Forensic Science and Technology Commons^™

Understanding Deleted File Decay On Removable Media Using Differential Analysis, James H. Jones Jr, Anurag Srivastava, Josh Mosier, Connor Anderson, Seth Buenafe

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital content created by picture recording devices is often stored internally on the source device, on either embedded or removable media. Such storage media is typically limited in capacity and meant primarily for interim storage of the most recent image files, and these devices are frequently configured to delete older files as necessary to make room for new files. When investigations involve such devices and media, it is sometimes these older deleted files that would be of interest. It is an established fact that deleted file content may persist in part or in its entirety after deletion, and identifying the …

Development Of A Professional Code Of Ethics In Digital Forensics, Kathryn C. Seigfried-Spellar, Marcus Rogers, Danielle M. Crimmins 2184089

Annual ADFSL Conference on Digital Forensics, Security and Law

Academics, government officials, and practitioners suggest the field of digital forensics is in need of a professional code of ethics. In response to this need, the authors developed and proposed a professional code of ethics in digital forensics. The current paper will discuss the process of developing the professional code of ethics, which included four sets of revisions based on feedback and suggestions provided by members of the digital forensic community. The final version of the Professional Code of Ethics in Digital Forensics includes eight statements, and we hope this is a step toward unifying the field of digital forensics …

Fast Filtering Of Known Png Files Using Early File Features, Sean Mckeown, Gordon Russell, Petra Leimich

Annual ADFSL Conference on Digital Forensics, Security and Law

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given media, comparing individual digests with a database of known contraband. However, the large capacities of modern storage media, and increased time pressure on forensics examiners, necessitates that more efficient processing mechanisms be developed. This work describes a technique for creating signatures for images of the PNG format which only requires a tiny fraction of the file to effectively distinguish between a large number of images. Highly …

Detect Kernel-Mode Rootkits Via Real Time Logging & Controlling Memory Access, Satoshi Tanda, Irvin Homem, Igor Korkin

Annual ADFSL Conference on Digital Forensics, Security and Law

Modern malware and spyware platforms attack existing antivirus solutions and even Microsoft PatchGuard. To protect users and business systems new technologies developed by Intel and AMD CPUs may be applied. To deal with the new malware we propose monitoring and controlling access to the memory in real time using Intel VT-x with EPT. We have checked this concept by developing MemoryMonRWX, which is a bare-metal hypervisor. MemoryMonRWX is able to track and trap all types of memory access: read, write, and execute. MemoryMonRWX also has the following competitive advantages: fine-grained analysis, support of multi-core CPUs and 64-bit Windows 10. MemoryMonRWX …

Harnessing Predictive Models For Assisting Network Forensic Investigations Of Dns Tunnels, Irvin Homem, Panagiotis Papapetrou

Annual ADFSL Conference on Digital Forensics, Security and Law

In recent times, DNS tunneling techniques have been used for malicious purposes, however network security mechanisms struggle to detect them. Network forensic analysis has been proven effective, but is slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper, we present a machine learning approach, based on feature subsets of network traffic evidence, to aid forensic analysis through automating the inference of protocols carried within DNS tunneling techniques. We explore four network protocols, namely, HTTP, HTTPS, FTP, and POP3. Three features are extracted from the DNS tunneled traffic: …

An Accidental Discovery Of Iot Botnets And A Method For Investigating Them With A Custom Lua Dissector, Max Gannon, Gary Warner, Arsh Arora

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper presents a case study that occurred while observing peer-to-peer network communications on a botnet monitoring station and shares how tools were developed to discover what ultimately was identified as Mirai and many related IoT DDOS Botnets. The paper explains how researchers developed a customized protocol dissector in Wireshark using the Lua coding language, and how this enabled them to quickly identify new DDOS variants over a five month period of study.

Kelihos Botnet: A Never-Ending Saga, Arsh Arora, Max Gannon, Gary Warner

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper investigates the recent behavior of the Kelihos botnet, a spam-sending botnet that accounts for many millions of emails sent each day. The paper demonstrates how a team of students are able to perform a longitudinal malware study, making significant observations and contributions to the understanding of a major botnet using tools and techniques taught in the classroom. From this perspective the paper has two objectives: encouragement and observation. First, by providing insight into the methodology and tools used by student researchers to document and understand a botnet, the paper strives to embolden other academic programs to follow a …

Minimum Education Requirements For Crime Scene Investigators, Araseli Saldivar

Themis: Research Journal of Justice Studies and Forensic Science

The initial crime scene investigation is critical since it is the primary step in the investigative process; therefore, individuals assigned to process a scene should be highly educated. Improperly educated (or uneducated) crime scene investigators (CSIs) can mishandle evidence during an investigation, affecting the outcome of cases. The minimum education requirement for CSIs should transition from a high school diploma—the current requirement—toward a bachelor’s degree. The importance of acquiring a college-level education is observed in a study conducted on crime scene examiners in Australia. To determine the educational requirement for CSIs in the United States, information was gathered electronically from …

Optimizing Collection Of Trace Biological Samples From Vehicle Headrests, Kevin Tang, Jesse Ramirez, John Bond, Jocelyn Weart, Yvette Delatorre, Ian Fitch, Steven Lee

Themis: Research Journal of Justice Studies and Forensic Science

Tape-lifting and swabbing are two methods commonly used for collecting biological samples in the United Kingdom and United States to investigate vehicle crimes. Determining the optimal collection method may lead to an increase in generating DNA profiles and crime-solving. The objective of this study is to evaluate the efficiency of adhesive tape and the double-swab collection methods for investigating vehicle crimes with possible touch DNA samples. Two experiments were conducted to evaluate the use of tape-lifts and swabs on spiked common vehicle fabric materials. The efficiency of recovery between the two collection methods was performed using qPCR. The results from …

Physical Match: Unique Fracture Patterns In Wooden Popsicle Sticks, Yiu Ming Sunny Lau

Themis: Research Journal of Justice Studies and Forensic Science

Physical match (or physical fit) evidence was considered reliable in court for years, until the Daubert case, which required standardized scientific methodology on all forensic evidence. Physical matching faces the same criticism as other forms of physical evidence (specifically, that it lacks a scientific foundation). Physical matching is based on the idea that when an object is fractured, the shape of each fragment is unique and it is not possible to recreate a fragment that is identical to any other. In this study, fifty wooden popsicle sticks were broken in half, the pieces were mixed, and then reconstructed using physical …

Forensics’ Fight: A Need For Aggressive Strategies Against Confirmation Bias, Madison Mcgowan

Themis: Research Journal of Justice Studies and Forensic Science

In 2009, the National Academy of Sciences produced a lengthy report illuminating significant weaknesses present within the forensic community. One complex fault found in forensics was conformation bias. Since it is within human nature to make decisions based on contextual information, assumptions, and pre-held opinions, confirmation bias is an issue that will continue to persist. Therefore, stronger efforts must be made to recognize and abate the problem of bias within the field of forensics in order to preserve the notion that forensic science exists to serve principles of both truth and justice. Accordingly, this paper argues for the fight against …

An Evaluation Of Escience Lab Kits For Online Learning, Diana Orozco

Themis: Research Journal of Justice Studies and Forensic Science

Higher education online science courses generally lack the hands-on components essential in understanding theories, methods, and techniques in chemistry and biology. Companies like eScience Labs construct kits to facilitate online learning, which provide students with hands-on activities relevant to their science courses. In order to evaluate ease, efficacy, and comprehension of the forensic science kits by eScience Labs was completed while writing observations of the activities during and after completion; the lab manual learning objectives were compared to results of activities and two stopwatches took elapsed time of each activity to compare with the stated times in the kit manual. …

Moral Time And Homicide Investigations., David Stuart Lapsey Jr.

Electronic Theses and Dissertations

Previous literature explores the many dimensions of homicide investigations, including case and individual characteristics, evidence and investigative activities. However, little research delves into situational characteristics and their relationship to specific homicides, charge severity sought by prosecutors and sentence length given to homicide offenders. The current study sampled homicide cases (N=68) to gather baseline information and data regarding judicial outcomes. Donald Black’s Theory of Moral Time (2011) is tested and utilized as the study’s conceptual framework for the study’s hypotheses.

Chemical Identification Of Synthetic Cannabinoids In Herbal Incense Products, Karol F. Alvarez Heredia

Student Theses

The emergence of synthetic cannabinoids is an ongoing challenge for forensic, clinical analytical chemists and toxicologists. Different analogs are continuously introduced in the market to circumvent the legislation and to enhance their pharmacological activity. In the present project, a total of seven synthetic cannabinoids were identified in four herbal incense products by employing GCMS, and LC-TOF. Fractional collection of four out of the seven synthetic cannabinoids was performed using HPLC followed by the collection of FTIR-ATR spectra. Five out of seven synthetic cannabinoids were classified as indazole carboxamide derivatives, which include 5Fluoro-EMB-Pinaca, 5Fluoro-AMB, MA-Chminaca, AB-Chminaca, and 5Fluoro-AKB-48. The remaining two …

Jurisdiction, Privacy, And Ownership: Dna Technology And Field Dynamics In Conflict-Related Mass Fatalities, Stefan Schmitt, Dallas Mazoori

Genocide Studies and Prevention: An International Journal

This article explores the dynamics and challenges of undertaking human identifications in states experiencing armed conflict or emerging therefrom. It emphasises the integral role of the State in human identifications and the need for the legal acts of the State in identifying an individual and confirming their death to be integrated into any humanitarian response to repatriating the dead. Conflict-related mass fatalities occur in uncontrolled circumstances, making DNA-based human identifications necessary. In states lacking the necessary forensic infrastructure, the promise of expedited human identifications through outsourcing DNA work can lead to the State abdicating the necessary jurisdiction and scientific transparency …

Tracking The Sexual Assault Kit Backlog, Kallie Crawford, Lyndsie Ferrara

Undergraduate Research and Scholarship Symposium

The backlog of untested sexual assault kits is a national problem. Numerous federal funding opportunities offer the forensic science and law enforcement communities valuable resources needed to test the kits, but issues still remain. The majority of resources are focused on the collection and testing of sexual assault kits, but the tracking of the kits has not been a primary focus. This research highlights improvements that can be made to better understand the current backlog and improve the future processing and tracking of kits. Given the lack of a universal evidence tracking database among agencies, tracking sexual assault kits seems …

Program And Proceedings: Nebraska Academy Of Sciences 1880–2017, 137th Anniversary Year, One Hundred-Twenty-Seventh Annual Meeting

Nebraska Academy of Sciences: Programs and Proceedings

Program

Aeronautics and Space Science

Chemistry and Physics

Collegiate Academy: Biology

Collegiate Academy: Chemistry and Physics

Biological and Medical Sciences

Aeronautics and Space Science: Poster Session

Applied Science and Technology

Maiben Memorial Lecture

Anthropology

Earth Science

Applied Science and Technology

Teaching of Science and Mathematics

Environmental Sciences

Friend of Science Award: Kacie Baum and Todd Young

Special Issue Of Best Papers From The 11th International Conference On Systematic Approaches To Digital Forensic Engineering (Sadfe 2016)

Journal of Digital Forensics, Security and Law

The SADFE series feature the different editions of the International Conference on Systematic Approaches to Digital Forensics Engineering. Now in its eleventh edition, SADFE has established itself as the premier conference for researchers and practitioners working in Systematic Approaches to Digital Forensics Engineering.

SADFE 2016, the eleventh international conference on Systematic Approaches to Digital Forensic Engineering was held in Kyoto, Japan, September 20 - 22, 2016.

Digital forensics engineering and the curation of digital collections in cultural institutions face pressing and overlapping challenges related to provenance, chain of custody, authenticity, integrity, and identity. The generation, analysis and sustainability of digital …

Compression Of Virtual-Machine Memory In Dynamic Malware Analysis, James E. Fowler Ph.D.

Journal of Digital Forensics, Security and Law

Lossless compression of memory dumps from virtual machines that run malware samples is considered with the goal of significantly reducing archival costs in dynamic-malware-analysis applications. Given that, in such dynamic-analysis scenarios, malware samples are typically run in virtual machines just long enough to activate any self-decryption or other detection- avoidance maneuvers, the virtual-machine memory typically changes little from that of the baseline state, with the difference being attributable in large degree to the loading of additional executables and libraries. Consequently, delta coding is proposed to compress the current virtual-machine memory dump by coding its differences with respect to a predicted …

Front Matter

Journal of Digital Forensics, Security and Law

No abstract provided.

Find Me If You Can: Mobile Gps Mapping Applications Forensic Analysis & Snavp The Open Source, Modular, Extensible Parser, Jason Moore, Ibrahim Baggili, Frank Breitinger

Journal of Digital Forensics, Security and Law

The use of smartphones as navigation devices has become more prevalent. The ubiquity of hand-held navigation devices such as Garmins or Toms Toms has been falling whereas the ownership of smartphones and their adoption as GPS devices is growing. This work provides a comprehensive study of the most popular smartphone mapping applications, namely Google Maps, Apple Maps, Waze, MapQuest, Bing, and Scout, on both Android and iOS. It details what data was found, where it was found, and how it was acquired for each application. Based on the findings, the work allowed for the construction of a tool capable of …

A Forensic Email Analysis Tool Using Dynamic Visualization, Johannes Stadlinger, Andreas Dewald

Journal of Digital Forensics, Security and Law

Communication between people counts to the most important information of today’s business. As a result, in case of forensic investigations in big companies, analysis of communication data in general and especially email, as the still most widely used business communication platform with an immense and still growing volume, is a typical task in digital forensics. One of the challenges is to identify the relevant communication partners and structures in the suspects surrounding as quickly as possible in order to react appropriately and identify further targets of evaluation. Due to the amount of emails in typical inboxes, reading through all the …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Spectral Signatures Of Immature Lucilia Sericata (Meigen) (Diptera: Calliphoridae), Jodie-A. Warren, T. D. Pulindu Ratnasekera, David A. Campbell, Gail S. Anderson

Faculty Research, Scholarly, and Creative Activity

Hyperspectral remote sensing is an innovative technology with applications in many sciences and is a non-destructive method that may offer more precise aging within development stages. Hyperspectral reflectance measurements from the anterior, midsection, and posterior of Lucilia sericata (Meigen) larvae and pupae were conducted daily from samples of the developing insects beginning at second instar. Only midsection measurements were conducted on second instar larvae due to their size, to ensure that the measurement was not of reflective surroundings. Once measured, all insects were washed with deionized water, blotted with filter paper, and re-measured. Daily age prediction during the post-feeding stage …

Innovative Silver-Based Catalyst For Oxidation Of Methane To Methanol, Ashley Gordon

Discovery Day (formerly Post & Beyond)

Methane is a main component of many natural gas reserves. It is fundamental for an effective method to be developed for inexpensive and abundant methane to be converted to value added chemicals, such as methanol, formaldehyde, acetic acid, carbon monoxide, and fuel. The primary goal of this research is for the development of an innovative silver-based catalyst for effective conversion of methane to methanol. The Ag-based solution we developed can be tuned to be either acidic or basic to adapt to different catalyst support. The solution was characterized by Ultraviolet-visible spectroscopy and the Ag adsorption was determined. The heterogeneous catalyst …

Development Of A Novel Cu-Zn Based Heterogeneous Catalyst For Direct Methane Conversion, Wan Yee Lam

Discovery Day (formerly Post & Beyond)

Many researchers are working on an efficient method to convert methane into methanol because the main cause of global warming is due to the burning of petroleum, which emits greenhouse gases. The extraction of crude oil would pollute our environment. The present method of methanol production is inefficient and generally yields less than 5%. Moreover, the traditional two-step process is very expensive and energy intensive. Therefore, the primary objective of my research is to develop a novel Cu-Zn based heterogeneous catalyst to enhance the catalytic conversion of methane for the synthesis of value added chemical such as methanol. The Cu-Zn-based …

Quantitative Analysis Of Opioids And Cannabinoids In Wastewater Samples, Alethea Jacox, Jillian Wetzel, Shu-Yuan Cheng, Marta Concheiro-Guisan

Publications and Research

Wastewater-based epidemiology is an innovative approach that uses the analysis of human excretion products in wastewater to obtain information about exposure to drugs in defined population groups. We developed and validated an analytical method for the simultaneous determination of opioids (morphine, oxycodone, hydrocodone, oxymorphone and hydromorphone), and cannabinoids (Δ⁹-tetrahydrocannabinol, 11-nor-9-carboxy-tetrahydrocannabinol (THCCOOH) and THCCOOH-glucuronide) in raw-influent wastewater samples by ultra-high performance liquid chromatography-tandem mass spectrometry. Method validation included linearity (5–1 000 ng/L for opioids, 10–1 000 ng/L for cannabinoids), imprecision (<21.2%), accuracy (83%–131%), matrix effect (from –35.1% to –14.7%) and extraction efficiency (25%–84%), limit of detection (1–5 ng/L) and quantification (5–10 ng/L) and auto-sampler stability (no loss detected). River and wastewater samples were collected in triplicate from different locations in New York City and stored at −20 °C until analysis. Water from sewage overflow location tested positive for morphine (10.7 ng/L), oxycodone (4.2–23.5 ng/L), oxymorphone (4.8 ng/L) and hydromorphone (4.2 ng/L). Raw influent wastewater samples tested positive for morphine (133.0–258.3 ng/L), oxycodone (31.1–63.6 ng/L), oxymorphone (16.0–56.8 ng/L), hydromorphone (6.8–18.0 ng/L), hydrocodone (4.0–12.8 ng/L) and THCCOOH (168.2–772.0 ng/L). This method is sensitive and specific for opioids and marijuana determination in wastewater samples.

The Use Of Raman Spectroscopy For The Identification Of Forensically Relevant Body Fluid Stains, Tyler Schlagetter, Claire L. Glynn, Brooke Weinger Kammrath

Forensic Science Publications

Raman spectroscopy is fast becoming a popular technique in the forensic science discipline, and more recently its focus has turned to biological samples. This study reveals the ability of Raman spectroscopy to identify some forensically relevant body fluids, both individually and within mixed samples, that can be crucial in some forensic investigations. This study also further demonstrates the capabilities of Raman as a means for human blood identification in simulated crime scene samples to include bloodstains on a variety of fabrics, at varying dilutions, following laundering, and with the use of various blood-enhancement reagents. The impact of washing and blood-enhancement …

Changes In J-Soap-Ii And Savry Scores Over The Course Of Residential, Cognitive-Behavioral Treatment For Adolescent Sexual Offending, Jodi L. Viljoen, Andrew L. Gray, Catherine Shaffer, Natasha E. Latzman, Mario Scalora, Daniel Ullman

Department of Psychology: Faculty Publications

Although the Juvenile Sex Offender Assessment Protocol–II (J-SOAP-II) and the Structured Assessment of Violence Risk in Youth (SAVRY) include an emphasis on dynamic, or modifiable factors, there has been little research on dynamic changes on these tools. To help address this gap, we compared admission and discharge scores of 163 adolescents who attended a residential, cognitive-behavioral treatment program for sexual offending. Based on reliable change indices, one half of youth showed a reliable decrease on the J-SOAP-II Dynamic Risk Total Score and one third of youth showed a reliable decrease on the SAVRY Dynamic Risk Total Score. Contrary to expectations, …

Drop (Drone Open Source Parser) Your Drone: Forensic Analysis Of The Dji Phantom Iii, Devon R. Clark, Christopher S. Meffert, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

The DJI Phantom III drone has already been used for malicious activities (to drop bombs, remote surveillance and plane watching) in 2016 and 2017. At the time of writing, DJI was the drone manufacturer with the largest market share. Our work presents the primary thorough forensic analysis of the DJI Phantom III drone, and the primary account for proprietary file structures stored by the examined drone. It also presents the forensically sound open source tool DRone Open source Parser (DROP) that parses proprietary DAT files extracted from the drone's nonvolatile internal storage. These DAT files are encrypted and encoded. The …