Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

Using multiple GPUs to accelerate string searching for digital forensic analysis

String searching within a large corpus of data is an important component of digital forensic (DF) analysis techniques such as file carving. The continuing increase in capacity of consumer storage devices requires corresponding im-provements to the performance of string searching techniques. As string search-ing is a trivially-parallelisable problem, GPGPU approaches are a natural fit – but previous studies have found that local storage presents an insurmountable performance bottleneck. We show that this need not be the case with modern hardware, and demonstrate substantial performance improvements from the use of single and multiple GPUs when searching for strings within a typical forensic disk image.

Galectin-3 Overexpression in Invasive Laryngeal Carcinoma, Assessed by Computer-assisted Analysis

The larynx is the most common site of malignancy in the upper aerodigestive tract. In Brazil, malignant laryngeal lesions represent 2% of all cancers, with similar to 3000 annual deaths. The association between human papillomavirus (HPV) and laryngeal cancer is still controversial. The aim of the present retrospective study was to determine the expression of galectin-3 immunoperoxidase in laryngeal carcinoma by examining paraffin-em bedded larynx biopsies from 65 patients, 10 in situ laryngeal carcinomas, 27 laryngeal carcinomas without metastases, and 28 with metastases. Twenty-eight cervical lymph nodes from patients with metastatic lesions were also evaluated. Nested PCR was performed to detect and type HPV DNA. Galectin-3 expression was assessed by immunohistochemistry using a computer-assisted system. Among 65 patients, 55 (84.6%)were positive to beta-globin (internal control); 10 (15.4%) patients were beta-globin negative and were excluded from the HPV evaluation. Thus, 7 (12.7%) out of 55 patients were HPV positive and 48 (87.3%) out of 55 patients were HPV negative. High expression of galectin-3 was observed in invasive laryngeal tumors, suggesting that galectin-3 could be associated with the invasiveness and aggressiveness of laryngeal carcinomas. (J Histochem Cytochem 57:665-673, 2009)

The application of chemometrics on Infrared and Raman spectra as a tool for the forensic analysis of paints

The aim of this work is to evaluate the capabilities and limitations of chemometric methods and other mathematical treatments applied on spectroscopic data and more specifically on paint samples. The uniqueness of the spectroscopic data comes from the fact that they are multivariate - a few thousands variables - and highly correlated. Statistical methods are used to study and discriminate samples. A collection of 34 red paint samples was measured by Infrared and Raman spectroscopy. Data pretreatment and variable selection demonstrated that the use of Standard Normal Variate (SNV), together with removal of the noisy variables by a selection of the wavelengths from 650 to 1830 cm−1 and 2730-3600 cm−1, provided the optimal results for infrared analysis. Principal component analysis (PCA) and hierarchical clusters analysis (HCA) were then used as exploratory techniques to provide evidence of structure in the data, cluster, or detect outliers. With the FTIR spectra, the Principal Components (PCs) correspond to binder types and the presence/absence of calcium carbonate. 83% of the total variance is explained by the four first PCs. As for the Raman spectra, we observe six different clusters corresponding to the different pigment compositions when plotting the first two PCs, which account for 37% and 20% respectively of the total variance. In conclusion, the use of chemometrics for the forensic analysis of paints provides a valuable tool for objective decision-making, a reduction of the possible classification errors, and a better efficiency, having robust results with time saving data treatments.

Fast gas chromatography and negative-ion chemical ionization tandem mass spectrometry for forensic analysis of cannabinoids in whole blood.

The present work describes a fast gas chromatography/negative-ion chemical ionization tandem mass spectrometric assay (Fast GC/NICI-MS/MS) for analysis of tetrahydrocannabinol (THC), 11-hydroxy-tetrahydrocannabinol (THC-OH) and 11-nor-9-carboxy-tetrahydrocannabinol (THC-COOH) in whole blood. The cannabinoids were extracted from 500 microL of whole blood by a simple liquid-liquid extraction (LLE) and then derivatized by using trifluoroacetic anhydride (TFAA) and hexafluoro-2-propanol (HFIP) as fluorinated agents. Mass spectrometric detection of the analytes was performed in the selected reaction-monitoring mode on a triple quadrupole instrument after negative-ion chemical ionization. The assay was found to be linear in the concentration range of 0.5-20 ng/mL for THC and THC-OH, and of 2.5-100 ng/mL for THC-COOH. Repeatability and intermediate precision were found less than 12% for all concentrations tested. Under standard chromatographic conditions, the run cycle time would have been 15 min. By using fast conditions of separation, the assay analysis time has been reduced to 5 min, without compromising the chromatographic resolution. Finally, a simple approach for estimating the uncertainty measurement is presented.

A framework for the forensic analysis of user interaction with social media

The increasing use of social media, applications or platforms that allow users to interact online, ensures that this environment will provide a useful source of evidence for the forensics examiner. Current tools for the examination of digital evidence find this data problematic as they are not designed for the collection and analysis of online data. Therefore, this paper presents a framework for the forensic analysis of user interaction with social media. In particular, it presents an inter-disciplinary approach for the quantitative analysis of user engagement to identify relational and temporal dimensions of evidence relevant to an investigation. This framework enables the analysis of large data sets from which a (much smaller) group of individuals of interest can be identified. In this way, it may be used to support the identification of individuals who might be ‘instigators’ of a criminal event orchestrated via social media, or a means of potentially identifying those who might be involved in the ‘peaks’ of activity. In order to demonstrate the applicability of the framework, this paper applies it to a case study of actors posting to a social media Web site.

First contribution of mites (Acari) to the forensic analysis of hanged corpses: a case study from Spain

This case study from North Spain, highlights the importance of the collection of mites in addition to insects, from crime scenes or corpses subjected to environmental constraints that reduce or minimise insect activity, such as hanged corpses. In addition, this analysis highlights the relevance of arthropods’ collection in the field, even after the corpse has been moved away for autopsy. Four species of mites, phoretic on carrion (Silphidae) and rove (Staphylinidae) beetles, complemented and reinforced the autopsy analysis as well as the scarce information provided by insect activity. Poecilochirus carabi Canestrini & Canestrini, 1882 and Poecilochirus (Physoparasitus) davydovae Hyatt, 1980 (Mesostigmata: Parasitidae) were found in association with two Silphidae, Nicrophorus Fabricius, 1775 and Necrodes Leach, 1815, only when sampled in the autopsy room; this is suggestive of host-switching of mites and was likely due to the lack of availability of specific carriers in the field. The interpretation of the activity of Parasitidae mites both in the field and the autopsy room allows a better understanding of the timing and circumstances of decomposition. Phoretic deutonymphs of Pelzneria Scheucher 1957 (Astigmata: Histiostomatidae) were highly abundant, mostly P. crenulata Oudemans, 1909 and are reported for the first time on a Staphylinidae rove beetle, Creophilus maxillosus (L., 1758). Surprisingly, in this case study no Pelzneria were associated with the Silphidae found, which are their most common hosts, such as Necrodes littoralis (L., 1758) and Nicrophorus interruptus (Stephens, 1830). All histiostomatids were removed from the staphylinid (rove beetle) collected from the soil, at the scene of death, suggesting a recent arrival of the beetle. The occurrence of Staphylinidae beetles and their associated mites, such as Parasitidae and Pelzneria, and the information they provided would have been easily overlooked or lost if only the autopsy sampling would have been considered in the analysis of the case. The four mite species are reported for the first time for the Iberian Peninsula.

Computer-assisted analysis of cell proliferation markers in oral lesions

Abnormalities in any component of the cell cycle regulatory machine may result in oral. cancer, and markers of cell proliferation have been used to determine the prognosis of tumor progression. The aim of this study was to determine whether silver-stained nucleolar organizer region (AgNOR) and Ki-67 measurements could improve the assessment of growth rates in oral lesions. Eighty-three oral biopsies were studied, 20 of which were classified as fibrous inflammatory hyperplasia (FIH), 40 as leukoplakia (LKP) and 23 as oral. squamous cell carcinoma (OSCC). Within the LKP group, 22 out of 29 biopsies were diagnosed as non-dysplastic leukoplakia (LK) and 18 as dysplastic teukoptakia (DLK), presenting discrete, moderate and severe dysplasia. Ki-67 immunotabeting of the lesions increased steadily in the following order: FIH, DLK, LK and OSCC, indicating that Ki-67 is a good marker for predicting the protiferative fraction among benign, premalignant and malignant oral lesions. The median values of AgNOR parameters indicate that the morphometric index gives better results regarding the proliferative rate than the numerical one. A series of linear regressions between AgNOR parameters and Ki-67 showed positive associations. We conclude that a combination of Ki-67 and morphometric AgNOR analyses could be used as an aid in the determination of the protiferative status of oral epithelial. cells in oral cancer. (C) 2007 Elsevier GmbH. All rights reserved.

Galectin-3 Overexpression in Invasive Laryngeal Carcinoma, Assessed by Computer-assisted Analysis

Conselho Nacional de Desenvolvimento Científico e Tecnológico (CNPq)

Computer-assisted analysis of p53 and PCNA expression in oral lesions infected with human papillomavirus

OBJECTIVE: To carry out a retrospective study to determine whether human papillomavirus (HPV) infection and immunohistochemical expression of p53 and proliferating cell nuclear antigen (PCNA) are related to the risk of oral cancer. STUDY DESIGN: Fifty-seven oral biopsies, consisting of 30 oral squamous papillomas (OSPs) and 27 oral squamous cell carcinomas (OSCCs) were tested for the presence of HPV 6/11 and 16/18 by in situ hybridization using catalyzed signal amplification and in situ hybridization. p53 And PCNA expression was analyzed by immunohistochemistry and evaluated quantitatively by image analysis. RESULTS: Nineteen of the 57 oral lesions (33.3%) were positive for HPV. HPV 6/11 was found in 6 of 30 (20%) OSPs and 1 of 27 (3.7%) OSCCs. HPV 16/18 was found in 10 of 27 (37%) OSCCs and 2 of 30 (6.7%) OSPs. Sixteen of the 19 HPV-positive cases (84.2%) were p53 negative; 5 (9%) were HPV 6/11 and 11 (19%) HPV 16/18, with an inverse correlation between the presence of HPV DNA and p53 expression (P=.017, P < .05). PCNA expression appeared in 18 (94.7%) of HPV positive cases, showing that HPV 16/18 was associated with intensity of PCNA expression and with OSCCs (P=.037, P < .05). CONCLUSION: Quantitative evaluation of p53 by image analysis showed an inverse correlation between p53 expression and HPV presence, suggesting protein degradation. Image analysis also demonstrated that PCNA expression was more intense in HPV DNA 16/18 OSCCs. These findings suggest involvement of high-risk HPV types in oral carcinogenesis.

Development of mev-eds methodology for forensic analysis on automotive headlights

A comparative study between three automotive headlights (conventional, halogen, and HID lamp) using scanning electron microscopy coupled with energy dispersive spectrometry (SEM-EDS) is described. Results show the possibility of conducting topographic and qualitative analysis of automotive light bulbs from vehicles involved in traffic accidents on the basis of similarities between the waste glass material left on the filaments. This should provide evidence as to whether the bulbs were energized at the time of the accident.

High-resolution dynamic computer simulation analysis of the behavior of sample components with pI values outside the pH gradient established by carrier ampholyte CIEF

The behavior of sample components whose pI values are outside the pH gradient established by 101 hypothetical biprotic carrier ampholytes covering a pH 6-8 range was investigated by computer simulation under constant current conditions with concomitant constant electroosmosis toward the cathode. Data obtained with the sample being applied between zones of carrier ampholytes and on the anodic side of the carrier ampholytes were studied and found to evolve into zone structures comprising three regions between anolyte and catholyte. The focusing region with the pH gradient is bracketed by two isotachopheretic zone structures comprising selected sample and carrier components as isotachophoretic zones. The isotachophoretic structures electrophoretically migrate in opposite direction and their lengths increase with time due to the gradual isotachophoretic decay at the pH gradient edges. Due to electroosmosis, however, the overall pattern is being transported toward the cathode. Sample components whose pI values are outside the established pH gradient are demonstrated to form isotachophoretic zones behind the leading cation of the catholyte (components with pI values larger than 8) and the leading anion of the anolyte (components with pI values smaller than 6). Amphoteric compounds with appropriate pI values or nonamphoteric components can act as isotachophoretic spacer compounds between sample compounds or between the leader and the sample with the highest mobility. The simulation data obtained provide for the first time insight into the dynamics of amphoteric sample components that do not focus within the established pH gradient.