Forensic Science and Technology Commons^™

Exploring The Use Of Graph Databases To Catalog Artifacts For Client Forensics, Rose Shumba

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud computing has revolutionized the methods by which digital data is stored, processed, and transmitted. It is providing users with data storage and processing services, enabling access to resources through multiple devices. Although organizations continue to embrace the advantages of flexibility and scalability offered by cloud computing, insider threats are becoming a serious concern as cited by security researchers. Insiders can use authorized access to steal sensitive information, calling for the need for an investigation. This concept paper describes research in progress towards developing a Neo4j graph database tool to enhance client forensics. The tool, with a Python interface, allows …

Precognition: Automated Digital Forensic Readiness System For Mobile Computing Devices In Enterprises, Jayaprakash Govindaraj, Robin Verma, Gaurav Gupta

Annual ADFSL Conference on Digital Forensics, Security and Law

Enterprises are facing an unprecedented risk of security incidents due to the influx of emerging technologies, like smartphones and wearables. Most of the current Mobile security systems are not maturing in pace with technological advances. They lack the ability to learn and adapt from the past knowledge base. In the case of a security incident, enterprises find themselves underprepared for the lack of evidence and data. The systems are not designed to be forensic ready. There is a need for automated security analysis and forensically ready solution, which can learn and continuously adapt to new challenges, improve efficiency and productivity …

Non-Use Of A Mobile Phone During Conducting Crime Can Also Be Evidential, Vinod Polpaya Bhattathiripad Ph D

Annual ADFSL Conference on Digital Forensics, Security and Law

Cyber-clever criminals who are aware of the consequence of using mobile phones during conducting crimes often stay away from their phones while involved in crimes. Some of them even change their handset and SIM card, subsequently. This article looks into how, intentional disassociation (and even unintentional non-use) of mobile phone in (non-cyber) crimes, can become evidential clues of the perpetrators’ involvement in criminal acts. With the help of a recent judicial episode, this article reveals how extremely careful and masterful handling of extensive and voluminous Call Details Records and tower dumps by a cyber-savvy investigating official can unearth evidential clues …

Forensic Analysis Of The Exfat Artifacts, Yves Vandermeer, An Lekhac, Tahar Kechadi, Joe Carthy

Annual ADFSL Conference on Digital Forensics, Security and Law

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is …

Live Gpu Forensics: The Process Of Recovering Video Frames From Nvidia Gpu, Yazeed M. Albabtain, Baijian Yang

Annual ADFSL Conference on Digital Forensics, Security and Law

The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The …

Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3 Drone As A Case Study, Alan Roder, Kim-Kwang Raymond Choo, Nhien-A Le-Khac

Annual ADFSL Conference on Digital Forensics, Security and Law

Drones (also known as Unmanned Aerial Vehicles – UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be …

Detection And Recovery Of Anti-Forensic (Vault) Applications On Android Devices, Michaila Duncan, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Significant number of mobile device users currently employ anti-forensics applications, also known as vault or locker applications, on their mobile devices in order to hide files such as photos. Because of this, investigators are required to spend a large portion of their time manually looking at the applications installed on the device. Currently, there is no automated method of detecting these anti-forensics applications on an Android device. This work presents the creation and testing of a vault application detection system to be used on Android devices. The main goal of this work is twofold: (i) Detecting and reporting the presence …

Forensic Entomology And The Order Coleoptera, Carrie Pratt

Essential Studies UNDergraduate Showcase

Medico-legal forensic entomology is the study of insects to aid in determining time, place, manner, and cause of death. Identification of the postmortem interval (PMI), or the time that has passed since a person has died, is arguably one of the most important pieces of information that forensic entomology can provide. The PMI can be found using either insect developmental rates or entomofaunal succession, the arrival of different insects at a body at different time points.

The largest group of insects, the beetles, is the order Coleoptera, which contains 25% of all animal species. Members of this order are critical …

A Forensic Investigation Into The Possible Origins Of Three Human Skeletons, Jefferson P. Sinnott

Forensic Science Theses

The Anthropology Department at Buffalo State has three human skeletons that have been part of the department’s collection for several years. The origin of the skeletons is currently unknown. Modern DNA techniques coupled with forensic anthropological techniques may now allow us to determine with some certainty the geographic origin of the skeletons. Ancestry, sex, age, and stature were assessed using current anthropological techniques. Afterwards, one tooth from each of the three skeletons was extracted, pulverized and DNA was isolated. Y-STR fragment size analysis of the DNA samples can provide information about the patrilineage of male individuals. Mitochondrial DNA sequencing analysis …

Analyzing Palm Print Shapes With Pressure And Distortion, Whitney Grannan

Honors Theses

While much research exists on latent fingerprints, there is a lack of research on palm prints. This study aims to discover how the variable of pressure affects the distortion of latent palm prints recovered from a crime scene. This study used various development techniques to extract prints from aluminum Coca-Cola cans, white copy paper, and household steak knives. The collected prints were scanned into the AFIX Tracker system and an auto-extract number, based on the number of minutiae points, was generated automatically from the system. These auto-extract numbers were then compared to a baseline, which consisted of an average of …

A Validation Study Of Blueview™ Gunpowder Particle Testing Kit, Hanna Lester

Honors Theses

The examination of gunshot residue is often an integral part of evidence processing. The aim of this preliminary study is to validate the use of the BlueView Gunshot Particle Test Kit in the field. This was done by comparing the results of the presumptive tests using the BlueView Gunshot Particle Test Kit to confirmatory test results using a scanning electron microscope. This study used both collection techniques to collect samples for presumptive tests and confirmatory tests. Gunshot residue samples were collected from the hands after a series of guns were fired, and positive results were obtained from the presumptive and …

Exploring Various Techniques To Process And Identify Latent Friction Ridge Details From Fingers On Semi-Porous Surfaces, Emily Campo

Honors Theses

Numerous terrorist groups in the Middle East have been recently making detonators for IEDs (Improvised Explosive Devices) using items as basic as flip flops. Because of the semi-porous nature of flip flops, military forensic response teams have been unable to find an effective method through which they can identify, process, and lift latent fingerprints from the surface of a flip flop. The present study aims to use three fingerprint principles to formulate a reliable method that can be used for such purposes. This study specifically investigated the potential use of powders and cyanoacrylate fuming as processing techniques. The case study …

Using Pattern Area Ridge Flow In The Three Areas Of The Palm To Determine Classification Trends, Ashton Horton

Honors Theses

Friction ridge skin is only located on the fingers, palms, and soles of feet. These ridges have been used to make identifications since before the twentieth century. These methods may be the basis of scientific testimony in court because of the amount of research that has been conducted in fingerprint identification. Courts uphold these techniques because of three principles behind fingerprint identification: fingerprints are unique because no two are the same, they will not change from the time they are formed in the womb until post-mortem decomposition, and they can be objectively classified using a general classification system. Little research …

Evaluation Of Illumina’S Forenseqtm Signature Prep Kit For Eye And Hair Color As Well As Biogeographical Ancestry Predictions, Krupa Vijaykumar Jani

Student Theses

This study examined and analyzed 266 samples using ForenSeq^TM Signature Prep Kit B. Samples from various populations such as African American, East Asian, South Asian, European, and Mixed population were included in the study. Primer Mix B targets 27 autosomal STRs (aSTRs), 24 Y-STRs, 7 X-STRs, and 94 identity Single Nucleotide Polymorphisms (iSNPs), 24 phenotypic SNPs (pSNPs), and 56 ancestry SNPs (aSNPs), coming to a total of 231 targets. The study mainly focused on the quality of data generated by the instrument as well as for the accuracy of eye and hair color as well as biogeographical ancestry predictions …

Ant Predation Of Blow Flies During Decomposition And Its Potential Impact On Pmi Estimations, Vincent J. Nappi

Student Theses

When an organism dies, the process of decomposition begins and many insects are attracted to the decomposing remains, or carrion, as a prospective food source for themselves, or their offspring. Blow flies (Family: Calliphoridae), in particular, are one of the first insects to discover and colonize a dead body due to the ability to detect a decomposing resource from large distances. As a result, forensic entomologists take advantage of the behavior and developmental cycles of early colonizers to calculate the post-mortem interval (PMI) in order to determine the time since death. However, along with the insects that are attracted to …

Smoke But No Fire: When Innocent People Are Wrongly Convicted Of Crimes That Never Happened, Jessica S. Henry

Department of Justice Studies Faculty Scholarship and Creative Works

Nearly one-third of exonerations involve the wrongful conviction of an innocent person for a crime that never actually happened, such as when the police plant drugs on an innocent person, a scorned lover invents a false accusation, or an expert mislabels a suicide as a murder. Despite the frequency with which no-crime convictions take place, little scholarship has been devoted to the subject. This Article seeks to fill that gap in the literature by exploring no-crime wrongful convictions as a discrete and unique phenomenon within the wrongful convictions universe. This Article considers three main factors that contribute to no-crime wrongful …

Automated Man-In-The-Middle Attack Against Wi‑Fi Networks, Martin Vondráček, Jan Pluskal, Ondřej Ryšavý

Journal of Digital Forensics, Security and Law

Currently used wireless communication technologies suffer security weaknesses that can be exploited allowing to eavesdrop or to spoof network communication. In this paper, we present a practical tool that can automate the attack on wireless security. The developed package called wifimitm provides functionality for the automation of MitM attacks in the wireless environment. The package combines several existing tools and attack strategies to bypass the wireless security mechanisms, such as WEP, WPA, and WPS. The presented tool can be integrated into a solution for automated penetration testing. Also, a popularization of the fact that such attacks can be easily automated …

Understanding The Sexual Assault Kit Backlog In Pennsylvania, Kallie Crawford, Lyndsie Ferrara

Graduate Student Research Symposium

According to the FBI, to date, there are more than 400,000 untested sexual assault kits nationwide. While this is a huge issue that cannot be solved overnight, continual improvements and changes are needed to reduce and hopefully eliminate the backlog.

This research examines work going on nationwide and aims to better understand the backlog issues specifically in Pennsylvania. Furthermore, the research examines a program utilized by the law enforcement community that garnered necessary resources. First, a comprehensive review of improved practices in proactive jurisdictions of Ohio, Houston, Texas, and Detroit, Michigan was conducted to identify general policies and procedures that …

Back Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Front Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Contents, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Hyperspectral Measurements Of Immature Lucilia Sericata (Meigen) (Diptera: Calliphoridae) Raised On Different Food Substrates, Jodie A. Warren, T. D. Pulindu Ratnasekera, David A. Campbell, Gail S. Anderson

Faculty Research, Scholarly, and Creative Activity

Immature Lucilia sericata (Meigen) raised on beef liver, beef heart, pork liver and pork heart at a mean temperature of 20.6°C took a minimum of 20 days to complete development. Minimum development time differences within stages were observed between the meat types (pork/beef), but not the organ types (liver/heart). Daily hyperspectral measurements were conducted and a functional regression was completed to examine the main effects of meat and organ type on daily spectral measurements. The model examined post feeding larval spectral measurements of insects raised on beef liver alone, the effect of those raised on pork compared with those raised …

Hanging By A Thread: Enhancing The Forensic Value Of Dyed Cotton Trace Evidence Through The Application Of Novel Techniques In Fiber Discrimination, Rachel M. Russo

The Pegasus Review: UCF Undergraduate Research Journal

This thesis examines the capability of current techniques in fiber classification such as UV-visible microspectrophotometry (MSP) (for dye in situ and/or extracted) to discriminate between fibers from sources known to be different. When these methods fail to adequately distinguish the fibers, novel alternative techniques'such as pulsed pumped laser-induced fluorescence spectroscopy (LIF) and liquid chromatography-mass spectrometry (LC-MS)'are utilized to provide definitive forensic evidence.

The FBI Dye Extraction Classification and Chromatography Schemes: Forensic Fiber Examination Guidelines provides the methodology used by the majority of crime labs across the United States (Fong, 1984). In the case of cotton fibers'the most frequently encountered fiber …

An Overview Of The Usage Of Default Passwords, Brandon Knierem, Xiaolu Zhang, Philip Levine, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The recent Mirai botnet attack demonstrated the danger of using default passwords and showed it is still a major problem. In this study we investigated several common applications and their password policies. Specifically, we analyzed if these applications: (1) have default passwords or (2) allow the user to set a weak password (i.e., they do not properly enforce a password policy). Our study shows that default passwords are still a significant problem: 61% of applications inspected initially used a default or blank password. When changing the password, 58% allowed a blank password, 35% allowed a weak password of 1 character.

Investigating The Isolation And Amplification Of Micrornas For Forensic Body Fluid Identification, Kelsie R. O'Leary, Claire L. Glynn

Forensic Science Publications

Background: The discovery of forensic DNA typing evolved molecular biology far beyond what could have been expected in terms of its forensic application, and now there exists other developments in molecular biology which are ready for application to forensic challenges. One such challenge is the identification of the body fluid source of stains recovered from evidence items and crime scenes. Currently there are significant efforts in the research field to develop novel methods for the molecular identification of body fluids, with microRNAs (miRNAs) revealing great potential. MiRNAs have been shown to have high tissue specificity and are less susceptible to …

Morphologically Directed Raman Spectroscopic Analysis Of Forensic Samples, Brooke Weinger Kammrath, Andrew Koutrakos, Pauline E. Leary, Josemar A. Castillo, Joe Wolfgang, Deborah Huck-Jones

Forensic Science Publications

Morphologically directed Raman spectroscopy (MDRS) is a novel and reliable tool that would enable criminalists to obtain more discriminatory information from forensic samples than their current capabilities. MDRS combines automated particle imaging and Raman spectroscopy into one instrument. Particle imaging is performed to determine particle size and shape distributions of components in a blended sample. Particle size is an important physical property of particulate samples and can be used in conjunction with Raman spectroscopy in the analysis of a range of samples of forensic interest, including illicit and counterfeit drugs, soils, gunshot residue (GSR), and white powders. Although measurement of …

Illicit And Counterfeit Drug Analysis By Morphologically Directed Raman Spectroscopy, Andrew Koutrakos, Pauline E. Leary, Brooke Weinger Kammrath

Forensic Science Publications

Morphologically directed Raman spectroscopy (MDRS) is a novel tool for the forensic analysis of illicit and counterfeit drug samples. MDRS combines Raman microspectroscopy with automated particle imaging so that physical and chemical information about the components of a mixture sample can be obtained. Results of automated particle imaging are used to determine samples for Raman analysis. The use of MDRS for these types of samples can be employed for both forensic investigations and adjudications of cases. The method provides insight about the physical and chemical composition of the sample, as well as about manufacturing and sample history. Here, MDRS was …

Is Forensic Science In Danger Of Extinction?, David San Pietro, Brooke Weinger Kammrath, Peter R. De Forest

Forensic Science Publications

Observations of modern day forensic science has prompted asking the question of whether this field is in danger of extinction. Although there have undoubtedly been meaningful advancements in analytical capabilities, we have overlooked several unintended practical and philosophical consequences. This article addresses three main areas of concern: the declining role of the generalist in an era of increased specialization, the role of education in preparing the next generation of forensic scientists, and the implementation of advanced instrumentation with a focus on statistical significance and field deployable instrumentation.

Introduction: Symposium On “Forensics, Statistics, And Law”, Brandon L. Garrett

Faculty Scholarship

No abstract provided.

Oil Dries: A New Absorbent Material For Collection Of Ignitable Liquids From Semi-Porous Material, Jessica Sosa

Online Theses and Dissertations

Extraction of an ignitable liquid sample from a semi-porous surface such as concrete is especially difficult. For this purpose, two different solid oil dry absorbent materials, Instazorb and MAXXAbsorb, were researched for use of collection of ignitable liquid samples at a fire scene. These oil dries were spiked with different ignitable liquids (Coleman fuel, gasoline, kerosene, and diesel). Isolation of the ignitable liquid from the oil dry absorbent was accomplished by passive headspace isolation. Data was obtained by gas chromatography coupled with flame ionization detection (GC-FID) and gas chromatography coupled with mass spectrometry (GC-MS). Chromatograms obtained from both oil dries …