Forensic victimology

Forensic victimology is intended to serve the justice system by educating it. This area of study is aimed at helping to provide for informed investigations, to require scientific examinations of victim evidence to be presented in court, and to result in more informed legal outcomes. The purpose of this chapter is to provide a discussion regarding the nature and scope of forensic victimology, its investigative implications, and its impact on court proceedings. We will begin with a brief section outlining the more Traditional Victimology...

Forensic challenges in service oriented architectures

Digital forensics relates to the investigation of a crime or other suspect behaviour using digital evidence. Previous work has dealt with the forensic reconstruction of computer-based activity on single hosts, but with the additional complexity involved with a distributed environment, a Web services-centric approach is required. A framework for this type of forensic examination needs to allow for the reconstruction of transactions spanning multiple hosts, platforms and applications. A tool implementing such an approach could be used by an investigator to identify scenarios of Web services being misused, exploited, or otherwise compromised. This information could be used to redesign Web services in order to mitigate identified risks. This paper explores the requirements of a framework for performing effective forensic examinations in a Web services environment. This framework will be necessary in order to develop forensic tools and techniques for use in service oriented architectures.

Extending the advanced forensic format to accommodate multiple data sources, logical evidence, arbitrary information and forensic workflow

Forensic analysis requires the acquisition and management of many different types of evidence, including individual disk drives, RAID sets, network packets, memory images, and extracted files. Often the same evidence is reviewed by several different tools or examiners in different locations. We propose a backwards-compatible redesign of the Advanced Forensic Formatdan open, extensible file format for storing and sharing of evidence, arbitrary case related information and analysis results among different tools. The new specification, termed AFF4, is designed to be simple to implement, built upon the well supported ZIP file format specification. Furthermore, the AFF4 implementation has downward comparability with existing AFF files.

Sex offenders in denial : a study into a group of forensic psychologists' attitudes regarding the corresponding impact upon risk assessment calculations and parole eligibility

A considerable proportion of convicted sex offenders maintain a stance of innocence and thus do not engage in recommended treatment programs. As a result, such offenders are often deemed to have outstanding criminogenic needs which may negatively impact upon risk assessment procedures and parole eligibility. This paper reports on a study that aimed to investigate a group of forensic psychologists’ attitudes regarding the impact of denial on risk assessment ratings as well as parole eligibility. Participants completed a confidential open-ended questionnaire. Analysis indicated that considerable variability exists among forensic psychologists in regards to their beliefs about the origins of denial and what impact such denial should have on post-prison release eligibility. In contrast, there was less disparity regarding beliefs about the percentage of innocent yet incarcerated sex offenders. This paper also reviews current understanding regarding the impact of denial on recidivism as well as upon general forensic assessments.

Near-infrared spectroscopic studies of human scalp hair in a forensic context

Human hair is a relatively inert biopolymer and can survive through natural disasters. It is also found as trace evidence at crime scenes. Previous studies by FTIRMicrospectroscopy and – Attenuated Total Reflectance (ATR) successfully showed that hairs can be matched and discriminated on the basis of gender, race and hair treatment, when interpreted by chemometrics. However, these spectroscopic techniques are difficult to operate at- or on-field. On the other hand, some near infrared spectroscopic (NIRS) instruments equipped with an optical probe, are portable and thus, facilitate the on- or at –field measurements for potential application directly at a crime or disaster scene. This thesis is focused on bulk hair samples, which are free of their roots, and thus, independent of potential DNA contribution for identification. It explores the building of a profile of an individual with the use of the NIRS technique on the basis of information on gender, race and treated hair, i.e. variables which can match and discriminate individuals. The complex spectra collected may be compared and interpreted with the use of chemometrics. These methods can then be used as protocol for further investigations. Water is a common substance present at forensic scenes e.g. at home in a bath, in the swimming pool; it is also common outdoors in the sea, river, dam, puddles and especially during DVI incidents at the seashore after a tsunami. For this reason, the matching and discrimination of bulk hair samples after the water immersion treatment was also explored. Through this research, it was found that Near Infrared Spectroscopy, with the use of an optical probe, has successfully matched and discriminated bulk hair samples to build a profile for the possible application to a crime or disaster scene. Through the interpretation of Chemometrics, such characteristics included Gender and Race. A novel approach was to measure the spectra not only in the usual NIR range (4000 – 7500 cm-1) but also in the Visible NIR (7500 – 12800 cm-1). This proved to be particularly useful in exploring the discrimination of differently coloured hair, e.g. naturally coloured, bleached or dyed. The NIR region is sensitive to molecular vibrations of the hair fibre structure as well as that of the dyes and damage from bleaching. But the Visible NIR region preferentially responds to the natural colourants, the melanin, which involves electronic transitions. This approach was shown to provide improved discrimination between dyed and untreated hair. This thesis is an extensive study of the application of NIRS with the aid of chemometrics, for matching and discrimination of bulk human scalp hair. The work not only indicates the strong potential of this technique in this field but also breaks new ground with the exploration of the use of the NIR and Visible NIR ranges for spectral sampling. It also develops methods for measuring spectra from hair which has been immersed in different water media (sea, river and dam)

Characterisation of soils with the use of instrumental techniques : a multivariate forensic study

The value of soil evidence in the forensic discipline is well known. However, it would be advantageous if an in-situ method was available that could record responses from tyre or shoe impressions in ground soil at the crime scene. The development of optical fibres and emerging portable NIR instruments has unveiled a potential methodology which could permit such a proposal. The NIR spectral region contains rich chemical information in the form of overtone and combination bands of the fundamental infrared absorptions and low-energy electronic transitions. This region has in the past, been perceived as being too complex for interpretation and consequently was scarcely utilized. The application of NIR in the forensic discipline is virtually non-existent creating a vacancy for research in this area. NIR spectroscopy has great potential in the forensic discipline as it is simple, nondestructive and capable of rapidly providing information relating to chemical composition. The objective of this study is to investigate the ability of NIR spectroscopy combined with Chemometrics to discriminate between individual soils. A further objective is to apply the NIR process to a simulated forensic scenario where soil transfer occurs. NIR spectra were recorded from twenty-seven soils sampled from the Logan region in South-East Queensland, Australia. A series of three high quartz soils were mixed with three different kaolinites in varying ratios and NIR spectra collected. Spectra were also collected from six soils as the temperature of the soils was ramped from room temperature up to 6000C. Finally, a forensic scenario was simulated where the transferral of ground soil to shoe soles was investigated. Chemometrics methods such as the commonly known Principal Component Analysis (PCA), the less well known fuzzy clustering (FC) and ranking by means of multicriteria decision making (MCDM) methodology were employed to interpret the spectral results. All soils were characterised using Inductively Coupled Plasma Optical Emission Spectroscopy and X-Ray Diffractometry. Results were promising revealing NIR combined with Chemometrics is capable of discriminating between the various soils. Peak assignments were established by comparing the spectra of known minerals with the spectra collected from the soil samples. The temperature dependent NIR analysis confirmed the assignments of the absorptions due to adsorbed and molecular bound water. The relative intensities of the identified NIR absorptions reflected the quantitative XRD and ICP characterisation results. PCA and FC analysis of the raw soils in the initial NIR investigation revealed that the soils were primarily distinguished on the basis of their relative quartz and kaolinte contents, and to a lesser extent on the horizon from which they originated. Furthermore, PCA could distinguish between the three kaolinites used in the study, suggesting that the NIR spectral region was sensitive enough to contain information describing variation within kaolinite itself. The forensic scenario simulation PCA successfully discriminated between the ‘Backyard Soil’ and ‘Melcann® Sand’, as well as the two sampling methods employed. Further PCA exploration revealed that it was possible to distinguish between the various shoes used in the simulation. In addition, it was possible to establish association between specific sampling sites on the shoe with the corresponding site remaining in the impression. The forensic application revealed some limitations of the process relating to moisture content and homogeneity of the soil. These limitations can both be overcome by simple sampling practices and maintaining the original integrity of the soil. The results from the forensic scenario simulation proved that the concept shows great promise in the forensic discipline.

Computer profiling for forensic purposes

Computer forensics is the process of gathering and analysing evidence from computer systems to aid in the investigation of a crime. Typically, such investigations are undertaken by human forensic examiners using purpose-built software to discover evidence from a computer disk. This process is a manual one, and the time it takes for a forensic examiner to conduct such an investigation is proportional to the storage capacity of the computer's disk drives. The heterogeneity and complexity of various data formats stored on modern computer systems compounds the problems posed by the sheer volume of data. The decision to undertake a computer forensic examination of a computer system is a decision to commit significant quantities of a human examiner's time. Where there is no prior knowledge of the information contained on a computer system, this commitment of time and energy occurs with little idea of the potential benefit to the investigation. The key contribution of this research is the design and development of an automated process to describe a computer system and its activity for the purposes of a computer forensic investigation. The term proposed for this process is computer profiling. A model of a computer system and its activity has been developed over the course of this research. Using this model a computer system, which is the subj ect of investigation, can be automatically described in terms useful to a forensic investigator. The computer profiling process IS resilient to attempts to disguise malicious computer activity. This resilience is achieved by detecting inconsistencies in the information used to infer the apparent activity of the computer. The practicality of the computer profiling process has been demonstrated by a proof-of concept software implementation. The model and the prototype implementation utilising the model were tested with data from real computer systems. The resilience of the process to attempts to disguise malicious activity has also been demonstrated with practical experiments conducted with the same prototype software implementation.

Dealing with temporal inconsistency in automated computer forensic profiling

Computer profiling is the automated forensic examination of a computer system in order to provide a human investigator with a characterisation of the activities that have taken place on that system. As part of this process, the logical components of the computer system – components such as users, files and applications - are enumerated and the relationships between them discovered and reported. This information is enriched with traces of historical activity drawn from system logs and from evidence of events found in the computer file system. A potential problem with the use of such information is that some of it may be inconsistent and contradictory thus compromising its value. This work examines the impact of temporal inconsistency in such information and discusses two types of temporal inconsistency that may arise – inconsistency arising out of the normal errant behaviour of a computer system, and inconsistency arising out of deliberate tampering by a suspect – and techniques for dealing with inconsistencies of the latter kind. We examine the impact of deliberate tampering through experiments conducted with prototype computer profiling software. Based on the results of these experiments, we discuss techniques which can be employed in computer profiling to deal with such temporal inconsistencies.