Digital Investigation 2007;4S: S13–5.]. Their results agree with our own experience from testing disk imaging software as part of our work for the Swedish National Laboratory of Forensic Science.We have explored the issue further, in order to determine the cause of contagious errors and to find ways around the issue. In this paper we present our analysis of the cause of contagious errors as well as several ways practitioners can avoid the problem. In addition we present our insights into the problem of consistently faulty drives in forensic tool testing.     

Initiation of formal death investigation procedures among the Northern Plains Indians: a necessary adjunct in the study of American Indian sudden infant deaths

The high rate of infant mortality among native peoples in the Aberdeen Service Area of the Indian Health Service (primarily North and South Dakota) prompted a multi-institutional study of this problem. The study investigators assumed that local coroners or medical examiners would be able to perform suitable death scene investigations. However, during the design portion of the study it became apparent that, with one exception, none of the participating Indian Nations had a death investigator or even a legal mandate to provide death investigation. To allow the study to go forward, and ultimately to better the community health within its service area, the Aberdeen Area Indian Health Service submitted a draft enabling coroner legislation/resolutions to the area tribes. By November of 1996, 6 of the 19 Indian Nations enacted enabling coroner legislation. To facilitate both the study and general death investigation within the area, the Aberdeen Area Indian Health Service since 1993 has held five 2-day death investigation training programs covering a variety of death investigation topics which were attended by 68 participants. Without further recognition of the need for tribal death investigation and additional funding, these gains in tribal death investigation will probably be transitory.     

Sex, Property Rights, and Divorce

This paper examines how differences in sex drives between husbands and wives affect bargaining strengths during marriage and particularly at times when divorce might occur. The basic argument follows from the fact that sex drives vary over an individual's life cycle, and are systematically different for men and women. The spouse having the lowest sex drive at any time in the marriage has a property right over whether or not sexual intercourse will occur, with a consequent increase in bargaining power at the margin. The paper derives a number of testable implications from its model, and, using several data sources, shows empirically how this difference affects marriage, adultery and divorce.     

Issues with imaging drives containing faulty sectors

In the ideal situation when imaging a hard drive, all sectors are completely and accurately acquired and saved to an image file. In reality, occasionally drives will contain faulty sectors such that the original content of the faulty sector cannot be acquired with typical imaging tools. We report on several experiments using non-commercial imaging tools and their behavior when encountering faulty sectors on a hard drive. Investigators should be aware of some behaviors exhibited by the tools that we examined. For example, some accessible sectors adjacent to a faulty sector may be missed when imaged directly from the ATA interface. In addition, more sectors were missed adjacent to the faulty sector when a drive was imaged over the firewire interface using a write blocker.     

Carving contiguous and fragmented files with fast object validation

“File carving” reconstructs files based on their content, rather than using metadata that points to the content. Carving is widely used for forensics and data recovery, but no file carvers can automatically reassemble fragmented files. We survey files from more than 300 hard drives acquired on the secondary market and show that the ability to reassemble fragmented files is an important requirement for forensic work. Next we analyze the file carving problem, arguing that rapid, accurate carving is best performed by a multi-tier decision problem that seeks to quickly validate or discard candidate byte strings – “objects” – from the media to be carved. Validators for the JPEG, Microsoft OLE (MSOLE) and ZIP file formats are discussed. Finally, we show how high speed validators can be used to reassemble fragmented files.     

VMware虚拟磁盘结构分析及在电子数据取证中的应用

详细分析了VMware的虚拟磁盘结构,并针对电子数据取证中的磁盘镜像虚拟加载、虚拟机数据迁移、虚拟磁盘文件的搜索和虚拟磁盘数据的鉴定与恢复等实际问题提出相应的解决方案。     

Putting Ourselves in Another’s Skin: Using the Plasticity of Self-Perception to Enhance Empathy and Decrease Prejudice

The self is one the most important concepts in social cognition and plays a crucial role in determining questions such as which social groups we view ourselves as belonging to and how we relate to others. In the past decade, the self has also become an important topic within cognitive neuroscience with an explosion in the number of studies seeking to understand how different aspects of the self are represented within the brain. In this paper, we first outline the recent research on the neurocognitive basis of the self and highlight a key distinction between two forms of self-representation. The first is the “bodily” self, which is thought to be the basis of subjective experience and is grounded in the processing of sensorimotor signals. The second is the “conceptual” self, which develops through our interactions of other and is formed of a rich network of associative and semantic information. We then investigate how both the bodily and conceptual self are related to social cognition with an emphasis on how self-representations are involved in the processing and creation of prejudice. We then highlight new research demonstrating that the bodily and conceptual self are both malleable and that this malleability can be harnessed in order to achieve a reduction in social prejudice. In particular, we will outline strong evidence that modulating people’s perceptions of the bodily self can lead to changes in attitudes at the conceptual level. We will highlight a series of studies demonstrating that social attitudes towards various social out-groups (e.g. racial groups) can lead to a reduction in prejudice towards that group. Finally, we seek to place these findings in a broader social context by considering how innovations in virtual reality technology can allow experiences of taking on another’s identity are likely to become both more commonplace and more convincing in the future and the various opportunities and risks associated with using such technology to reduce prejudice.     

Neighborhood immigrant concentration and violent crime reporting to the police: A multilevel analysis of data from the National Crime Victimization Survey*

Using data from the Area‐Identified National Crime Victimization Survey (NCVS), we provide a national assessment of the impact of neighborhood immigrant concentration on whether violence is reported to the police. By drawing on multiple theoretical perspectives, we outline how the level of violence reporting could be higher or lower in immigrant neighborhoods, as well as how this may depend on individual race/ethnicity and the history of immigration in the county in which immigrant neighborhoods are located. Controlling for both individual‐ and neighborhood‐level conditions, our findings indicate that within traditional immigrant counties, rates of violence reporting in immigrant neighborhoods are similar to those observed elsewhere. In contrast, within newer immigrant destinations, we observe much lower rates of violence reporting in neighborhoods with a large concentration of immigrants. Our study findings reveal comparable patterns for Whites, Blacks, and Latinos. The results have important implications for theory, policy, and future research.     

P2P服务提供者侵权责任问题研究

P2P技术自1999年诞生以来,由于其技术的本质特性不可避免地存在着许多法律上的问题,在学术界和司法界也存在过争议,这在很长一段时间使得人们对于P2P很难给予一个准确和公平的判断,从而导致对P2P服务提供者是否侵权以及如何认定侵权模棱两可。随着P2P技术的不断发展,人们对其技术的认识也日渐清晰,对其服务提供者承担责任问题也在司法实践中日渐成熟。结合中美典型案例分析P2P网络服务提供者在P2P技术的不同发展阶段承担侵权责任的问题,以期为将来P2P技术不断深入发展,司法实践中如何认定网络服务提供者的侵权责任提供借鉴。     

Discursive ethnomethodology: Analysing power and resistance in talk

Abstract

In order to better understand relationships between forms of institutional discourse and social interaction we outline an approach to the study of power in talk which we call discursive ethnomethodology. Following commas on approaches to the study of language and power, we illustrate our framework through analysis of an interview between a police officer and suspect where the latter exhibits a ‘right to silence’. Essentially, our approach distinguishes between two aspects of talk as event the immediate participation context, end the discursive or ‘folk-model’ resources employed by participants in context. Corresponding to these aspects are implicit/explicit expressions of power and resistance and externally available discursive objects. Through example extracts we illustrate how this framework can be employed in forensic psychology, bringing together both discursive psychology and critical discourse analysis alongside the ethnomethodological orientation of conversation analysis.     

Prison population growth and crime reduction

The impact of state prison populations on crime is typically estimated by applying the lambda, the individual crime rate, of prisoners or arrestees. We outline the problems with this approach, attempt to reanalyze the widely divergent lambdas derived in past research, and make adjustments necessary to use lambdas for estimating the incapacitation impact. The result is an uncertain estimate of 16 to 25 index crimes averted per year per each additional prisoner. We argue that regression analysis can provide a better estimate of the impact of prison population growth. Applying the Granger test to pooled state data over 19 years, we found that prison population growth leads to lower crime rates but that crime rate changes have little or no short-term impact on prison population growth. Next we regressed crime rates on prison population and conclude that, on average, at least 17 index crimes are averted per additional prisoner. The impact is limited mainly to property crime.     

Police Case-ending Possibilities within Criminal Investigations

This article refers to the function of the Police within the criminal justice systems in various European countries. It focuses on the legal and practical possibilities of the Police to either end criminal cases autonomously or to contribute to the final Public Prosecution Service decisions or at the end of the investigative stage. Normally Police hand on evidentially sufficient cases to the Public Prosecution Service at least at the end of the investigatory stage in all countries. Nevertheless, in almost all countries ways have been found to either legally or factually reduce PPS workload by giving Police some sort of case-ending decisions.     

The WODC Research and Documentation Centre; its Past and Current Research

This paper describes a number of past and present research projects carried out by or in assignment for the WODC Research and Documentation Centre of The Netherlands Ministry of Justice. As an introduction, we briefly describe how the WODC came into existence, and how it evolved over the years. We highlight a number of studies and themes that were focused on in the past, and we describe in more detail a number of on-going projects.We end by outlining the WODC's plans for the future.     

硬组织中D1S80位点基因型分析

用PCR技术分析硬组织中DIS80位点基因型及其DNA含量。当DNA部分降解时．此法仍然可行。证实了在同一个体，骨-血液及牙齿-血液DIS80位点的AmP－FLP的一致性。可应用于微量硬组织个人识别及骨化遗骸身源鉴定。     

浅析数据恢复技术

目的以常见的计算机存储介质硬盘为例,从数据原理的角度出发,介绍数据恢复技术在公安工作中的应用。方法针对硬盘故障不同(物理故障和逻辑故障),利用硬盘的物理性能和EasyRecovery、Finaldata等软件进行数据恢复。结果大部分被破坏的数据格均可恢复,并应用到实际案例中。