The application of chemometrics on Infrared and Raman spectra as a tool for the forensic analysis of paints

The aim of this work is to evaluate the capabilities and limitations of chemometric methods and other mathematical treatments applied on spectroscopic data and more specifically on paint samples. The uniqueness of the spectroscopic data comes from the fact that they are multivariate - a few thousands variables - and highly correlated. Statistical methods are used to study and discriminate samples. A collection of 34 red paint samples was measured by Infrared and Raman spectroscopy. Data pretreatment and variable selection demonstrated that the use of Standard Normal Variate (SNV), together with removal of the noisy variables by a selection of the wavelengths from 650 to 1830 cm−1 and 2730-3600 cm−1, provided the optimal results for infrared analysis. Principal component analysis (PCA) and hierarchical clusters analysis (HCA) were then used as exploratory techniques to provide evidence of structure in the data, cluster, or detect outliers. With the FTIR spectra, the Principal Components (PCs) correspond to binder types and the presence/absence of calcium carbonate. 83% of the total variance is explained by the four first PCs. As for the Raman spectra, we observe six different clusters corresponding to the different pigment compositions when plotting the first two PCs, which account for 37% and 20% respectively of the total variance. In conclusion, the use of chemometrics for the forensic analysis of paints provides a valuable tool for objective decision-making, a reduction of the possible classification errors, and a better efficiency, having robust results with time saving data treatments.

Fast gas chromatography and negative-ion chemical ionization tandem mass spectrometry for forensic analysis of cannabinoids in whole blood.

The present work describes a fast gas chromatography/negative-ion chemical ionization tandem mass spectrometric assay (Fast GC/NICI-MS/MS) for analysis of tetrahydrocannabinol (THC), 11-hydroxy-tetrahydrocannabinol (THC-OH) and 11-nor-9-carboxy-tetrahydrocannabinol (THC-COOH) in whole blood. The cannabinoids were extracted from 500 microL of whole blood by a simple liquid-liquid extraction (LLE) and then derivatized by using trifluoroacetic anhydride (TFAA) and hexafluoro-2-propanol (HFIP) as fluorinated agents. Mass spectrometric detection of the analytes was performed in the selected reaction-monitoring mode on a triple quadrupole instrument after negative-ion chemical ionization. The assay was found to be linear in the concentration range of 0.5-20 ng/mL for THC and THC-OH, and of 2.5-100 ng/mL for THC-COOH. Repeatability and intermediate precision were found less than 12% for all concentrations tested. Under standard chromatographic conditions, the run cycle time would have been 15 min. By using fast conditions of separation, the assay analysis time has been reduced to 5 min, without compromising the chromatographic resolution. Finally, a simple approach for estimating the uncertainty measurement is presented.

A framework for the forensic analysis of user interaction with social media

The increasing use of social media, applications or platforms that allow users to interact online, ensures that this environment will provide a useful source of evidence for the forensics examiner. Current tools for the examination of digital evidence find this data problematic as they are not designed for the collection and analysis of online data. Therefore, this paper presents a framework for the forensic analysis of user interaction with social media. In particular, it presents an inter-disciplinary approach for the quantitative analysis of user engagement to identify relational and temporal dimensions of evidence relevant to an investigation. This framework enables the analysis of large data sets from which a (much smaller) group of individuals of interest can be identified. In this way, it may be used to support the identification of individuals who might be ‘instigators’ of a criminal event orchestrated via social media, or a means of potentially identifying those who might be involved in the ‘peaks’ of activity. In order to demonstrate the applicability of the framework, this paper applies it to a case study of actors posting to a social media Web site.

First contribution of mites (Acari) to the forensic analysis of hanged corpses: a case study from Spain

This case study from North Spain, highlights the importance of the collection of mites in addition to insects, from crime scenes or corpses subjected to environmental constraints that reduce or minimise insect activity, such as hanged corpses. In addition, this analysis highlights the relevance of arthropods’ collection in the field, even after the corpse has been moved away for autopsy. Four species of mites, phoretic on carrion (Silphidae) and rove (Staphylinidae) beetles, complemented and reinforced the autopsy analysis as well as the scarce information provided by insect activity. Poecilochirus carabi Canestrini & Canestrini, 1882 and Poecilochirus (Physoparasitus) davydovae Hyatt, 1980 (Mesostigmata: Parasitidae) were found in association with two Silphidae, Nicrophorus Fabricius, 1775 and Necrodes Leach, 1815, only when sampled in the autopsy room; this is suggestive of host-switching of mites and was likely due to the lack of availability of specific carriers in the field. The interpretation of the activity of Parasitidae mites both in the field and the autopsy room allows a better understanding of the timing and circumstances of decomposition. Phoretic deutonymphs of Pelzneria Scheucher 1957 (Astigmata: Histiostomatidae) were highly abundant, mostly P. crenulata Oudemans, 1909 and are reported for the first time on a Staphylinidae rove beetle, Creophilus maxillosus (L., 1758). Surprisingly, in this case study no Pelzneria were associated with the Silphidae found, which are their most common hosts, such as Necrodes littoralis (L., 1758) and Nicrophorus interruptus (Stephens, 1830). All histiostomatids were removed from the staphylinid (rove beetle) collected from the soil, at the scene of death, suggesting a recent arrival of the beetle. The occurrence of Staphylinidae beetles and their associated mites, such as Parasitidae and Pelzneria, and the information they provided would have been easily overlooked or lost if only the autopsy sampling would have been considered in the analysis of the case. The four mite species are reported for the first time for the Iberian Peninsula.

Development of mev-eds methodology for forensic analysis on automotive headlights

A comparative study between three automotive headlights (conventional, halogen, and HID lamp) using scanning electron microscopy coupled with energy dispersive spectrometry (SEM-EDS) is described. Results show the possibility of conducting topographic and qualitative analysis of automotive light bulbs from vehicles involved in traffic accidents on the basis of similarities between the waste glass material left on the filaments. This should provide evidence as to whether the bulbs were energized at the time of the accident.

Forensic analysis of buildings affected by mining subsidence based on Differential Interferometry (Part III)

This work presents a forensic analysis of buildings affected by mining subsidence, which is based on deformation data obtained by Differential Interferometry (DInSAR). The proposed test site is La Union village (Murcia, SE Spain) where subsidence was triggered in an industrial area due to the collapse of abandoned underground mining labours occurred in 1998. In the first part of this work the study area was introduced, describing the spatial and temporal evolution of ground subsidence, through the elaboration of a cracks map on the buildings located within the affected area. In the second part, the evolution of the most significant cracks found in the most damaged buildings was monitored using biaxial extensometric units and inclinometers. This article describes the work performed in the third part, where DInSAR processing of satellite radar data, available between 1998 and 2008, has permitted to determine the spatial and temporal evolution of the deformation of all the buildings of the study area in a period when no continuous in situ instrumental data is available. Additionally, the comparison of these results with the forensic data gathered in the 2005–2008 period, reveal that there is a coincidence between damaged buildings, buildings where extensometers register significant movements of cracks, and buildings deformation estimated from radar data. As a result, it has been demonstrated that the integration of DInSAR data into forensic analysis methodologies contributes to improve significantly the assessment of the damages of buildings affected by mining subsidence.

Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

Using multiple GPUs to accelerate string searching for digital forensic analysis

String searching within a large corpus of data is an important component of digital forensic (DF) analysis techniques such as file carving. The continuing increase in capacity of consumer storage devices requires corresponding im-provements to the performance of string searching techniques. As string search-ing is a trivially-parallelisable problem, GPGPU approaches are a natural fit – but previous studies have found that local storage presents an insurmountable performance bottleneck. We show that this need not be the case with modern hardware, and demonstrate substantial performance improvements from the use of single and multiple GPUs when searching for strings within a typical forensic disk image.

Quality evaluation of DNA obtained from stored human saliva and its applicability to identification in Forensic Dentistry

PURPOSE: This study evaluated the quality of DNA obtained from stored human saliva and its applicability to human identification. METHODS: The saliva samples of 20 subjects, collected in the form of saliva in natura and from mouth swabs and stored at -20ºC, were analyzed. After 7 days, the DNA was extracted from the 40 saliva samples and subjected to PCR and electrophoresis. After 180 days, the technique was repeated with the 20 swab samples. RESULTS: The first-stage results indicated that DNA was successfully extracted in 97.5% of reactions, 95% of saliva in natura and 100% of swab saliva samples, with no statistically significant difference between the forms of saliva. In the second phase, the result was positive for all 20 analyzed samples (100%). Subsequently, in order to analyze the quality of the DNA obtained from human saliva, the SIX3-2 gene was tested on the 20 mouth swab samples, and the PCR products were digested using the MbO1 restriction enzyme to evaluate polymorphisms in the ADRA-2 gene, with positive results for most samples. CONCLUSION: It was concluded that the quantity and quality of DNA from saliva and the techniques employed are adequate for forensic analysis of DNA.

Statistical evaluation of the reproducibility and the influence of paper on the analysis of black gel pen ink using laser desorption ionisation mass spectrometry

Laser desorption ionisation mass spectrometry (LDI-MS) has demonstrated to be an excellent analytical method for the forensic analysis of inks on a questioned document. The ink can be analysed directly on its substrate (paper) and hence offers a fast method of analysis as sample preparation is kept to a minimum and more importantly, damage to the document is minimised. LDI-MS has also previously been reported to provide a high power of discrimination in the statistical comparison of ink samples and has the potential to be introduced as part of routine ink analysis. This paper looks into the methodology further and evaluates statistically the reproducibility and the influence of paper on black gel pen ink LDI-MS spectra; by comparing spectra of three different black gel pen inks on three different paper substrates. Although generally minimal, the influences of sample homogeneity and paper type were found to be sample dependent. This should be taken into account to avoid the risk of false differentiation of black gel pen ink samples. Other statistical approaches such as principal component analysis (PCA) proved to be a good alternative to correlation coefficients for the comparison of whole mass spectra.

Considerations on the ASTM Standards 1789-04 and 1422-05 on the Forensic Examination of Ink

The ASTM standards on Writing Ink Identification (ASTM 1789-04) and on Writing Ink Comparison (ASTM 1422-05) are the most up-to-date guidelines that have been published on the forensic analysis of ink. The aim of these documents is to cover most aspects of the forensic analysis of ink evidence, from the analysis of ink samples, the comparison of the analytical profile of these samples (with the aim to differentiate them or not), through to the interpretation of the result of the examination of these samples in a forensic context. Significant evolutions in the technology available to forensic scientists, in the quality assurance requirements brought onto them, and in the understanding of frameworks to interpret forensic evidence have been made in recent years. This article reviews the two standards in the light of these evolutions and proposes some practical improvements in terms of the standardization of the analyses, the comparison of ink samples, and the interpretation of ink examination. Some of these suggestions have already been included in a DHS funded project aimed at creating a digital ink library for the United States Secret Service.

Record of postmortem injuries caused by the Neotropical social wasp Agelaia fulvofasciata (Degeer) (Hymenoptera, Vespidae) on pig carcasses in the Eastern Amazon region: implications in forensic taphonomy

ABSTRACTPostmortem injuries are a source of misinterpretations in forensic analysis and therefore are subject matter of taphonomic interest. Many types of injuries can cause different artifacts, which deserve attention of the forensic pathologists when evaluating corpses, either at the crime scene or during an autopsy. Insects can be important biotaphonomic agents and their activity may result in artifacts that resemble antemortem injuries. Here, we describe postmortem injuries caused by the Neotropical wasp Agelaia fulvofasciata (Degeer, 1773) on domestic pig carcasses weighting 15 kg. The specimens showed extensive injuries to the lower lip, similar to lacerations, and some minor lesions on the snout and anus. In addition, we observed the same wasp species preying on larvae of Sarcophagidae (Peckia sp.). Besides causing postmortem injuries, the ability of this species to detect carcasses in the early and fresh decomposition stages should be noted. Thus, future applications aiming criminal, any biotaphonomic events caused by carrion insects need to be disclosed.

Simultaneous analysis of nuclear and mitochondrial DNA, mRNA and miRNA from backspatter from inside parts of firearms generated by shots at "triple contrast" doped ballistic models

When a firearm projectile hits a biological target a spray of biological material (e.g., blood and tissue fragments) can be propelled from the entrance wound back towards the firearm. This phenomenon has become known as "backspatter" and if caused by contact shots or shots from short distances traces of backspatter may reach, consolidate on, and be recovered from, the inside surfaces of the firearm. Thus, a comprehensive investigation of firearm-related crimes must not only comprise of wound ballistic assessment but also backspatter analysis, and may even take into account potential correlations between these emergences. The aim of the present study was to evaluate and expand the applicability of the "triple contrast" method by probing its compatibility with forensic analysis of nuclear and mitochondrial DNA and the simultaneous investigation of co-extracted mRNA and miRNA from backspatter collected from internal components of different types of firearms after experimental shootings. We demonstrate that "triple contrast" stained biological samples collected from the inside surfaces of firearms are amenable to forensic co-analysis of DNA and RNA and permit sequence analysis of the entire mtDNA displacement-loop, even for "low template" DNA amounts that preclude standard short tandem repeat DNA analysis. Our findings underscore the "triple contrast" method's usefulness as a research tool in experimental forensic ballistics.

Foundational forensic techniques for cellular and ad hoc multi-hop networks

The Internet has become an integral part of our nation’s critical socio-economic infrastructure. With its heightened use and growing complexity however, organizations are at greater risk of cyber crimes. To aid in the investigation of crimes committed on or via the Internet, a network forensics analysis tool pulls together needed digital evidence. It provides a platform for performing deep network analysis by capturing, recording and analyzing network events to find out the source of a security attack or other information security incidents. Existing network forensics work has been mostly focused on the Internet and fixed networks. But the exponential growth and use of wireless technologies, coupled with their unprecedented characteristics, necessitates the development of new network forensic analysis tools. This dissertation fostered the emergence of a new research field in cellular and ad-hoc network forensics. It was one of the first works to identify this problem and offer fundamental techniques and tools that laid the groundwork for future research. In particular, it introduced novel methods to record network incidents and report logged incidents. For recording incidents, location is considered essential to documenting network incidents. However, in network topology spaces, location cannot be measured due to absence of a ‘distance metric’. Therefore, a novel solution was proposed to label locations of nodes within network topology spaces, and then to authenticate the identity of nodes in ad hoc environments. For reporting logged incidents, a novel technique based on Distributed Hash Tables (DHT) was adopted. Although the direct use of DHTs for reporting logged incidents would result in an uncontrollably recursive traffic, a new mechanism was introduced that overcome this recursive process. These logging and reporting techniques aided forensics over cellular and ad-hoc networks, which in turn increased their ability to track and trace attacks to their source. These techniques were a starting point for further research and development that would result in equipping future ad hoc networks with forensic components to complement existing security mechanisms.