Forensic Science and Technology Commons^™

I Know What You Did Last Summer: Your Smart Home Internet Of Things And Your Iphone Forensically Ratting You Out, Gokila Dorai, Shiva Houshmand, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The adoption of smart home Internet of Things (IoT) devices continues to grow. What if your devices can snitch on you and let us know where you are at any given point in time? In this work we examined the forensic artifacts produced by Nest devices, and in specific, we examined the logical backup structure of an iPhone used to control a Nest thermostat, Nest Indoor Camera and a Nest Outdoor Camera. We also integrated the Google Home Mini as another method of controlling the studied Smart Home devices. Our work is the primary account for the examination of Nest …

Open-Source Tools For Dense Facial Tissue Depth Mapping (Ftdm) Of Computed Tomography Models, Terrie Simmons-Ehrhardt, Catyana Falsetti, Anthony B. Falsetti, Christopher J. Ehrhardt

Human Biology Open Access Pre-Prints

Computed tomography (CT) scans provide anthropologists with a resource to generate three- dimensional (3D) digital skeletal material to expand quantification methods and build more standardized reference collections. The ability to visualize and manipulate the bone and skin of the face simultaneously in a 3D digital environment introduces a new way for forensic facial approximation practitioners to access and study the face. Craniofacial relationships can be quantified with landmarks or with surface processing software that can quantify the geometric properties of the entire 3D facial surface. This paper describes tools for the generation of dense facial tissue depth maps (FTDMs) using …

Forensic Analysis Of Immersive Virtual Reality Social Applications: A Primary Account, Ananya Yarramreddy, Peter Gromkowski, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Our work presents the primary account for exploring the forensics of immersive Virtual Reality (VR) systems and their social applications. The Social VR applications studied in this work include Bigscreen, Altspace VR, Rec Room and Facebook Spaces. We explored the two most widely adopted consumer VR systems: the HTC Vive and the Oculus Rift. Our tests examined the efficacy of reconstructing evidence from network traffic as well as the systems themselves. The results showed that a significant amount of forensically relevant data such as user names, user profile pictures, events, and system details may be recovered. We anticipate that this …

Environmental Factors Affecting Rapid Shear In Fibers From The Passage Of A Bullet, Laura Molina

Student Theses

Evaluation of fabric defects may provide insight on the specific cause of fiber fracture. In forensic casework, fabric defects may provide a determination of previous occurrences connected to a case. Different methods of fabric breakage impart differing physical characteristics on individual fibers. These alterations to otherwise highly ordered fibers are determined by a multitude of factors, among them temperature. The process of rapid shear occurs in thermoplastic materials following high-speed impact. It results in distinct features caused by excessive heat generated through the interaction which is unable to dissipate at a rate that would leave the fibers unchanged. Rapid shear …

Welcoming Remarks From The Ijcic Honorary Editor, Peter Grabosky

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

The Present And Future Of Cybercrime, Cyberterrorism, And Cybersecurity, Kyung-Shick Choi, Claire Seungeun Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Cybercriminology combines knowledge from criminology, psychology, sociology, computer science, and cybersecurity to provide an in-depth understanding of cybercrime. Cybercrime and cybersecurity are interconnected across many places, platforms, and actors. Cybercrime issues are continuously and expeditiously changing and developing, especially with the advent of new technologies. The International Journal of Cybersecurity Intelligence and Cybercrime (IJCIC) aims to contribute to the growing field of cybercriminology and cybersecurity. The IJCIC is eager to work with scholars, policy analysts, practitioners, and others to enhance theory, methods, and practice within cybercrime and cybersecurity at the regional, national, and international levels.

Architecture Of Aggression In Cyberspace. Testing Cyber Aggression In Young Adults In Hungary, Katalin Parti, Tibor Kiss, Gergely Koplányi

International Journal of Cybersecurity Intelligence & Cybercrime

In order to test whether and how violence is exacerbated in online social networking sites, we utilized the BryantSmith Aggression Scale (Bryant & Smith, 2001), and included examples in the questionnaire offering solutions for 7 different hypothetical cases occurring online (Kiss, 2017). The questionnaire was sent to social work and law school students in Hungary. Prevalence and levels of aggression and its manifestation as violence online proved to be not more severe than in offline social relations. Law students were more aware than students of social work that online hostile acts are discrediting. Students of social work were significantly more …

An Argument For Interdisciplinary Programs In Cybersecurity, Dennis Giever

International Journal of Cybersecurity Intelligence & Cybercrime

In this commentary Dr. Giever presents a compelling argument for interdisciplinary programs in cybersecurity at the university level. He argues that we no longer have the luxury of allowing barriers to exist between those tasked with IT security and those who provide physical security. He recommends that any security program take an “all possible paths” or “balanced approach” to the protection of assets within an organization. Students in computer science, criminal justice, business, human resources, and others should work collaboratively within education programs learning these necessary skills. A team effort is needed to accomplish the myriad of tasks necessary to …

Survey Results On Adults And Cybersecurity Education, Frank Breitinger, Joseph Ricci, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Cyberattacks and identity theft are common problems nowadays where researchers often say that humans are the weakest link in the security chain. Therefore, this survey focused on analyzing the interest for adults for ‘cyber threat education seminars’, e.g., how to project themselves and their loved ones. Specifically, we asked questions to understand a possible audience, willingness for paying / time commitment, or fields of interest as well as background and previous training experience. The survey was conducted in late 2016 and taken by 233 participants. The results show that many are worried about cyber threats and about their children exploring …

Experience Constructing The Artifact Genome Project (Agp): Managing The Domain's Knowledge One Artifact At A Time, Cinthya Grajeda, Laura Sanchez, Ibrahim Baggili, Devon R. Clark, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

While various tools have been created to assist the digital forensics community with acquiring, processing, and organizing evidence and indicating the existence of artifacts, very few attempts have been made to establish a centralized system for archiving artifacts. The Artifact Genome Project (AGP) has aimed to create the largest vetted and freely available digital forensics repository for Curated Forensic Artifacts (CuFAs). This paper details the experience of building, implementing, and maintaining such a system by sharing design decisions, lessons learned, and future work. We also discuss the impact of AGP in both the professional and academic realms of digital forensics. …

Δ-9-Thc Effect On The Dopamine Transporter, Brooke E. Nielsen

Student Theses

Understanding the mechanism behind drugs of abuse is one of the key elements to understanding why addiction is so prevalent in society. The goal of this research was to determine the effect that a popular cannabinoid, Δ -9-tetrahydrocannabinol has on the regulation of dopamine neurotransmitter in the synapses. It was hypothesized that the addictive high users experience from using Δ-9-THC had a direct effect on lowering the dopamine transporter protein on cell surface causing a buildup of dopamine in the synapse. The results of the study show that the higher concentration of Δ-9-THC that the cells were exposed to caused …

A Novel On‐Chip Method For Differential Extraction Of Sperm In Forensic Cases, Fatih Inci, Mehmet O. Ozen, Yeseren Saylan, Morteza Miansari, Duygu Cimen, Raghu Dhara, Thiruppathiraja Chinnasamy, Mehmet Yuksekkaya, Chiara Filippini, Deepan Kishore Kumar, Semih Calamak, Yusuf Yesil, Naside Gozde Durmus, George Duncan, Leonard Klevan, Utkan Demirci

Biology Faculty Articles

One out of every six American women has been the victim of a sexual assault in their lifetime. However, the DNA casework backlog continues to increase outpacing the nation's capacity since DNA evidence processing in sexual assault casework remains a bottleneck due to laborious and time‐consuming differential extraction of victim's and perpetrator's cells. Additionally, a significant amount (60–90%) of male DNA evidence may be lost with existing procedures. Here, a microfluidic method is developed that selectively captures sperm using a unique oligosaccharide sequence (Sialyl‐LewisX), a major carbohydrate ligand for sperm‐egg binding. This method is validated with forensic mock samples dating …

An Improved Method For The Analysis Of Fiber Evidence Using Polarized Light Microscopy, Samuel F. Kaplan

Student Theses

Using the basic fundamentals of polarized light microscopy, a new and improved method for identifying synthetic fibers is presented in this thesis. Using the equation of an ellipse in spherical coordinates, an EXCEL™ (Microsoft Inc., Seattle, WA) spreadsheet was developed that generated tables of data that provide a foundation for a new and more efficient method in fiber analysis. Intermediate refractive index values for each subclass of textile fibers were calculated based on the fiber's principal refractive index values. The angles of refractive index matching to known refractive index fluids vary from 0 to 90 degrees upon rotation of the …

Identification Of Animal Species By Utilization Of Processed Remains, Melissa I. Gaud

Student Theses

An enzymatic method to process decomposed non-human bone for forensic DNA analysis is presented. Red snapper species is identified by sequencing of the COI gene.

Forensic analysis of DNA from non-human bones can be important in investigating a variety of forensic cases. However, decomposed bone is difficult to process for isolating DNA. In this study, a previously established enzymatic method was utilized to process bone samples that simulate decomposed specimens. Our results demonstrated that this enzymatic processing method is effective for removing decomposed soft tissues and outer surface materials such as mineralized bone connective tissue of bone fragment samples. Our …

Zolpidem Facilitated Sexual Assaults: A Hair Method Validation, Danielle N. Chasworth

Student Theses

A liquid chromatography tandem mass spectrometry (LC-MSMS) method was developed and validated to detect for the presence of zolpidem in human hair samples. Zolpidem is a sedative hypnotic whose adverse effects make it a common drug found in drug facilitated crimes (DFC). It is important to be able to detect and quantitate the drug after a long period of time due to the victim’s delayed reporting of the crime. Hair’s long window of detection makes it a useful matrix for DFC investigations. The linear range of the assay was targeted at 2 pg/mg to 1,000 pg/mg and experiments designed to …

A 3d Characteristics Database Of Land Engraved Areas With Known Subclass, Entni Lin

Student Theses

Subclass characteristics on bullets may mislead firearm examiners when they rely on traditional 2D images. In order to provide indelible examples for training and help avoid identification errors, 3D topography surface maps and statistical methods of pattern recognition are applied to toolmarks on bullets containing known subclass characteristics. This research was conducted by collecting 3D topography surface map data from land engraved areas of bullets fired through known barrels. This data was processed and used to train the statistical algorithms to predict their origin. The results from the algorithm are compared with the “right answers” (i.e. correct IDs) of the …

The Y-Screen Assay: Validation And Evaluation Of Subsequent Str Success, Kassandra Luyando

Student Theses

There are hundreds of untested sexual assault kits in police custody. As of 2017, New York State passed a law stating that all untested kits must be turned over to forensic laboratories to be tested, causing backlogs at laboratories to increase. The Y-Screen assay is a DNA extraction protocol which utilizes NaOH to rapidly lyse epithelial and sperm cells, and the Quantifiler Trio DNA quantification kit to detect the presence or absence of male DNA prior to standard sample processing. The Y-Screen assay is a commercial product used in this research to test a defined set of validation samples with …

Contents, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Front Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Lacking Regulated Policy For Dna Evidence, Maia Lister

Themis: Research Journal of Justice Studies and Forensic Science

Despite its strong presence in criminal justice, DNA analysis is still a minimally regulated area. This minimal regulation devalues DNA evidence through the inconsistencies in these areas. The analysis methods of low template DNA lack a uniform method resulting in varying levels of reliability. Utilizing familial searches to assist in criminal investigations can potentially violate citizen rights. Such violations can also be found in the collection of DNA samples before an arrestee is tried or convicted. There are, however, regulations that could be applied universally to combat the problems that were discussed.

Analysis Of Data Erasure Capability On Sshd Drives For Data Recovery, Andrew Blyth

Annual ADFSL Conference on Digital Forensics, Security and Law

Data Protection and Computer Forensics/Anti-Forensics has now become a critical area of concern for organizations. A key element to this is how data is sanitized at end of life. In this paper we explore Hybrid Solid State Hybrid Drives (SSHD) and the impact that various Computer Forensics and Data Recovery techniques have when performing data erasure upon a SSHD.

Knowledge Expiration In Security Awareness Training, Tianjian Zhang

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Positive Identification Of Lsb Image Steganography Using Cover Image Comparisons, Michael Pelosi, Nimesh Poudel, Pratap Lamichhane, Devon Lam, Gary Kessler, Joshua Macmonagle

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we introduce a new software concept specifically designed to allow the digital forensics professional to clearly identify and attribute instances of LSB image steganography by using the original cover image in side-by-side comparison with a suspected steganographic payload image. The “CounterSteg” software allows detailed analysis and comparison of both the original cover image and any modified image, using sophisticated bit- and color-channel visual depiction graphics. In certain cases, the steganographic software used for message transmission can be identified by the forensic analysis of LSB and other changes in the payload image. The paper demonstrates usage and typical …

Exploring The Use Of Graph Databases To Catalog Artifacts For Client Forensics, Rose Shumba

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud computing has revolutionized the methods by which digital data is stored, processed, and transmitted. It is providing users with data storage and processing services, enabling access to resources through multiple devices. Although organizations continue to embrace the advantages of flexibility and scalability offered by cloud computing, insider threats are becoming a serious concern as cited by security researchers. Insiders can use authorized access to steal sensitive information, calling for the need for an investigation. This concept paper describes research in progress towards developing a Neo4j graph database tool to enhance client forensics. The tool, with a Python interface, allows …

Precognition: Automated Digital Forensic Readiness System For Mobile Computing Devices In Enterprises, Jayaprakash Govindaraj, Robin Verma, Gaurav Gupta

Annual ADFSL Conference on Digital Forensics, Security and Law

Enterprises are facing an unprecedented risk of security incidents due to the influx of emerging technologies, like smartphones and wearables. Most of the current Mobile security systems are not maturing in pace with technological advances. They lack the ability to learn and adapt from the past knowledge base. In the case of a security incident, enterprises find themselves underprepared for the lack of evidence and data. The systems are not designed to be forensic ready. There is a need for automated security analysis and forensically ready solution, which can learn and continuously adapt to new challenges, improve efficiency and productivity …

Non-Use Of A Mobile Phone During Conducting Crime Can Also Be Evidential, Vinod Polpaya Bhattathiripad Ph D

Annual ADFSL Conference on Digital Forensics, Security and Law

Cyber-clever criminals who are aware of the consequence of using mobile phones during conducting crimes often stay away from their phones while involved in crimes. Some of them even change their handset and SIM card, subsequently. This article looks into how, intentional disassociation (and even unintentional non-use) of mobile phone in (non-cyber) crimes, can become evidential clues of the perpetrators’ involvement in criminal acts. With the help of a recent judicial episode, this article reveals how extremely careful and masterful handling of extensive and voluminous Call Details Records and tower dumps by a cyber-savvy investigating official can unearth evidential clues …

Forensic Analysis Of The Exfat Artifacts, Yves Vandermeer, An Lekhac, Tahar Kechadi, Joe Carthy

Annual ADFSL Conference on Digital Forensics, Security and Law

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is …

Live Gpu Forensics: The Process Of Recovering Video Frames From Nvidia Gpu, Yazeed M. Albabtain, Baijian Yang

Annual ADFSL Conference on Digital Forensics, Security and Law

The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The …

Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3 Drone As A Case Study, Alan Roder, Kim-Kwang Raymond Choo, Nhien-A Le-Khac

Annual ADFSL Conference on Digital Forensics, Security and Law

Drones (also known as Unmanned Aerial Vehicles – UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be …

Detection And Recovery Of Anti-Forensic (Vault) Applications On Android Devices, Michaila Duncan, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Significant number of mobile device users currently employ anti-forensics applications, also known as vault or locker applications, on their mobile devices in order to hide files such as photos. Because of this, investigators are required to spend a large portion of their time manually looking at the applications installed on the device. Currently, there is no automated method of detecting these anti-forensics applications on an Android device. This work presents the creation and testing of a vault application detection system to be used on Android devices. The main goal of this work is twofold: (i) Detecting and reporting the presence …