Diary of an astronaut: examination of the remains of the late Israeli astronaut Colonel Ilan Ramon's Crew Notebook recovered after the loss of NASA's space shuttle Columbia

Two months after the fatal re-entering into the Earth's atmosphere of Columbia flight STS-107, the remains of Israeli astronaut Colonel Ilan Ramon's Crew Notebook were found strewn in a field in San Augustine County, TX. The random pile of papers was found to have survived the calamity of the Shuttle's disintegration remarkably well. Most of the papers recovered were torn and/or washed out to varying degrees but only mildly charred around the edges. The sheets of paper could be categorized into four groups: Group I: eight sides of paper written while in space in black ink and in pencil--Ramon's personal diary; the writing on these eight sides of paper survived well and is only missing where the pages were torn. Small fragments found in the field were physically matched to holes in the pages thus locating their original positions in the text. Group II: six sides of technical preparation notes written by Ramon before the mission. The writing on these pages was washed out entirely, but much of it was visualized using infrared luminescence. Group III: eight sides of personal notes prepared by Ramon before the mission written in blue ink. The writing on these pages was barely visible to the naked eye and not visualized by infrared luminescence, but was made largely legible by digital enhancement imaging. Group IV: a few sides of printed technical information. These pages were mostly intact and were not examined at length as they contained standard printed material. After completion of examinations at the Questioned Document Laboratory of the Israel Police, the diary was transferred to the Paper Conservation Department of the Israel Museum for preservation and strengthening treatments.     

Comparison of the Performance of Two Methods for Height Estimation

Abstract: In the case study, two methods of performing body height measurements in images are compared based on projective geometry and 3D modeling of the crime scene. Accuracy and stability of height estimations are tested using reconstruction images of test persons of known height. Given unchanged camera settings, predictions of both methods are accurate. However, as the camera had been moved in the case, new vanishing points and camera matches had to be created for the reconstruction images. 3D modeling still yielded accurate and stable estimations. Projective geometry produced incorrect predictions for test persons and unstable intervals for questioned persons. The latter is probably caused by the straight lines in the field of view being hard to discern. With the quality of material presented, which is representative for our case practice, using vanishing points may thus yield unstable results. The results underline the importance of performing validation experiments in casework.     

Advanced Framework for Digital Forensic Technologies and Procedures*

Abstract: Recent trends in global networks are leading toward service‐oriented architectures and sensor networks. On one hand of the spectrum, this means deployment of services from numerous providers to form new service composites, and on the other hand this means emergence of Internet of things. Both these kinds belong to a plethora of realms and can be deployed in many ways, which will pose serious problems in cases of abuse. Consequently, both trends increase the need for new approaches to digital forensics that would furnish admissible evidence for litigation. Because technology alone is clearly not sufficient, it has to be adequately supported by appropriate investigative procedures, which have yet become a subject of an international consensus. This paper therefore provides appropriate a holistic framework to foster an internationally agreed upon approach in digital forensics along with necessary improvements. It is based on a top‐down approach, starting with legal, continuing with organizational, and ending with technical issues. More precisely, the paper presents a new architectural technological solution that addresses the core forensic principles at its roots. It deploys so‐called leveled message authentication codes and digital signatures to provide data integrity in a way that significantly eases forensic investigations into attacked systems in their operational state. Further, using a top‐down approach a conceptual framework for forensics readiness is given, which provides levels of abstraction and procedural guides embellished with a process model that allow investigators perform routine investigations, without becoming overwhelmed by low‐level details. As low‐level details should not be left out, the framework is further evaluated to include these details to allow organizations to configure their systems for proactive collection and preservation of potential digital evidence in a structured manner. The main reason behind this approach is to stimulate efforts on an internationally agreed “template legislation,” similarly to model law in the area of electronic commerce, which would enable harmonized national implementations in the area of digital forensics.     

Measurement Uncertainty When Estimating the Velocity of an Allegedly Speeding Vehicle from Images

Abstract: Sometimes the question arises whether it is possible to estimate the velocity of a speeding car recorded by closed circuit television cameras. By estimating the travelled distance of the car between two images and the time elapsed, estimation of the velocity is rather straightforward. However, to quantify the corresponding measurement uncertainty, the data analysis becomes more involved. The article describes two approaches as to how to derive the measurement uncertainty. In the first method, distance and timing are estimated separately, and the two uncertainties are combined to derive the measurement uncertainty for the velocity. For this, a frequentist and a Bayesian approach are described. In the second method, the measurement uncertainty for the speed is derived directly using validation recordings of a car driving by at known speed. The choice which method to use depends mainly on the length of the path that the car has travelled.     

A Forensic Examination of Online Search Facility URL Record Structures

The use of search engines and associated search functions to locate content online is now common practice. As a result, a forensic examination of a suspect's online search activity can be a critical aspect in establishing whether an offense has been committed in many investigations. This article offers an analysis of online search URL structures to support law enforcement and associated digital forensics practitioners interpret acts of online searching during an investigation. Google, Bing, Yahoo!, and DuckDuckGo searching functions are examined, and key URL attribute structures and metadata have been documented. In addition, an overview of social media searching covering Twitter, Facebook, Instagram, and YouTube is offered. Results show the ability to extract embedded metadata from search engine URLs which can establish online searching behaviors and the timing of searches.     

The Effects of High Dynamic Range on Fingerprint Images Processed by Photoshop

High dynamic range (HDR) imaging is a function that combines five images with different exposures into a single image. This technique may provide fine ridge details of fingerprint images for forensic latent fingerprint examination. Therefore, viewing fingerprints under optimal conditions is of paramount importance. This paper analyzes HDR and non‐HDR photos by using the Michelson contrast formula. The Michelson formula will provide a measurement to determine whether better contrast between the background and print can be achieved using the HDR function and if the background color affects the quality of the images. Two hypothesis were tested: (i) the HDR image provides more details of fingerprints with a better tone, greater clarity, and contrast than a normally exposed image regardless of the background color; (ii) the background color does not affect the quality of HDR fingerprint images overall, but the multi‐color background may increase the contrast of HDR fingerprint images in some cases.     

Changes in Fingerprints Depending on Physiological Factors

The aim of the study was to determine the effect of gender, body mass index, and time on the width of friction ridge impressions in fingerprints and the content of sweat and sebum forming the print. The research showed that the friction ridge impressions of women are significantly wider than those of men, and this tendency persists throughout the existence of the print. The differences may result from the anatomical structure of the skin, as well as from the use of protective products such as creams, which are used more often by women. The width of friction ridge impression is similar in underweight and overweight people, but greater than in those with normal body weight, and the amount of sweat and sebum increases with body weight. The passage of time significantly reduces both the width of the friction ridge impression and the content of sweat and sebum secretions in the print.     

Stability and Specificity of Counterfeit Protection System Code

In this study, the stability and specificity of a counterfeit protection system (CPS) code were determined. This research involved an analysis of a counterfeit protection system code unit over time using the pattern location measurement method. We collected 379 sample sheets from 196 printers or photocopiers, covering 14 original brands, including 129 models. There was an interval of at least two months between the collections of samples from each machine. Four types of characteristics were established: CPS pattern unit, distance of the CPS unit, position of dots, size and shape of the dot. Except for the partial changes in the Xerox brand, no other brand exhibited changes over time. This implies that the CPS characteristics are stable. Meanwhile, no correlation was noted between the combinations of the characteristic systems in the collected samples, which implied strong specificity.     

An Evidence‐Based Forensic Taxonomy of Windows Phone Communication Apps

Communication apps can be an important source of evidence in a forensic investigation (e.g., in the investigation of a drug trafficking or terrorism case where the communications apps were used by the accused persons during the transactions or planning activities). This study presents the first evidence‐based forensic taxonomy of Windows Phone communication apps, using an existing two‐dimensional Android forensic taxonomy as a baseline. Specifically, 30 Windows Phone communication apps, including Instant Messaging (IM) and Voice over IP (VoIP) apps, are examined. Artifacts extracted using physical acquisition are analyzed, and seven digital evidence objects of forensic interest are identified, namely: Call Log, Chats, Contacts, Locations, Installed Applications, SMSs and User Accounts. Findings from this study would help to facilitate timely and effective forensic investigations involving Windows Phone communication apps.     

Collection of Wet‐Origin Footwear Impressions on Various Surfaces Using an Electrostatic Dust Print Lifter

Electrostatic dust print lift method is known to be able to recover only dry‐origin footwear impression. However, the wet‐origin footwear impression could also be recovered using this method. As the amount of dust accumulated before deposition of the wet‐origin footwear impression increased, the intensity of the footwear impression lifted with this method became stronger. If the footwear impression is not affected by moisture after it is made, the 28‐h old wet‐origin footwear impression could be recovered using this method. The intensity of the lifted footwear impression did not decrease significantly even when the number of sequential steps increased as long as the shoe sole is wet. However, when the moisture on the shoe sole depleted, the intensity of the footwear impression decreased sharply. This method has the advantage of being able to enhance the footwear impression without being affected by the footwear impressions deposited in the past.