Forensic Investigation of Cooperative Storage Cloud Service: Symform as a Case Study

Researchers envisioned Storage as a Service (StaaS) as an effective solution to the distributed management of digital data. Cooperative storage cloud forensic is relatively new and is an under‐explored area of research. Using Symform as a case study, we seek to determine the data remnants from the use of cooperative cloud storage services. In particular, we consider both mobile devices and personal computers running various popular operating systems, namely Windows 8.1, Mac OS X Mavericks 10.9.5, Ubuntu 14.04.1 LTS, iOS 7.1.2, and Android KitKat 4.4.4. Potential artefacts recovered during the research include data relating to the installation and uninstallation of the cloud applications, log‐in to and log‐out from Symform account using the client application, file synchronization as well as their time stamp information. This research contributes to an in‐depth understanding of the types of terrestrial artifacts that are likely to remain after the use of cooperative storage cloud on client devices.     

Visualizing Digital Forensic Datasets: A Proof of Concept

Digital forensic visualization is an understudied area despite its potential to achieve significant improvements in the efficiency of an investigation, criminal or civil. In this study, a three‐stage forensic data storage and visualization life cycle is presented. The first stage is the decoding of data, which involves preparing both structured and unstructured data for storage. In the storage stage, data are stored within our proposed database schema designed for ensuring data integrity and speed of storage and retrieval. The final stage is the visualization of stored data in a manner that facilitates user interaction. These functionalities are implemented in a proof of concept to demonstrate the utility of the proposed life cycle. The proof of concept demonstrates the utility of the proposed approach for the storage and visualization of digital forensic data.     

汽车和挂车后下部防护装置安装使用现状分析

后下部防护装置是减少高速公路小车追尾货车事故的重要技术手段,但现阶段这一装置的应用状况普遍较差,导致社会危害和给社会造成的损失巨大。要从根本上改变目前这一状况,需要从多方面入手加以整治。     

An initial evaluation of stable isotopic characterisation of post-blast plastic debris from improvised explosive devices

A number of two-way radios, similar to those which have been employed to initiate Improvised Explosive Devices (IEDs), were acquired from a commercial supplier and grouped into four pairs. Samples of plastic material were collected from five distinct regions of each radio and analysed by Infrared and Raman spectroscopy to identify the nature of the material. One radio of each pair was then subjected to detonation with a commercially available plastic explosive. The combination of radio and explosive was considered to be representative of the components of an IED. Following detonation, fragments were recovered and, where possible, identified as specific sampling points of the radio.A combination of δ²H and δ¹³C stable isotopic analysis of material from each of the five sampling points was found to provide a pattern which was characteristic of a given radio and provided a means to associate pairs of radios. When few fragments were recovered, no positive association could be made between the fragments and the paired, undamaged radio. This was attributed, in part, to manufacturing variation in the radios. However, when three or more post-blast fragments were recovered it was possible to associate these with the paired, undamaged radio with a high degree of certainty.     

Increased Hematocrit Due to Electrical‐Waveform Exposures in Splenectomized Sus scrofa,

In laboratory studies of the pig Sus scrofa, hematocrit has consistently increased after conducted‐electrical‐weapon (CEW) exposures, possibly due to contraction of the spleen. Splenectomized animals and intact sham control animals were exposed, each for 30 sec, to a benchtop‐produced electrical waveform of net charge levels similar to those of some CEWs. Changes in the blood were compared statistically. Hematocrit increased significantly in both splenectomized and sham animals. There were no significant main‐effect differences between values of hematocrit from the two groups. There were, however, significant interactive effects of time and splenectomy for hematocrit, red blood cell count, and hemoglobin. After peak values were reached for these variables, values returned toward baseline levels more slowly in splenectomized animals. This may have been due to the lack of a spleen to sequester red blood cells (thereby resulting in more cells remaining in the general circulation), unlike sham animals with intact spleens.     

Loose‐Lipped Mobile Device Intelligent Personal Assistants: A Discussion of Information Gleaned from Siri on Locked iOS Devices

The forensic analysis of mobile handsets is becoming a more prominent factor in many criminal investigations. Despite such devices frequently storing relevant evidential content to support an investigation, accessing this information is becoming an increasingly difficult task due to enhanced effective security features. Where access to a device's resident data is not possible via traditional mobile forensic methods, in some cases it may still be possible to extract user information via queries made to an installed intelligent personal assistant. This article presents an evaluation of the information which is retrievable from Apple's Siri when interacted with on a locked iOS device running iOS 11.2.5 (the latest at the time of testing). The testing of verbal commands designed to elicit a response from Siri demonstrate the ability to recover call log, SMS, Contacts, Apple Maps, Calendar, and device information which may support any further investigation.     

Analysis of Explosives by GC‐UV

A mixture of explosives was analyzed by gas chromatography (GC) linked to ultraviolet (UV) spectrophotometry that enabled detection in the range of 178–330 nm. The gas‐phase UV spectra of 2,4,6‐trinitrotoluene (TNT), 2,4‐dinitrotoluene (DNT), ethylene glycol dinitrate (EGDN), glycerine trinitrate (NG, nitroglycerine), triacetone triperoxide (TATP), and pentaerythritol tetranitrate (PETN) were successfully recorded. The most interesting aspect of the current application is that it enabled simultaneous detection of both the target analyte and its decomposition products. At suitable elevated temperatures of the transfer line between the GC instrument and the UV detector, a partial decomposition was accomplished. Detection was made in real time and resulted in overlaid spectra of the mother compound and its decomposition product. Hence, the presented approach added another level to the qualitative identification of the explosives in comparison with traditional methods that relies only on the detection of the target analyte. As expected, the decomposition product of EGDN, NG, and PETN was NO, while TATP degraded to acetone. DNT and TNT did not exhibit any decomposition at the temperatures used.     

Location and tracking of mobile devices: Überveillance stalks the streets

During the last decade, location-tracking and monitoring applications have proliferated, in mobile cellular and wireless data networks, and through self-reporting by applications running in smartphones that are equipped with onboard global positioning system (GPS) chipsets. It is now possible to locate a smartphone user's location not merely to a cell, but to a small area within it. Innovators have been quick to capitalise on these location-based technologies for commercial purposes, and have gained access to a great deal of sensitive personal data in the process. In addition, law enforcement utilises these technologies, can do so inexpensively and hence can track many more people. Moreover, these agencies seek the power to conduct tracking covertly, and without a judicial warrant. This article investigates the dimensions of the problem of people-tracking through the devices that they carry. Location surveillance has very serious negative implications for individuals, yet there are very limited safeguards. It is incumbent on legislatures to address these problems, through both domestic laws and multilateral processes.     

Accumulation of explosives in hair--part II: factors affecting sorption

This study examines the sorption of eight explosives (2,4,6-trinitrotoluene [TNT]; pentaerythritol tetranitrate [PETN]; hexahydro-1,3,5-trinitro-s-triazine [RDX]; diacetone diperoxide [DADP]; triacetone triperoxide [TATP]; ethylene glycol [EGDN], nitroglycerin [NG]; and 2,4-dinitrotoluene [DNT]) to human hair. The study uses only cut hair, which is exposed to explosive vapor. The vapor transfer studies reported herein indicated that hair did not reach saturation even after 2.5 years of exposure to TNT. While previous studies showed black hair sorbed more explosive than blond or brown, this study reports that red hair sorption is similar to black, while grey hairs, exposed along with black hair from the same individual, sorbed significantly less explosive than the same individual's black hairs. In a study using only black hair, a slight racial bias was observed with sorption greater for Mongoloid hair as compared to Caucasian or Negroid. Only for Mongoloid hairs were enough samples studied to examine for a gender bias, but one was not observed. There was much variability in results in all categories (hair color, race, and gender) that trends were established only in general terms. Hair at different ages was tested for a few individuals. Detailed studies focused on the sorption of TATP and TNT as these appear to be sorbed most differently-TATP mainly on the hair surface and TNT both on the surface and in the cortex. The uptake of high vapor pressure explosives (e.g., TATP) and moderate vapor pressure explosives (e.g., TNT) by hair was rapid and could be detected within about 1 h of exposure. Both explosives were readily sorbed by pure melanin.