Forensic Science and Technology Commons^™

Knowledge Expiration In Security Awareness Training, Tianjian Zhang

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Positive Identification Of Lsb Image Steganography Using Cover Image Comparisons, Michael Pelosi, Nimesh Poudel, Pratap Lamichhane, Devon Lam, Gary Kessler, Joshua Macmonagle

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we introduce a new software concept specifically designed to allow the digital forensics professional to clearly identify and attribute instances of LSB image steganography by using the original cover image in side-by-side comparison with a suspected steganographic payload image. The “CounterSteg” software allows detailed analysis and comparison of both the original cover image and any modified image, using sophisticated bit- and color-channel visual depiction graphics. In certain cases, the steganographic software used for message transmission can be identified by the forensic analysis of LSB and other changes in the payload image. The paper demonstrates usage and typical …

Exploring The Use Of Graph Databases To Catalog Artifacts For Client Forensics, Rose Shumba

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud computing has revolutionized the methods by which digital data is stored, processed, and transmitted. It is providing users with data storage and processing services, enabling access to resources through multiple devices. Although organizations continue to embrace the advantages of flexibility and scalability offered by cloud computing, insider threats are becoming a serious concern as cited by security researchers. Insiders can use authorized access to steal sensitive information, calling for the need for an investigation. This concept paper describes research in progress towards developing a Neo4j graph database tool to enhance client forensics. The tool, with a Python interface, allows …

Precognition: Automated Digital Forensic Readiness System For Mobile Computing Devices In Enterprises, Jayaprakash Govindaraj, Robin Verma, Gaurav Gupta

Annual ADFSL Conference on Digital Forensics, Security and Law

Enterprises are facing an unprecedented risk of security incidents due to the influx of emerging technologies, like smartphones and wearables. Most of the current Mobile security systems are not maturing in pace with technological advances. They lack the ability to learn and adapt from the past knowledge base. In the case of a security incident, enterprises find themselves underprepared for the lack of evidence and data. The systems are not designed to be forensic ready. There is a need for automated security analysis and forensically ready solution, which can learn and continuously adapt to new challenges, improve efficiency and productivity …

Non-Use Of A Mobile Phone During Conducting Crime Can Also Be Evidential, Vinod Polpaya Bhattathiripad Ph D

Annual ADFSL Conference on Digital Forensics, Security and Law

Cyber-clever criminals who are aware of the consequence of using mobile phones during conducting crimes often stay away from their phones while involved in crimes. Some of them even change their handset and SIM card, subsequently. This article looks into how, intentional disassociation (and even unintentional non-use) of mobile phone in (non-cyber) crimes, can become evidential clues of the perpetrators’ involvement in criminal acts. With the help of a recent judicial episode, this article reveals how extremely careful and masterful handling of extensive and voluminous Call Details Records and tower dumps by a cyber-savvy investigating official can unearth evidential clues …

Forensic Analysis Of The Exfat Artifacts, Yves Vandermeer, An Lekhac, Tahar Kechadi, Joe Carthy

Annual ADFSL Conference on Digital Forensics, Security and Law

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is …

Live Gpu Forensics: The Process Of Recovering Video Frames From Nvidia Gpu, Yazeed M. Albabtain, Baijian Yang

Annual ADFSL Conference on Digital Forensics, Security and Law

The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The …

Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3 Drone As A Case Study, Alan Roder, Kim-Kwang Raymond Choo, Nhien-A Le-Khac

Annual ADFSL Conference on Digital Forensics, Security and Law

Drones (also known as Unmanned Aerial Vehicles – UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be …

Detection And Recovery Of Anti-Forensic (Vault) Applications On Android Devices, Michaila Duncan, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Significant number of mobile device users currently employ anti-forensics applications, also known as vault or locker applications, on their mobile devices in order to hide files such as photos. Because of this, investigators are required to spend a large portion of their time manually looking at the applications installed on the device. Currently, there is no automated method of detecting these anti-forensics applications on an Android device. This work presents the creation and testing of a vault application detection system to be used on Android devices. The main goal of this work is twofold: (i) Detecting and reporting the presence …

Forensic Entomology And The Order Coleoptera, Carrie Pratt

Essential Studies UNDergraduate Showcase

Medico-legal forensic entomology is the study of insects to aid in determining time, place, manner, and cause of death. Identification of the postmortem interval (PMI), or the time that has passed since a person has died, is arguably one of the most important pieces of information that forensic entomology can provide. The PMI can be found using either insect developmental rates or entomofaunal succession, the arrival of different insects at a body at different time points.

The largest group of insects, the beetles, is the order Coleoptera, which contains 25% of all animal species. Members of this order are critical …

A Forensic Investigation Into The Possible Origins Of Three Human Skeletons, Jefferson P. Sinnott

Forensic Science Theses

The Anthropology Department at Buffalo State has three human skeletons that have been part of the department’s collection for several years. The origin of the skeletons is currently unknown. Modern DNA techniques coupled with forensic anthropological techniques may now allow us to determine with some certainty the geographic origin of the skeletons. Ancestry, sex, age, and stature were assessed using current anthropological techniques. Afterwards, one tooth from each of the three skeletons was extracted, pulverized and DNA was isolated. Y-STR fragment size analysis of the DNA samples can provide information about the patrilineage of male individuals. Mitochondrial DNA sequencing analysis …

Evaluation Of Illumina’S Forenseqtm Signature Prep Kit For Eye And Hair Color As Well As Biogeographical Ancestry Predictions, Krupa Vijaykumar Jani

Student Theses

This study examined and analyzed 266 samples using ForenSeq^TM Signature Prep Kit B. Samples from various populations such as African American, East Asian, South Asian, European, and Mixed population were included in the study. Primer Mix B targets 27 autosomal STRs (aSTRs), 24 Y-STRs, 7 X-STRs, and 94 identity Single Nucleotide Polymorphisms (iSNPs), 24 phenotypic SNPs (pSNPs), and 56 ancestry SNPs (aSNPs), coming to a total of 231 targets. The study mainly focused on the quality of data generated by the instrument as well as for the accuracy of eye and hair color as well as biogeographical ancestry predictions …

Ant Predation Of Blow Flies During Decomposition And Its Potential Impact On Pmi Estimations, Vincent J. Nappi

Student Theses

When an organism dies, the process of decomposition begins and many insects are attracted to the decomposing remains, or carrion, as a prospective food source for themselves, or their offspring. Blow flies (Family: Calliphoridae), in particular, are one of the first insects to discover and colonize a dead body due to the ability to detect a decomposing resource from large distances. As a result, forensic entomologists take advantage of the behavior and developmental cycles of early colonizers to calculate the post-mortem interval (PMI) in order to determine the time since death. However, along with the insects that are attracted to …

Using Pattern Area Ridge Flow In The Three Areas Of The Palm To Determine Classification Trends, Ashton Horton

Honors Theses

Friction ridge skin is only located on the fingers, palms, and soles of feet. These ridges have been used to make identifications since before the twentieth century. These methods may be the basis of scientific testimony in court because of the amount of research that has been conducted in fingerprint identification. Courts uphold these techniques because of three principles behind fingerprint identification: fingerprints are unique because no two are the same, they will not change from the time they are formed in the womb until post-mortem decomposition, and they can be objectively classified using a general classification system. Little research …

A Validation Study Of Blueview™ Gunpowder Particle Testing Kit, Hanna Lester

Honors Theses

The examination of gunshot residue is often an integral part of evidence processing. The aim of this preliminary study is to validate the use of the BlueView Gunshot Particle Test Kit in the field. This was done by comparing the results of the presumptive tests using the BlueView Gunshot Particle Test Kit to confirmatory test results using a scanning electron microscope. This study used both collection techniques to collect samples for presumptive tests and confirmatory tests. Gunshot residue samples were collected from the hands after a series of guns were fired, and positive results were obtained from the presumptive and …

Analyzing Palm Print Shapes With Pressure And Distortion, Whitney Grannan

Honors Theses

While much research exists on latent fingerprints, there is a lack of research on palm prints. This study aims to discover how the variable of pressure affects the distortion of latent palm prints recovered from a crime scene. This study used various development techniques to extract prints from aluminum Coca-Cola cans, white copy paper, and household steak knives. The collected prints were scanned into the AFIX Tracker system and an auto-extract number, based on the number of minutiae points, was generated automatically from the system. These auto-extract numbers were then compared to a baseline, which consisted of an average of …

Exploring Various Techniques To Process And Identify Latent Friction Ridge Details From Fingers On Semi-Porous Surfaces, Emily Campo

Honors Theses

Numerous terrorist groups in the Middle East have been recently making detonators for IEDs (Improvised Explosive Devices) using items as basic as flip flops. Because of the semi-porous nature of flip flops, military forensic response teams have been unable to find an effective method through which they can identify, process, and lift latent fingerprints from the surface of a flip flop. The present study aims to use three fingerprint principles to formulate a reliable method that can be used for such purposes. This study specifically investigated the potential use of powders and cyanoacrylate fuming as processing techniques. The case study …

Smoke But No Fire: When Innocent People Are Wrongly Convicted Of Crimes That Never Happened, Jessica S. Henry

Department of Justice Studies Faculty Scholarship and Creative Works

Nearly one-third of exonerations involve the wrongful conviction of an innocent person for a crime that never actually happened, such as when the police plant drugs on an innocent person, a scorned lover invents a false accusation, or an expert mislabels a suicide as a murder. Despite the frequency with which no-crime convictions take place, little scholarship has been devoted to the subject. This Article seeks to fill that gap in the literature by exploring no-crime wrongful convictions as a discrete and unique phenomenon within the wrongful convictions universe. This Article considers three main factors that contribute to no-crime wrongful …

Automated Man-In-The-Middle Attack Against Wi‑Fi Networks, Martin Vondráček, Jan Pluskal, Ondřej Ryšavý

Journal of Digital Forensics, Security and Law

Currently used wireless communication technologies suffer security weaknesses that can be exploited allowing to eavesdrop or to spoof network communication. In this paper, we present a practical tool that can automate the attack on wireless security. The developed package called wifimitm provides functionality for the automation of MitM attacks in the wireless environment. The package combines several existing tools and attack strategies to bypass the wireless security mechanisms, such as WEP, WPA, and WPS. The presented tool can be integrated into a solution for automated penetration testing. Also, a popularization of the fact that such attacks can be easily automated …

Understanding The Sexual Assault Kit Backlog In Pennsylvania, Kallie Crawford, Lyndsie Ferrara

Graduate Student Research Symposium

According to the FBI, to date, there are more than 400,000 untested sexual assault kits nationwide. While this is a huge issue that cannot be solved overnight, continual improvements and changes are needed to reduce and hopefully eliminate the backlog.

This research examines work going on nationwide and aims to better understand the backlog issues specifically in Pennsylvania. Furthermore, the research examines a program utilized by the law enforcement community that garnered necessary resources. First, a comprehensive review of improved practices in proactive jurisdictions of Ohio, Houston, Texas, and Detroit, Michigan was conducted to identify general policies and procedures that …