Foundational Forensic Techniques for Cellular and Ad Hoc Multi-hop Networks

The Internet has become an integral part of our nation's critical socio-economic infrastructure. With its heightened use and growing complexity however, organizations are at greater risk of cyber crimes. To aid in the investigation of crimes committed on or via the Internet, a network forensics analysis tool pulls together needed digital evidence. It provides a platform for performing deep network analysis by capturing, recording and analyzing network events to find out the source of a security attack or other information security incidents. Existing network forensics work has been mostly focused on the Internet and fixed networks. But the exponential growth and use of wireless technologies, coupled with their unprecedented characteristics, necessitates the development of new network forensic analysis tools. This dissertation fostered the emergence of a new research field in cellular and ad-hoc network forensics. It was one of the first works to identify this problem and offer fundamental techniques and tools that laid the groundwork for future research. In particular, it introduced novel methods to record network incidents and report logged incidents. For recording incidents, location is considered essential to documenting network incidents. However, in network topology spaces, location cannot be measured due to absence of a 'distance metric'. Therefore, a novel solution was proposed to label locations of nodes within network topology spaces, and then to authenticate the identity of nodes in ad hoc environments. For reporting logged incidents, a novel technique based on Distributed Hash Tables (DHT) was adopted. Although the direct use of DHTs for reporting logged incidents would result in an uncontrollably recursive traffic, a new mechanism was introduced that overcome this recursive process. These logging and reporting techniques aided forensics over cellular and ad-hoc networks, which in turn increased their ability to track and trace attacks to their source. These techniques were a starting point for further research and development that would result in equipping future ad hoc networks with forensic components to complement existing security mechanisms.

The Use of Hyphenated Spectrometric Techniques for the Environmental Forensic Assessment of Non-Traditional Pollutants and Degradates in the Greater Florida Everglades

A comprehensive investigation of sensitive ecosystems in South Florida with the main goal of determining the identity, spatial distribution, and sources of both organic biocides and trace elements in different environmental compartments is reported. This study presents the development and validation of a fractionation and isolation method of twelve polar acidic herbicides commonly applied in the vicinity of the study areas, including e.g. 2,4-D, MCPA, dichlorprop, mecroprop, picloram in surface water. Solid phase extraction (SPE) was used to isolate the analytes from abiotic matrices containing large amounts of dissolved organic material. Atmospheric-pressure ionization (API) with electrospray ionization in negative mode (ESP-) in a Quadrupole Ion Trap mass spectrometer was used to perform the characterization of the herbicides of interest. The application of Laser Ablation-ICP-MS methodology in the analysis of soils and sediments is reported in this study. The analytical performance of the method was evaluated on certified standards and real soil and sediment samples. Residential soils were analyzed to evaluate feasibility of using the powerful technique as a routine and rapid method to monitor potential contaminated sites. Forty eight sediments were also collected from semi pristine areas in South Florida to conduct screening of baseline levels of bioavailable elements in support of risk evaluation. The LA-ICP-MS data were used to perform a statistical evaluation of the elemental composition as a tool for environmental forensics. A LA-ICP-MS protocol was also developed and optimized for the elemental analysis of a wide range of elements in polymeric filters containing atmospheric dust. A quantitative strategy based on internal and external standards allowed for a rapid determination of airborne trace elements in filters containing both contemporary African dust and local dust emissions. These distributions were used to qualitative and quantitative assess differences of composition and to establish provenance and fluxes to protected regional ecosystems such as coral reefs and national parks.

Validation of an Analytical Method for the Identification of SmartWater CSI Forensic Marking Technology

SmartWater is a chemical taggant used as a crime deterrent. The chemical taggant is a colorless liquid that fluoresces yellow under ultra-violet (UV) light and contains distinctive, identifiable and traceable elemental composition. For instance, upon a break and entry scenario, the burglar is sprayed with a solution that has an elemental signature custom-made to a specific location. The residues of this taggant persist on skin and other objects and can be easily recovered for further analysis. The product has been effectively used in Europe as a crime deterrent and has been recently introduced in South Florida. In 2014, Fourt Lauderdale Police Department reported the use of SmartWater products with a reduction in burglaries of 14% [1]. The International Forensic Research Institute (IFRI) at FIU validated the scientific foundation of the methods of recovery and analysis of these chemical tagging systems using LA-ICP-MS. Analytical figures of merit of the method such as precision, accuracy, limits of detection, linearity and selectivity are reported in this study. Moreover, blind samples were analyzed by LA-ICP-MS to compare the chemical signatures to the company’s database and evaluate error rates and the accuracy of the method. This study demonstrated that LA-ICP-MS could be used to effectively detect these traceable taggants to assist law enforcement agencies in the United States with cases involving transfer of these forensic coding systems.

The Development of Forensic Social Work in Spain

The focus of this article is to explain the state of research work with regard to the specialty of forensic social work in Spain. The study was carried out as part of the activities developed by Research Team 940102 ‘Observatory for Social Intervention in Organizations’ from the University Complutense of Madrid and funded by this university.

Analysis of White Latex Paints using Laser Induced Breakdown Spectroscopy for Forensic Applications

The analysis of white latex paint is a problem for forensic laboratories because of difficulty in differentiation between samples. Current methods provide limited information that is not suitable for discrimination. Elemental analysis of white latex paints has resulted in 99% discriminating power when using LA-ICP-MS; however, mass spectrometers can be prohibitively expensive and require a skilled operator. A quick, inexpensive, effective method is needed for the differentiation of white latex paints. In this study, LIBS is used to analyze 24 white latex paint samples. LIBS is fast, easy to operate, and has a low cost. Results show that 98.1% of variation can be accounted for via principle component analysis, while Tukey pairwise comparisons differentiated 95.6% with potassium as the elemental ratio, showing that the discrimination capabilities of LIBS are comparable to those of LA-ICP-MS. Due to the many advantages of LIBS, this instrument should be considered a necessity for forensic laboratories.

Development of Advanced Capillary Electrophoresis Techniques with UV and Mass Spectrometry Detection for Forensic, Pharmaceutical and Environmental Applications

Capillary electrophoresis (CE) is a modern analytical technique, which is electrokinetic separation generated by high voltage and taken place inside the small capillaries. In this dissertation, several advanced capillary electrophoresis methods are presented using different approaches of CE and UV and mass spectrometry are utilized as the detection methods. Capillary electrochromatography (CEC), as one of the CE modes, is a recent developed technique which is a hybrid of capillary electrophoresis and high performance liquid chromatography (HPLC). Capillary electrochromatography exhibits advantages of both techniques. In Chapter 2, monolithic capillary column are fabricated using in situ photoinitiation polymerization method. The column was then applied for the separation of six antidepressant compounds. Meanwhile, a simple chiral separation method is developed and presented in Chapter 3. Beta cycodextrin was utilized to achieve the goal of chiral separation. Not only twelve cathinone analytes were separated, but also isomers of several analytes were enantiomerically separated. To better understand the molecular information on the analytes, the TOF-MS system was coupled with the CE. A sheath liquid and a partial filling technique (PFT) were employed to reduce the contamination of MS ionization source. Accurate molecular information was obtained. It is necessary to propose, develop, and optimize new techniques that are suitable for trace-level analysis of samples in forensic, pharmaceutical, and environmental applications. Capillary electrophoresis (CE) was selected for this task, as it requires lower amounts of samples, it simplifies sample preparation, and it has the flexibility to perform separations of neutral and charged molecules as well as enantiomers. Overall, the study demonstrates the versatility of capillary electrophoresis methods in forensic, pharmaceutical, and environmental applications.

Exploring Forensic Nursing Ethics and Practice: Roles, Loyalties and Photodocumentation Practices

Thesis (Ph.D.)--University of Washington, 2016-08

Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

In vitro studies of drug transformations: application to forensic toxicology

The forensic toxicologist faces challenges in the detection of drugs and poisons in biological samples due to transformations which occur both during life and after death. For example, changes can result from drug metabolism during life or from the use of formalin solution for post mortem embalming purposes. The former requires the identification of drug metabolites and the latter the identification of chemical reaction products in order to know which substances had been administered. The work described in this thesis was aimed at providing ways of tackling these challenges and was divided into two parts. Part 1 investigated the use of in vitro drug metabolism by human liver microsomes (HLM) to obtain information on drug metabolites and Part 2 investigated the chemical reactions of drugs and a carbamate pesticide with formalin solution and formalin-blood. The initial aim of part I was to develop an in vitro metabolism method using HLM, based on a literature review of previous studies of this type. MDMA was chosen as a model compound to develop the HLM method because its metabolism was known and standards of its metabolites were commercially available. In addition, a sensitive and selective method was developed for the identification and quantitation of hydrophilic phase I drug metabolites using LC/MS/MS with a conventional reverse-phase (C18) column. In order to obtain suitable retention factors for polar drug metabolites on this column, acetyl derivatives were evaluated for converting the metabolites to more lipophilic compounds and an optimal separation system was developed. Acetate derivatives were found to be stable in the HPLC mobile phase and to provide good chromatographic separation of the target analytes. In vitro metabolism of MDMA and, subsequently, of other drugs involved incubation of 4 µg drug substance in pH 7.4 buffer with an NADPH generating system (NGS) at 37oC for 90 min with addition of more NGS after 30 min. The reaction was stopped at 90 min by the addition of acetonitrile before extraction of the metabolites. Acetate derivatives of MDMA metabolites were identified by LC/MS/MS using multiple reaction monitoring (MRM). Three phase I metabolites (both major and minor metabolites) of MDMA were detected in HLM samples. 3,4-dihydroxy-methamphetamine and 4-hydroxy-3-methoxymethamphetamine were found to be major metabolites of MDMA whereas 3,4-methylenedioxyamphetamine was found to be a minor metabolite. Subsequently, ten MDMA positive urines were analysed to compare the metabolite patterns with those produced by HLM. An LC/MS method for MDMA and its metabolites in urine samples was developed and validated. The method demonstrated good linearity, accuracy and precision and insignificant matrix effects, with limits of quantitation of 0.025 µg/ml. Moreover, derivatives of MDMA and its metabolites were quantified in all 10 positive human urine samples. The urine metabolite pattern was found to be similar to that from HLM. The second aim of Part 1 was to use the HLM system to study the metabolism of some new psychoactive substances, whose misuse worldwide has necessitated the development of analytical methods for these drugs in biological specimens. Methylone and butylone were selected as representative cathinones and para-methoxyamphetamine (PMA) was chosen as a representative ring-substituted amphetamine, because of the involvement of these drugs in recent drug-related deaths, because of a relative lack of information on their metabolism, and because reference standards of their metabolites were not commercially available. An LC/MS/MS method for the analysis of methylone, butylone, PMA and their metabolites was developed. Three phase I metabolites of methylone and butylone were detected in HLM samples. Ketone reduction to β-OH metabolites and demethylenation to dihydroxy-metabolites were found to be major phase I metabolic pathways of butylone and methylone whereas N-demethylation to nor-methylone and nor-butylone were found to be minor pathways. Also, demethylation to para-hydroxyamphetamine was found to be a major phase I metabolic pathway of PMA whereas β-hydroxylation to β-OH-PMA was found to be a minor pathway. Formaldehyde is used for embalming, to reduce decomposition and preserve cadavers, especially in tropical countries such as Thailand. Drugs present in the body can be exposed to formaldehyde resulting in decreasing concentrations of the original compounds and production of new substances. The aim of part II of the study was to evaluate the in vitro reactions of formaldehyde with selected drug groups including amphetamines (amphetamine, methamphetamine and MDMA), benzodiazepines (alprazolam and diazepam), opiates (morphine, hydromorphone, codeine and hydrocodone) and with a carbamate insecticide (carbosulfan). The study would identify degradation products to serve as markers for the parent compounds when these were no longer detectable. Drugs standards were spiked in 10% formalin solution and 10% formalin blood. Water and whole blood without formalin were used for controls. Samples were analysed by LC/MS/MS at different times from the start, over periods of up to 30 days. Amphetamine, methamphetamine and MDMA were found to rapidly convert to methamphetamine, DMA and MDDMA respectively, in both formalin solution and formalin blood, confirming the Eschweiler-Clarke reaction between amine-containing compounds and formaldehyde. Alprazolam was found to be unstable whereas diazepam was found to be stable in both formalin solution and water. Both were found to hydrolyse in formalin solution and to give open-ring alprazolam and open-ring diazepam. Other alprazolam conversion products attached to paraformaldehyde were detected in both formalin solution and formalin blood. Morphine and codeine were found to be more stable than hydromorphone and hydrocodone in formalin solution. Conversion products of hydromorphone and hydrocodone attached to paraformaldehyde were tentatively identified in formalin solution. Moreover, hydrocodone and hydromorphone rapidly decreased within 24 h in formalin blood and could not be detected after 7 days. Carbosulfan was found to be unstable in formalin solution and was rapidly hydrolysed within 24 h, whereas in water it was stable up to 48 h. Carbofuran was the major degradation product, plus smaller amounts of other products, 3-ketocarbofuran and 3-hydrocarbofuran. By contrast, carbosulfan slowly hydrolysed in formalin-blood and was still detected after 15 days. It was concluded that HLM provide a useful tool for human drug metabolism studies when ethical considerations preclude their controlled administration to humans. The use of chemical derivatisation for hydrophilic compounds such as polar drug metabolites for analysis by LC/MS/MS with a conventional C18 column is effective and inexpensive, and suitable for routine use in the identification and quantitation of drugs and their metabolites. The detection of parent drugs and their metabolites or conversion and decomposition products is potentially very useful for the interpretation of cases in forensic toxicology, especially when the original compounds cannot be observed.

Attachment Style, Therapeutic Alliance and Recovery in forensic mental health: the A-STAR study and clinical research portfolio

Background: Research suggests that forensic mental health services and staff can play an important role in the recognition and intervention with attachment-related behaviours to promote engagement and recovery. There is a lack of literature exploring whether the attachment needs of forensic service-users are recognised and, associations between attachment style and factors predictive of recovery. Aims: This study aimed to examine the extent to which service-users and keyworkers agree about service-users’ attachment and to identify whether attachment was associated with service attachment, working alliance, ward climate and recovery. Methods: Twenty-two service-users from low and medium secure forensic services, completed questionnaire measures of their attachment style, service attachment, working alliance, ward climate and experiences of recovery. Nineteen keyworkers completed measures of the service-users attachment style and working alliance. Results: There was strong agreement between service-users and staff for attachment anxiety (ICC=0.71) but poor agreement for attachment avoidance (ICC=0.39). Service attachment was associated with more positive perceptions of staff support (r=0.49) and avoidant attachment was associated with lower ratings of recovery (r=-0.51). Correlations between attachment style and service attachment, working alliance and ward climate were small and non-significant. Conclusions: A focus on staff training to support recognition of the nature and impact of avoidant attachment styles is indicated. The findings suggest that interventions to enhance staff - service-user relationships may be important for service attachment and indeed promotion of a recovery focused orientation amongst service-users high in avoidant attachment may improve wellbeing and outcomes.