Feasibility of Canine Detection of Mass Storage Devices: A Study of Volatile Organic Compounds Emanating from Electronic Devices Using Solid Phase Microextraction

Detection of canines are well‐known to be valuable in the location of contraband, such as explosives or narcotics. More recently, canines have been trained and utilized in the detection of concealed mass storage devices that might contain evidence of illegal activity such as child pornography. To lay the analytical foundation for this detection work, research was carried out to determine the volatile organic compounds associated with mass storage devices (MSD) that could be used by trained canines for detection. Headspace analysis of a variety of electronic devices was performed using solid phase microextraction (SPME) with gas chromatography/mass spectrometry (GC/MS). Analyses found several volatile compounds common to SIM and SD cards, as well as USB drives, including 2‐propenenitrile, styrene, isophorone, hydroxycyclohexyl phenyl ketone, and 2‐furanmethanol, tetrahydro. Results indicated that mass storage devices do have a characteristic odor profile making detection with minimal false alerts feasible for trained canines.     

The Verifiability Approach to detection of malingered physical symptoms

Inspired by recent research showing that liars are reluctant to include verifiable details in their accounts, we explored in two studies (N?=?125; N?=?105) whether participants who report fabricated symptoms (‘malingerers’) present fewer verifiable details than participants who report genuine ill-health symptoms. In Study 1, participants were instructed to describe a typical day on which they had experienced a genuine or malingered symptom. Truth tellers’ statements included significantly higher proportions of verifiable details concerning the reported symptoms than malingerers’ statements. Compared with truth tellers, malingerers generated longer statements with more unverifiable details. In Study 2, we informed participants that their statements may be assessed for verifiable or checkable details. Malingerers often mentioned ‘false’ witnesses to provide checkable information and differences between malingerers and truth tellers in statement length, and checkable and uncheckable details were no longer significant. The utility and implications of the Verifiability Approach to detection of malingering are discussed.     

Graph clustering and anomaly detection of access control log for forensic purposes

Attacks on operating system access control have become a significant and increasingly common problem. This type of security threat is recorded in a forensic artifact such as an authentication log. Forensic investigators will generally examine the log to analyze such incidents. An anomaly is highly correlated to an attacker's attempts to compromise the system. In this paper, we propose a novel method to automatically detect an anomaly in the access control log of an operating system. The logs will be first preprocessed and then clustered using an improved MajorClust algorithm to get a better cluster. This technique provides parameter-free clustering so that it automatically can produce an analysis report for the forensic investigators. The clustering results will be checked for anomalies based on a score that considers some factors such as the total members in a cluster, the frequency of the events in the log file, and the inter-arrival time of a specific activity. We also provide a graph-based visualization of logs to assist the investigators with easy analysis. Experimental results compiled on an open dataset of a Linux authentication log show that the proposed method achieved the accuracy of 83.14% in the authentication log dataset.     

Scanning memory with Yara

Memory analysis has been successfully utilized to detect malware in many high profile cases. The use of signature scanning to detect malicious tools is becoming an effective triaging and first response technique. In particular, the Yara library and scanner has emerged as the defacto standard in malware signature scanning for files, and there are many open source repositories of yara rules. Previous attempts to incorporate yara scanning in memory analysis yielded mixed results. This paper examines the differences between applying Yara signatures on files and in memory and how yara signatures can be developed to effectively search for malware in memory. For the first time we document a technique to identify the process owner of a physical page using the Windows PFN database. We use this to develop a context aware Yara scanning engine which can scan all processes simultaneously using a single pass over the physical image.     

论职务犯罪侦查权的优化配置与运行

职务犯罪侦查权的优化配置与运行,不仅关系到检察机关法律监督职能的强化和检察工作的深入发展,而且涉及到国家权力配置模式和运行方式的完善.在深化司法体制改革,推进刑事诉讼法修改,贯彻全国人大常委会<关于批准〈联合国反腐败公约〉的决定>的时代背景下,进一步加强对职务犯罪侦查权配置与运行问题的专题研究,具有重要的现实意义.特别是要对职务犯罪侦查权从法理上作出进一步的阐释,正确认识国家立法机关将这一权力赋予检察机关的法理基础,准确把握职务犯罪侦查权的性质,科学确立职务犯罪侦查权配置和运行的原则.     

羊口疮病毒环介导等温扩增快速检测方法的建立及应用

参照GenBank中登录的羊口疮病毒(ORFV)序列(Gu320351),针对OrfV的B2L基因保守区域设计了4条引物,通过优化反应条件,建立了检测OrfV的环介导等温扩增技术(LAMP),并进行了特异性试验、敏感性试验及临床样本检测。结果显示,用建立的LAMP方法对OrfV阳性样品扩增产物的电泳呈特征性梯状条带,而绵羊痘病毒、蓝舌病病毒、口蹄疫病毒、丝状支原体山羊亚种、山羊痘病毒及健康山羊皮肤的扩增产物电泳后均无扩增条带。建立的LAMP方法对OrfV的最低检出量为5.3fg,比常规PCR方法高1 000倍。表明建立的LAMP方法特异性强,敏感性高。对6份临床样本的检测结果显示,OrfV阳性检出率为83.33%(5/6),与常规PCR的符合率为100%。本试验为羊口疮病例的临床诊断和OrfV的快速检测提供了新的方法。     

K9 water searches: scent and scent transport considerations

Increased use of water search dogs for detecting submerged bodies has created the need for a better understanding of scent emanating from the bodies and how it transits the water to the dog's nose. A review of recent literature identifies likely scent sources, potential scent transport processes, and research needs. Scent sources include gases in bubbles or dissolved in the water, liquids as buoyant plumes and droplets or dissolved in the water, and solids consisting of buoyant particulates with secretions, bacteria, and body fluids. Potential transport processes through the water include buoyancy, entrainment, and turbulence. Transport processes from the water surface into the air include volatilization and evaporation enhanced by bubble bursting, breaking waves, splashing, and wind spray. Implications for the use of water search dogs are examined. Observations of submerged, decomposing bodies are needed to quantify the physical and chemical characteristics of the scent and scent transport processes.     

Visualization of latent fingermark corrosion of brass, climatic influence in a comparison between the U.K. and Iraq

Through a comparison of fingermark sweat corrosion of α phase brass in both the U.K. and Iraq, we show how samples from Iraq have improved fingermark corrosion over U.K. samples that require no additional enhancement prior to visualization. Over 50% of Iraqi samples produced fingermark corrosion with full ridge detail compared with 0% from the U.K. X-ray photoelectron spectroscopy analysis of the fingermark corrosion products showed that Iraqi samples exhibit more dezincification with the Zn:Cu ratio averaging 1:1.82 compared with 1:3.07 for U.K. samples. Auger spectroscopy showed the presence of both zinc oxide and copper (I) oxide. No copper (II) was observed on the surface of the corroded brass. Opportunities to exploit the optical properties of these thin film oxides to enhance the visualization of fingermark corrosion are considered, and the potential to use fingermark corrosion of metal as a means of visualizing fingerprints in war zones is discussed.     

论视频监控的犯罪预防功能及犯罪侦查价值

各国的犯罪预防理论发展至今,已经形成了比较完善的犯罪预防体系,主要包括司法预防、社会预防和情景预防三种模式。在我国的犯罪预防体系中,向来重视司法预防和社会预防,而对情景预防关注不够,情景预防措施尚不完善。作为一种对犯罪的干预,视频监控是一种对情境犯罪的干预,研究发掘其在犯罪预防中的作用对完善犯罪预防体系具有重要意义。同时,视频监控系统在犯罪侦查方面也具有重要作用。     

应用多种STR技术对基因嵌合体进行亲权鉴定分析

目的 查找嵌合基因的来源并进行父母和孩子的亲权鉴定.方法 采用Chelex-100法抽提基因组DNA,用复合扩增和荧光检测技术对STR、X-STR和Y-STR基因座进行分型.结果 父亲为XX,XY基因嵌合体,其能够提供给孩子必须的遗传基因.结论 父亲为被检孩子的生物学父亲.