计算机取证的相关法律技术问题研究

法律界研究计算机证据的有关法律特性及其认定,而计算机科学领域的研究人员则从技术的角度研究计算证据的技术特征及其获取技术.由于这一学科是建立在法学和计算机科学之上的交叉学科,必须从这两个学科及其派生学科上体现出的特殊性的角度对其进行研究.在这一领域把法律和技术分离的做法会导致法律认定上的错误和技术上的无序性.通过将法律和计算机技术相结合对计算机取证进行了研究.阐明了计算机取证的相关法律问题,重点研究了计算机取证的技术方法和工具,并给出了一个计算机取证实验的技术过程.提出了目前计算机取证相关法律法规和计算机取证技术的不足,指出了今后法律法规的进一步健全、计算机取证工作的规范化和计算机取证技术的发展趋势.

Thinking with and outside the box: developing computer support for evidence teaching

B. Schafer, J. Keppens and Q. Shen. Thinking with and outside the Box: Developing Computer Support for Evidence Teaching. P. Robert and M. Redmayne (Eds.), Innovations in Evidence and Proof: Integrating Theory, Research and Teaching, pp. 139-158, 2007.

Assessing the evidence: Student response system versus computer based testing for undertaking multiple choice question assessment in undergraduate nursing education

There is a dearth of evidence focusing on student preferences for computer-based testing versus
testing via student response systems for summative assessment in undergraduate education.
This quantitative study compared the preference and acceptability of computer-based testing
and a student response system for completing multiple choice questions in undergraduate
nursing education. After using both computer-based testing and a student response system to
complete multiple choice questions, 192 first year undergraduate nursing students rated their
preferences and attitudes towards using computer-based testing and a student response system.
Results indicated that seventy four percent felt the student response system was easy to use.
Fifty six percent felt the student response system took more time than the computer-based testing
to become familiar with. Sixty Percent felt computer-based testing was more users friendly.
Seventy Percent of students would prefer to take a multiple choice question summative exam
via computer-based testing, although Fifty percent would be happy to take using student response
system. Results are useful for undergraduate educators in relation to student’s preference
for using computer-based testing or student response system to undertake a summative
multiple choice question exam

Legal LEGO: Model based computer assisted teaching in evidence courses

This paper describes the development of a new approach to the use of ICT for the teaching of courses in the interpretation and evaluation of evidence. It is based on ideas developed for the teaching of science to school children, in particular the importance of models and qualitative reasoning skills. In the first part, we make an analysis of the basis of current research into “evidence scholarship” and the demands such a system would have to meet. In the second part, we introduce the details of such a system that we developed initially to assist police in the interpretation of evidence.

The impact of a computer based adult literacy program on literacy and numeracy : evidence from India

With over 700 million illiterate adults in the world, many governments have implemented adult literacy programs across the world, although typically with low rates of success partly because the quality of teaching is low. One solution may lie in the standardization of teaching provided by computer-aided instruction. We present the first rigorous evidence of the effectiveness of a computer-based adult literacy program. A randomized control trial study of TARA Akshar Plus, an Indian adult literacy program, was implemented in the state of Uttar Pradesh in India. We find large, significant impacts of this computer-aided program on literacy and numeracy outcomes. We compare the improvement in learning to that of other traditional adult literacy programs and conclude that TARA Akshar Plus is effective in increasing literacy and numeracy for illiterate adult women.

Evidence of different thermoregulatory mechanisms between two sympatric Scarabaeus species using infrared thermography and micro-computer tomography

In endotherms insects, the thermoregulatory mechanisms modulate heat transfer from the thorax to the abdomen to avoid overheating or cooling in order to obtain a prolonged flight performance. Scarabaeus sacer and S. cicatricosus, two sympatric species with the same habitat and food preferences, showed daily temporal segregation with S. cicatricosus being more active during warmer hours of the day in opposition to S. sacer who avoid it. In the case of S. sacer, their endothermy pattern suggested an adaptive capacity for thorax heat retention. In S. cicatricosus, an active ‘heat exchanger’ mechanism was suggested. However, no empirical evidence had been documented until now. Thermographic sequences recorded during flight performance showed evidence of the existence of both thermoregulatory mechanisms. In S. sacer, infrared sequences showed a possible heat insulator (passive thermal window), which prevents heat transfer from meso- and metathorax to the abdomen during flight. In S. cicatricosus, infrared sequences revealed clear and effective heat flow between the thorax and abdomen (abdominal heat transfer) that should be considered the main mechanism of thermoregulation. This was related to a subsequent increase in abdominal pumping (as a cooling mechanism) during flight. Computer microtomography scanning, anatomical dissections and internal air volume measurements showed two possible heat retention mechanisms for S. sacer; the abdominal air sacs and the development of the internal abdominal sternites that could explain the thermoregulation between thorax and abdomen. Our results suggest that interspecific interactions between sympatric species are regulated by very different mechanisms. These mechanisms create unique thermal niches for the different species, thereby preventing competition and modulating spatio-temporal distribution and the composition of dung beetle assemblages.

Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Formatdan open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.

Further evidence of a relationship between explaining, tracing and writing skills in introductory programming

This paper reports on a replication of earlier studies into a possible hierarchy of programming skills. In this study, the students from whom data was collected were at a university that had not provided data for earlier studies. Also, the students were taught the programming language Python, which had not been used in earlier studies. Thus this study serves as a test of whether the findings in the earlier studies were specific to certain institutions, student cohorts, and programming languages. Also, we used a non–parametric approach to the analysis, rather than the linear approach of earlier studies. Our results are consistent with the earlier studies. We found that students who cannot trace code usually cannot explain code, and also that students who tend to perform reasonably well at code writing tasks have also usually acquired the ability to both trace code and explain code.

Prediction of adjacent vertebral fracture risk associated with vertebroplasty : a computer-based simulation study

Vertebrplasty involved injecting cement into a fractured vertebra to provide stabilisation. There is clinical evidence to suggest however that vertebroplasty may be assocated with a higher risk of adjacent vertebral fracture; which may be due to the change in material properties of the post-procedure vertebra modifying the transmission of mechanical stresses to adjacent vertebrae.

Computer profiling for forensic purposes

Computer forensics is the process of gathering and analysing evidence from computer systems to aid in the investigation of a crime. Typically, such investigations are undertaken by human forensic examiners using purpose-built software to discover evidence from a computer disk. This process is a manual one, and the time it takes for a forensic examiner to conduct such an investigation is proportional to the storage capacity of the computer's disk drives. The heterogeneity and complexity of various data formats stored on modern computer systems compounds the problems posed by the sheer volume of data. The decision to undertake a computer forensic examination of a computer system is a decision to commit significant quantities of a human examiner's time. Where there is no prior knowledge of the information contained on a computer system, this commitment of time and energy occurs with little idea of the potential benefit to the investigation. The key contribution of this research is the design and development of an automated process to describe a computer system and its activity for the purposes of a computer forensic investigation. The term proposed for this process is computer profiling. A model of a computer system and its activity has been developed over the course of this research. Using this model a computer system, which is the subj ect of investigation, can be automatically described in terms useful to a forensic investigator. The computer profiling process IS resilient to attempts to disguise malicious computer activity. This resilience is achieved by detecting inconsistencies in the information used to infer the apparent activity of the computer. The practicality of the computer profiling process has been demonstrated by a proof-of concept software implementation. The model and the prototype implementation utilising the model were tested with data from real computer systems. The resilience of the process to attempts to disguise malicious activity has also been demonstrated with practical experiments conducted with the same prototype software implementation.

Reconstruction of falsified computer logs for digital forensics investigations

Digital forensics investigations aim to find evidence that helps confirm or disprove a hypothesis about an alleged computer-based crime. However, the ease with which computer-literate criminals can falsify computer event logs makes the prosecutor's job highly challenging. Given a log which is suspected to have been falsified or tampered with, a prosecutor is obliged to provide a convincing explanation for how the log may have been created. Here we focus on showing how a suspect computer event log can be transformed into a hypothesised actual sequence of events, consistent with independent, trusted sources of event orderings. We present two algorithms which allow the effort involved in falsifying logs to be quantified, as a function of the number of `moves' required to transform the suspect log into the hypothesised one, thus allowing a prosecutor to assess the likelihood of a particular falsification scenario. The first algorithm always produces an optimal solution but, for reasons of efficiency, is suitable for short event logs only. To deal with the massive amount of data typically found in computer event logs, we also present a second heuristic algorithm which is considerably more efficient but may not always generate an optimal outcome.

Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.

CAT Detect (Computer Activity Timeline Detection) : a tool for detecting inconsistency in computer activity timelines

The construction of timelines of computer activity is a part of many digital investigations. These timelines of events are composed of traces of historical activity drawn from system logs and potentially from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work introduces a software tool (CAT Detect) for the detection of inconsistency within timelines of computer activity. We examine the impact of deliberate tampering through experiments conducted with our prototype software tool. Based on the results of these experiments, we discuss techniques which can be employed to deal with such temporal inconsistencies.