Reassembling Linux-based Hybrid RAID

Network-attached storage (NAS) is a system that uses a redundant array of disks (RAID) to create virtual disks comprising multiple disks and provide network services such as FTP, SSH, and WebDAV. Using these services, the NAS's virtual disks store data about individuals or groups, making them a critical analysis target for digital forensics. Well-known storage manufacturers like Seagate, Synology, and NETGEAR use Linux-based software RAID, and they usually support Berkeley RAID (e.g., RAID 0, 1, 5, 6, and 10) as well as self-developed hybrid RAID. Those manufacturers have published data on the introduction and features of hybrid RAID, but there is not enough information to reassemble RAID from a digital forensic perspective. Besides, digital forensic tools (such as EnCase, FTK, X-ways, and RAID Reconstructor) do not support automatic RAID reassembly for hybrid RAID, so research on hybrid RAID reassembly methods is necessary. This paper analyzes the disk array composed of hybrid RAID and explains the layout of disk array, partition layout in hybrid RAID, and hybrid RAID configuration strategy. Furthermore, it suggests parameters that are required for RAID reassembly and then propose a hybrid RAID reassembly procedure using them. Finally, we propose a proof-of-concept tool (Hybrid RAID Reconstructor) that identifies hybrid RAID from disk array and parse RAID parameters.     

Sudden Death Caused by Rupture of Spontaneous Ductus Arteriosus Aneurysm in an Adult

A 55-year-old man complained of sudden onset of severe neck pain. This was followed by prompt loss of consciousness and death. Autopsy revealed rupture of a saccular aneurysm, which was considered to have resulted from enlargement of the remaining ductal tissue, and was located on the medial aspect of the uppermost portion of the descending aorta. Dense blood extravasation was noted in the posterior mediastinum and extending to the strap muscles of the neck and larynx. Histological examination of the rupture site revealed disappearance of the medial elastic fibers and thickened intima covered with dense fibrous tissue. Spontaneous ductus arteriosus aneurysm in adults is a rare finding, but widespread use of imaging technologies has revealed that it develops more frequently than previously recognized. Fatal complications may occur even when the aneurysm is relatively small. Therefore, pathologists should be aware of this aneurysm as a potential cause of sudden death.     

A Comparison of Coronary Artery Stenosis Estimates Made by Forensic Pathologists and Medical Students

Previous studies suggest cardiovascular pathologists are less accurate than noncardiovascular pathologists (e.g., clinical pathologists) in estimating the degree of coronary artery stenosis. To further investigate the effect of training on accurate estimation of coronary artery stenosis, we designed a study to compare the accuracy of estimates made by forensic pathologists versus medical students. Six forensic pathologists and twelve medical students each independently examined 24 images of coronary artery cross sections and gave an estimate of the degree of stenosis. When comparing all 24 images, the forensic pathologists had a median difference between the estimated percentage of stenosis and actual percentage of stenosis of −12.380 and the medical students had a median difference of −16.50 (p-value of 0.08542). In estimating the percentage of stenosis, training in forensic pathology does not guarantee significantly improved accuracy compared with medical students. Our study showed no consistent statistically significant difference between estimates given by forensic pathologists and by medical students.     

A Study of the Background Levels of Male DNA on Underpants Worn by Females

This study is the first to examine the background level of male DNA on underpants worn by females in the absence of sexual contact. Here, we examined 103 samples from the inside front of underpants from 85 female volunteers. Samples were examined for the presence of male DNA using NGM SElect and PowerPlex Y23 kits. Only five samples gave a “complete” Y-STR profile, even though 83.5% of our volunteers cohabited with a male. In all cases where a partner reference sample was available, the Y-STR profile matched the cohabiting partner. We have demonstrated that a Y-STR profile is not expected on the inside front of underpants worn by females after social contact alone. The results of this study are informative for evaluating the significance of a Y-STR profile on underpants in cases of alleged sexual assault.     

Sample Mining and Data Mining: Combined Real-Time and Retrospective Approaches for the Identification of Emerging Novel Psychoactive Substances

Novel psychoactive substances (NPS) are synthetic drugs that pose serious public health and safety concerns. A multitude of NPS have been identified in the United States, often implicated in forensic investigations. The most common and effective manner for identifying NPS is by use of mass spectrometry and the true utility lies within nontargeted acquisition techniques. During this study, a liquid chromatography quadrupole time-of-flight mass spectrometry (LC-QTOF-MS) assay was developed, validated, and implemented for forensic toxicology testing. A SCIEX TripleTOF™ 5600 + with SWATH^® acquisition was used. Resulting data were compared against an extensive library database containing more than 800 compounds. The LC-QTOF-MS assay was applied to the reanalysis of biological sample extracts to discover emergent NPS. More than 3,000 sample extracts were analyzed, and more than 20 emerging NPS were detected for the first time. Among these were isopropyl-U-47700, 3,4-methylenedioxy-U-47700, fluorofuranylfentanyl, N-methyl norfentanyl, 2F-deschloroketamine, 3,4-methylenedioxy-alpha-PHP, eutylone, and N-ethyl hexedrone.     

Evaluation of Suspected Counterfeit Pharmaceutical Tablets Declared to Contain Controlled Substances Using Handheld Raman Spectrometers

This study describes the performance of handheld Raman devices for determining whether suspect pharmaceutical tablets declared to contain controlled substances were consistent with authentic (CWA) or not consistent with authentic (NCWA) tablets using a simple, rapid, field-friendly method capable of being used by nonexperts. Twenty-five authentic products and 84 known NCWA tablets were examined using three “parent” devices for a total of 327 analyses. On average, the parent devices yielded a true pass rate of 100%, a true fail rate of 98.4%, a false pass rate of 1.6%, and a false fail rate of 0%. The methods/libraries were then transferred to 13 identical “daughter” devices, which were used to examine 10 suspect finished dosage forms in duplicate (six known NCWA tablets and four authentic tablets) for a total of 260 measurements. On average, the daughter devices had a true pass rate of 100%, a true fail rate of 95.5%, a false pass rate of 4.5%, and a false fail rate of 0.0%. These data demonstrate that the parent–daughter electronic transfer method was successful, which permits the ability to develop methods in the laboratory that can be seamlessly pushed out to field devices. The methods can then be used to (i) prioritize samples for additional testing using other more time-consuming laboratory-based techniques needed to detect and quantify active ingredients and (ii) help support the interdiction of dangerous tablets at ports of entry, thereby preventing them from reaching the supply chain.     

How do body-worn cameras affect the amount and makeup of police-initiated activities? A randomized controlled trial in Milwaukee,Wisconsin

Journal of Experimental Criminology - Examine how the amount and makeup of police-initiated activities changed after the introduction of body-worn cameras (BWCs). From May 21 to November 22, 2016,...     

What to Believe? Social Media Commentary and Belief in Misinformation

Political Behavior - Americans are increasingly turning to social media for political information. However, given that the average social media user only clicks through on a small fraction of the...     

Helping to Break the Glass Ceiling? Fathers,First Daughters,and Presidential Vote Choice in 2016

Political Behavior - Throughout her 2016 U.S. presidential campaign, Democratic Party nominee Hillary Clinton crafted messages intended to appeal to fathers of daughters and to highlight the...