Social and Behavioral Sciences Commons^™

Sensitivity And Species Specificity Of Bisulfite Modification And Pyrosequencing Technology Used To Identify Tissue-Specific Dna Methylation Patterns In Common Biofluids Foudn In Crime Scenes, Sitara Christian Shirwani

Master's Theses

In order to convict the guilty or exonerate the innocent in criminal cases, it is crucial to reconstruct the crime scene and/or determine the nature of the crime. Identifying the different biofluids found at a crime scene can help shed light on these aspects of forensic casework. Recently, DNA methylation has been used as a means of identifying biological materials, as opposed to conventional protein/enzyme based methods. DNA methylation is the addition of a methyl group to the 5' carbon on a cytosine base (C), which is directly followed by a guanine base (G) and are called CpG sites. The …

Money Laundering Detection Framework To Link The Disparate And Evolving Schemes, Murad Mehmet, Duminda Wijesekera, Miguel F. Buchholtz

Journal of Digital Forensics, Security and Law

Money launderers hide traces of their transactions with the involvement of entities that participate in sophisticated schemes. Money laundering detection requires unraveling concealed connections among multiple but seemingly unrelated human money laundering networks, ties among actors of those schemes, and amounts of funds transferred among those entities. The link among small networks, either financial or social, is the primary factor that facilitates money laundering. Hence, the analysis of relations among money laundering networks is required to present the full structure of complex schemes. We propose a framework that uses sequence matching, case-based analysis, social network analysis, and complex event processing …

Ground Penetrating Radar Use In Three Contrasting Soil Textures In Southern Ontario, Amanda C. Lowe, David V. Beresford, David O. Carter, Franco Gaspari, R. Christopher O'Brien, Shari L. Forbes

Forensic Science Publications

Ground penetrating radar (GPR) is a non-invasive, geophysical tool that can be used for the identification of clandestine graves. GPR operates by detecting density differences in soil by the transmission of high frequency electromagnetic waves from an antenna. Domestic pig (Sus scrofa domesticus) carcasses were clothed in 100% cotton t-shirts and 50% cotton/50% polyester briefs, and buried at a consistent depth at three field sites of contrasting soil texture (silty clay loam, fine sand and fine sandy loam) in southern Ontario. GPR was used to detect and monitor the graves for a period of 14 months post-burial. Analysis of collected …

A Forensic Study Of The Effectiveness Of Selected Anti-Virus Products Against Ssdt Hooking Rootkits, Sami Al-Shaheri, Dale Lindskog, Pavol Zavarsky, Ron Ruhl

Annual ADFSL Conference on Digital Forensics, Security and Law

For Microsoft Windows Operating Systems, both anti-virus products and kernel rootkits often hook the System Service Dispatch Table (SSDT). This research paper investigates the interaction between these two in terms of the SSDT. To investigate these matters, we extracted digital evidence from volatile memory, and studied that evidence using the Volatility framework. Due to the diversity in detection techniques used by the anti-virus products, and the diversity of infection techniques used by rootkits, our investigation produced diverse results, results that helped us to understand several SSDT hooking strategies, and the interaction between the selected anti-virus products and the rootkit samples. …

An Ontology-Based Forensic Analysis Tool, Mohammed Alzaabi, Andy Jones, Thomas A. Martin

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in …

First Glance: An Introductory Analysis Of Network Forensics Of Tor, Raymond Hansen

Annual ADFSL Conference on Digital Forensics, Security and Law

The Tor network is a low-latency overlay network for TCP flows that is designed to provide privacy and anonymity to its users. It is currently in use by many as a means to avoid censorship of both information to be shared and information to be retrieved. This paper details the architecture of the Tor network as a platform for evaluating the current state of forensic analysis of the Tor network. Specific attempts to block access to the Tor network are examined to identify (a) the processes utilized to identify Tor nodes, and (b) the resulting exposure of potentially inculpatory evidence. …

A Thematic Review Of User Compliance With Information Security Policies Literature, David Sikolia

Annual ADFSL Conference on Digital Forensics, Security and Law

The adoption of computer and internet technology has greatly improved the way businesses operate. However the risk to the confidentiality, integrity and availability of organizational data and systems has greatly increased too. Information security is an ever present concern for all organizations. Financial estimates of the impact of security breaches to information and technology resources range from hundreds of billions to over one trillion dollars each year worldwide (D'Arcy et al., 2011b). Organizations have therefore developed a combination of technical, administrative, and physical controls to reduce this risk (D'Arcy et al., 2011a). Administrative measures include the development of information security …

Journey Into Windows 8 Recovery Artifacts, W. K. Johnson

Annual ADFSL Conference on Digital Forensics, Security and Law

One of the most difficult processes of digital forensics is to understand how new technology interacts with current technology and how digital forensic analysts can utilize current Digital Forensics technologies and processes to recover and find information hidden. Microsoft has released their new operating system Windows 8, with this new release Microsoft has added some features to the operating system that will present some interesting complications to digital forensics. Since the initial release of the Windows 8 Release Candidates there have been some research released that focus primarily on the new user created artifacts and a few artifacts that have …

An Image Forensic Scheme With Robust And Fragile Watermarking For Business Documents, Sai Ho Kwok

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper proposes an image forensic scheme with both robust and fragile watermarking techniques for business documents. Through a dual watermarking approach, the proposed scheme can achieve image forensics objectives of (a) identification of source; (b) authentication of documents; and (c) locating the tempered areas of documents due to attacks. An example is presented to prove the concepts of the proposed scheme.

Keywords: Image Forensics, Fragile and Robust Watermarking, Business Document.

Significance Of Semantic Reconciliation In Digital Forensics, Nickson M. Karie, H. S. Venter

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics (DF) is a growing field that is gaining popularity among many computer professionals, law enforcement agencies and other stakeholders who must always cooperate in this profession. Unfortunately, this has created an environment replete with semantic disparities within the domain that needs to be resolved and/or eliminated. For the purpose of this study, semantic disparity refers to disagreements about the meaning, interpretation, descriptions and the intended use of the same or related data and terminologies. If semantic disparity is not detected and resolved, it may lead to misunderstandings. Even worse, since the people involved may not be from the …

System-Generated Digital Forensic Evidence In Graphic Design Applications, Enos Mabuto, Hein Venter

Annual ADFSL Conference on Digital Forensics, Security and Law

Graphic design applications are often used for the editing and design of digital art. The same applications can be used for creating counterfeit documents such as identity documents (IDs), driver’s licences, passports, etc. However, the use of any graphic design application leaves behind traces of digital information that can be used during a digital forensic investigation. Current digital forensic tools examine a system to find digital evidence, but they do not examine a system specifically for the creating of counterfeit documents created through the use of graphic design applications. The paper in hand reviews the system-generated digital forensic evidence gathered …

Money Laundering Detection Framework To Link The Disparate And Evolving Schemes, Murad Mehmet, Duminda Wijesekera, Miguel F. Buchholtz

Annual ADFSL Conference on Digital Forensics, Security and Law

Money launderers hide traces of their transactions with the involvement of entities that participate in sophisticated schemes. Money laundering detection requires unraveling concealed connections among multiple but seemingly unrelated human money laundering networks, ties among actors of those schemes, and amounts of funds transferred among those entities. The link among small networks, either financial or social, is the primary factor that facilitates money laundering. Hence, the analysis of relations among money laundering networks is required to present the full structure of complex schemes. We propose a framework that uses sequence matching, case-based analysis, social network analysis, and complex event processing …

Identifying Peer-To-Peer Traffic On Shared Wireless Networks, Simon Piel, Ej Jung

Annual ADFSL Conference on Digital Forensics, Security and Law

Tracing contraband downloads leads investigators to an IP address, and in turn Internet Service Providers (ISP) can provide a physical location using this IP address. However, most homes and offices share this IP address among many computers using wireless networks. In other words, there needs to be another investigation to find out which computer was responsible for contraband downloads. To make matters worse, these shared wireless networks often have vulnerabilities in access control such as using WEP or using weak passwords. In such cases, any computer in range, not necessarily at the given physical address, could be responsible. We use …

On Resolving The Cloud Forensics Conundrum, John Bagby

Annual ADFSL Conference on Digital Forensics, Security and Law

The “cloud” is idiom for an ill-defined set of online services. The cloud simultaneously offers IT savings and promises advances in functionality (e.g., ubiquity). However, the cloud also imposes poorly understood burdens on security and it may provoke injustice. Thus, the cloud presents a durable and seemingly irreconcilable conundrum for the digital forensics communit(ies). First, cloud proponents make efficiency promises for cloud services (SaaS, IaaS, PaaS). These translate well into the digital forensics domain. Indeed, the cloud may enable crowd sourcing of investigatory data vastly lowering costs of dispute resolution. For example, cloud-based litigation war rooms may reduce electronic discovery …

Cybercrime And Punishment: An Analysis Of The Deontological And Utilitarian Functions Of Punishment In The Information Age, Karim Jetha

Annual ADFSL Conference on Digital Forensics, Security and Law

This conceptual piece analyzes the role of criminal punishment and the nature of cyber crime to investigate whether the current punishment schemes are appropriate given the deontological and utilitarian goals of punishment: retribution, deterrence, incapacitation, and rehabilitation. The research has implications for policymaking in cybercriminal law.

Keywords: cybercrime, criminal law, punishment, retribution, deterrence, information economics

The Development Of Computer Forensic Legal System In China, Yonghao Mai, K. P. Chow, Rongsheng Xu, Gang Zhou, Fei Xu, Jun Zhang

Annual ADFSL Conference on Digital Forensics, Security and Law

The computer forensic discipline was established around 2000 in China, which was further developed along with Chinese judicial appraisal system in 2005. The new criminal and civil procedure laws of the People’s Republic of China was enacted on 1 Jan 2013. The new laws specified electronic data is legal evidence and has great impact on the current practice on handling electronic evidence. This paper introduces the electronic data and electronic evidence examination procedure in mainland China, the general concept of computer forensic legal system, the management of computer judicial experts, the management of computer judicial expertise institutions.

Keywords: China legal …

Comparing Wearer Dna Sample Collection Methods For The Recovery Of Single Source Profiles, Corissa J. Harris, Amanda J. Cardenas, Steven B. Lee, Brooke Barloewen

Themis: Research Journal of Justice Studies and Forensic Science

Wearer DNA is the deposit of epithelial cells on clothing worn by an individual. Detection of the last individual to handle or wear an item is often an important and desirable determination in forensic science. The most commonly used collection methods for wearer DNA include swabbing and scraping. These often result in mixture profiles. Recently, adhesives have been introduced as a possible reliable method for the collection of biological evidence. The goal of the research was to compare the current collection methods of swabbing and scraping with a gel film called Gel-Pak ‘0’ which shares similar properties with adhesives. Gel-Pak …

Comparison Of Liquid-Liquid Extraction And Solid Phase Extraction Of Mephedrone, Brittany Simone Love

Master's Theses

Legal high drugs are modified scheduled drugs. As with any new drug, researchers have to conduct studies to gather information about the drug. The problem with obtaining accurate information on new drugs is that by the time information is gathered, drug abusers and street chemists have developed new ones. Comparing designer drugs to their illegal counterparts is often helpful in that it can provide a starting point. Mephedrone is a new designer drug that has become a problem over the past few years. Often marketed as bath salts and plant food, mephedrone has become the knockoff replacement for amphetamines. This …

Comparison Of Stated Iron Concentrations Between Name Brand And Generic Children's Multivitamins, Ashlea Nicole Pettengill

Master's Theses

The mineral iron is one of the most common minerals on Earth; not only is iron found in the atmosphere, water, and plants, it is an essential mineral needed for the human body. Children need iron at a young age to ensure proper growth and development of myelin, to promote oxygen transportation within red blood cells, and to assist in Deoxyribonucleic acid (DNA) and Ribonucleic acid (RNA). With iron readily available in children's multivitamins, iron toxicity can become an issue when taking too many tablets. With two types of brands, generic and name brand, parents should be aware of the …

Confirmation Bias: The Pitfall Of Forensic Science, Scott Moser

Themis: Research Journal of Justice Studies and Forensic Science

As it stands, forensic science and its practitioners are held in high regard in criminal court proceedings due to their ability to discover irrefutable facts that would otherwise go unnoticed. Nevertheless, forensic scientists can fall victim to natural logical fallacies. More specifically, confirmation bias is “a proclivity to search for or interpret additional information to confirm beliefs and to steer clear of information that may disagree with those prior beliefs” (Budlowe et al., 2009, p. 803). To restore the integrity of the forensic sciences, the sources of confirmation bias need to be identified and eliminated. Accordingly, empirical studies have given …

Electronic Communication And Privacy Rights: Rape Shield Laws, Sexual Assault Survivors’ Rights, And Defense Subpoenas In A Digital World, Kelly J. Thompson

Kelly J. Thompson

As electronic communications and online information access become indispensable components of our day-to-day lives, they also begin to trigger changes in policy and produce unintended consequences from existing policies. Privacy of personal information has always been an issue in legal cases dealing with sexual assault, but in the information age, so much more information exists in a digital format, and without proper protections, provides a tempting trove of information ripe for unjust “fishing expeditions.” Privacy protections for survivors of sexual violence are as important as ever in this new technological landscape. Consumer education and awareness of privacy issues should also …

Isolation Of Secreted Micrornas (Mirnas) From Cell-Conditioned Media, Claire L. Glynn, Sonja Khan, Michael J. Kerin, Roisin M. Dwyer

Forensic Science Publications

MicroRNAs (miRNAs) have been found to be stable in the circulation of cancer patients raising their potential as circulating biomarkers of disease. The specific source and role, however, of miRNAs in the circulation is unknown and requires elucidation to determine their true potential. In this study, along with primary tissue explants and primary stromal cells, three breast cancer cell lines were employed, including T47D, MDA-MB-231 and SK-BR-3. Tissue explants were harvested in theatre, with informed patient consent, and included tumour, tumour associated normal, and diseased lymph node samples. Cell-conditioned media containing all factors secreted by the cells were harvested. MiRNAs …

Effect Of Fluctuating Temperatures On The Development Of A Forensically Important Blow Fly, Protophormia Terraenovae (Diptera: Calliphoridae), Jodie-A. Warren, Gail S. Anderson

Faculty Research, Scholarly, and Creative Activity

Experiments were conducted to compare the immature development of Protophormia terraenovae (Robineau-Desvoidy) at fluctuating temperatures of 4-28 and 9-23°C to their mean constant temperature, 16°C. Overall development was fastest at the greater fluctuation and slowest at the constant temperature but showed similar percentages of development time in each stage. The rate summation effect is suspected to have caused this difference in development rate because fluctuations above the mean increase the rate relatively more than temperatures below the mean can lower the rate.

Development Of Micro Volume Dna And Rna Profiling Assays To Identify The Donor And Tissue Source Of Origin Of Trace Forensic Biological Evidence, Brittany Morgan

Electronic Theses and Dissertations

In forensic casework analysis it is necessary to obtain genetic profiles from increasingly smaller amounts of biological material left behind by perpetrators of crime. The ability to obtain profiles from trace biological evidence is demonstrated with so-called ‘touch DNA evidence’ which is perceived to be the result of DNA obtained from shed skin cells transferred from donor to an object or person during physical contact. However, the current method of recovery of trace DNA involves cotton swabs or adhesive tape to sample an area of interest. This "blindswabbing" approach may result in the recovery of biological material from different individuals …

The Hermeneutics Of The Hard Drive: Using Narratology, Natural Language Processing, And Knowledge Management To Improve The Effectiveness Of The Digital Forensic Process, Mark Pollitt

Electronic Theses and Dissertations

In order to protect the safety of our citizens and to ensure a civil society, we ask our law enforcement, judiciary and intelligence agencies, under the rule of law, to seek probative information which can be acted upon for the common good. This information may be used in court to prosecute criminals or it can be used to conduct offensive or defensive operations to protect our national security. As the citizens of the world store more and more information in digital form, and as they live an ever-greater portion of their lives online, law enforcement, the judiciary and the Intelligence …

Automating Vendor Fraud Detection In Enterprise Systems, Kishore Singh, Peter Best, Joseph Mula

Journal of Digital Forensics, Security and Law

Fraud is a multi-billion dollar industry that continues to grow annually. Many organizations are poorly prepared to prevent and detect fraud. Fraud detection strategies are intended to quickly and efficiently identify fraudulent activities that circumvent preventative measures. In this paper, we adopt a DesignScience methodological framework to develop a model for detection of vendor fraud based on analysis of patterns or signatures identified in enterprise system audit trails. The concept is demonstrated by developing prototype software. Verification of the prototype is achieved by performing a series of experiments. Validation is achieved by independent reviews from auditing practitioners. Key findings of …

Technology Corner Visualising Forensic Data: Evidence (Part 1), Damian Schofield, Ken Fowle

Journal of Digital Forensics, Security and Law

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example: network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an …

A Simple Experiment With Microsoft Office 2010 And Windows 7 Utilizing Digital Forensic Methodology, Gregory H. Carlton

Journal of Digital Forensics, Security and Law

Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital forensic examiners are expected to describe whether data have been altered, and if so, then to what extent have data been altered. Addressing these expectations results from opinions digital forensic examiners reach concerning their understanding of electronic storage and retrieval methods. The credibility of these opinions evolves from the scientific basis from which they are drawn using …

Information Security Challenge Of Qr Codes, Nik Thompson, Kevin Lee

Journal of Digital Forensics, Security and Law

The discipline of information security must adapt to new technologies and methods of interaction with those technologies. New technologies present both challenges and opportunities for the security professional, especially for areas such as digital forensics. Challenges can be in the form of new devices such as smartphones or new methods of sharing information, such as social networks. One such rapidly emerging interaction technology is the use of Quick Response (QR) codes. These offer a physical mechanism for quick access to Web sites for advertising and social interaction. This paper argues that the common implementation of QR codes potentially presents security …

Book Review: Placing The Suspect Behind The Keyboard: Using Digital Forensics And Investigative Techniques To Identify Cybercrime Suspects, Thomas Nash

Journal of Digital Forensics, Security and Law

In this must read for any aspiring novice cybercrime investigator as well as the seasoned professional computer guru alike, Brett Shaver takes the reader into the ever changing and dynamic world of Cybercrime investigation. Shaver, an experienced criminal investigator, lays out the details and intricacies of a computer related crime investigation in a clear and concise manner in his new easy to read publication, Placing the Suspect behind the Keyboard. Using Digital Forensics and Investigative techniques to Identify Cybercrime Suspects. Shaver takes the reader from start to finish through each step of the investigative process in well organized …