Observer determination of the make,model, and year of questioned vehicles

Often, criminal acts involving a vehicle are caught on digital video surveillance systems. While potentially useful for an investigation, the recording conditions are typically less than optimal for the extraction of key information for the identification of the perpetrator, such as a license plate. Providing the make, model and year of a questioned vehicle is a common request for examiners, to narrow the field of potential suspect vehicles. This study seeks to compare the performance of a nonpeer-reviewed make, model, and year determination between two separate groups, specifically, trained forensic image examiners and nontrained individuals. Results show that even with varied image capture conditions and quality, the trained forensic image examiners more correctly and completely identified the test group of questioned vehicles make, model, and year.     

基层派出所视频侦查体系构建实证研究

视频侦查已成为公安机关重要的刑侦基础性工作。目前省、市、县、所四级公安视频侦查体系基本建成,而作为基层一线的“所级”视频侦查体系,实践中没有受到足够的重视。应强化派出所层级的视频侦查体系建设,同时,合理协调全社会视频监控系统建设的系统推进,以提升视频侦查工作实战效能。     

微生物物证检验

面对21世纪生物犯罪或生物恐怖活动的新挑战,物证鉴定的新专业--微生物物证检验将成为执法部门侦查和起诉生物犯罪必不可少的手段。微生物物证检验以用作犯罪武器的各种微生物为检验对象,获得微生物种类和能够提供来源信息的菌毒株细致分型结果,达到提供犯罪侦查线索和法庭证据的目的。本文综述了微生物物证检验的定义、特征、技术应用以及美国近年来在微生物物证检验的实践和值得借鉴的成功经验。并建议我国物证鉴定实验室应积极开展研究,建立能够满足生物犯罪侦查需求的微生物物证检验能力。     

澳大利亚《信息技术证据管理指引》述评

在实行诉讼对抗制的国家，人们可以通过以下三种方法使信息技术证据成为保护企业利益的一种工具：(1)起诉，包括刑事诉讼；(2)法庭辩护；(3)为规则制定者和企业作出重要决策提供依据。然而，对于什么样的信息技术证据具有可采信性，人们仍有质疑。计算机法学正是研究如何确定、保存、分析及如何提交数字证据的一门新兴的学科。尽管传统上计算机法学被认为是一门滞后的学科，但是澳大利亚《信息技术证据管理指引》还是前瞻性地规定了能使电子证据效力最大化的系统生存周期的一些重要原则。     

中心城区街面图像实时监控系统建设的思考

中心城区街面图像实时监控系统是城市治安防控体系的一部分,是把握社会治安主动权的重要举措。它的建设要按需设计,充分挖掘各方资源,搞好系统的整体规划,处理好系统建设中的各种关系。     

Digital forensics as a service: Game on

The big data era has a high impact on forensic data analysis. Work is done in speeding up the processing of large amounts of data and enriching this processing with new techniques. Doing forensics calls for specific design considerations, since the processed data is incredibly sensitive. In this paper we explore the impact of forensic drivers and major design principles like security, privacy and transparency on the design and implementation of a centralized digital forensics service.     

NTFS格式存储设备数据恢复方法研究

目的研究NTFS存储设备的3种数据恢复方式,测试、比较不同方式的恢复效果,促进电子物证检验工作。方法本文针对同一NTFS存储设备,分别使自行设计的NTFS日志检验软件测试基于NTFS日志文件的恢复方式,使用Final Data的快速扫描功能测试基于MFT记录的恢复方式,使用Final Data的完整扫描功能测试基于文件头部存储特征值的恢复方式,比较3种方式的恢复效果,分析各自的恢复原理。结果基于NTFS日志和MFT记录的方式恢复出的信息较全,用时较短,但不适合恢复较长时间之前删除的文件。基于文件头部存储特征值的方式可恢复较长时间前删除的文件,但用时长,不能恢复文件名、创建时间等信息,也不能有效恢复离散存储的文件。结论结合实际情况、综合运用3种方式可有效恢复数据。     

Estimating Individual Contributions to Complex DNA SNP Mixtures.,

High‐throughput sequencing (HTS) of large panels of single nucleotide polymorphisms (SNPs) provides an alternative or complimentary approach to short tandem repeats (STRs) panels for the analysis of complex DNA mixture forensic samples. For STRs, methods to estimate individual contribution concentrations compare capillary electrophoresis peak heights, peak areas, or HTS allele read counts within a mixture. This article introduces three approaches (mean, median, and slope methods) for estimating individual DNA contributions to forensic mixtures for HTS/massively parallel sequencing (MPS) SNP panels. For SNPs, the major:minor allele ratios or counts, unique to each contributor, were compared to estimate contributor proportion within the mixture using the mean, median, and slope intercept for these alleles. The estimates for these three methods were typically within 5% of planned experimental contributions for defined mixtures.     

Reassembling Linux-based Hybrid RAID

Network-attached storage (NAS) is a system that uses a redundant array of disks (RAID) to create virtual disks comprising multiple disks and provide network services such as FTP, SSH, and WebDAV. Using these services, the NAS's virtual disks store data about individuals or groups, making them a critical analysis target for digital forensics. Well-known storage manufacturers like Seagate, Synology, and NETGEAR use Linux-based software RAID, and they usually support Berkeley RAID (e.g., RAID 0, 1, 5, 6, and 10) as well as self-developed hybrid RAID. Those manufacturers have published data on the introduction and features of hybrid RAID, but there is not enough information to reassemble RAID from a digital forensic perspective. Besides, digital forensic tools (such as EnCase, FTK, X-ways, and RAID Reconstructor) do not support automatic RAID reassembly for hybrid RAID, so research on hybrid RAID reassembly methods is necessary. This paper analyzes the disk array composed of hybrid RAID and explains the layout of disk array, partition layout in hybrid RAID, and hybrid RAID configuration strategy. Furthermore, it suggests parameters that are required for RAID reassembly and then propose a hybrid RAID reassembly procedure using them. Finally, we propose a proof-of-concept tool (Hybrid RAID Reconstructor) that identifies hybrid RAID from disk array and parse RAID parameters.     

论跨境电子证据司法协助简易程序的构建

跨国网络犯罪的增加使得跨境电子取证的实际需求日益旺盛,我国在2018年颁布了《国际刑事司法协助法》,目的之一是加强国际合作打击跨国犯罪,为我国履行国际条约义务提供法律依据。但在司法实践中,我国的跨境电子取证面临着理论困境和实践困境。网络主权、司法管辖权理论使得单边取证存在着非法性可能。传统跨境电子取证因数据本地化存储和"倒U型"取证结构而效率不高。现有的国际司法协助程序繁杂、时间冗长,无法满足打击跨境犯罪和电子证据取证的现实需求。因此跨境电子取证的简易程序构建具有必要性和紧迫性,对现有司法协助程序进行适当简化,遵循合法性原则和效率性原则,构建境内外双方执法者直接合作方式合法化、派员调查取证方式、建立个案电子取证协助机制三种途径。