Forensic investigation of cross platform massively multiplayer online games: Minecraft as a case study

Minecraft, a Massively Multiplayer Online Game (MMOG), has reportedly millions of players from different age groups worldwide. With Minecraft being so popular, particularly with younger audiences, it is no surprise that the interactive nature of Minecraft has facilitated the commission of criminal activities such as denial of service attacks against gamers, cyberbullying, swatting, sexual communication, and online child grooming. In this research, there is a simulated scenario of a typical Minecraft setting, using a Linux Ubuntu 16.04.3 machine (acting as the MMOG server) and Windows client devices running Minecraft. Server and client devices are then examined to reveal the type and extent of evidential artefacts that can be extracted.     

Comparison of Different Swabs for Sampling Inorganic Gunshot Residue from Gunshot Wounds: Applicability and Reliability for the Determination of Firing Distance

This study concentrates on samples of bare pork skin, with and without bristles, and dried bovine ribs shot with a semi‐automatic pistol to find the best methodology and sampling surface in the search for inorganic gunshot residues (IGSR). Four quadrants of known surface areas were sampled at different distances from the bullet's hole with different swabs: tapes in graphite, Leukosilk® white tape, 3M® transparent tape, and a cotton swab to assess the technique able to collect the highest amounts of IGSR with the lowest contribution of the blank. The cotton swab wet in 10% HNO₃ gave the best results. The highest amounts of IGSR, measured by ICP‐OES and MS, were detected on a surface of 3‐cm radius from the bullet's edge. The amount of metals collected decreased with the firing distance between 20 and 60 cm. The procedure was efficient for sampling different tissues like skin and bones.     

A Forensic Examination of Online Search Facility URL Record Structures

The use of search engines and associated search functions to locate content online is now common practice. As a result, a forensic examination of a suspect's online search activity can be a critical aspect in establishing whether an offense has been committed in many investigations. This article offers an analysis of online search URL structures to support law enforcement and associated digital forensics practitioners interpret acts of online searching during an investigation. Google, Bing, Yahoo!, and DuckDuckGo searching functions are examined, and key URL attribute structures and metadata have been documented. In addition, an overview of social media searching covering Twitter, Facebook, Instagram, and YouTube is offered. Results show the ability to extract embedded metadata from search engine URLs which can establish online searching behaviors and the timing of searches.     

Loose‐Lipped Mobile Device Intelligent Personal Assistants: A Discussion of Information Gleaned from Siri on Locked iOS Devices

The forensic analysis of mobile handsets is becoming a more prominent factor in many criminal investigations. Despite such devices frequently storing relevant evidential content to support an investigation, accessing this information is becoming an increasingly difficult task due to enhanced effective security features. Where access to a device's resident data is not possible via traditional mobile forensic methods, in some cases it may still be possible to extract user information via queries made to an installed intelligent personal assistant. This article presents an evaluation of the information which is retrievable from Apple's Siri when interacted with on a locked iOS device running iOS 11.2.5 (the latest at the time of testing). The testing of verbal commands designed to elicit a response from Siri demonstrate the ability to recover call log, SMS, Contacts, Apple Maps, Calendar, and device information which may support any further investigation.     

An Evidence‐Based Forensic Taxonomy of Windows Phone Communication Apps

Communication apps can be an important source of evidence in a forensic investigation (e.g., in the investigation of a drug trafficking or terrorism case where the communications apps were used by the accused persons during the transactions or planning activities). This study presents the first evidence‐based forensic taxonomy of Windows Phone communication apps, using an existing two‐dimensional Android forensic taxonomy as a baseline. Specifically, 30 Windows Phone communication apps, including Instant Messaging (IM) and Voice over IP (VoIP) apps, are examined. Artifacts extracted using physical acquisition are analyzed, and seven digital evidence objects of forensic interest are identified, namely: Call Log, Chats, Contacts, Locations, Installed Applications, SMSs and User Accounts. Findings from this study would help to facilitate timely and effective forensic investigations involving Windows Phone communication apps.     

医疗损害鉴定面临的挑战与对策

2017年底发布的《侵权责任法·医疗损害责任》司法解释规定了新的鉴定规则:确定了医疗损害专门性问题鉴定的概念及内容,取鉴定申请替代患方举证能力的不足,规定了新的鉴定人资格要求,明确了医疗过错判定的要求;明确了因果关系分级要求;明确了医疗损害鉴定的程序要求等。但仍然保留了医疗损害鉴定二元化模式。新的规定给我国医疗损害鉴定带来了新的挑战,尤其是鉴定人资格、专家辅助人意见可以成为定案依据的规定,将直接影响我国的法医开展医疗损害鉴定。笔者由此提出了以下建议:(1)医疗鉴定要回归科学性、公益性、规范性;(2)医疗损害鉴定回归同行评议是必然趋势;(3)应当建立统一的临床医学鉴定专家库;(4)应当研究医疗损害鉴定的理论、原则和方法。     

Cloud forecasting: Legal visibility issues in saturated environments

The advent of cloud computing has brought the computing power of corporate data processing and storage centers to lightweight devices. Software-as-a-service cloud subscribers enjoy the convenience of personal devices along with the power and capability of a service. Using logical as opposed to physical partitions across cloud servers, providers supply flexible and scalable resources. Furthermore, the possibility for multitenant accounts promises considerable freedom when establishing access controls for cloud content. For forensic analysts conducting data acquisition, cloud resources present unique challenges. Inherent properties such as dynamic content, multiple sources, and nonlocal content make it difficult for a standard to be developed for evidence gathering in satisfaction of United States federal evidentiary standards in criminal litigation. Development of such standards, while essential for reliable production of evidence at trial, may not be entirely possible given the guarantees to privacy granted by the Fourth Amendment and the Electronic Communications Privacy Act. Privacy of information on a cloud is complicated because the data is stored on resources owned by a third-party provider, accessible by users of an account group, and monitored according to a service level agreement. This research constructs a balancing test for competing considerations of a forensic investigator acquiring information from a cloud.     

“I couldn't find it your honour,it mustn't be there!” – Tool errors,tool limitations and user error in digital forensics

The field of digital forensics maintains significant reliance on the software it uses to acquire and investigate forms of digital evidence. Without these tools, analysis of digital devices would often not be possible. Despite such levels of reliance, techniques for validating digital forensic software are sparse and research is limited in both volume and depth. As practitioners pursue the goal of producing robust evidence, they face the onerous task of both ensuring the accuracy of their tools and, their effective use. Whilst tool errors provide one issue, establishing a tool's limitations also provides an investigatory challenge leading the potential for practitioner user-error and ultimately a grey area of accountability. This article debates the problems surrounding digital forensic tool usage, evidential reliability and validation.     

计算机取证的时间分析方法

从一个时间标签被取证人员错误修改的案例出发,介绍计算机的日期和时间结构、MAC时间标签的含义,以及本地时间和UTC时间的转换问题,提出一些帮助涉及时间问题调查的规则和建议。     

De l'espace nomade à l'espace mobile en passant par l'espace du contrat: une expérience théorique

The paper retraces both a scientific itinerary and what might be described as a stratification and a history of the dominant social forms of structuring space: nomadism, sedentariness, mobility. It argues against a possible evolutionist interpretation of this scheme by privileging a synchronic observation of the various intersecting spatial forms in what might be called the truth of the place (which is the stage of intersection). The theoretical idea of a mobile space is thus schematized by opposing it to the paradigm of fixedness which dominates classical as well as modern spatial analysis. The rapprochement of nomadic space (being the source of reflection) and mobile space (being the result of reflection) is presented as a “methodological” space avoiding metaphorical vagueness.