A reference database of Windows artifacts for file-wiping tool execution analysis

Anti-forensic technology can play an effective role in protecting information, but it can make forensic investigations difficult. Specifically, file-wiping permanently erases evidence, making it challenging for investigators to determine whether a file ever existed and prolonging the investigation process. To address this issue, forensic researchers have studied anti-forensic techniques that detect file-wiping activities. Many previous studies have focused on the effects of file-wiping tools on $MFT, $LogFile, and $DATA, rather than on Windows artifacts. Additionally, previous studies that have examined Windows artifacts have considered different artifacts, making it difficult to study them in a comprehensive manner. To address this, we focused on analyzing traces in 13 Windows artifacts of 10 file-wiping tools' operations in the Windows operating system comprehensively. For our experiments, we installed each file-wiping tool on separate virtual machines and checked the traces that the tools left behind in each artifact. We then organized the results in a database format. Our analysis revealed that most of the tools left traces on other artifacts, except for JumpList, Open&SavePidlMRU, and lnk. There were also some cases where traces remained on the other three artifacts. Based on our research, forensic investigators can quickly identify whether a file-wiping tool has been used, and it can assist in decision-making for evidence collection and forensic triage.     

Pulp volume quantification methods in cone-beam computed tomography for age estimation: A critical review and meta-analysis

The secondary dentin deposition that occurs after the tooth formation process results in a decrease in pulp cavity volume in adolescents and adults. The purpose of this critical review was to correlate pulpal and/or dental volume on cone-beam computed tomography (CBCT) with chronological age approximation. A subobjective was to investigate which methodology and CBCT technical parameters would be most appropriate to evaluate this correlation. This critical review followed the PRISMA guidelines, and it was conducted by a search through PubMed, Embase, SciELO, Scopus, Web of Science, Cochrane Library databases, as well as gray literature. Primary studies that used pulp volume, or pulp chamber to tooth volume ratio measured using CBCT were included. Seven hundred and eight indexed and 31 non-indexed records were identified. A qualitative analysis was performed including 25 selected studies with a total of 5100 individuals, age ranging from 8 to 87 years without sex predilection. The most used method was pulp volume/tooth volume. CBCT voxel size ranged between 0.09 and 0.5. Manual segmentation associated with threshold algorithms was used in most of the studies. Correlation between the pulp volume/tooth volume ratio was moderate: −0.66 for the upper central incisors, −0.59 for upper canines and −0.56 for lower canines. High heterogeneity was observed among the studies. It is concluded that pulp volume should be used with caution in age estimation. Evidence supports the preferable use of upper incisors with pulp volume/tooth volume ratio for age estimation. There is not enough evidence that voxel size interferes in age estimation by pulp volume.     

Evaluation of canine training aids containment for homemade explosive and components by headspace analysis and canine testing

While canines are most commonly trained to detect traditional explosives, such as nitroaromatics and smokeless powders, homemade explosives (HMEs), such as fuel–oxidizer mixtures, are arguably a greater threat. As such, it is imperative that canines are sufficiently trained in the detection of such HMEs. The training aid delivery device (TADD) is a primary containment device that has been used to house HMEs and HME components for canine detection training purposes. This research assesses the odor release from HME components, ammonium nitrate (AN), urea nitrate (UN), and potassium chlorate (PC), housed in TADDs. Canine odor recognition tests (ORTs) were used with analytical data to determine the detectability of TADDs containing AN, UN, or PC. Headspace analysis by gas chromatography/mass spectrometry (GC/MS) with solid-phase microextraction (SPME) or online cryotrapping were used to measure ammonia or chlorine, as well as other unwanted odorants, emanating from bulk AN, UN, and PC in TADDs over 28 weeks. The analytical data showed variation in the amount of ammonia and chlorine over time, with ammonia from AN and UN decreasing slowly over time and the abundance of chlorine from PC TADDs dependent on the frequency of exposure to ambient air. Even with these variations in odor abundance, canines previously trained to detect bulk explosive HME components were able to detect all three targets in glass and plastic TADDs for at least 18 months after loading. Detection proficiency ranged from 64% to 100% and was not found to be dependent on either age of material.     

Characterization of an odor permeable membrane device for the storage of explosives and use as canine training aids

The storage and use of explosives is regulated at the state and federal level, with a particular focus on physical security and rigorous accounting of the explosive inventory. For those working with explosives for the training and testing of explosive-detecting canines, cross-contamination is an important concern. Hence, explosives intended for use with canine teams must be placed into secondary storage containers that are new, clean, and airtight. A variety of containers meet these requirements and include screw-top glass jars (e.g., mason jars). However, an additional need from the explosive-detecting canine community is secondary containers that can also be used as training aids whereby the volatiles emitted by explosives are emitted in a predictable and stable manner. Currently, a generally accepted method for the storage of explosives and controlled emission of explosive vapor for canine detection does not exist. Ideally, such containers should allow odor to escape from the training aid but block external contaminates such as particulates or other volatiles. One method in use places the explosive inside a permeable cotton bag when in use for training and then stores the cotton bag inside an impermeable nylon bag for long-term storage. This paper describes the testing of an odor permeable membrane device (OPMD) as a new way to store and deploy training aids. We measured the evaporation rate and flux of various liquid explosives and volatile compounds that have been identified in the headspace of actual explosives. OPMDs were used in addition to traditional storage containers to monitor the contamination and degradation of 14 explosives used as canine training aids. Explosives were stored individually using traditional storage bags or inside an OPMD at two locations, one of which actively used the training aids. Samples from each storage type at both locations were collected at 0, 3, 6, and 9 months and analyzed using Fourier Transform Infrared (FTIR) Spectroscopy and Gas Chromatography–Mass Spectrometry (GC–MS) with Solid-Phase Microextraction (SPME). FTIR analyses showed no signs of degradation. GC–MS identified cross-contamination from ethylene glycol dinitrate (EGDN) and/or 2,3-dimethyl-2,3-dinitrobutane (DMNB) across almost all samples regardless of storage condition. The contamination was found to be higher among training aids that were stored in traditional ways and that were in active use by canine teams.     

Overview of the seized and examined pharmaceutical in the state of Minas Gerais-Brazil by the Civil Police from 2017 to 2022: A fundamental analysis of the recent impact over the drugs market

This work presents a data survey regarding the qualitative chemical analysis of drugs seized by the Police in the state of Minas Gerais between July 2017 and June 2022, including an evaluation of labeling of 265 samples of anabolic androgenic steroids (AAS) seized in 2020. The Active Pharmaceutical Ingredients (API) present in the samples were identified through chemical analysis and classified by system Anatomical Therapeutic Chemical (ATC) methods. Analysis of the labeling information for 265 samples of AAS followed the guidance of legislation RDC 71 (2009) from ANVISA. For this study 6355 seized pharmaceuticals underwent qualitative chemical analysis that corresponded to 7739 APIs successfully identified and classified. Among the components studied AAS, psychostimulants, anesthetics, and analgesics were the most commonly examined. AAS seized and tested increased by over 100% and for the majority of the samples analyzed were found to not match the labeling on the packaging. In the meantime, anti-obesity drugs presented a prominent increase of 400% from 2020/1 to 2021/2, during covid-19 quarantine. Seized pharmaceuticals and tests can support information in the planning of public health and safety policies.     

Evaluating the discriminating power of amino acid ratios on distinguishing dark colored hair samples

Human hairs are one of the most commonly encountered items of trace evidence. Currently, conventional methods for hair analysis include microscopic comparison and DNA analysis (nuclear and mitochondrial). Each approach has its own drawbacks. Hair proteins are stable and offer an alternative to DNA testing, as demonstrated with proteomics for distinguishing humans. However, proteomics is complicated and requires identifying peptides to remain intact following harsh sample preparation methods. Alternatively, the actual amino acid content of a hair sample may also offer important identifying information and actually requires proteins and peptides to be broken down completely rather than remaining intact. This study evaluated the discriminating power of using hair amino acid ratios to differentiate hair samples from 10 unrelated individuals with dark colored hair. Hair proteins were digested, derivatized, and analyzed using gas chromatography–mass spectrometry. Amino acid ratios were calculated for each individual and comparisons using ANOVA and post-hoc pairwise t-test with Bonferroni correction were made with amino acid ratios for individuals. Overall, out of the 45 possible pairwise comparisons between all hair samples, 38 (84%) were differentiable. Out of the 36 possible pairwise comparisons between brown haired individuals, 32 (89%) were considered differentiable using univariate statistics. Multivariate statistics were also attempted but, overall, univariate models were sufficient for exclusionary purposes. These results indicate that amino acid ratio analysis can potentially be used as an exclusionary method using hair if DNA analysis cannot be performed, or to corroborate conclusions made following microscopic analysis.     

Saving more than the children: the role of child-focused NGOs in the creation of southern security norms

The past decade has seen the emergence of ‘new critical discourses’ on security that argue for a widening of the term. This article hopes to add to such discussions by specifically examining the position of children and of the ngos that champion their rights in relation to the evolving security discourse in Southern societies. With this in mind, the first section of the article outlines the role of ngos in the contemporary practice of security. This will serve as an introduction to section two, where the activity of ngos vis-à-vis children will be considered. Such activity raises a number of questions with regard to the usefulness of incorporating children into the security discourse specifically, and to the social construction of ‘children’ generally. These will be outlined in section three. Section four argues for children to be considered as inherent to the creation of Southern security norms, while the final section concludes.     

Correlation between saw blade width and kerf width

Most studies of saw marks have focused on morphological characteristics and their utility in identifying saws suspected to have been utilized in cases of criminal dismemberment. The present study examined the extent to which metric analysis may be used to correlate saw blade measurements with minimum kerf widths (MKWs). A sample of 56 partially defleshed white‐tailed deer (Odocoileus virginianus) long bones was utilized as proxy for human remains. The long bones were cut using a variety of commercially available saws, including 11 manual‐powered and 5 mechanical‐powered saws. A total of 496 false start kerfs (FSKs) were created. Two experiments were performed, with the first test examining the MKWs of FSKs produced on specimens that were restrained using a bench vise, while the second test analyzed the MKWs of FSKs produced on minimally restrained specimens. Statistical analysis using Hierarchical Linear Modeling (HLM) indicated a positive relationship between saw blade width (mm) and MKW, with blade width (p < 0.001) and the overall difference between the mechanical‐ and manual‐powered saws (p = 0.029) tested, reaching statistical significance. A comparison of MKWs produced using manual‐powered saws on restrained and minimally restrained bones suggests that restraint condition (p = 0.009) has a statistically significant effect. In comparisons of MKWs to blade widths, the average ratio for mechanical‐powered saws is 18.7% greater than the average ratio for manual‐powered saws. While the mode of the ratios was 1.42, thus supporting the general rule that MKW does not exceed 1.5 times blade width, multiple individual ratios did surpass 1.5.     

Forensic determination of hair deposition time in crime scenes using electron paramagnetic resonance

Several types of biological samples, including hair strands, are found at crime scenes. Apart from the identification of the value and the contributor of the probative evidence, it is important to prove that the time of shedding of hair belonging to a suspect or victim matches the crime window. To this end, to estimate the ex vivo aging of hair, we evaluated time‐dependent changes in melanin‐derived free radicals in blond, brown, and black hairs by using electron paramagnetic resonance spectroscopy (EPR). Hair strands aged under controlled conditions (humidity 40%, temperature 20–22°C, indirect light, with 12/12 hour of light/darkness cycles) showed a time‐dependent decay of melanin‐derived radicals. The half‐life of eumelanin‐derived radicals in hair under our experimental settings was estimated at 22 ± 2 days whereas that of pheomelanin was about 2 days suggesting better stabilization of unpaired electrons by eumelanin. Taken together, this study provides a reference for future forensic studies on determination of degradation of shed hair in a crime scene by following eumelanin radicals by utilizing the non‐invasive, non‐destructive, and highly specific EPR technique.     

Pitfalls of Computed Tomography 3D Reconstruction Models in Cranial Nonmetric Analysis*

Many studies in the literature have highlighted the utility of virtual 3D databanks as a substitute for real skeletal collections and the important application of radiological records in personal identification. However, none have investigated the accuracy of virtual material compared to skeletal remains in nonmetric variant analysis using 3D models. The present study investigates the accuracy of 20 computed tomography (CT) 3D reconstruction models compared to the real crania, focusing on the quality of the reproduction of the real crania and the possibility to detect 29 dental/cranial morphological variations in 3D images. An interobserver analysis was performed to evaluate trait identification, number, position, and shape. Results demonstrate a false bone loss in 3D models in some cranial regions, specifically the maxillary and occipital bones in 85% and 20% of the samples. Additional analyses revealed several difficulties in the detection of cranial nonmetric traits in 3D models, resulting in incorrect identification in circa 70% of the traits. In particular, pitfalls included the detection of erroneous position, error in presence/absence rates, in number, and in shape. The lowest percentages of correct evaluations were found in traits localized in the lateral side of the cranium and for the infraorbital suture, mastoid foramen, and crenulation. The present study highlights important pitfalls in CT scan when compared with the real crania for nonmetric analysis. This may have crucial consequences in cases where 3D databanks are used as a source of reference population data for nonmetric traits and pathologies and during bone-CT comparisons for identification purposes.