That tool is rubbish!…or is it?

Digital forensic practitioners often utilise a range of tools throughout their casework in order to access, identify and analyse relevant data, making them a vital part of conducting thorough, efficient and accurate digital examinations of device content and datasets. Whilst their importance cannot be understated, there is also no guarantee that their functionality is free from error, where similarly, no practitioner can 100% assure that their performance is flawless. Should an error occur during an investigation, assuming that it has been identified, then determining the cause of it is important for the purposes of ensuring quality control in both the immediate investigation and for longer-term practice improvements. Perhaps anecdotally, a starting position in any postmortem review of an error may be to suspect that any tools used may be at fault, where recent narratives and initiatives have enforced the need to evaluate all tools prior to them being used in any live investigation. Yet, in addition, an error may occur as a result of a practitioner’s investigative conduct. This work discusses the concept of ‘fault-attribution’, focusing on the roles of the forensic tool and practitioner, and proposes a series of principles for determining responsibility for an investigative error.     

软件侵权计算机取证方法的法律推理

随着计算机越来越广泛地应用于国家和社会的各行各业中,软件带来的经济利益不断增多。各种软件不断地开发和应用,随之而来对软件的侵权行为也越来越多,只有完善法律法规,并大力打击侵权行为,才能有效保障软件开发者的利益。如何判断软件侵权行为是保护正版打击盗版的前提条件,这就是侦查和司法鉴定的计算机取证。     

手机短信与网络诈骗犯罪

随着互联网技术的发展,手机消费将更多地与网络结合,手机短信的快捷、便利为人们生活带来方便的同时,也为犯罪分子所利用,出现了利用手机短信进行网络诈骗新型犯罪,通过对此类犯罪的特点、成因及预防几个方面阐述了自己的观点。     

利用邮件头分析电子邮件的真伪

目的通过分析电子邮件头,鉴别电子邮件的真伪,为电子邮件的真实性鉴定提供一些技术方法。方法运用邮件头的关键字段的构建机制对电子邮件的邮件头进行分析处理。结果示例邮件的邮件头的多处关键字段按照邮件传递时间和邮件传递地址的分析,不符合正常规律,系伪造的电子邮件。结论利用邮件头分析电子邮件不仅为确保电子邮件证据的证据效力提供了强有力的支持,也为获取破案的线索提供了条件。     

移动电话“靓号”应成为盗窃罪的犯罪对象——全国首例“靓号黑客案”的物权法解读

全国首例“靓号黑客案”二审判定移动电话“靓号”不属于刑法上的财物范畴,从而否定其成为盗窃罪的犯罪对象。这是二审法院受刑法学理论界关于盗窃罪犯罪对象的“有体性说”错误指导的结果。“有体性说”的错误根源在于对民法中无体物与有体物相区分理论的错误理解。我国刑事司法实务界应该主动舍弃“有体性说”,并应从盗窃罪犯罪对象的几个基本特征入手,认定移动电话“靓号”可以成为盗窃罪的犯罪对象。     

Cybercrime investigation in Finland

Nordic police cooperation concerning cybercrimes has been developed during the last few years, e.g. through the Nordic Computer Forensics Investigators (NCFI) and Nordplus training programmes. More empirical research is needed in order to enhance cybercrime investigation and address the training needs of police officers. There is a knowledge gap concerning organizational models for the police’s cybercrime investigation: How the function is organized, what the professional characteristics of the staff are and how to combine computer forensics with crime investigation? The purpose of this paper was to study the organization of cybercrime investigation in Finland. Data were collected by a questionnaire from all 11 local police districts and the National Bureau of Investigation in July–August 2014. In addition, six thematic interviews of cybercrime investigators were conducted in 2014. Three investigation models of computer integrity crimes were found: (1) Computer forensic investigators conduct the entire pre-trial examination, (2) Computer forensic investigators conduct only the computer forensics, and tactical investigation is done by an occasional investigator, (3) Computer forensic investigators conduct only the computer forensics and tactical investigation is centralized to designated investigators. The recognition of various organizational models and educational backgrounds of investigators will help to develop cybercrime investigation training.     

Smartphone and Tablet Applications for Crime Scene Investigation: State of the Art,Typology, and Assessment Criteria

The use of applications on mobile devices is gradually becoming a new norm in everyday life, and crime scene investigation is unlikely to escape this reality. The article assesses the current state of research and practices by means of literature reviews, semistructured interviews, and a survey conducted among crime scene investigators from Canada and Switzerland. Attempts at finding a particular strategy to guide the development, usage, and evaluation of applications that can assist crime scene investigation prove to be rather challenging. Therefore, the article proposes a typology for these applications, as well as criteria for evaluating their relevance, reliability, and answer to operational requirements. The study of five applications illustrates the evaluation process. Far away from the revolution announced by some stakeholders, it is required to pursue scientific and pragmatic research to set the theoretical foundations that will allow a significant contribution of applications to crime scene investigation.     

27个常染色体AIM-SNP的筛选和验证

目的构建27个常染色体AIM-SNP组合用于未知个体种族来源推断。方法通过对Hap Map数据库中描述祖先遗传信息标记的908个AIMs位点(非洲、欧洲、东亚人群)筛选,选出27个AIMs位点组合,利用相关软件同时与数据库908个AIMs不同子集合的分析进行对比,验证其推断祖先来源的可行性。结果应用本研究27个AIMs的SNP多态性分析方法可以正确推断未知样品祖先起源,估算祖先成分比例。结论本研究建立的常染色体27个AIMs的SNP多态性分析方法可准确推断来自于欧洲、非洲、东亚3大祖先血统个体的祖先来源,是SNP多态性分析用于个体种族来源推断的一种有效方法,在法医实践中可以用于DNA检验中未知DNA供者洲际人群祖先来源推断。     

公安本科院校电子取证新兴交叉专业建设的探索与实践

电子取证专业是新生事物,是我国公安高等教育改革发展过程中的重大探索。在专业建设和人才培养中应重视学生实践能力培养,注重多学科知识的交叉渗透融合,加强优秀教学团队建设,重视核心课程的整合,增强专业教学监督力度,构建适应公安网监业务需求的立体人才培养模式。     

A study on the forensic mechanisms of VoIP attacks: Analysis and digital evidence

This paper discusses the use of communication technology to commit crimes, including crime facts and crime techniques. The analysis focuses on the security of voice over Internet protocol (VoIP), a prevention method against VoIP call attack and the attention points for setting up an Internet phone. The importance of digital evidence and digital forensics are emphasised. This paper provides the VoIP digital evidence forensics standard operating procedures (DEFSOP) to help police organisations and establishes an experimental platform to simulate phone calls, hacker attacks and forensic data. Finally, this paper provides a general discussion of a digital evidence strategy that includes VoIP for crime investigators who are interested in digital evidence forensics.