The Development and Evaluation of Radiological Decontamination Procedures for Documents,Document Inks,and Latent Fingermarks on Porous Surfaces*†

Abstract: Criminal acts such as an attack utilizing a radiological dispersal device (RDD or dirty bomb), the manufacture of such a device, or the illicit trafficking of radioactive materials would warrant a criminal investigation. This could involve the collection, transportation, and analysis of radiologically contaminated trace evidence. But are law enforcement agencies and forensic scientists capable of dealing with this? This research investigates the decontamination efficacy of two decontamination techniques (chemical and physical) designed for the removal of radiological material from documents of forensic importance. The impact that these procedures have on the development of latent fingermarks and the forensic analysis of the inks on these documents is also studied. It was found that slight changes in the color and chemical composition of a variety of document inks and a destruction of fingermark ridges occurred after chemical decontamination. Physical decontamination had no impact on these parameters.     

仿真分析取证模型的形式化研究

计算机犯罪的多样性使得现有的静态取证和动态取证模型均已不能很好的满足计算机取证的要求,亟需建立一种新型态的取证模型。仿真分析取证模型运用“自顶向下”的形式化建模方法,结合虚拟机技术的最新发展成果,通过虚拟犯罪现场重建构建了一种并行的取证平台,为侦查实践和司法实务提供了有力的技术支撑。     

Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

Abstract: There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in‐depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three‐tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation.     

The Recovery of Latent Fingermarks from Evidence Exposed to Ionizing Radiation*

Abstract: Continual reports of illicit trafficking incidents involving radioactive materials have prompted authorities to consider the likelihood of forensic evidence being exposed to radiation. In this study, we investigated the ability to recover latent fingermark evidence from a variety of substrates that were exposed to ionizing radiation. Fingermarks deposited on common surfaces, including aluminum, glass, office paper, and plastic, were exposed to doses ranging from 1 to 1000 kGy, in an effort to simulate realistic situations where evidence is exposed to significant doses of radiation from sources used in a criminal act. The fingermarks were processed using routine fingermark detection techniques. With the exception of glass and aluminum substrates, radiolysis had a considerable effect on the quality of the developed fingermarks. The damage to ridge characteristics can, in part, be attributed to chemical interactions between the substrate and the components of the fingermark secretions that react with the detection reagents.     

A Forensic Exploration of the Microsoft Windows 10 Timeline

The Microsoft Windows operating system continues to dominate the desktop computing market. With such high levels of usage comes an inferred likelihood of digital forensic practitioners encountering this platform during their investigations. As part of any forensic examination of a digital device, operating system artifacts, which support the identification and understanding of how a user has behaved on their system provide a potential source of evidence. Now, following Microsoft's April 2018 build 1803 release with its incorporated “Timeline” feature, the potential for identifying and tracking user activity has increased. This work provides a timely examination of the Windows 10 Timeline feature demonstrating the ability to recover activity‐based content from within its stored database log files. Examination results and underpinning experimental methodologies are offered, demonstrating the ability to recover activity tile and process information in conjunction with the Windows Timeline. Further, an SQL query has been provided to support the interpretation of data stored within the ActivitiesCache.db .     

Differentiating synthetic and optical zooming for passive video forgery detection: An anti-forensic perspective

A video can be manipulated using synthetic zooming without using the state-of-the-art video forgeries. Synthetic zooming is performed by upscaling individual frames of a video with varying scale factors followed by cropping them to the original frame size. These manipulated frames resemble genuine natural (optical) camera zoomed frames and hence may be misclassified as a pristine video by video forgery detection algorithms. Even if such a video is classified as forged, forensic investigators may ignore the results, believing it as part of an optical camera zooming activity. Hence, this can be used as an anti-forensic method which eliminates digital evidence. In this paper, we propose a method for differentiating optical camera zooming from synthetic zooming for video tampering detection. The features used for this method are pixel variance correlation and sensor pattern noise. Experimental results on a dataset containing 3200 videos show the effectiveness of the proposed method.     

隐私关注对移动个性化服务采纳的影响——基于用户主观认知视角的实证研究

文章研究隐私关注与MPS采纳行为意愿之间的影响关系,创新性提出从用户主观认知视角的MPS采纳理论模型。通过调研收集421份问卷,并采用结构方程模型进行隐私关注程度测量与用户隐私认知之间关系分析,验证各影响因素与隐私关注,以及隐私关注与采纳MPS意愿之间的理论假设。结果表明,用户隐私倾向、内控点、社交群体对隐私关注信息收集、错误使用、不正当访问、二次使用都有显著的正向影响;用户开放性、随和性和外向性对隐私关注上述四个维度都有显著的负向影响;同时,提出的影响因素通过隐私关注四个维度均负向影响用户采纳MPS的意愿。文章能为企业革新隐私关注下的网络营销方式,以及促进用户采纳MPS意愿向实际行为转换提供理论支持。     

Authentication of Surveillance Videos: Detecting Frame Duplication Based on Residual Frame

Nowadays, surveillance systems are used to control crimes. Therefore, the authenticity of digital video increases the accuracy of deciding to admit the digital video as legal evidence or not. Inter‐frame duplication forgery is the most common type of video forgery methods. However, many existing methods have been proposed for detecting this type of forgery and these methods require high computational time and impractical. In this study, we propose an efficient inter‐frame duplication detection algorithm based on standard deviation of residual frames. Standard deviation of residual frame is applied to select some frames and ignore others, which represent a static scene. Then, the entropy of discrete cosine transform coefficients is calculated for each selected residual frame to represent its discriminating feature. Duplicated frames are then detected exactly using subsequence feature analysis. The experimental results demonstrated that the proposed method is effective to identify inter‐frame duplication forgery with localization and acceptable running time.     

Developing and Testing a Soil Property Database for Forensic Applications in Southern California

The research sought to develop and test a forensic database of surface soil variability within previously mapped geologic and soil units in southern California. This type of database could be used to link suspects to crime scenes or determine source locations of soil sample evidence. Variability was evaluated using (i) color, (ii) magnetic susceptibility, and (iii) particle‐size distribution. Soil properties were analyzed for their ability to discriminate source areas using stepwise discriminant analysis. The percent correct predictions for geologic unit groups ranged from 30% to 100%. A blind study experiment matched four of the 18 samples to their unit of origin with the first choice by stepwise discriminant analysis, and eight were matched as second and third choices. The probability of selecting the appropriate unit of origin increased by 54% over random chance and eliminated as much as 99% of the field area as a potential search location.