FIA : an open foresic integration architecture for composing digital evidence

The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture (FIA) which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of integrating evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.

A framework for identifying associations in digital evidence using metadata

Digital forensics concerns the analysis of electronic artifacts to reconstruct events such as cyber crimes. This research produced a framework to support forensic analyses by identifying associations in digital evidence using metadata. It showed that metadata based associations can help uncover the inherent relationships between heterogeneous digital artifacts thereby aiding reconstruction of past events by identifying artifact dependencies and time sequencing. It also showed that metadata association based analysis is amenable to automation by virtue of the ubiquitous nature of metadata across forensic disk images, files, system and application logs and network packet captures. The results prove that metadata based associations can be used to extract meaningful relationships between digital artifacts, thus potentially benefiting real-life forensics investigations.

Forensic Geomorphology

Geomorphology plays a critical role in two areas of geoforensics: searching the land for surface or buried objects and sampling or imaging rural scenes of crime and control locations as evidence. Most of the associated geoscience disciplines have substantial bodies of work dedicated to their relevance in forensic investigations, yet geomorphology (specifically landforms, their mapping and evolution, soils and relationship to geology and biogeography) have had no such exposure. This is strange considering how fundamental to legal enquiries the location of a crime and its evolution are, as this article will demonstrate. This work aims to redress the balance by showing how geomorphology is featured in one of the earliest works on forensic science methods, and has continued to play a role in the sociology, archaeology, criminalistics and geoforensics of crime. The application geomorphology has in military/humanitarian geography and environmental/engineering forensics is briefly discussed as these are also regularly reviewed in courts of law

A Complexity Based Model for Quantifying Forensic Evidential Probabilities

An operational complexity model (OCM) is proposed to enable the complexity of both the cognitive and the computational components of a process to be determined. From the complexity of formation of a set of traces via a specified route a measure of the probability of that route can be determined. By determining the complexities of alternative routes leading to the formation of the same set of traces, the odds ratio indicating the relative plausibility of the alternative routes can be found. An illustrative application to a BitTorrent piracy case is presented, and the results obtained suggest that the OCM is capable of providing a realistic estimate of the odds ratio for two competing hypotheses. It is also demonstrated that the OCM can be straightforwardly refined to encompass a variety of circumstances.

Latin-American Society Of Forensic Genetics (SLAGF) results of the Interlaboratory Quality Control Exercise 2010-2011

Latin-American Society of Forensic Genetics (SLAGF) Interlaboratory Quality Control Exercise (2010-2011) included the analysis of three bloodstain samples in FTA Classic Card (three persons, biologically unrelated) and one theoretical exercise. There were 56 participating laboratories from 13 Latin-American countries that belong to society, were reported 70 STRs, including autosomal and sex chromosome markers with consensus in 53 STRs with a rate in reporting errors of 2.3%. Fifty-six laboratories reported results in theoretical exercise with mistakes in calculation of IP for each marker. It is necessary to hold meetings to discuss the results of this exercise to reach conclusions and recommendations on all aspects of DNA forensics analysis and paternity test, to improve results and quality in the results of each laboratory. © 2011 Elsevier B.V.

Development and validation of a D-loop mtDNA SNP assay for the screening of specimens in forensic casework

Mitochondrial DNA (mtDNA) analysis is usually a last resort in routine forensic DNA casework. However, it has become a powerful tool for the analysis of highly degraded samples or samples containing too little or no nuclear DNA, such as old bones and hair shafts. The gold standard methodology still constitutes the direct sequencing of polymerase chain reaction (PCR) products or cloned amplicons from the HVS-1 and HVS-2 (hypervariable segment) control region segments. Identifications using mtDNA are time consuming, expensive and can be very complex, depending on the amount and nature of the material being tested. The main goal of this work is to develop a less labour-intensive and less expensive screening method for mtDNA analysis, in order to aid in the exclusion of non-matching samples and as a presumptive test prior to final confirmatory DNA sequencing. We have selected 14 highly discriminatory single nucleotide polymorphisms (SNPs) based on simulations performed by Salas and Amigo (2010) [1] to be typed using SNaPShotTM (Applied Biosystems, Foster City, CA, USA). The assay was validated by typing more than 100 HVS-1/HVS-2 sequenced samples. No differences were observed between the SNP typing and DNA sequencing when results were compared, with the exception of allelic dropouts observed in a few haplotypes. Haplotype diversity simulations were performed using 172 mtDNA sequences representative of the Brazilian population and a score of 0.9794 was obtained when the 14 SNPs were used, showing that the theoretical prediction approach for the selection of highly discriminatory SNPs suggested by Salas and Amigo (2010) [1] was confirmed in the population studied. As the main goal of the work is to develop a screening assay to skip the sequencing of all samples in a particular case, a pair-wise comparison of the sequences was done using the selected SNPs. When both HVS-1/HVS-2 SNPs were used for simulations, at least two differences were observed in 93.2% of the comparisons performed. The assay was validated with casework samples. Results show that the method is straightforward and can be used for exclusionary purposes, saving time and laboratory resources. The assay confirms the theoretic prediction suggested by Salas and Amigo (2010) [1]. All forensic advantages, such as high sensitivity and power of discrimination, as also the disadvantages, such as the occurrence of allele dropouts, are discussed throughout the article. © 2013 Elsevier B.V.

Dental fluorescence: Potential forensic use

In cases of identification of bones, skeletal segments or isolated bones, searching for biotypologic diagnostic data to estimate an individual's age enables comparing these data with those of missing individuals. Enamel, dentin and pulp undergo remarkable changes during an individual's life. The enamel becomes more mineralized, smoother and thinner, and deteriorates because of physiological and pathological factors. Dental pulp decreases in volume due to the deposition of secondary dentin; thus, the dentin becomes thicker with time. In natural teeth, the fluorescence phenomenon occurs in dentin and enamel and changes in those tissues may alter the expression of the natural tooth color. The aim of this study was to assess the correlation between age and teeth fluorescence for individuals from different age groups. The sample consisted of 66 randomly selected Brazilians of both genders aged 7-63 years old. They were divided into 6 groups: Group 1 - aged 7-12 years, Group 2 - aged 13-20 years, Group 3 - aged 21-30 years, Group 4 - aged 31-40 years, Group 5 - aged 41-50 years and Group 6 - aged between 51 and 63 years. Upper right or left central incisors were used for the study. Restored and aesthetic rehabilitated teeth were excluded from the sample. The measurement of tooth fluorescence was carried out via computer analysis of digital images using the software ScanWhite DMC/Darwin Systems - Brazil. It was observed that dental fluorescence decreases when comparing the age groups 21-30, 31-40, 41-50 and 51-63 years. The results also showed that there is a statistically significant difference between the groups 41-50 years and 21-30 years (p=. 0.005) and also among the group 51-63 years and all other groups (p< 0.005). It can be concluded that dental fluorescence is correlated with age and has a similar and stable behavior from 7 to 20 years of age. It reaches its maximum expected value at the age of 26.5 years and thereafter decreases. © 2013 Elsevier B.V.

Getting in touch-3D printing in Forensic Imaging

With the increasing use of medical imaging in forensics, as well as the technological advances in rapid prototyping, we suggest combining these techniques to generate displays of forensic findings. We used computed tomography (CT), CT angiography, magnetic resonance imaging (MRI) and surface scanning with photogrammetry in conjunction with segmentation techniques to generate 3D polygon meshes. Based on these data sets, a 3D printer created colored models of the anatomical structures. Using this technique, we could create models of bone fractures, vessels, cardiac infarctions, ruptured organs as well as bitemark wounds. The final models are anatomically accurate, fully colored representations of bones, vessels and soft tissue, and they demonstrate radiologically visible pathologies. The models are more easily understood by laypersons than volume rendering or 2D reconstructions. Therefore, they are suitable for presentations in courtrooms and for educational purposes.

Determination of signature volatile odor chemicals emanating from novel biological specimens by non-invasive analytical techniques for the potential use in forensic identifications

Human scent, or the volatile organic compounds (VOCs) produced by an individual, has been recognized as a biometric measurement because of the distinct variations in both the presence and abundance of these VOCs between individuals. In forensic science, human scent has been used as a form of associative evidence by linking a suspect to a scene/object through the use of human scent discriminating canines. The scent most often collected and used with these specially trained canines is from the hands because a majority of the evidence collected is likely to have been handled by the suspect. However, the scents from other biological specimens, especially those that are likely to be present at scenes of violent crimes, have yet to be explored. Hair, fingernails and saliva are examples of these types of specimens. ^ In this work, a headspace solid phase microextraction gas chromatography-mass spectrometry (HS-SPME-GC-MS) technique was used for the identification of VOCs from hand odor, hair, fingernails and saliva. Sixty individuals were sampled and the profiles of the extracted VOCs were evaluated to assess whether they could be used for distinguishing individuals. Preliminary analysis of the biological specimens collected from an individual (intra-subject) showed that, though these materials have some VOCs in common, their overall chemical profile is different for each specimen type. Pair-wise comparisons, using Spearman Rank correlations, were made between the chemical profiles obtained from each subject, per a specimen type. Greater than 98.8% of the collected samples were distinguished from the subjects for all of the specimen types, demonstrating that these specimens can be used for distinguishing individuals. ^ Additionally, field trials were performed to determine the utility of these specimens as scent sources for human scent discriminating canines. Three trials were conducted to evaluate hair, fingernails and saliva in comparison to hand odor, which was considered the standard source of human odor. It was revealed that canines perform similarly to these alternative human scent sources as they do to hand odor implying that, though there are differences in the chemical profiles released by these specimens, they can still be used for the discrimination of individuals by trained canines.^

Determination of Signature Volatile Odor Chemicals Emanating from Novel Biological Specimens by Non-invasive Analytical Techniques for the Potential use in Forensic Identifications

Human scent, or the volatile organic compounds (VOCs) produced by an individual, has been recognized as a biometric measurement because of the distinct variations in both the presence and abundance of these VOCs between individuals. In forensic science, human scent has been used as a form of associative evidence by linking a suspect to a scene/object through the use of human scent discriminating canines. The scent most often collected and used with these specially trained canines is from the hands because a majority of the evidence collected is likely to have been handled by the suspect. However, the scents from other biological specimens, especially those that are likely to be present at scenes of violent crimes, have yet to be explored. Hair, fingernails and saliva are examples of these types of specimens. In this work, a headspace solid phase microextraction gas chromatography-mass spectrometry (HS-SPME-GC-MS) technique was used for the identification of VOCs from hand odor, hair, fingernails and saliva. Sixty individuals were sampled and the profiles of the extracted VOCs were evaluated to assess whether they could be used for distinguishing individuals. Preliminary analysis of the biological specimens collected from an individual (intra-subject) showed that, though these materials have some VOCs in common, their overall chemical profile is different for each specimen type. Pair-wise comparisons, using Spearman Rank correlations, were made between the chemical profiles obtained from each subject, per a specimen type. Greater than 98.8% of the collected samples were distinguished from the subjects for all of the specimen types, demonstrating that these specimens can be used for distinguishing individuals. Additionally, field trials were performed to determine the utility of these specimens as scent sources for human scent discriminating canines. Three trials were conducted to evaluate hair, fingernails and saliva in comparison to hand odor, which was considered the standard source of human odor. It was revealed that canines perform similarly to these alternative human scent sources as they do to hand odor implying that, though there are differences in the chemical profiles released by these specimens, they can still be used for the discrimination of individuals by trained canines.

Near-infrared spectroscopic studies of human scalp hair in a forensic context

Human hair is a relatively inert biopolymer and can survive through natural disasters. It is also found as trace evidence at crime scenes. Previous studies by FTIRMicrospectroscopy and – Attenuated Total Reflectance (ATR) successfully showed that hairs can be matched and discriminated on the basis of gender, race and hair treatment, when interpreted by chemometrics. However, these spectroscopic techniques are difficult to operate at- or on-field. On the other hand, some near infrared spectroscopic (NIRS) instruments equipped with an optical probe, are portable and thus, facilitate the on- or at –field measurements for potential application directly at a crime or disaster scene. This thesis is focused on bulk hair samples, which are free of their roots, and thus, independent of potential DNA contribution for identification. It explores the building of a profile of an individual with the use of the NIRS technique on the basis of information on gender, race and treated hair, i.e. variables which can match and discriminate individuals. The complex spectra collected may be compared and interpreted with the use of chemometrics. These methods can then be used as protocol for further investigations. Water is a common substance present at forensic scenes e.g. at home in a bath, in the swimming pool; it is also common outdoors in the sea, river, dam, puddles and especially during DVI incidents at the seashore after a tsunami. For this reason, the matching and discrimination of bulk hair samples after the water immersion treatment was also explored. Through this research, it was found that Near Infrared Spectroscopy, with the use of an optical probe, has successfully matched and discriminated bulk hair samples to build a profile for the possible application to a crime or disaster scene. Through the interpretation of Chemometrics, such characteristics included Gender and Race. A novel approach was to measure the spectra not only in the usual NIR range (4000 – 7500 cm-1) but also in the Visible NIR (7500 – 12800 cm-1). This proved to be particularly useful in exploring the discrimination of differently coloured hair, e.g. naturally coloured, bleached or dyed. The NIR region is sensitive to molecular vibrations of the hair fibre structure as well as that of the dyes and damage from bleaching. But the Visible NIR region preferentially responds to the natural colourants, the melanin, which involves electronic transitions. This approach was shown to provide improved discrimination between dyed and untreated hair. This thesis is an extensive study of the application of NIRS with the aid of chemometrics, for matching and discrimination of bulk human scalp hair. The work not only indicates the strong potential of this technique in this field but also breaks new ground with the exploration of the use of the NIR and Visible NIR ranges for spectral sampling. It also develops methods for measuring spectra from hair which has been immersed in different water media (sea, river and dam)

A model for computer profiling

This paper discusses the use of models in automatic computer forensic analysis, and proposes and elaborates on a novel model for use in computer profiling, the computer profiling object model. The computer profiling object model is an information model which models a computer as objects with various attributes and inter-relationships. These together provide the information necessary for a human investigator or an automated reasoning engine to make judgements as to the probable usage and evidentiary value of a computer system. The computer profiling object model can be implemented so as to support automated analysis to provide an investigator with the information needed to decide whether manual analysis is required.

Hash based disk imaging using AFF4

Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space, and are potentially applicable to forensic acquisition. Using the new AFF4 forensic file format we employ a hash based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash based imaging a reality.

A forensic investigation of single human hair fibres using FTIR-ATR spectroscopy and chemometrics

Human hair fibres are ubiquitous in nature and are found frequently at crime scenes often as a result of exchange between the perpetrator, victim and/or the surroundings according to Locard's Principle. Therefore, hair fibre evidence can provide important information for crime investigation. For human hair evidence, the current forensic methods of analysis rely on comparisons of either hair morphology by microscopic examination or nuclear and mitochondrial DNA analyses. Unfortunately in some instances the utilisation of microscopy and DNA analyses are difficult and often not feasible. This dissertation is arguably the first comprehensive investigation aimed to compare, classify and identify the single human scalp hair fibres with the aid of FTIR-ATR spectroscopy in a forensic context. Spectra were collected from the hair of 66 subjects of Asian, Caucasian and African (i.e. African-type). The fibres ranged from untreated to variously mildly and heavily cosmetically treated hairs. The collected spectra reflected the physical and chemical nature of a hair from the near-surface particularly, the cuticle layer. In total, 550 spectra were acquired and processed to construct a relatively large database. To assist with the interpretation of the complex spectra from various types of human hair, Derivative Spectroscopy and Chemometric methods such as Principal Component Analysis (PCA), Fuzzy Clustering (FC) and Multi-Criteria Decision Making (MCDM) program; Preference Ranking Organisation Method for Enrichment Evaluation (PROMETHEE) and Geometrical Analysis for Interactive Aid (GAIA); were utilised. FTIR-ATR spectroscopy had two important advantages over to previous methods: (i) sample throughput and spectral collection were significantly improved (no physical flattening or microscope manipulations), and (ii) given the recent advances in FTIR-ATR instrument portability, there is real potential to transfer this work.s findings seamlessly to on-field applications. The "raw" spectra, spectral subtractions and second derivative spectra were compared to demonstrate the subtle differences in human hair. SEM images were used as corroborative evidence to demonstrate the surface topography of hair. It indicated that the condition of the cuticle surface could be of three types: untreated, mildly treated and treated hair. Extensive studies of potential spectral band regions responsible for matching and discrimination of various types of hair samples suggested the 1690-1500 cm^-1 IR spectral region was to be preferred in comparison with the commonly used 1750-800 cm^-1. The principal reason was the presence of the highly variable spectral profiles of cystine oxidation products (1200-1000 cm^-1), which contributed significantly to spectral scatter and hence, poor hair sample matching. In the preferred 1690-1500 cm^-1 region, conformational changes in the keratin protein attributed to the α-helical to β-sheet transitions in the Amide I and Amide II vibrations and played a significant role in matching and discrimination of the spectra and hence, the hair fibre samples. For gender comparison, the Amide II band is significant for differentiation. The results illustrated that the male hair spectra exhibit a more intense β-sheet vibration in the Amide II band at approximately 1511 cm^-1 whilst the female hair spectra displayed more intense α-helical vibration at 1520-1515cm^-1. In terms of chemical composition, female hair spectra exhibit greater intensity of the amino acid tryptophan (1554 cm^-1), aspartic and glutamic acid (1577 cm^-1). It was also observed that for the separation of samples based on racial differences, untreated Caucasian hair was discriminated from Asian hair as a result of having higher levels of the amino acid cystine and cysteic acid. However, when mildly or chemically treated, Asian and Caucasian hair fibres are similar, whereas African-type hair fibres are different. In terms of the investigation's novel contribution to the field of forensic science, it has allowed for the development of a novel, multifaceted, methodical protocol where previously none had existed. The protocol is a systematic method to rapidly investigate unknown or questioned single human hair FTIR-ATR spectra from different genders and racial origin, including fibres of different cosmetic treatments. Unknown or questioned spectra are first separated on the basis of chemical treatment i.e. untreated, mildly treated or chemically treated, genders, and racial origin i.e. Asian, Caucasian and African-type. The methodology has the potential to complement the current forensic analysis methods of fibre evidence (i.e. Microscopy and DNA), providing information on the morphological, genetic and structural levels.