FIA : an open foresic integration architecture for composing digital evidence

The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture (FIA) which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of integrating evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.

The efficacy of the Sortino ratio and other benchmarked performance measures under skewed return distributions

This paper will investigate the suitability of existing performance measures under the assumption of a clearly defined benchmark. A range of measures are examined including the Sortino Ratio, the Sharpe Selection ratio (SSR), the Student’s t-test and a decay rate measure. A simulation study is used to assess the power and bias of these measures based on variations in sample size and mean performance of two simulated funds. The Sortino Ratio is found to be the superior performance measure exhibiting more power and less bias than the SSR when the distribution of excess returns are skewed.

A model for computer profiling

This paper discusses the use of models in automatic computer forensic analysis, and proposes and elaborates on a novel model for use in computer profiling, the computer profiling object model. The computer profiling object model is an information model which models a computer as objects with various attributes and inter-relationships. These together provide the information necessary for a human investigator or an automated reasoning engine to make judgements as to the probable usage and evidentiary value of a computer system. The computer profiling object model can be implemented so as to support automated analysis to provide an investigator with the information needed to decide whether manual analysis is required.

Improving automatic speaker verification using SVM techniques

Automatic recognition of people is an active field of research with important forensic and security applications. In these applications, it is not always possible for the subject to be in close proximity to the system. Voice represents a human behavioural trait which can be used to recognise people in such situations. Automatic Speaker Verification (ASV) is the process of verifying a persons identity through the analysis of their speech and enables recognition of a subject at a distance over a telephone channel { wired or wireless. A significant amount of research has focussed on the application of Gaussian mixture model (GMM) techniques to speaker verification systems providing state-of-the-art performance. GMM's are a type of generative classifier trained to model the probability distribution of the features used to represent a speaker. Recently introduced to the field of ASV research is the support vector machine (SVM). An SVM is a discriminative classifier requiring examples from both positive and negative classes to train a speaker model. The SVM is based on margin maximisation whereby a hyperplane attempts to separate classes in a high dimensional space. SVMs applied to the task of speaker verification have shown high potential, particularly when used to complement current GMM-based techniques in hybrid systems. This work aims to improve the performance of ASV systems using novel and innovative SVM-based techniques. Research was divided into three main themes: session variability compensation for SVMs; unsupervised model adaptation; and impostor dataset selection. The first theme investigated the differences between the GMM and SVM domains for the modelling of session variability | an aspect crucial for robust speaker verification. Techniques developed to improve the robustness of GMMbased classification were shown to bring about similar benefits to discriminative SVM classification through their integration in the hybrid GMM mean supervector SVM classifier. Further, the domains for the modelling of session variation were contrasted to find a number of common factors, however, the SVM-domain consistently provided marginally better session variation compensation. Minimal complementary information was found between the techniques due to the similarities in how they achieved their objectives. The second theme saw the proposal of a novel model for the purpose of session variation compensation in ASV systems. Continuous progressive model adaptation attempts to improve speaker models by retraining them after exploiting all encountered test utterances during normal use of the system. The introduction of the weight-based factor analysis model provided significant performance improvements of over 60% in an unsupervised scenario. SVM-based classification was then integrated into the progressive system providing further benefits in performance over the GMM counterpart. Analysis demonstrated that SVMs also hold several beneficial characteristics to the task of unsupervised model adaptation prompting further research in the area. In pursuing the final theme, an innovative background dataset selection technique was developed. This technique selects the most appropriate subset of examples from a large and diverse set of candidate impostor observations for use as the SVM background by exploiting the SVM training process. This selection was performed on a per-observation basis so as to overcome the shortcoming of the traditional heuristic-based approach to dataset selection. Results demonstrate the approach to provide performance improvements over both the use of the complete candidate dataset and the best heuristically-selected dataset whilst being only a fraction of the size. The refined dataset was also shown to generalise well to unseen corpora and be highly applicable to the selection of impostor cohorts required in alternate techniques for speaker verification.

Case-control study of early childhood caries in Australia

The aim of this case-control study of 617 children was to investigate early childhood caries (ECC) risk indicators in a non-fluoridated region in Australia. ECC cases were recruited from childcare facilities, public hospitals and private specialist clinics to source children from different socioeconomic backgrounds. Non-ECC controls were recruited from the same childcare facilities. A multinomial logistic modelling approach was used for statistical analysis. The results showed that a large percentage of children tested positive for Streptococcus mutans if their mothers also tested positive. A common risk indicator found in ECC children from childcare facilities and public hospitals was visible plaque (OR 4.1, 95% CI 1.0-15.9, and OR 8.7, 95% CI 2.3-32.9, respectively). Compared to ECC-free controls, the risk indicators specific to childcare cases were enamel hypoplasia (OR 4.2, 95% CI 1.0-18.3), difficulty in cleaning child's teeth (OR 6.6, 95% CI 2.2-19.8), presence of S. mutans (OR 4.8, 95% CI 0.7-32.6), sweetened drinks (OR 4.0, 95% CI 1.2-13.6) and maternal anxiety (OR 5.1, 95% CI 1.1-25.0). Risk indicators specific to public hospital cases were S. mutans presence in child (OR 7.7, 95% CI 1.3-44.6) or mother (OR 8.1, 95% CI 0.9-72.4), ethnicity (OR 5.6, 95% CI 1.4-22.1), and access of mother to pension or health care card (OR 20.5, 95% CI 3.5-119.9). By contrast, a history of chronic ear infections was found to be protective for ECC in childcare children (OR 0.28, 95% CI 0.09-0.82). The biological, socioeconomic and maternal risk indicators demonstrated in the present study can be employed in models of ECC that can be usefully applied for future longitudinal studies.

Artful determination : "state of the art" and PCME Ltd v. Goyen COntrols Co. UK Ltd

In a recent decision by Mr Justice Laddie, a patent was held anticipated by, inter alia, prior use of a device which fell within the claims of the patent in suit, even though its circuitry was enclosed in resin. The anticipating invention had been "made available to the public" within the terms of section 2 (2) of the Patents Act 1977 because its essential integers would have been revealed by an interesting character, the "skilled forensic engineer".

Expression of chondromodulin-1 in the temporomandibular joint condylar cartilage and disc

BACKGROUND: The temporomandibular joint (TMJ) cartilage consists of condylar cartilage and disc and undergoes continuous remodeling throughout post-natal life. To maintain the integrity of the TMJ cartilage, anti-angiogenic factors play an important role during the remodeling process. In this study, we investigated the expression of the anti-angiogenic factor, chondromodulin- 1 (ChM-1), in TMJ cartilage and evaluate its potential role in TMJ remodeling. METHODS: Eight TMJ specimens were collected from six 4-month-old Japanese white rabbits. Safranin-O staining was performed to determine proteoglycan content. ChM-1 expression in TMJ condylar cartilage and disc was determined by immunohistochemistry. Three human perforated disc tissue samples were collected for investigation of ChM-1 and vascular endothelial growth factor (VEGF) distribution in perforated TMJ disc. RESULTS: Safranin-O stained weakly in TMJ compared with tibial articular and epiphyseal cartilage. In TMJ, ChM-1 was expressed in the proliferative and hypertrophic zone of condylar cartilage and chondrocyte-like cells in the disc. No expression of ChM-1 was observed in osteoblasts and subchondral bone. ChM-1 and VEGF were both similarly expressed in perforated disc tissues. CONCLUSIONS: ChM-1 may play a role in the regulation of TMJ remodeling by preventing blood vessel invasion of the cartilage, thereby maintaining condylar cartilage and disc integrity.

Application of autologous periosteal cells for the regeneration of class III furcation defects in Beagle dogs

The aim of this study was to evaluate the healing of class III furcation defects following transplantation of autogenous periosteal cells combined with b-tricalcium phosphate (b-TCP). Periosteal cells obtained from Beagle dogs’ periosteum explant cultures, were inoculated onto the surface of b-TCP. Class III furcation defects were created in the mandibular premolars. Three experimental groups were used to test the defects’ healing: group A, b-TCP seeded with periosteal cells were transplanted into the defects; group B, b-TCP alone was used for defect filling; and group C, the defect was without filling materials. Twelve weeks post surgery, the tissue samples were collected for histology, immunohistology and X-ray examination. It was found that both the length of newly formed periodontal ligament and the area of newly formed alveolar bone in group A, were significantly increased compared with both group B and C. Furthermore, both the proportion of newly formed periodontal ligament and newly formed alveolar bone in group A were much higher than those of group B and C. The quantity of cementum and its percentage in the defects (group A) were also significantly higher than those of group C. These results indicate that autogenous periosteal cells combined with b-TCP application can improve periodontal tissue regeneration in class III furcation defects.

Automatic speaker recognition under adverse conditions

Speaker verification is the process of verifying the identity of a person by analysing their speech. There are several important applications for automatic speaker verification (ASV) technology including suspect identification, tracking terrorists and detecting a person’s presence at a remote location in the surveillance domain, as well as person authentication for phone banking and credit card transactions in the private sector. Telephones and telephony networks provide a natural medium for these applications. The aim of this work is to improve the usefulness of ASV technology for practical applications in the presence of adverse conditions. In a telephony environment, background noise, handset mismatch, channel distortions, room acoustics and restrictions on the available testing and training data are common sources of errors for ASV systems. Two research themes were pursued to overcome these adverse conditions: Modelling mismatch and modelling uncertainty. To directly address the performance degradation incurred through mismatched conditions it was proposed to directly model this mismatch. Feature mapping was evaluated for combating handset mismatch and was extended through the use of a blind clustering algorithm to remove the need for accurate handset labels for the training data. Mismatch modelling was then generalised by explicitly modelling the session conditions as a constrained offset of the speaker model means. This session variability modelling approach enabled the modelling of arbitrary sources of mismatch, including handset type, and halved the error rates in many cases. Methods to model the uncertainty in speaker model estimates and verification scores were developed to address the difficulties of limited training and testing data. The Bayes factor was introduced to account for the uncertainty of the speaker model estimates in testing by applying Bayesian theory to the verification criterion, with improved performance in matched conditions. Modelling the uncertainty in the verification score itself met with significant success. Estimating a confidence interval for the "true" verification score enabled an order of magnitude reduction in the average quantity of speech required to make a confident verification decision based on a threshold. The confidence measures developed in this work may also have significant applications for forensic speaker verification tasks.

Legislative and security requirements of audit material for evidentiary purpose

This research used the Queensland Police Service, Australia, as a major case study. Information on principles, techniques and processes used, and the reason for the recording, storing and release of audit information for evidentiary purposes is reported. It is shown that Law Enforcement Agencies have a two-fold interest in, and legal obligation pertaining to, audit trails. The first interest relates to the situation where audit trails are actually used by criminals in the commission of crime and the second to where audit trails are generated by the information systems used by the police themselves in support of the recording and investigation of crime. Eleven court cases involving Queensland Police Service audit trails used in evidence in Queensland courts were selected for further analysis. It is shown that, of the cases studied, none of the evidence presented was rejected or seriously challenged from a technical perspective. These results were further analysed and related to normal requirements for trusted maintenance of audit trail information in sensitive environments with discussion on the ability and/or willingness of courts to fully challenge, assess or value audit evidence presented. Managerial and technical frameworks for firstly what is considered as an environment where a computer system may be considered to be operating “properly” and, secondly, what aspects of education, training, qualifications, expertise and the like may be considered as appropriate for persons responsible within that environment, are both proposed. Analysis was undertaken to determine if audit and control of information in a high security environment, such as law enforcement, could be judged as having improved, or not, in the transition from manual to electronic processes. Information collection, control of processing and audit in manual processes used by the Queensland Police Service, Australia, in the period 1940 to 1980 was assessed against current electronic systems essentially introduced to policing in the decades of the 1980s and 1990s. Results show that electronic systems do provide for faster communications with centrally controlled and updated information readily available for use by large numbers of users who are connected across significant geographical locations. However, it is clearly evident that the price paid for this is a lack of ability and/or reluctance to provide improved audit and control processes. To compare the information systems audit and control arrangements of the Queensland Police Service with other government departments or agencies, an Australia wide survey was conducted. Results of the survey were contrasted with the particular results of a survey, conducted by the Australian Commonwealth Privacy Commission four years previous, to this survey which showed that security in relation to the recording of activity against access to information held on Australian government computer systems has been poor and a cause for concern. However, within this four year period there is evidence to suggest that government organisations are increasingly more inclined to generate audit trails. An attack on the overall security of audit trails in computer operating systems was initiated to further investigate findings reported in relation to the government systems survey. The survey showed that information systems audit trails in Microsoft Corporation's “Windows” operating system environments are relied on quite heavily. An audit of the security for audit trails generated, stored and managed in the Microsoft “Windows 2000” operating system environment was undertaken and compared and contrasted with similar such audit trail schemes in the “UNIX” and “Linux” operating systems. Strength of passwords and exploitation of any security problems in access control were targeted using software tools that are freely available in the public domain. Results showed that such security for the “Windows 2000” system is seriously flawed and the integrity of audit trails stored within these environments cannot be relied upon. An attempt to produce a framework and set of guidelines for use by expert witnesses in the information technology (IT) profession is proposed. This is achieved by examining the current rules and guidelines related to the provision of expert evidence in a court environment, by analysing the rationale for the separation of distinct disciplines and corresponding bodies of knowledge used by the Medical Profession and Forensic Science and then by analysing the bodies of knowledge within the discipline of IT itself. It is demonstrated that the accepted processes and procedures relevant to expert witnessing in a court environment are transferable to the IT sector. However, unlike some discipline areas, this analysis has clearly identified two distinct aspects of the matter which appear particularly relevant to IT. These two areas are; expertise gained through the application of IT to information needs in a particular public or private enterprise; and expertise gained through accepted and verifiable education, training and experience in fundamental IT products and system.

Hash based disk imaging using AFF4

Forensic imaging has been facing scalability challenges for some time. As disk capacity growth continues to outpace storage IO bandwidth, the demands placed on storage and time are ever increasing. Data reduction and de-duplication technologies are now commonplace in the Enterprise space, and are potentially applicable to forensic acquisition. Using the new AFF4 forensic file format we employ a hash based compression scheme to leverage an existing corpus of images, reducing both acquisition time and storage requirements. This paper additionally describes some of the recent evolution in the AFF4 file format making the efficient implementation of hash based imaging a reality.

Identifying the presence of psychopathy in the community

Aim: Researchers have suggested that approximately 1% of individuals with psychopathic tendencies can successfully function within the community, although there has been a lack of research to support this claim. The current study aimed to identify individuals with psychopathic tendencies within a community sample and furthermore the socio-demographic correlates of this community integrated psychopath (e.g. relationship stability, substance use, and employment status). Procedure: 300 participants completed the Self-Reported Psychopathy scale – version 3 which contains four core psychopathy subfactors: (a) Interpersonal Manipulation, (b) Callous Affect, (c) Erratic Lifestyle and (d) Criminal Tendencies as well as the Paulhus Deception Scales to explore the effect of impression management and self-deception on the identification of psychopathy. Findings: Results indicated that at least 1% of the current community displayed characteristics consistent with psychopathic tendencies. A series of bivariate and multivariate statistical analyses were conducted which indicated that gender, age and alcohol misuse were predictive of psychopathy scores for this sample. More specifically, younger males who tend to misuse alcohol were found to be most likely to have psychopathic tendencies. Interestingly, impression management and self-deception was not associated with such tendencies. Discussion: The results provide some support for the assertion that individuals with psychopathic tendencies can be identified within the community (regardless of impression management techniques) and that such tendencies are associated with specific socio-demographic characteristics.

Differentially Expressed Protein Profile of Human Dental Pulp Cells in the Early Process of Odontoblast-like Differentiation In Vitro

Dental pulp cells (DPCs) are capable of differentiating into odontoblasts that secrete reparative dentin after pulp injury. The molecular mechanisms governing reparative dentinogenesis are yet to be fully understood. Here we investigated the differential protein profile of human DPCs undergoing odontogenic induction for 7 days. Using two-dimensional differential gel electrophoresis coupled with matrix-assisted laser adsorption ionization time of flight mass spectrometry, 2 3 protein spots related to the early odontogenic differentiation were identified. These proteins included cytoskeleton proteins, nuclear proteins, cell membrane-bound molecules, proteins involved in matrix synthesis, and metabolic enzymes. The expression of four identified proteins, which were heteronuclear ribonuclear proteins C, annexin VI, collagen type VI, and matrilin-2, was confirmed by Western blot and real-time realtime polymerase chain reaction analyses. This study generated a proteome reference map during odontoblast- like differentiation of human DPCs, which will be valuable to better understand the underlying molecular mechanisms in odontoblast-like differentiation.