Forensic Science and Technology Commons^™

Bayesian Approach To Toolmark Analysis, Antonio W. Del Valle

Student Theses

Statistical analysis of toolmarks using frequentist methods can be problematic for assorted reasons. Thus, in order to analyze toolmarks whilst avoiding these issues, a Bayesian approach is taken. Specifically for this thesis we discuss the computation of a specific Likelihood Ratio for toolmark comparisons. This Bayesian based approach involves using data already at hand in conjunction with a probability model in order to establish an estimate for its “value”, i.e. the “weight of evidence”. Making the calculations to obtain a Likelihood Ratio is very cumbersome and time consuming. Also many commercial software packages hide the process and underlying assumptions that …

Exploring Digital Evidence With Graph Theory, Imani Palmer, Boris Gelfand, Roy Campbell

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis phase of the digital forensic process is the most complex. The analysis phase remains very subjective to the views of the forensic practitioner. There are many tools dedicated to assisting the investigator during the analysis process. However, they do not address the challenges. Digital forensics is in need of a consistent approach to procure the most judicious conclusions from the digital evidence. The objective of this paper is to discuss the ability of graph theory, a study of related mathematical structures, to aid in the analysis phase of the digital forensic process. We develop a graph-based representation of …

Case Study: A New Method For Investigating Crimes Against Children, Hallstein Asheim Hansen, Stig Andersen, Stefan Axelsson, Svein Hopland

Annual ADFSL Conference on Digital Forensics, Security and Law

Investigations of crimes against children are often complex, both in terms of the varied and large amount of digital technology encountered and the offensive nature of the crimes. Such cases are numerous, large, and prioritised, requiring digital forensics competence. Earlier digital forensics was considered and treated as a typical forensic science like fingerprint analysis, performed in a laboratory isolated from the investigative team. This decoupled way of working has proved to be both inefficient and error prone.

At the Digital Forensic Unit of Oslo Police District we have developed a new way of working that addresses many of the problems …

Downstream Competence Challenges And Legal/Ethical Risks In Digital Forensics, Michael M. Losavio, Antonio Losavio

Annual ADFSL Conference on Digital Forensics, Security and Law

Forensic practice is an inherently human-mediated system, from processing and collection of evidence to presentation and judgment. This requires attention to human factors and risks which can lead to incorrect judgments and unjust punishments.

For digital forensics, such challenges are magnified by the relative newness of the discipline and the use of electronic evidence in forensic proceedings. Traditional legal protections, rules of procedure and ethics rules mitigate these challenges. Application of those traditions better ensures forensic findings are reliable. This has significant consequences where findings may impact a person's liberty or property, a person's life or even the political direction …

Digital Forensics Tool Selection With Multi-Armed Bandit Problem, Umit Karabiyik, Tugba Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital forensics investigation is a long and tedious process for an investigator in general. There are many tools that investigators must consider, both proprietary and open source. Forensics investigators must choose the best tool available on the market for their cases to make sure they do not overlook any evidence resides in suspect device within a reasonable time frame. This is however hard decision to make, since learning and testing all available tools make their job only harder. In this project, we define the digital forensics tool selection for a specific investigative task as a multi-armed bandit problem assuming that …

Detecting Deception In Asynchronous Text, Fletcher Glancy

Annual ADFSL Conference on Digital Forensics, Security and Law

Glancy and Yadav (2010) developed a computational fraud detection model (CFDM) that successfully detected financial reporting fraud in the text of the management’s discussion and analysis (MDA) portion of annual filings with the United States Securities and Exchange Commission (SEC). This work extends the use of the CFDM to additional genres, demonstrates the generalizability of the CFDM and the use of text mining for quantitatively detecting deception in asynchronous text. It also demonstrates that writers committing fraud use words differently from truth tellers.

Understanding Deleted File Decay On Removable Media Using Differential Analysis, James H. Jones Jr, Anurag Srivastava, Josh Mosier, Connor Anderson, Seth Buenafe

Annual ADFSL Conference on Digital Forensics, Security and Law

Digital content created by picture recording devices is often stored internally on the source device, on either embedded or removable media. Such storage media is typically limited in capacity and meant primarily for interim storage of the most recent image files, and these devices are frequently configured to delete older files as necessary to make room for new files. When investigations involve such devices and media, it is sometimes these older deleted files that would be of interest. It is an established fact that deleted file content may persist in part or in its entirety after deletion, and identifying the …

Development Of A Professional Code Of Ethics In Digital Forensics, Kathryn C. Seigfried-Spellar, Marcus Rogers, Danielle M. Crimmins 2184089

Annual ADFSL Conference on Digital Forensics, Security and Law

Academics, government officials, and practitioners suggest the field of digital forensics is in need of a professional code of ethics. In response to this need, the authors developed and proposed a professional code of ethics in digital forensics. The current paper will discuss the process of developing the professional code of ethics, which included four sets of revisions based on feedback and suggestions provided by members of the digital forensic community. The final version of the Professional Code of Ethics in Digital Forensics includes eight statements, and we hope this is a step toward unifying the field of digital forensics …

Fast Filtering Of Known Png Files Using Early File Features, Sean Mckeown, Gordon Russell, Petra Leimich

Annual ADFSL Conference on Digital Forensics, Security and Law

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given media, comparing individual digests with a database of known contraband. However, the large capacities of modern storage media, and increased time pressure on forensics examiners, necessitates that more efficient processing mechanisms be developed. This work describes a technique for creating signatures for images of the PNG format which only requires a tiny fraction of the file to effectively distinguish between a large number of images. Highly …

Detect Kernel-Mode Rootkits Via Real Time Logging & Controlling Memory Access, Satoshi Tanda, Irvin Homem, Igor Korkin

Annual ADFSL Conference on Digital Forensics, Security and Law

Modern malware and spyware platforms attack existing antivirus solutions and even Microsoft PatchGuard. To protect users and business systems new technologies developed by Intel and AMD CPUs may be applied. To deal with the new malware we propose monitoring and controlling access to the memory in real time using Intel VT-x with EPT. We have checked this concept by developing MemoryMonRWX, which is a bare-metal hypervisor. MemoryMonRWX is able to track and trap all types of memory access: read, write, and execute. MemoryMonRWX also has the following competitive advantages: fine-grained analysis, support of multi-core CPUs and 64-bit Windows 10. MemoryMonRWX …

Harnessing Predictive Models For Assisting Network Forensic Investigations Of Dns Tunnels, Irvin Homem, Panagiotis Papapetrou

Annual ADFSL Conference on Digital Forensics, Security and Law

In recent times, DNS tunneling techniques have been used for malicious purposes, however network security mechanisms struggle to detect them. Network forensic analysis has been proven effective, but is slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper, we present a machine learning approach, based on feature subsets of network traffic evidence, to aid forensic analysis through automating the inference of protocols carried within DNS tunneling techniques. We explore four network protocols, namely, HTTP, HTTPS, FTP, and POP3. Three features are extracted from the DNS tunneled traffic: …

An Accidental Discovery Of Iot Botnets And A Method For Investigating Them With A Custom Lua Dissector, Max Gannon, Gary Warner, Arsh Arora

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper presents a case study that occurred while observing peer-to-peer network communications on a botnet monitoring station and shares how tools were developed to discover what ultimately was identified as Mirai and many related IoT DDOS Botnets. The paper explains how researchers developed a customized protocol dissector in Wireshark using the Lua coding language, and how this enabled them to quickly identify new DDOS variants over a five month period of study.

Kelihos Botnet: A Never-Ending Saga, Arsh Arora, Max Gannon, Gary Warner

Annual ADFSL Conference on Digital Forensics, Security and Law

This paper investigates the recent behavior of the Kelihos botnet, a spam-sending botnet that accounts for many millions of emails sent each day. The paper demonstrates how a team of students are able to perform a longitudinal malware study, making significant observations and contributions to the understanding of a major botnet using tools and techniques taught in the classroom. From this perspective the paper has two objectives: encouragement and observation. First, by providing insight into the methodology and tools used by student researchers to document and understand a botnet, the paper strives to embolden other academic programs to follow a …

Minimum Education Requirements For Crime Scene Investigators, Araseli Saldivar

Themis: Research Journal of Justice Studies and Forensic Science

The initial crime scene investigation is critical since it is the primary step in the investigative process; therefore, individuals assigned to process a scene should be highly educated. Improperly educated (or uneducated) crime scene investigators (CSIs) can mishandle evidence during an investigation, affecting the outcome of cases. The minimum education requirement for CSIs should transition from a high school diploma—the current requirement—toward a bachelor’s degree. The importance of acquiring a college-level education is observed in a study conducted on crime scene examiners in Australia. To determine the educational requirement for CSIs in the United States, information was gathered electronically from …

Optimizing Collection Of Trace Biological Samples From Vehicle Headrests, Kevin Tang, Jesse Ramirez, John Bond, Jocelyn Weart, Yvette Delatorre, Ian Fitch, Steven Lee

Themis: Research Journal of Justice Studies and Forensic Science

Tape-lifting and swabbing are two methods commonly used for collecting biological samples in the United Kingdom and United States to investigate vehicle crimes. Determining the optimal collection method may lead to an increase in generating DNA profiles and crime-solving. The objective of this study is to evaluate the efficiency of adhesive tape and the double-swab collection methods for investigating vehicle crimes with possible touch DNA samples. Two experiments were conducted to evaluate the use of tape-lifts and swabs on spiked common vehicle fabric materials. The efficiency of recovery between the two collection methods was performed using qPCR. The results from …

An Evaluation Of Escience Lab Kits For Online Learning, Diana Orozco

Themis: Research Journal of Justice Studies and Forensic Science

Higher education online science courses generally lack the hands-on components essential in understanding theories, methods, and techniques in chemistry and biology. Companies like eScience Labs construct kits to facilitate online learning, which provide students with hands-on activities relevant to their science courses. In order to evaluate ease, efficacy, and comprehension of the forensic science kits by eScience Labs was completed while writing observations of the activities during and after completion; the lab manual learning objectives were compared to results of activities and two stopwatches took elapsed time of each activity to compare with the stated times in the kit manual. …

Physical Match: Unique Fracture Patterns In Wooden Popsicle Sticks, Yiu Ming Sunny Lau

Themis: Research Journal of Justice Studies and Forensic Science

Physical match (or physical fit) evidence was considered reliable in court for years, until the Daubert case, which required standardized scientific methodology on all forensic evidence. Physical matching faces the same criticism as other forms of physical evidence (specifically, that it lacks a scientific foundation). Physical matching is based on the idea that when an object is fractured, the shape of each fragment is unique and it is not possible to recreate a fragment that is identical to any other. In this study, fifty wooden popsicle sticks were broken in half, the pieces were mixed, and then reconstructed using physical …

Forensics’ Fight: A Need For Aggressive Strategies Against Confirmation Bias, Madison Mcgowan

Themis: Research Journal of Justice Studies and Forensic Science

In 2009, the National Academy of Sciences produced a lengthy report illuminating significant weaknesses present within the forensic community. One complex fault found in forensics was conformation bias. Since it is within human nature to make decisions based on contextual information, assumptions, and pre-held opinions, confirmation bias is an issue that will continue to persist. Therefore, stronger efforts must be made to recognize and abate the problem of bias within the field of forensics in order to preserve the notion that forensic science exists to serve principles of both truth and justice. Accordingly, this paper argues for the fight against …

Moral Time And Homicide Investigations., David Stuart Lapsey Jr.

Electronic Theses and Dissertations

Previous literature explores the many dimensions of homicide investigations, including case and individual characteristics, evidence and investigative activities. However, little research delves into situational characteristics and their relationship to specific homicides, charge severity sought by prosecutors and sentence length given to homicide offenders. The current study sampled homicide cases (N=68) to gather baseline information and data regarding judicial outcomes. Donald Black’s Theory of Moral Time (2011) is tested and utilized as the study’s conceptual framework for the study’s hypotheses.

Jurisdiction, Privacy, And Ownership: Dna Technology And Field Dynamics In Conflict-Related Mass Fatalities, Stefan Schmitt, Dallas Mazoori

Genocide Studies and Prevention: An International Journal

This article explores the dynamics and challenges of undertaking human identifications in states experiencing armed conflict or emerging therefrom. It emphasises the integral role of the State in human identifications and the need for the legal acts of the State in identifying an individual and confirming their death to be integrated into any humanitarian response to repatriating the dead. Conflict-related mass fatalities occur in uncontrolled circumstances, making DNA-based human identifications necessary. In states lacking the necessary forensic infrastructure, the promise of expedited human identifications through outsourcing DNA work can lead to the State abdicating the necessary jurisdiction and scientific transparency …