USB Storage Device Forensics for Windows 10

Significantly increased use of USB devices due to their user‐friendliness and large storage capacities poses various threats for many users/companies in terms of data theft that becomes easier due to their efficient mobility. Investigations for such data theft activities would require gathering critical digital information capable of recovering digital forensics artifacts like date, time, and device information. This research gathers three sets of registry and logs data: first, before insertion; second, during insertion; and the third, after removal of a USB device. These sets are analyzed to gather evidentiary information from Registry and Windows Event log that helps in tracking a USB device. This research furthers the prior research on earlier versions of Microsoft Windows and compares it with latest Windows 10 system. Comparison of Windows 8 and Windows 10 does not show much difference except for new subkey under USB Key in registry. However, comparison of Windows 7 with latest version indicates significant variances.     

浅析提存法律关系

提存是债的必然消灭的重要方式之一,提存关系的各主体之间形成了复杂的法律关系。从民法学的角度分析提存法律关系,提存是提存人代理债权人与提存机关建立的一般保管关系。正确认识提存法律关系,有助于更好地认识提存的本质,严格各主体的责任分担,推动提存事业的发展。     

A case study on anonymised sharing platforms and digital traces left by their usage

Non-local forms of file storage and transfer provide investigatory concerns. Whilst mainstream cloud providers offer a well-established challenge to those involved in criminal enquiries, there are also a host of services offering non-account based ‘anonymous’ online temporary file storage and transfer. From the context of a digital forensic investigation, the practitioner examining a suspect device must detect when such services have been utilised by a user, as offending files may not be resident on local storage media. In addition, identifying the use of a service may also expose networks of illegal file distribution, supporting wider investigations into criminal activity. This work examines 16 anonymous file transfer services and identifies and interprets the digital traces left behind on a device following their use to support law enforcement investigations.     

Whole bovine blood use in forensic research: Sample preparation and storage considerations

Mammalian whole blood sources are often used for forensic research and training when human samples cannot be sourced. While porcine, ovine and equine blood have been shown to be viable alternatives to whole human blood for forensic purposes, procurement can still pose a problem, especially for smaller and remote institutions. This work explores the use of whole bovine blood for basic bloodstain simulation. Sample preparation through the addition of ACD-A anticoagulant was optimized and storability was explored. Viscosity, surface tension, density, and packed cell volume, four fluid properties relevant to bloodstain pattern analysis, were monitored over four days and in two temperature conditions. Linear mixed models accounting for variation in the donor demonstrated that these fluid properties of the bovine blood changed predictably over time and with temperature. Whole bovine blood with 12.5% v/v ACD-A was found to be viable for use in basic bloodstain simulation at ambient and physiological temperature.     

Toward maintaining canine training aid integrity: Visualizing contamination and testing storage materials for a non-hazardous canine training aid

Contamination of canine training aids is a pervasive issue that may lead to incorrect canine discrimination of target odors. It is therefore important to properly store training materials to maintain their integrity and efficiency. First, this study demonstrated the potential for contamination using GloGerm™ as a proxy for odor/particulate transfer. Then, eight types of containers were evaluated to determine (1) the ability to prevent odor permeation and (2) the likelihood of maintaining the ab/adsorbed odor. Lastly, a longitudinal study evaluated how the permeation of the target odor changed over time. Analysis occurred using a direct analysis in real-time mass spectrometer (DART-MS) to detect triacetone triperoxide (TATP) from the non-hazardous canine training aid known as the polymer odor capture-and-release (POCR) system. Results showed that Mylar and Opsak bags were most effective for short-term storage, maintaining low levels of ab/adsorption. Over time, the amount of TATP permeating through the primary containers and collecting in a secondary container (i.e., outer packaging) increased at 1 week and decreased thereafter (up to 4 months). The amount of TATP collecting in the primary containers, however, increased up to 1 month and decreased thereafter.     

非法储存爆炸物罪的司法认定问题研究

解决司法实践中认定非法储存爆炸物罪存在的分歧,应从四个方面入手：一是围绕立法本意,科学界定刑法上“爆炸物”的范围;二是针对目前关于“非法储存”的规定在司法认定中引起的争议,深入分析,提出认定“非法储存”中应遵循的原则;三是通过对非法储存爆炸物罪的未完成形态的分析,形成对未完成形态认定的正确方法;四是结合实践中易混淆的情况,对本罪与他罪进行比较研究,指出本罪与他罪的认定界限。     

The Stability of Collected Human Scent Under Various Environmental Conditions*,†

Abstract: Human scent evidence collected from objects at a crime scene is used for scent discrimination with specially trained canines. Storage of the scent evidence is usually required yet no optimized storage protocol has been determined. Storage containers including glass, polyethylene, and aluminized pouches were evaluated to determine the optimal medium for storing human scent evidence of which glass was determined to be the optimal storage matrix. Hand odor samples were collected on three different sorbent materials, sealed in glass vials and subjected to different storage environments including room temperature, ?80°C conditions, dark storage, and UVA/UVB light exposure over a 7‐week period. Volatile organic compounds (VOCs) in the headspace of the samples were extracted and identified using solid‐phase micro‐extraction–gas chromatography/mass spectrometry (SPME–GC/MS). Three‐dimensional covariance mapping showed that glass containers subjected to minimal UVA/UVB light exposure provide the most stable environment for stored human scent samples.     

Windows系统存储区DPAPI的解密技术研究

目的 在电子数据取证过程中,数据的加解密经常是取证人员关注的重点.数据保护接口(DPAPI)作为Windows系统提供的数据保护接口被广泛使用,目前主要用于保护加密的数据.其特性主要表现在加密和解密必须在同一台计算机上操作,密钥的生成、使用和管理由Windows系统内部完成,如果更换计算机则无法解开DPAPI加密数据....     

液化天然气的开发应用

利用低温将天然气液化,便于运输、储存和冷能利用,是跨洲际、跨海洋运送天然气的主要方式,对调剂世界天然气供应起着重要作用,使供气来源多样化。     

试论低谷电能采暖的环境与经济效益

各城市大量的低谷电没有利用 ,电价是峰电的 1 /3左右。电热锅炉在夜间利用低谷电能蓄热 ,既可供暖 ,又可蓄热 ,且不产生任何污染