Forensic Data Analysis Research Articles

AN ASSESSMENT OF FORENSIC ACCOUNTING TECHNIQUES IN THE PREVENTION OF REVENUE LEAKAGES IN NIGERIAN FEDERAL UNIVERSITIES

Purpose: Forensic accounting reflects the application of investigative and analytical techniques for the purpose of resolving fraudulent practices. The purpose of the research was to examine the extent at which Forensic Accounting Techniques serves as a panacea for preventing Revenue Leakages in Federal Universities in Nigeria. 
 Methodology: Primary data were collected with the aid of research questionnaire and used in this study. The sample size of 238 respondents was determined from a census of targeted EFCC, internal audit staff of selected Nigerian Federal Universities. This study applied a statistical tool, which described and evaluated the relationships between Forensic accounting techniques and revenue leakages.
 Findings: The methodology shows that Forensic accounting data analysis techniques have positive effects on revenue leakages in Nigerian Federal Universities. This implies that a forensic data analysis technique can help in uncovering leakages of revenue in Nigerian Federal Universities. The implication is that when these technologies are applied, there would be drastic reduction in revenue leakages. From the findings, it was concluded that the application of forensic accounting techniques will help in preventing revenue leakages in Nigerian Federal Universities.
 Unique Contribution to Theory, Practice and Policy: On the basis of these findings and conclusion, it was recommended that forensic accounting data analysis and technology techniques should be employed in Nigerian Federal Universities to help them curb revenue leakages in the system. That will help to discover and analyse patterns of fraudulent activities and develop sorts of digital tools that would be found helpful in fighting economic and financial crimes within the system.
 Keywords: Forensic Accounting, Revenue Leakages, Frauds, Forensic Accounting Technologies

Application of digits based test to analyse presidential election data in Nigeria

ABSTRACT This study examined the application of Benford's Law to analyse the 2015 and 2019 presidential election data in Nigeria. Data obtained from the electoral body were analysed using frequency distribution and Spearman Rank Correlation tests at 0.05 level of significance. Findings revealed that the second digits distributions of the vote counts for the two major political parties, registered voters and total vote counts in both elections do not conform to the distributional pattern predicted by Benford's Law. The study recommends that stakeholders should aim for an electoral reform that allows the use of forensic analysis of electoral data in Nigeria.

Internet of things forensic data analysis using machine learning to identify roots of data scavenging

In this paper, we proposed the blockchain-assisted shared audit framework (BSAF) to analyze digital forensic data in the IoT platform. The proposed framework was designed to detect the source/cause of data scavenging attacks in virtualized resources (VR). The proposed framework implements blockchain technology for access log and control management. Access log information is analyzed for its consistency of adversary event detection using logistic regression (LR) machine learning and cross-validation. An adversary event detected by LR is filtered using cross-validation to retain the precision of data analysis for varying user density and VRs. Experimental results prove the consistency of the proposed method by improving the data analysis, as well as reducing analysis time and the adversary event rate.

Analysis of Digital Forensic Tools

This paper aims to analyze different tools for Forensic Data Analysis comes under the branch of Digital Forensics. Forensic data analysis is done with digital techniques. Digital forensics becomes more important in law enforcement, due to the large use of computers and mobile devices. The pattern recognition system most appropriately fits into the Analysis Phase of the Digital Forensics. Pattern Recognition involves two processes. One Process is an analysis and the second process is recognition. The result of the analysis is taken out of the attributes from the patterns to be recognized i.e., a pattern of different faces and fingerprints. These attributes are then utilized for the further process in the analysis phase which provides attention on various techniques of pattern recognition that are applied to digital forensic examinations and is proposed to develop different forensic tools to collect evidence that would be helpful to solve specific types of crimes. This evidence further helps the examiner in the analysis phase of the digital forensic process by identifying the applicable data.

MHTyper: a microhaplotype allele-calling pipeline for use with next generation sequencing data

ABSTRACT Microhaplotypes have been reported for applications in different aspects of human forensics. Next generation sequencing (NGS) possesses several advantages in microhaplotype genotyping. Large amounts of NGS-based microhaplotype data has been accumulated, and bioinformatic software designed for microhaplotype NGS data analysis is in urgent need. In this work, we introduced MHTyper, a Linux/Unix pipeline designed for efficient microhaplotype allele-calling and sequencing depth statistics. We developed an NGS-based 30-plex microhaplotype panel and used MHTyper to analyse the data produced. The allele-calling accuracy of MHTyper was evaluated by manually comparing the MHTyper-reported genotypes with those visualized, along with the well-accepted bioinformatic software Integrative Genomics Viewer. No discordance was observed in all 150 pairs for comparison. These data supported that MHTyper could provide an efficient tool for NGS-based forensic microhaplotype data analysis.

Principal–Agent Dynamics and Electoral Manipulation: Local Risks, Patronage and Tactical Variation in Russian Elections, 2003–2012

Why are some elections manipulated more severely than others, and why do the techniques used to manipulate them vary over time and space? This article addresses these related questions by showing that patronage resources—not incumbent popularity—make manipulation appealing to frontline agents, while local political conditions can make manipulation personally risky for them. Agents can mitigate these risks by adopting more dispersed forms of manipulation like vote-buying, rather than more centralised falsification. These hypotheses are tested using forensic analysis of electoral data from more than 90,000 precincts per election across Russia’s 83 regions, from 2003 to 2012.

High throughput sequencing data analysis workflow: mtDNA variant detection and identification of STR/Y-STR alleles and iso-alleles

High throughput sequencing of mtDNA and STRs enable forensic laboratories to have the benefits of both analysis methods at the same time. HTS chemistries are more cost effective than Sanger sequencing for the mitochondrial genome and produce data at a greater depth of coverage allowing for detection of low level heteroplasmy [1,2,4]. Advantages of HTS STR chemistries over traditional CE include the ability to have smaller amplicons, analyze more loci in each reaction, and the identification of sequence polymorphisms that could, once iso-allele frequencies are available, potentially be processed in mixture software, such as MaSTR™, for deconvolution and LR calculation. Rigorous, user-friendly software is needed in order to analyze the large data files consisting of thousands to millions of reads generated for each sample [5].GeneMarker®HTS is a rapid, user-friendly, software for analysis of forensic mtDNA, autosomal and Y-STR high throughput sequencing data. National Institute of Standards and Technology (NIST), in conjunction with Promega corporation, generously supplied fastq sequence files and corresponding CE allele calls for 672 samples amplified with the PowerSeq® Auto/Y System and analyzed on an Illumina® MiSeq. Results of these data analyzed in GeneMarkerHTS software were highly concordant with the CE allele calls. Summary of the STR allele calls concordance and examples of alleles exhibiting sequence variation will be presented. Additionally, a review of the mtDNA genome forensic alignment, heteroplasmy report, import of major variant profile to EMPOP, sample comparison, and database options will be presented.

Forensic analysis of MPS mtDNA data using QIAGEN biomedical genomics workbench and AQME tool – preliminary results

Massively Parallel Sequencing (MPS) allows to sequence the total mitochondrial DNA (mtDNA) through specific panels. Human Mitochondria Panel is one of the QIAseq Targeted DNA panels developed by QIAGEN for MPS, which have an optimized chemistry based on the integration of unique molecular indices (UMIs). However, the major problem is the analysis of the MPS data and, therefore, it became necessary to create bioinformatics tools that would enable mtDNA analysis such as the AQME tool to be used with the QIAGEN Biomedical Genomics Workbench software. In this study, a coverage comparison workflow was tested to verify the coverage differences between two mtDNA panels, QIAseq Human Mitochondria Panel and Precision ID mtDNA Whole Genome Panel. The preliminary results showed a significant decrease in the Precision ID coverage, after the bioinformatics removal of PCR artifacts. For the QIAseq panel, this coverage variation was lower, since the UMIs enable to know more accurately the initial number of molecules in the original mtDNA sequence.

EPIDEMIOLOGY AND RISK FACTORS OF SUDDEN DEATH DUE TO PULMONARY THROMBOEMBOLISM: A RETROSPECTIVE STUDY

Introduction. Pulmonary thromboembolism (PTE) is not an uncommon cause of sudden, unexpected death. Autopsy is the gold standard for cause of death determination in cases of suspected PTE. Mortality rates due to PTE are not estimated accurately.
 Objective. The aim of this study was to analyze distribution patterns and risk factors of sudden deaths due to PTE.
 Methods. Retrospective analysis of Lithuanian State Forensic Medicine Service autopsy data, period 2014-2018. A total of 4533 cases were reviewed; 80 cases met the criteria of immediate cause of death being PTE and were included in the study. PTE epidemiology, risk factors, clinical and pathoanatomical characteristics were described by reviewing scientific literature and statistical databases.
 Results. PTE as the cause of sudden death was diagnosed in 37(46.25%) men and 43(53.75%) women. Median age at the time of death was 62.8±17.2 years. Death occurred in hospital in 21(26.25%) cases. Trauma was the underlying cause of PTE in 11(13.75%) cases; 9(81.8%) patients were admitted to hospital after a traumatic event. Cardiac hypertrophy was observed in 70(87.5%) autopsies. Abdominal subcutaneous fat thickness was 4.08±2.64 cm in men and 5.35±2.69 cm in women. Deep vein thrombosis (DVT) was confirmed upon microscopic examination in all cases, being the underlying cause of death in 67(83.75%) cases.
 Conclusion. Sudden death due to PTE usually occurs at an older age and in absence of medical care. PTE is common after sustaining severe traumatic injuries which, when not immediately lethal, are managed in hospital. Cardiac hypertrophy and obesity may increase risk of death due to PTE. Undiagnosed and untreated DVT is often the underlying cause of sudden death due to PTE.

Application of likelihood ratios and optimal decision thresholds in fire debris analysis based on a partial least squares discriminant analysis (PLS-DA) model

A set of 9000 computationally generated (in-silico) total ion spectra comprising samples containing ignitable liquids from ASTM E1618-14 classes mixed with pyrolyzed substrates (class IL) and samples containing a mixture of pyrolyzed substrates without ignitable liquid contribution (class SUB) was used to generate a partial least squares discriminant analysis (PLS-DA) model. The training data set was balanced in IL and SUB class composition and the IL class samples were composed of a uniform distribution of ignitable liquids from the ASTM E1618-14 defined classes. The number of components in the optimized PLS-DA model, 13, was determined by optimizing the area under the receiver operating characteristic curve (ROC AUC) as a function of the number of components. Ten cross validation folds had an average ROC AUC of 0.930 ± 0.006. The PLS-DA model was further challenged with a uniformly distributed and balanced IL/SUB validation set of 1000 computationally mixed total ion spectra, giving an ROC AUC 0f 0.93. The model which had been validated on computationally generated total ion spectra was tested on a set of “real” fire debris samples from large-scale burn tests that had been independently evaluated by an “informed analyst”. The results from this study demonstrate the application of a chemometric model to the forensic analysis of fire debris data and emphasize the connection between quantified strength of the evidence and categorical decisions based on a defined operational decision point on the ROC curve. The success of the PLS-DA model demonstrates the feasibility of applying chemometric methods to the analysis of fire debris as a means of introducing probabilistic statements of evidentiary value to the court.

PENGGUNAAN METODE STATIS DAN LIVE FORENSIK PADA UAV UNTUK MENDAPATKAN BUKTI DIGITAL

In recent years, the use of drones by civilians is increasing rapidly by the presentation of total sales continued to increase rapidly every year. With the increasing possibility of Unmanned Aerial Vehicle (UAV) abuse, crime in the use of UAVs to be larger. Through forensic analysis of data using static forensic and live forensic to obtain data that allows it to be used as digital evidence. To dig up information that could be used as digital evidence in the UAV and controllers, as well as to know the characteristics of digital evidence on a UAV. The results showed that digital evidence on a UAV, the smartphone is used as a controller UAV has a very important role in the investigation. The findings in aircraft has a percentage of 50% and a camera memory card with 16.6%. DJI Phantom 3 Advanced GPS coordinates always store data in flight LOG; the data is always stored even when the flight mode is used does not use GPS signals to stability. Due to DJI Phantom 3 Advanced always use GPS on flights, file, image or video captured by the camera has the best GPS location coordinates to the metadata therein.

Bring2lite: A Structural Concept and Tool for Forensic Data Analysis and Recovery of Deleted SQLite Records

As of today mobile applications such as WhatsApp or Skype make use of the SQLite database format to store its data. From an IT forensics point of view it is therefore essential to extract all information related to an SQLite database. In this paper we focus on digital traces in the scope of SQLite that belong to deleted database data. We suggest to make use of a structural approach: we analyse the deletion behaviour of SQLite depending on different database parameters, which affect the erasure of database data. As SQLite pragmas are an important parameter during deletion, we examine the erasure behaviour dependent on the pragmas in use. Based on the results of our analysis, we develop a concept to parse and process deleted records. Our concept is implemented within our tool bring2lite, which is evaluated with respect to a common dataset of SQLite files. The overall result is that bring2lite achieves the highest recovery rate of approximately 53% compared to eight competing programmes.

An analysis of anti-forensic capabilities of B-tree file system (Btrfs)

ABSTRACT Anti-forensic techniques aim to prevent, hinder or corrupt the forensic process of evidence acquisition, its analysis, and/or its admissibility. File systems are at the spotlight of almost every forensic investigation. The Linux B-tree file system (Btrfs) offers a paradigm shift in file system design by providing simple administration, end-to-end data integrity, and immense scalability without loss of performance. However, the potential of Btrfs for forensics examination and its resistance to anti-forensic activities was not investigated before. This paper covers this gap by analysing the forensics value of Btrfs and its robustness against anti-forensics activities. The experimental results suggest that Btrfs offers strong hurdles to many anti-forensic attacks. These include making it difficult to securely wipe files, disallowing hiding data in reserved locations of the file system data structures, and so on. Based on our findings, even a corrupt Btrfs volume could contain remnants of deletion of small files, hidden data in reserved locations and magic string forgery. Furthermore, forensic tools meant for Btrfs investigation must be augmented to support automated forensic analysis of possible hidden data in boot sector, file slack, volume slack and mount-point directories, MAC-DTS forgery, and sparse files.

Welcome pwn: Almond smart home hub forensics

Many home interactive sensors and networked devices are being branded as “Internet of Things” or IoT devices. Such disparate gadgets often have little in common other than that they all communicate using similar protocols. The emergence of devices known as “smart home hubs” allow for such hardware to be controlled by non-technical users providing inexpensive home security and other home automation functions. To the cyber analyst, these smart environments can be a boon to digital forensics; information such as interactions with the devices, sensors registering motion, temperature or moisture levels in different rooms, all tend to be collected in one central location rather than separate ones. This paper presents the research work conducted on one such smart home hub environment, the Securifi Almond+, and provides guidance for forensic data acquisition and analysis of artefacts pertaining to user interaction across the hub, the iPhone/Android companion applications and the local & cloud-based web interfaces.

Smart vehicle forensics: Challenges and case study

Vehicles are fast becoming another important source of digital evidence in a criminal investigation. Traditionally, when a vehicle is involved in a crime scene (e.g. drink driving) or a terrorist attack, the investigators focus on the acquisition of DNA, fingerprints and other identifying materials that are usually non digital in nature. However, modern-day cars, particularly smart or driverless cars, store a wealth of digital information, such as recent destinations, favorite locations, routes, and personal data (e.g. call logs, contact lists, SMS messages, pictures, and videos). In this paper, we describe some of the challenges associated with vehicle data forensics, which is an understudied area. Next, we present our case studies on forensic acquisition and data analysis of an entertainment system on a Volkswagen car. We also discuss potential hardware and software solutions that can be used to acquire forensic artifacts from such vehicles. Finally, we describe and analyze the mobile data traffic from an Audi car, a VW car and a BMW car.

A Visualization Approach to Analyze Android Smartphone Data

This study aims to design and develop an interactive system that can visualize evidence collected from Android smartphone data. This project is developing to support forensic investigator in investigating the security incidents particularly involving Android smartphone forensic data. The used of smartphone in crime was widely recognized. Several types of personnel information are stored in their smartphones. When the investigator analyses the image data of the smartphone, the investigator can know the behaviour of the smartphone’s owner and his social relationship with other people. The analysis of smartphone forensic data is cover in mobile device forensic. Mobile device forensics is a branch of digital forensics relating to recovery of digital evidence from a mobile device under forensically sound condition. The digital investigation model used in this project is the model proposed by United States National Institute of Justice (NIJ) which consists four phases, which are collection phase, examination phase, analysis phase and presentation phase. This project related with analysis phase and presentation phase only. This paper introduces Visroid, a new tool that provides a suite of visualization for Android smartphone data.

Quantifying Mental Health Issues & Taboos of Mental Health

The research agenda starts 3 weeks after conception, including the whole human life cycle. Pathological stress of stigmatization is identified as the hidden driver and trigger of modern illnesses and diseases; the control of the heart-beat-frequency is seen as the medical key to maintain mental and physical health. Mood science factors in immediately at the time of conception with respect to the information gained by professional treatment of the mother. The trigger of stress is immediately activated via the thought process of the mother which is transmitted to the child in the womb via the umbilical cord. As such the pathway of stress is established via the blood flow of our mothers. Conception is most likely to evolve either of two ways: a) with consent, or b) non-consent. In both cases, the health of the mother effects that of the child in the womb. Since the development of the human brain at the time of conception is virtual nonexistent, it is very probable that the moods of the mother during the pregnancy effects the child. Hence the feelings (mood science) of the mother provide circumstantial evidence of the child's mental health prior to birth. This paper will provide the circumstantial evidence (via mathematics) that can be used as a baseline design of a Forensic Simulator. Such a simulation could be used to treat those of us who suffer from diseases such as PTSD. Specifically, it could be used by patients experiencing high stress levels via the bio-feedback algorithms of the simulator. Measurement signals would take the form of EEG's while being stimulated via an Interview script used by the professional conducting the examination. Forensic Data Analysis (FDA) is a branch of Digital forensics. It examines structured data with regard to incidents of financial crime. The aim is to discover and analyze patterns of fraudulent activities. Data from application systems or from their underlying databases is referred to as structured data.

Recommendation techniques in forensic data analysis

Recommendation techniques in forensic data analysis

IoT Device Forensics and Data Reduction

The growth in the prevalence of the plethora of digital devices has resulted in growing volumes of disparate data, with potential relevance to criminal and civil investigations. With the increase in data volume, there is an opportunity to build greater case-related knowledge and discover evidence, with implications at all stages of the digital forensic analysis process. The growth in digital devices will potentially further contribute to the growth in big digital forensic data, with a need for practitioners to consider a wider range of data and devices that may be relevant to an investigation. A process of data reduction by selective imaging and quick analysis, coupled with automated data extraction, gives potential to undertake the analysis of the growing volume of data in a timely manner. In this paper, we outline a process of bulk digital forensic data analysis including disparate device data. We research the process with a research data corpus and apply our process to real-world data. The challenges of the growing volume of devices and data will require forensic practitioners to expand their ability to undertake research into newly developed data structures, and be able to explain this to the court, judge, jury, and investigators.

Mobile Forensic Data Analysis: Suspicious Pattern Detection in Mobile Evidence

Culprits’ identification by the means of suspicious pattern detection techniques from mobile device data is one of the most important aims of the mobile forensic data analysis. When criminal activities are related to entirely automated procedures such as malware propagation, predicting the corresponding behavior is a rather achievable task. However, when human behavior is involved, such as in cases of traditional crimes, prediction and detection become more compelling. This paper introduces a combined criminal profiling and suspicious pattern detection methodology for two criminal activities with moderate to the heavy involvement of mobile devices, cyberbullying and low-level drug dealing. Neural and Neurofuzzy techniques are applied on a hybrid original and simulated dataset. The respective performance results are measured and presented, the optimal technique is selected, and the scenarios are re-run on an actual dataset for additional testing and verification.