Forensic Science and Technology Commons^™

Non-Use Of A Mobile Phone During Conducting Crime Can Also Be Evidential, Vinod Polpaya Bhattathiripad Ph D

Annual ADFSL Conference on Digital Forensics, Security and Law

Cyber-clever criminals who are aware of the consequence of using mobile phones during conducting crimes often stay away from their phones while involved in crimes. Some of them even change their handset and SIM card, subsequently. This article looks into how, intentional disassociation (and even unintentional non-use) of mobile phone in (non-cyber) crimes, can become evidential clues of the perpetrators’ involvement in criminal acts. With the help of a recent judicial episode, this article reveals how extremely careful and masterful handling of extensive and voluminous Call Details Records and tower dumps by a cyber-savvy investigating official can unearth evidential clues …

Forensic Analysis Of The Exfat Artifacts, Yves Vandermeer, An Lekhac, Tahar Kechadi, Joe Carthy

Annual ADFSL Conference on Digital Forensics, Security and Law

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is …

Live Gpu Forensics: The Process Of Recovering Video Frames From Nvidia Gpu, Yazeed M. Albabtain, Baijian Yang

Annual ADFSL Conference on Digital Forensics, Security and Law

The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The …

Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3 Drone As A Case Study, Alan Roder, Kim-Kwang Raymond Choo, Nhien-A Le-Khac

Annual ADFSL Conference on Digital Forensics, Security and Law

Drones (also known as Unmanned Aerial Vehicles – UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be …

Detection And Recovery Of Anti-Forensic (Vault) Applications On Android Devices, Michaila Duncan, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Significant number of mobile device users currently employ anti-forensics applications, also known as vault or locker applications, on their mobile devices in order to hide files such as photos. Because of this, investigators are required to spend a large portion of their time manually looking at the applications installed on the device. Currently, there is no automated method of detecting these anti-forensics applications on an Android device. This work presents the creation and testing of a vault application detection system to be used on Android devices. The main goal of this work is twofold: (i) Detecting and reporting the presence …

Smoke But No Fire: When Innocent People Are Wrongly Convicted Of Crimes That Never Happened, Jessica S. Henry

Department of Justice Studies Faculty Scholarship and Creative Works

Nearly one-third of exonerations involve the wrongful conviction of an innocent person for a crime that never actually happened, such as when the police plant drugs on an innocent person, a scorned lover invents a false accusation, or an expert mislabels a suicide as a murder. Despite the frequency with which no-crime convictions take place, little scholarship has been devoted to the subject. This Article seeks to fill that gap in the literature by exploring no-crime wrongful convictions as a discrete and unique phenomenon within the wrongful convictions universe. This Article considers three main factors that contribute to no-crime wrongful …

Understanding The Sexual Assault Kit Backlog In Pennsylvania, Kallie Crawford, Lyndsie Ferrara

Graduate Student Research Symposium

According to the FBI, to date, there are more than 400,000 untested sexual assault kits nationwide. While this is a huge issue that cannot be solved overnight, continual improvements and changes are needed to reduce and hopefully eliminate the backlog.

This research examines work going on nationwide and aims to better understand the backlog issues specifically in Pennsylvania. Furthermore, the research examines a program utilized by the law enforcement community that garnered necessary resources. First, a comprehensive review of improved practices in proactive jurisdictions of Ohio, Houston, Texas, and Detroit, Michigan was conducted to identify general policies and procedures that …

Back Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Front Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Contents, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Introduction: Symposium On “Forensics, Statistics, And Law”, Brandon L. Garrett

Faculty Scholarship

No abstract provided.

Digital Forensic Readiness In Organizations: Issues And Challenges, Nickson Menza Karie, Simon Maina Karume Dr.

Journal of Digital Forensics, Security and Law

With the evolution in digital technologies, organizations have been forced to change the way they plan, develop, and enact their information technology strategies. This is because modern digital technologies do not only present new opportunities to business organizations but also a different set of issues and challenges that need to be resolved. With the rising threats of cybercrimes, for example, which have been accelerated by the emergence of new digital technologies, many organizations as well as law enforcement agencies globally are now erecting proactive measures as a way to increase their ability to respond to security incidents as well as …

Legislative Requirements For Cyber Peacekeeping, Nikolay Akatyev, Joshua I. James

Journal of Digital Forensics, Security and Law

Cyber Peacekeeping strives for the prevention, mitigation and cessation of cyber and physical conflicts. The creation of a Cyber Peacekeeping organization, however, has major legal and political implications. In this work we review current international legislation applicable for functions of Cyber Peacekeeping. Specifically, we analyze prominent works which contribute to definitions, law and ethics regulating cyber conflicts from the perspective of the creation of a CPK organization. Legislative and terminological foundations are analyzed and adopted from current practice. Further, this work analyzes guiding principles of global organizations such as ITU IMPACT, INTERPOL and regional organizations such as NATO and the …

Exploring Digital Evidence With Graph Theory, Imani Palmer, Boris Gelfand, Roy Campbell

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis phase of the digital forensic process is the most complex. The analysis phase remains very subjective to the views of the forensic practitioner. There are many tools dedicated to assisting the investigator during the analysis process. However, they do not address the challenges. Digital forensics is in need of a consistent approach to procure the most judicious conclusions from the digital evidence. The objective of this paper is to discuss the ability of graph theory, a study of related mathematical structures, to aid in the analysis phase of the digital forensic process. We develop a graph-based representation of …

Case Study: A New Method For Investigating Crimes Against Children, Hallstein Asheim Hansen, Stig Andersen, Stefan Axelsson, Svein Hopland

Annual ADFSL Conference on Digital Forensics, Security and Law

Investigations of crimes against children are often complex, both in terms of the varied and large amount of digital technology encountered and the offensive nature of the crimes. Such cases are numerous, large, and prioritised, requiring digital forensics competence. Earlier digital forensics was considered and treated as a typical forensic science like fingerprint analysis, performed in a laboratory isolated from the investigative team. This decoupled way of working has proved to be both inefficient and error prone.

At the Digital Forensic Unit of Oslo Police District we have developed a new way of working that addresses many of the problems …

Downstream Competence Challenges And Legal/Ethical Risks In Digital Forensics, Michael M. Losavio, Antonio Losavio

Annual ADFSL Conference on Digital Forensics, Security and Law

Forensic practice is an inherently human-mediated system, from processing and collection of evidence to presentation and judgment. This requires attention to human factors and risks which can lead to incorrect judgments and unjust punishments.

For digital forensics, such challenges are magnified by the relative newness of the discipline and the use of electronic evidence in forensic proceedings. Traditional legal protections, rules of procedure and ethics rules mitigate these challenges. Application of those traditions better ensures forensic findings are reliable. This has significant consequences where findings may impact a person's liberty or property, a person's life or even the political direction …

Understanding Deleted File Decay On Removable Media Using Differential Analysis, James H. Jones Jr, Anurag Srivastava, Josh Mosier, Connor Anderson, Seth Buenafe

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital content created by picture recording devices is often stored internally on the source device, on either embedded or removable media. Such storage media is typically limited in capacity and meant primarily for interim storage of the most recent image files, and these devices are frequently configured to delete older files as necessary to make room for new files. When investigations involve such devices and media, it is sometimes these older deleted files that would be of interest. It is an established fact that deleted file content may persist in part or in its entirety after deletion, and identifying the …

Development Of A Professional Code Of Ethics In Digital Forensics, Kathryn C. Seigfried-Spellar, Marcus Rogers, Danielle M. Crimmins 2184089

Annual ADFSL Conference on Digital Forensics, Security and Law

Academics, government officials, and practitioners suggest the field of digital forensics is in need of a professional code of ethics. In response to this need, the authors developed and proposed a professional code of ethics in digital forensics. The current paper will discuss the process of developing the professional code of ethics, which included four sets of revisions based on feedback and suggestions provided by members of the digital forensic community. The final version of the Professional Code of Ethics in Digital Forensics includes eight statements, and we hope this is a step toward unifying the field of digital forensics …

Harnessing Predictive Models For Assisting Network Forensic Investigations Of Dns Tunnels, Irvin Homem, Panagiotis Papapetrou

Annual ADFSL Conference on Digital Forensics, Security and Law

In recent times, DNS tunneling techniques have been used for malicious purposes, however network security mechanisms struggle to detect them. Network forensic analysis has been proven effective, but is slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper, we present a machine learning approach, based on feature subsets of network traffic evidence, to aid forensic analysis through automating the inference of protocols carried within DNS tunneling techniques. We explore four network protocols, namely, HTTP, HTTPS, FTP, and POP3. Three features are extracted from the DNS tunneled traffic: …

Minimum Education Requirements For Crime Scene Investigators, Araseli Saldivar

Themis: Research Journal of Justice Studies and Forensic Science

The initial crime scene investigation is critical since it is the primary step in the investigative process; therefore, individuals assigned to process a scene should be highly educated. Improperly educated (or uneducated) crime scene investigators (CSIs) can mishandle evidence during an investigation, affecting the outcome of cases. The minimum education requirement for CSIs should transition from a high school diploma—the current requirement—toward a bachelor’s degree. The importance of acquiring a college-level education is observed in a study conducted on crime scene examiners in Australia. To determine the educational requirement for CSIs in the United States, information was gathered electronically from …

Optimizing Collection Of Trace Biological Samples From Vehicle Headrests, Kevin Tang, Jesse Ramirez, John Bond, Jocelyn Weart, Yvette Delatorre, Ian Fitch, Steven Lee

Themis: Research Journal of Justice Studies and Forensic Science

Tape-lifting and swabbing are two methods commonly used for collecting biological samples in the United Kingdom and United States to investigate vehicle crimes. Determining the optimal collection method may lead to an increase in generating DNA profiles and crime-solving. The objective of this study is to evaluate the efficiency of adhesive tape and the double-swab collection methods for investigating vehicle crimes with possible touch DNA samples. Two experiments were conducted to evaluate the use of tape-lifts and swabs on spiked common vehicle fabric materials. The efficiency of recovery between the two collection methods was performed using qPCR. The results from …

Physical Match: Unique Fracture Patterns In Wooden Popsicle Sticks, Yiu Ming Sunny Lau

Themis: Research Journal of Justice Studies and Forensic Science

Physical match (or physical fit) evidence was considered reliable in court for years, until the Daubert case, which required standardized scientific methodology on all forensic evidence. Physical matching faces the same criticism as other forms of physical evidence (specifically, that it lacks a scientific foundation). Physical matching is based on the idea that when an object is fractured, the shape of each fragment is unique and it is not possible to recreate a fragment that is identical to any other. In this study, fifty wooden popsicle sticks were broken in half, the pieces were mixed, and then reconstructed using physical …

Forensics’ Fight: A Need For Aggressive Strategies Against Confirmation Bias, Madison Mcgowan

Themis: Research Journal of Justice Studies and Forensic Science

In 2009, the National Academy of Sciences produced a lengthy report illuminating significant weaknesses present within the forensic community. One complex fault found in forensics was conformation bias. Since it is within human nature to make decisions based on contextual information, assumptions, and pre-held opinions, confirmation bias is an issue that will continue to persist. Therefore, stronger efforts must be made to recognize and abate the problem of bias within the field of forensics in order to preserve the notion that forensic science exists to serve principles of both truth and justice. Accordingly, this paper argues for the fight against …

Moral Time And Homicide Investigations., David Stuart Lapsey Jr.

Electronic Theses and Dissertations

Previous literature explores the many dimensions of homicide investigations, including case and individual characteristics, evidence and investigative activities. However, little research delves into situational characteristics and their relationship to specific homicides, charge severity sought by prosecutors and sentence length given to homicide offenders. The current study sampled homicide cases (N=68) to gather baseline information and data regarding judicial outcomes. Donald Black’s Theory of Moral Time (2011) is tested and utilized as the study’s conceptual framework for the study’s hypotheses.

Jurisdiction, Privacy, And Ownership: Dna Technology And Field Dynamics In Conflict-Related Mass Fatalities, Stefan Schmitt, Dallas Mazoori

Genocide Studies and Prevention: An International Journal

This article explores the dynamics and challenges of undertaking human identifications in states experiencing armed conflict or emerging therefrom. It emphasises the integral role of the State in human identifications and the need for the legal acts of the State in identifying an individual and confirming their death to be integrated into any humanitarian response to repatriating the dead. Conflict-related mass fatalities occur in uncontrolled circumstances, making DNA-based human identifications necessary. In states lacking the necessary forensic infrastructure, the promise of expedited human identifications through outsourcing DNA work can lead to the State abdicating the necessary jurisdiction and scientific transparency …

Special Issue Of Best Papers From The 11th International Conference On Systematic Approaches To Digital Forensic Engineering (Sadfe 2016)

Journal of Digital Forensics, Security and Law

The SADFE series feature the different editions of the International Conference on Systematic Approaches to Digital Forensics Engineering. Now in its eleventh edition, SADFE has established itself as the premier conference for researchers and practitioners working in Systematic Approaches to Digital Forensics Engineering.

SADFE 2016, the eleventh international conference on Systematic Approaches to Digital Forensic Engineering was held in Kyoto, Japan, September 20 - 22, 2016.

Digital forensics engineering and the curation of digital collections in cultural institutions face pressing and overlapping challenges related to provenance, chain of custody, authenticity, integrity, and identity. The generation, analysis and sustainability of digital …

Compression Of Virtual-Machine Memory In Dynamic Malware Analysis, James E. Fowler Ph.D.

Journal of Digital Forensics, Security and Law

Lossless compression of memory dumps from virtual machines that run malware samples is considered with the goal of significantly reducing archival costs in dynamic-malware-analysis applications. Given that, in such dynamic-analysis scenarios, malware samples are typically run in virtual machines just long enough to activate any self-decryption or other detection- avoidance maneuvers, the virtual-machine memory typically changes little from that of the baseline state, with the difference being attributable in large degree to the loading of additional executables and libraries. Consequently, delta coding is proposed to compress the current virtual-machine memory dump by coding its differences with respect to a predicted …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Find Me If You Can: Mobile Gps Mapping Applications Forensic Analysis & Snavp The Open Source, Modular, Extensible Parser, Jason Moore, Ibrahim Baggili, Frank Breitinger

Journal of Digital Forensics, Security and Law

The use of smartphones as navigation devices has become more prevalent. The ubiquity of hand-held navigation devices such as Garmins or Toms Toms has been falling whereas the ownership of smartphones and their adoption as GPS devices is growing. This work provides a comprehensive study of the most popular smartphone mapping applications, namely Google Maps, Apple Maps, Waze, MapQuest, Bing, and Scout, on both Android and iOS. It details what data was found, where it was found, and how it was acquired for each application. Based on the findings, the work allowed for the construction of a tool capable of …

A Forensic Email Analysis Tool Using Dynamic Visualization, Johannes Stadlinger, Andreas Dewald

Journal of Digital Forensics, Security and Law

Communication between people counts to the most important information of today’s business. As a result, in case of forensic investigations in big companies, analysis of communication data in general and especially email, as the still most widely used business communication platform with an immense and still growing volume, is a typical task in digital forensics. One of the challenges is to identify the relevant communication partners and structures in the suspects surrounding as quickly as possible in order to react appropriately and identify further targets of evaluation. Due to the amount of emails in typical inboxes, reading through all the …