The Recovery of Latent Fingermarks from Evidence Exposed to Ionizing Radiation*

Abstract: Continual reports of illicit trafficking incidents involving radioactive materials have prompted authorities to consider the likelihood of forensic evidence being exposed to radiation. In this study, we investigated the ability to recover latent fingermark evidence from a variety of substrates that were exposed to ionizing radiation. Fingermarks deposited on common surfaces, including aluminum, glass, office paper, and plastic, were exposed to doses ranging from 1 to 1000 kGy, in an effort to simulate realistic situations where evidence is exposed to significant doses of radiation from sources used in a criminal act. The fingermarks were processed using routine fingermark detection techniques. With the exception of glass and aluminum substrates, radiolysis had a considerable effect on the quality of the developed fingermarks. The damage to ridge characteristics can, in part, be attributed to chemical interactions between the substrate and the components of the fingermark secretions that react with the detection reagents.     

Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

Abstract: There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in‐depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three‐tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation.     

The Development and Evaluation of Radiological Decontamination Procedures for Documents,Document Inks,and Latent Fingermarks on Porous Surfaces*†

Abstract: Criminal acts such as an attack utilizing a radiological dispersal device (RDD or dirty bomb), the manufacture of such a device, or the illicit trafficking of radioactive materials would warrant a criminal investigation. This could involve the collection, transportation, and analysis of radiologically contaminated trace evidence. But are law enforcement agencies and forensic scientists capable of dealing with this? This research investigates the decontamination efficacy of two decontamination techniques (chemical and physical) designed for the removal of radiological material from documents of forensic importance. The impact that these procedures have on the development of latent fingermarks and the forensic analysis of the inks on these documents is also studied. It was found that slight changes in the color and chemical composition of a variety of document inks and a destruction of fingermark ridges occurred after chemical decontamination. Physical decontamination had no impact on these parameters.     

仿真分析取证模型的形式化研究

计算机犯罪的多样性使得现有的静态取证和动态取证模型均已不能很好的满足计算机取证的要求,亟需建立一种新型态的取证模型。仿真分析取证模型运用“自顶向下”的形式化建模方法,结合虚拟机技术的最新发展成果,通过虚拟犯罪现场重建构建了一种并行的取证平台,为侦查实践和司法实务提供了有力的技术支撑。     

A simple and effective image-statistics-based approach to detecting recaptured images from LCD screens

It is now extremely easy to recapture high-resolution and high-quality images from LCD (Liquid Crystal Display) screens. Recaptured image detection is an important digital forensic problem, as image recapture is often involved in the creation of a fake image in an attempt to increase its visual plausibility. State-of-the-art image recapture forensic methods make use of strong prior knowledge about the recapturing process and are based on either the combination of a group of ad-hoc features or a specific and somehow complicated dictionary learning procedure. By contrast, we propose a conceptually simple yet effective method for recaptured image detection which is built upon simple image statistics and a very loose assumption about the recapturing process. The adopted features are pixel-wise correlation coefficients in image differential domains. Experimental results on two large databases of high-resolution, high-quality recaptured images and comparisons with existing methods demonstrate the forensic accuracy and the computational efficiency of the proposed method.     

ForensicNet: Modern convolutional neural network-based image forgery detection network

The advancements in Image editing techniques produce realistic-looking artificial images with ease. These images can easily circumvent the forensic systems making the authentication process more tedious and difficult. To overcome this problem, we introduce a modern convolutional neural network (CNN) named ForensicNet, inspired by the recent developments in computer vision. The three major contributions of our CNNs are inverted bottleneck, separate downsampling layers, and using depth-wise convolutions for mixing information in the spatial dimension. The inverted bottlenecks help improve accuracy and reduce network parameters/FLOPs. The separate downsampling layers help converge the network. The normalization layers also help stabilize training whenever the spatial resolution is changed. The depth-wise convolution is a grouped convolution where the number of groups and channels are the same. The experiments show that ForensicNet outperforms the state-of-the-art methods by a large margin.     

Paired stable carbon and oxygen isotope analyses of human enamel for forensic human geolocation: An exploratory study

Stable carbon isotope analysis has proven utility for reconstructing dietary information in humans in past populations. The usefulness of stable carbon for forensic geolocation has been little investigated, largely because of the globalization of the human diet seemingly rendering it inconsequential. This study queried this assumption at a country-wide level on a known sample group. Stable carbon isotope values were obtained from human enamel with known biographical and geographical information to determine whether stable carbon, when paired with stable oxygen isotope values, could differentiate Canadians from non-Canadians. Samples originating outside of Canada were separated into three regions, and a linear discriminant analysis was used to generate discriminant functions that best separate the regions according to the stable carbon and oxygen isotope values. The results revealed two functions, where the first function explained 92.1% and the second 7.9% of the variance. Although some overlap in stable carbon and oxygen values was observed for individuals from both the United States and Canada, differences were observed between those from Canada and other geographical regions. This study demonstrated that pairing the dietary isotope carbon with the geolocator stable oxygen isotope, produced an interesting separation geographically, one that might well be helpful when attempting a geolocation query on unknown human remains.     

计算机取证综述

随着计算机与网络技术的发展,计算机犯罪活动日益增多,从而给国家和人民造成巨大的破坏。计算机犯罪是一种高技术犯罪,其很多证据都以数字形式通过计算机或网络进行存储和传输,不仅难以提取,而且易于篡改、销毁。因此,计算机取证已成为打击计算机犯罪的重要手段。计算机取证（Computer Forensics）作为法学、刑事侦查学和计算机科学的交叉学科,正逐渐成为人们研究和关注的焦点。     

Integrity verification of the ordered data structures in manipulated video content

Video content stored in Video Event Data Recorders (VEDRs) are used as important evidence when certain events such as vehicle collisions occur. However, with sophisticated video editing software, assailants can easily manipulate video records to their advantage without leaving visible clues. Therefore, the integrity of video content recorded through VEDRs cannot be guaranteed, and the number of related forensic issues increases. Existing video integrity detection methods use the statistical properties of the pixels within each frame of the video. However, these methods require ample time, because they check frames individually. Moreover, the frame can easily be replaced and forged using the appropriate public software. To solve this problem, we propose an integrity checking mechanism using the structure of ordered fields in a video file, because existing video editing software does not allow users to access or modify field structures. In addition, because our proposed method involves checking the header information of video content only once, much less detection time is required compared with existing methods that examine the entire frames. We store an ordered file structure of video content as a signature in the database using a customized automated tool. The signature appears according to the video editing software. Then, the suspected video content is compared to a set of signatures. If the file structure matches with a signature, we recognize a manipulated video file by its corresponding editing software. We tested five types of video editing software that cover 99% of the video editing software market share. Furthermore, we arranged 305,981 saving options for all five video editing suites. As a result, we obtained 100% detection accuracy using stored signatures, without false positives, in a collection of 305,981 video files. The principle of this method can be applied to other video formats.     

The Hierarchy of Case Priority (HiCaP):- A proposed method for case prioritisation in digital forensic laboratories

The need for digital forensic science (DFS) services has grown due to widespread and consistent engagement with technology by members of society. Whilst digital evidence often plays an important role in many inquiries, available investigative resources have failed to keep pace with such demand for them. As a result, the use case prioritisation models for backlog/workload management are of increasing importance to ensure the effective deployment of laboratory resources. This work focuses on the concept of ​​case prioritisation in a digital forensic laboratory setting, following the submission of exhibits for examination, where this workflow is described. The challenges of case management and prioritisation in laboratories are discussed, with both ‘case acceptance’ and ‘case prioritisation’ procedures explained. Finally, the ‘Hierarchy of Case Priority’ (HiCaP) - a transparent, risk-based approach for the prioritisation of cases for examination, is proposed and described using examples.