Assisting digital forensic analysis via exploratory information visualisation

Background: Digital forensics is a rapidly expanding field, due to the continuing advances in computer technology and increases in data stage capabilities of devices. However, the tools supporting digital forensics investigations have not kept pace with this evolution, often leaving the investigator to analyse large volumes of textual data and rely heavily on their own intuition and experience. Aim: This research proposes that given the ability of information visualisation to provide an end user with an intuitive way to rapidly analyse large volumes of complex data, such approached could be applied to digital forensics datasets. Such methods will be investigated; supported by a review of literature regarding the use of such techniques in other fields. The hypothesis of this research body is that by utilising exploratory information visualisation techniques in the form of a tool to support digital forensic investigations, gains in investigative effectiveness can be realised. Method:To test the hypothesis, this research examines three different case studies which look at different forms of information visualisation and their implementation with a digital forensic dataset. Two of these case studies take the form of prototype tools developed by the researcher, and one case study utilises a tool created by a third party research group. A pilot study by the researcher is conducted on these cases, with the strengths and weaknesses of each being drawn into the next case study. The culmination of these case studies is a prototype tool which was developed to resemble a timeline visualisation of the user behaviour on a device. This tool was subjected to an experiment involving a class of university digital forensics students who were given a number of questions about a synthetic digital forensic dataset. Approximately half were given the prototype tool, named Insight, to use, and the others given a common open-source tool. The assessed metrics included: how long the participants took to complete all tasks, how accurate their answers to the tasks were, and how easy the participants found the tasks to complete. They were also asked for their feedback at multiple points throughout the task. Results:The results showed that there was a statistically significant increase in accuracy for one of the six tasks for the participants using the Insight prototype tool. Participants also found completing two of the six tasks significantly easier when using the prototype tool. There were no statistically significant different difference between the completion times of both participant groups. There were no statistically significant differences in the accuracy of participant answers for five of the six tasks. Conclusions: The results from this body of research show that there is evidence to suggest that there is the potential for gains in investigative effectiveness when information visualisation techniques are applied to a digital forensic dataset. Specifically, in some scenarios, the investigator can draw conclusions which are more accurate than those drawn when using primarily textual tools. There is also evidence so suggest that the investigators found these conclusions to be reached significantly more easily when using a tool with a visual format. None of the scenarios led to the investigators being at a significant disadvantage in terms of accuracy or usability when using the prototype visual tool over the textual tool. It is noted that this research did not show that the use of information visualisation techniques leads to any statistically significant difference in the time taken to complete a digital forensics investigation.

Sudden death: ethical and legal problems of post-mortem forensic genetic testing for hereditary cardiac diseases.

Hereditary non-structural diseases such as catecholaminergic polymorphic ventricular tachycardia (CPVT), long QT, and the Brugada syndrome as well as structural disease such as hypertrophic cardiomyopathy (HCM) and arrhythmogenic right ventricular cardiomyopathy (ARVC) cause a significant percentage of sudden cardiac deaths in the young. In these cases, genetic testing can be useful and does not require proxy consent if it is carried out at the request of judicial authorities as part of a forensic death investigation. Mutations in several genes are implicated in arrhythmic syndromes, including SCN5A, KCNQ1, KCNH2, RyR2, and genes causing HCM. If the victim's test is positive, this information is important for relatives who might be themselves at risk of carrying the disease-causing mutation. There is no consensus about how professionals should proceed in this context. This article discusses the ethical and legal arguments in favour of and against three options: genetic testing of the deceased victim only; counselling of relatives before testing the victim; counselling restricted to relatives of victims who tested positive for mutations of serious and preventable diseases. Legal cases are mentioned that pertain to the duty of geneticists and other physicians to warn relatives. Although the claim for a legal duty is tenuous, recent publications and guidelines suggest that geneticists and others involved in the multidisciplinary approach of sudden death (SD) cases may, nevertheless, have an ethical duty to inform relatives of SD victims. Several practical problems remain pertaining to the costs of testing, the counselling and to the need to obtain permission of judicial authorities.

Digital forensic osteology--possibilities in cooperation with the Virtopsy project.

The present study was carried out to check whether classic osteometric parameters can be determined from the 3D reconstructions of MSCT (multislice computed tomography) scans acquired in the context of the Virtopsy project. To this end, four isolated and macerated skulls were examined by six examiners. First the skulls were conventionally (manually) measured using 32 internationally accepted linear measurements. Then the skulls were scanned by the use of MSCT with slice thicknesses of 1.25 mm and 0.63 mm, and the 33 measurements were virtually determined on the digital 3D reconstructions of the skulls. The results of the traditional and the digital measurements were compared for each examiner to figure out variations. Furthermore, several parameters were measured on the cranium and postcranium during an autopsy and compared to the values that had been measured on a 3D reconstruction from a previously acquired postmortem MSCT scan. The results indicate that equivalent osteometric values can be obtained from digital 3D reconstructions from MSCT scans using a slice thickness of 1.25 mm, and from conventional manual examinations. The measurements taken from a corpse during an autopsy could also be validated with the methods used for the digital 3D reconstructions in the context of the Virtopsy project. Future aims are the assessment and biostatistical evaluation in respect to sex, age and stature of all data sets stored in the Virtopsy project so far, as well as of future data sets. Furthermore, a definition of new parameters, only measurable with the aid of MSCT data would be conceivable.

Is characterizing the digital forensic facial reconstruction with hair necessary? A familiar assessors' analysis

Background: In the international scientific literature, there are few studies that emphasize the presence or absence of hair in forensic facial reconstructions. There are neither Brazilian studies concerning digital facial reconstructions without hair, nor research comparing recognition tests between digital facial reconstructions with hair and without hair. The miscegenation of Brazilian people is considerable. Brazilian people, and, in particular, Brazilian women, even if considered as Caucasoid, may present the hair in very different ways: curly, wavy or straight, blonde, red, brown or black, long or short, etc. For this reason, it is difficult to find a correct type of hair for facial reconstruction (unless, in real cases, some hair is recovered with the skeletal remains). Aims and methods: This study focuses on the performance of three different digital forensic facial reconstructions, without hair, of a Brazilian female subject (based on one international database and two Brazilian databases for soft facial-tissue thickness) and evaluates the digital forensic facial reconstructions comparing them to photographs of the target individual and nine other subjects, employing the recognition method. A total of 22 assessors participated in the recognition process; all of them were familiar with the 10 individuals who composed the face pool. Results and conclusions: The target subject was correctly recognized by 41% of the 22 examiners in the International Pattern, by 32% in the Brazilian Magnetic Resonance Pattern and by 32% in the Brazilian Fresh Cadavers Pattern. The facial reconstructions without hair were correctly recognized using the three databases of facial soft-tissue thickness. The observed results were higher than the results obtained using facial reconstructions with hair, from the same skull, which can indicate that it is better to not use hair, at least when there is no information concerning its characteristics. © 2013 Elsevier B.V. All rights reserved.

Digital forensic osteology--possibilities in cooperation with the Virtopsy project

The present study was carried out to check whether classic osteometric parameters can be determined from the 3D reconstructions of MSCT (multislice computed tomography) scans acquired in the context of the Virtopsy project. To this end, four isolated and macerated skulls were examined by six examiners. First the skulls were conventionally (manually) measured using 32 internationally accepted linear measurements. Then the skulls were scanned by the use of MSCT with slice thicknesses of 1.25 mm and 0.63 mm, and the 33 measurements were virtually determined on the digital 3D reconstructions of the skulls. The results of the traditional and the digital measurements were compared for each examiner to figure out variations. Furthermore, several parameters were measured on the cranium and postcranium during an autopsy and compared to the values that had been measured on a 3D reconstruction from a previously acquired postmortem MSCT scan. The results indicate that equivalent osteometric values can be obtained from digital 3D reconstructions from MSCT scans using a slice thickness of 1.25 mm, and from conventional manual examinations. The measurements taken from a corpse during an autopsy could also be validated with the methods used for the digital 3D reconstructions in the context of the Virtopsy project. Future aims are the assessment and biostatistical evaluation in respect to sex, age and stature of all data sets stored in the Virtopsy project so far, as well as of future data sets. Furthermore, a definition of new parameters, only measurable with the aid of MSCT data would be conceivable.

A Study of the Molecular Basis of Microvariants at the FGA and D21S11 Loci Used in Forensic DNA Testing

Microvariant alleles, defined as alleles that contain an incomplete repeat unit, often complicate the process of DNA analysis. Understanding the molecular basis of microvariants would help to catalogue results and improve upon the analytical process involved in DNA testing. The first step is to determine the sequence/cause of a microvariant. This was done by sequencing samples that were determined to have a microvariant at the FGA or D21S11 loci. The results indicate that a .2 microvariant at the D21S11 locus is caused by a -TA- dinucleotide partial repeat before the last full TCTA repeat. The .2 microvariant at the FGA locus is caused by a -TT- dinucleotide partial repeat after the fifth full repeat and before the variable CTTT repeat motif. There are several possibilities for the reason the .2 microvariants are all the same at a locus, each of which carry implications on the forensic community. The first possibility is that the microvariants are identical by descent, which means that the microvariant is an old allele that has been passed down through the generations. The second possibility is that the microvariants are identical by state, which would mean that there is a mechanism selecting for these microvariants. Future research studying the flanking regions of these microvariants is proposed to determine which of these possibilities is the actual cause and to learn more about the molecular basis of microvariants.

Using multiple GPUs to accelerate string searching for digital forensic analysis

String searching within a large corpus of data is an important component of digital forensic (DF) analysis techniques such as file carving. The continuing increase in capacity of consumer storage devices requires corresponding im-provements to the performance of string searching techniques. As string search-ing is a trivially-parallelisable problem, GPGPU approaches are a natural fit – but previous studies have found that local storage presents an insurmountable performance bottleneck. We show that this need not be the case with modern hardware, and demonstrate substantial performance improvements from the use of single and multiple GPUs when searching for strings within a typical forensic disk image.

Taphonomic mycota: fungi with forensic potential

Forensic archaeologists and criminal investigators employ many different techniques for the location, recovery, and analysis of clandestine graves. Many of these techniques are based upon the premise that a grave is an anomaly and therefore differs physically, biologically, or chemically from its surroundings. The work reviewed in this communication demonstrates how and why field mycology might provide a further tool towards the investigation of scenes of crime concealed in forest ecosystems. The fruiting structures of certain fungi, the ammonia and the postputrefaction fungi, have been recorded repeatedly in association with decomposed mammalian cadavers in disparate regions of the world. The ecology and physiology of these fungi are reviewed briefly with a view to their potential as a forensic tool. This application of mycology is at an interface with forensic archaeology and forensic taphonomy and may provide a means to detect graves and has the potential to estimate postburial interval.

Tests of one Brazilian facial reconstruction method using three soft tissue depth sets and familiar assessors

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Proposta de modelo de processo de produção de conteúdo em emissora de TV digital universitária

Pós-graduação em Televisão Digital: Informação e Conhecimento - FAAC

Tests of one Brazilian facial reconstruction method using three soft tissue depth sets and familiar assessors

Facial reconstruction is a method that seeks to recreate a person's facial appearance from his/her skull. This technique can be the last resource used in a forensic investigation, when identification techniques such as DNA analysis, dental records, fingerprints and radiographic comparison cannot be used to identify a body or skeletal remains. To perform facial reconstruction, the data of facial soft tissue thickness are necessary. Scientific literature has described differences in the thickness of facial soft tissue between ethnic groups. There are different databases of soft tissue thickness published in the scientific literature. There are no literature records of facial reconstruction works carried out with data of soft tissues obtained from samples of Brazilian subjects. There are also no reports of digital forensic facial reconstruction performed in Brazil. There are two databases of soft tissue thickness published for the Brazilian population: one obtained from measurements performed in fresh cadavers (fresh cadavers' pattern), and another from measurements using magnetic resonance imaging (Magnetic Resonance pattern). This study aims to perform three different characterized digital forensic facial reconstructions (with hair, eyelashes and eyebrows) of a Brazilian subject (based on an international pattern and two Brazilian patterns for soft facial tissue thickness), and evaluate the digital forensic facial reconstructions comparing them to photos of the individual and other nine subjects. The DICOM data of the Computed Tomography (CT) donated by a volunteer were converted into stereolitography (STL) files and used for the creation of the digital facial reconstructions. Once the three reconstructions were performed, they were compared to photographs of the subject who had the face reconstructed and nine other subjects. Thirty examiners participated in this recognition process. The target subject was recognized by 26.67% of the examiners in the reconstruction performed with the Brazilian Magnetic Resonance Pattern, 23.33% in the reconstruction performed with the Brazilian Fresh Cadavers Pattern and 20.00% in the reconstruction performed with the International Pattern, in which the target-subject was the most recognized subject in the first two patterns. The rate of correct recognitions of the target subject indicate that the digital forensic facial reconstruction, conducted with parameters used in this study, may be a useful tool. (C) 2011 Elsevier Ireland Ltd. All rights reserved.

Indagini forensi in tema di scambio di file pedopornografici mediante software di file sharing a mezzo peer-to-peer

La prova informatica richiede l’adozione di precauzioni come in un qualsiasi altro accertamento scientifico. Si fornisce una panoramica sugli aspetti metodologici e applicativi dell’informatica forense alla luce del recente standard ISO/IEC 27037:2012 in tema di trattamento del reperto informatico nelle fasi di identificazione, raccolta, acquisizione e conservazione del dato digitale. Tali metodologie si attengono scrupolosamente alle esigenze di integrità e autenticità richieste dalle norme in materia di informatica forense, in particolare della Legge 48/2008 di ratifica della Convenzione di Budapest sul Cybercrime. In merito al reato di pedopornografia si offre una rassegna della normativa comunitaria e nazionale, ponendo l’enfasi sugli aspetti rilevanti ai fini dell’analisi forense. Rilevato che il file sharing su reti peer-to-peer è il canale sul quale maggiormente si concentra lo scambio di materiale illecito, si fornisce una panoramica dei protocolli e dei sistemi maggiormente diffusi, ponendo enfasi sulla rete eDonkey e il software eMule che trovano ampia diffusione tra gli utenti italiani. Si accenna alle problematiche che si incontrano nelle attività di indagine e di repressione del fenomeno, di competenza delle forze di polizia, per poi concentrarsi e fornire il contributo rilevante in tema di analisi forensi di sistemi informatici sequestrati a soggetti indagati (o imputati) di reato di pedopornografia: la progettazione e l’implementazione di eMuleForensic consente di svolgere in maniera estremamente precisa e rapida le operazioni di analisi degli eventi che si verificano utilizzando il software di file sharing eMule; il software è disponibile sia in rete all’url http://www.emuleforensic.com, sia come tool all’interno della distribuzione forense DEFT. Infine si fornisce una proposta di protocollo operativo per l’analisi forense di sistemi informatici coinvolti in indagini forensi di pedopornografia.

A TV DIGITAL DIVULGADA NO BOLETIM ELETRÔNICO DO FNDC: UM ESTUDO SOBRE O COMPORTAMENTO DA MÍDIA NA IMPLANTAÇÃO DA TV DIGITAL NO BRASIL

Implantada no Brasil na década de 50, a TV a mídia de maior abrangência e poder ideológico entre seus públicos encara sua segunda grande transformação: ela deixa de ser analógica e passa a ser digital. Com isso, traz à tona novas possibilidades de recepção e a possível convergência de meios. Nesse contexto, o objetivo deste estudo foi analisar o processo de instalação do Sistema Brasileiro de Televisão Digital Terrestre (SBTVD-t) a partir do clipping on-line do Fórum Nacional pela Democratização da Comunicação (FNDC). A análise desse material teve como foco averiguar se o FNDC foi tendencioso ou não na veiculação de matérias voltadas aos aspectos técnicos da nova tecnologia, em detrimento de seu potencial social. Para tanto, optou-se por uma pesquisa de base quantitativa em que as informações e os dados coletados levaram à constatação de que o FNDC se mostra pouco eficaz como aparato crítico-apreciativo da grande mídia, além de não cumprir alguns de seus objetivos ao reproduzir discursos e ideologias de outros veículos. Da mesma forma, verificou-se ainda que o Governo Federal também fugiu aos objetivos listados nos decretos presidenciais que instituem e dispõem sobre a implantação do SBTVD.(AU)

A TV DIGITAL DIVULGADA NO BOLETIM ELETRÔNICO DO FNDC: UM ESTUDO SOBRE O COMPORTAMENTO DA MÍDIA NA IMPLANTAÇÃO DA TV DIGITAL NO BRASIL

Implantada no Brasil na década de 50, a TV a mídia de maior abrangência e poder ideológico entre seus públicos encara sua segunda grande transformação: ela deixa de ser analógica e passa a ser digital. Com isso, traz à tona novas possibilidades de recepção e a possível convergência de meios. Nesse contexto, o objetivo deste estudo foi analisar o processo de instalação do Sistema Brasileiro de Televisão Digital Terrestre (SBTVD-t) a partir do clipping on-line do Fórum Nacional pela Democratização da Comunicação (FNDC). A análise desse material teve como foco averiguar se o FNDC foi tendencioso ou não na veiculação de matérias voltadas aos aspectos técnicos da nova tecnologia, em detrimento de seu potencial social. Para tanto, optou-se por uma pesquisa de base quantitativa em que as informações e os dados coletados levaram à constatação de que o FNDC se mostra pouco eficaz como aparato crítico-apreciativo da grande mídia, além de não cumprir alguns de seus objetivos ao reproduzir discursos e ideologias de outros veículos. Da mesma forma, verificou-se ainda que o Governo Federal também fugiu aos objetivos listados nos decretos presidenciais que instituem e dispõem sobre a implantação do SBTVD.(AU)