Forensic Field Research Articles

Introduction to Digital Forensics

Abstract: Crimes committed using computers are increasing rapidly, posing a challenge to law enforcement. Investigations including cybercrime, terrorism, and civil litigation all make use of digital forensics today. Because of the ever-increasing sophistication of modern technology, forensic investigations of this sort can quickly become difficult and time-consuming. In order to successfully retrieve meaningful digital evidence during such investigations, however, a standard framework for digital forensic professionals to follow must be developed. All appropriate steps that a digital forensic investigation would take should be highlighted by the framework and methodology used to conduct digital forensics. This study provides a system for conducting digital forensic investigations with an emphasis on the forensic aspects of those probes, the tools and procedures employed by examiners, and the significance of hashing in preventing the manipulation of evidence. Digital forensics, as a whole, is still a field that is widely growing along with the continually advancing world of technology. This form of forensics is one that is also growing in importance and necessity due to crimes stemming from digital devices becoming increasingly popular as well. These steady numbers are what have and will continue to drive the field of digital forensics into meeting its full potential on a consistent basis, in both a preventative and recovering manner. However, in order to recognize this potential, it is important to first understand what digital forensics really entails

Study of Root Transparency in Different Postmortem Intervals Using Scanning Electron Microscopy.

In the fields of forensics, the identification of human remains is a recurrent problem. The estimated age at death is one of the copious criteria to be evaluated. In adult teeth, the height of the root dentin transparency is used to estimate age. However, in archaeological material, this phenomenon appears inconstant. The aim of this work was to observe the structural modifications of the sclerotic dentin in the teeth for different postmortem intervals. The study included two parts (retrospective and prospective study) with 21 human monoradicular teeth, from bodies donated to medical science with postmortem intervals (PMIs) of 0, 1, 2 and 5 years and archeological excavation. After inclusion based on resin, section and polishing, the samples were analyzed with a scanning electron microscope (SEM) JSM-7800F®, and the procedure was completed via a semiquantitative analysis of calcium and phosphorus using EDX microanalysis. The analysis showed the existence of tubular and chemical modifications of sclerotic dentin at different PMIs. Our SEM study allowed us to observe a difference in tubule aspects linked to an increased PMI: the loss of peritubular collar and the lumen obstruction of tubules with a hyperdense material. Microanalysis highlighted variations in phosphocalcic ratios among the different groups, especially in the pulp area and the canine. Our hypotheses that explain these differences are based on the postmortem modifications of the crystals of the mineral phase of sclerotic dentin under the influence of chemical and/or bacterial action.

Source Camera Identification with a Robust Device Fingerprint: Evolution from Image-Based to Video-Based Approaches.

With the increasing prevalence of digital multimedia content, the need for reliable and accurate source camera identification has become crucial in applications such as digital forensics. While effective techniques exist for identifying the source camera of images, video-based source identification presents unique challenges due to disruptive effects introduced during video processing, such as compression artifacts and pixel misalignment caused by techniques like video coding and stabilization. These effects render existing approaches, which rely on high-frequency camera fingerprints like Photo Response Non-Uniformity (PRNU), inadequate for video-based identification. To address this challenge, we propose a novel approach that builds upon the image-based source identification technique. Leveraging a global stochastic fingerprint residing in the low- and mid-frequency bands, we exploit its resilience to disruptive effects in the high-frequency bands, envisioning its potential for video-based source identification. Through comprehensive evaluation on recent smartphones dataset, we establish new benchmarks for source camera model and individual device identification, surpassing state-of-the-art techniques. While conventional image-based methods struggle in video contexts, our approach unifies image and video source identification through a single framework powered by the novel non-PRNU device-specific fingerprint. This contribution expands the existing body of knowledge in the field of multimedia forensics.

Multi-attention-based approach for deepfake face and expression swap detection and localization

Advancements in facial manipulation technology have resulted in highly realistic and indistinguishable face and expression swap videos. However, this has also raised concerns regarding the security risks associated with deepfakes. In the field of multimedia forensics, the detection and precise localization of image forgery has become essential tasks. Current deepfake detectors perform well with high-quality faces within specific datasets, but often struggle to maintain their performance when evaluated across different datasets. To this end, we propose an attention-based multi-task approach to improve feature maps for classification and localization tasks. The encoder and the attention-based decoder of our network generate localized maps that highlight regions with information about the type of manipulation. These localized features are shared with the classification network, improving its performance. Instead of using encoded spatial features, attention-based localized features from the decoder’s first layer are combined with frequency domain features to create a discriminative representation for deepfake detection. Through extensive experiments on face and expression swap datasets, we demonstrate that our method achieves competitive performance in comparison to state-of-the-art deepfake detection approaches in both in-dataset and cross-dataset scenarios. Code is available at https://github.com/saimawaseem/Multi-Attention-Based-Approach-for-Deepfake-Face-and-Expression-Swap-Detection-and-Localization.

Detection and confirmation of fentanyls in high clay-content soil by electron ionization gas chromatography-mass spectrometry.

Detection of illicit drugs in the environment, particularly in soils, often suggests the present or past location of a clandestine production center for these substances. Thus, development of efficient methods for the analysis and detection of these chemicals is of paramount importance in the field of chemical forensics. In this work, a method involving the extraction and retrospective confirmation of fentanyl, acetylfentanyl, thiofentanyl, and acetylthiofentanyl using trichloroethoxycarbonylation chemistry in a high clay-content soil is presented. The soil was spiked separately with each fentanyl at two concentrations (1 and 10 μg/g) and their extraction accomplished using ethyl acetate and aqueous NH4 OH (pH ~ 11.4) with extraction recoveries ranging from ~56% to 82% for the high-concentration (10 μg/g) samples while ranging from ~68% to 83% for the low-concentration (1 μg/g) samples. After their extraction, residues containing each fentanyl were reacted with 2,2,2-trichloroethoxycarbonyl chloride (Troc-Cl) to generate two unique and predictable products from each opioid that can be used to retrospectively confirm their presence and identity using EI-GC-MS. The method's limit of detection (MDL/LOD) for Troc-norfentanyl and Troc-noracetylfentanyl were estimated to be 29.4 and 31.8 ng/mL in the organic extracts. In addition, the method's limit of quantitation for Troc-norfentanyl and Troc-noracetylfentanyl were determined to be 88.2 and 95.5 ng/mL, respectively. Collectively, the results presented herein strengthen the use of chloroformate chemistry as an additional chemical tool to confirm the presence of these highly toxic and lethal substances in the environment.

Review of Image Forensic Techniques Based on Deep Learning

Digital images have become an important carrier for people to access information in the information age. However, with the development of this technology, digital images have become vulnerable to illegal access and tampering, to the extent that they pose a serious threat to personal privacy, social order, and national security. Therefore, image forensic techniques have become an important research topic in the field of multimedia information security. In recent years, deep learning technology has been widely applied in the field of image forensics and the performance achieved has significantly exceeded the conventional forensic algorithms. This survey compares the state-of-the-art image forensic techniques based on deep learning in recent years. The image forensic techniques are divided into passive and active forensics. In passive forensics, forgery detection techniques are reviewed, and the basic framework, evaluation metrics, and commonly used datasets for forgery detection are presented. The performance, advantages, and disadvantages of existing methods are also compared and analyzed according to the different types of detection. In active forensics, robust image watermarking techniques are overviewed, and the evaluation metrics and basic framework of robust watermarking techniques are presented. The technical characteristics and performance of existing methods are analyzed based on the different types of attacks on images. Finally, future research directions and conclusions are presented to provide useful suggestions for people in image forensics and related research fields.

Study of fingerprint patterns in relation to gender and blood groups

Dermatoglyphics (fingerprint/dactylography) is derived from the Greek word “Derma=Skin, Glyph=Carve.” Dermatoglyphics is defined as the scientific study of naturally occurring epidermal ridges and their configuration on the digits, palms and soles apart from flexion crease and secondary folds. The objective of the study was to determine correlation if any exits between the fingerprint pattern and blood group and gender. The general study design selected for this article was cross-sectional study. Here, the primary outcome variable is to determine correlation (if any) between the fingerprint pattern and blood group and gender. A total of 271 students volunteered for the study. Loops were found to the most prevalent type of fingerprint in all blood groups. Blood groups and primary fingerprint patterns were found to be associated with the association being statistically significant. The correlation between the said entities would enable better authentication and prediction of identity of a person and thereby has the potential for great application in the field of forensics.

Macroanatomical investigations of the skulls of both genders of Heliosciurus gambianus (Gambian sun squirrel) and Funisciurus anerythrus (Thomas’s rope squirrel)

BackgroundThe skull shape and morphometry have been used by several researchers to differentiate and classify species, breeds and also to age the specimen. This study highlights details of the gross morphometry of the skulls of two species of squirrels, Heliosciurus gambianus and Funisciurus anerythrus, using both sexes.ResultsA total of thirty-one (31) linear morphometric parameters were measured on each skull specimen, relating to individual bones. Results were presented as mean ± standard deviation with significant difference at (P < 0.05). Linear measurements were similar in both genders, although some were negligibly higher in females (51.61% in H. gambianus, 70.96% in F anerythrus); no statistically significant difference was observed (P > 0.05). In spite of the similarity in shape, size and linear morphometric values obtained in both species, Pearson’s correlation analysis of the skull height with other measured parameters gave widely differing results. Correlation data obtained may be used to understand better the pattern of the skull development in these squirrels, as well as how it differs from those obtained in other mammals. Examination of the dentition revealed a varied dental formula across the two species, relating to the presence or absence of the upper and lower premolars.ConclusionsThe results obtained in this study may find application in the fields of comparative anatomy and forensics as well as provide basis for future research in ageing, skull development and feeding patterns in these species.

Relationship between Pulp–Tooth Area Ratio and Chronological Age among Saudi Arabian Adults: A Cone Beam Computed Tomography Image Analysis

The pulp–tooth area ratio (PTR) from radiographic dental archives is considered useful for age estimation in the forensic field. Since there have been no studies conducted in the Saudi Arabian population using the PTR method, this study aimed to assess the relationship between the pulp–tooth area ratio of maxillary canines and central incisors and chronological age among Saudi Arabian adults using CBCT and to compare the selected teeth’s predictive power. For this, 100 CBCT scans of 62 male and 38 female patients aged between 20 and 60 years were assessed using OnDemand 3D DentalTM software (Cybermed Co., Tustin, CA, USA) in the axial and sagittal section of each tooth. The mean age estimated using the PTR of the maxillary incisors (39.98 years) was higher than the canines’ (37.9 years). A negative correlation coefficient ‘r’ value was seen between PTR and age. The strongest inverse correlation was noted between age and incisor axial view (0.47) (p &lt; 0.05), Maxillary central incisors had higher R2 in both genders (males: PTRS-0.18, PTRA-0.17; females: PTRS-0.19, PTRA-0.35) than canines. We conclude a weak correlation between the pulp–tooth ratio and chronological age estimation. CBCT pulp–tooth ratios of axial and sagittal sections of incisors were inconclusive in estimating the age of Saudi Arabian individuals owing to their low coefficient of estimation. Among the tooth types studied, maxillary incisors were better predictors than canines.

Use of Lateral Flow Assays in Forensics.

Already for some decades lateral flow assays (LFAs) are 'common use' devices in our daily life. Also, for forensic use LFAs are developed, such as for the analysis of illicit drugs and DNA, but also for the detection of explosives and body fluid identification. Despite their advantages, including ease-of-use, LFAs are not yet frequently applied at a crime scene. This review describes (academic) developments of LFAs for forensic applications, focusing on biological and chemical applications, whereby the main advantages and disadvantages of LFAs for the different forensic applications are summarized. Additionally, a critical review is provided, discussing why LFAs are not frequently applied within the forensic field and highlighting the steps that are needed to bring LFAs to the forensic market.

Metabolomics investigation of post-mortem human pericardial fluid

IntroductionDue to its peculiar anatomy and physiology, the pericardial fluid is a biological matrix of particular interest in the forensic field. Despite this, the available literature has mainly focused on post-mortem biochemistry and forensic toxicology, while to the best of authors’ knowledge post-mortem metabolomics has never been applied. Similarly, estimation of the time since death or post-mortem interval based on pericardial fluids has still rarely been attempted.ObjectivesWe applied a metabolomic approach based on 1H nuclear magnetic resonance spectroscopy to ascertain the feasibility of monitoring post-mortem metabolite changes on human pericardial fluids with the aim of building a multivariate regression model for post-mortem interval estimation.MethodsPericardial fluid samples were collected in 24 consecutive judicial autopsies, in a time frame ranging from 16 to 170 h after death. The only exclusion criterion was the quantitative and/or qualitative alteration of the sample. Two different extraction protocols were applied for low molecular weight metabolites selection, namely ultrafiltration and liquid-liquid extraction. Our metabolomic approach was based on the use of 1H nuclear magnetic resonance and multivariate statistical data analysis.ResultsThe pericardial fluid samples treated with the two experimental protocols did not show significant differences in the distribution of the metabolites detected. A post-mortem interval estimation model based on 18 pericardial fluid samples was validated with an independent set of 6 samples, giving a prediction error of 33–34 h depending on the experimental protocol used. By narrowing the window to post-mortem intervals below 100 h, the prediction power of the model was significantly improved with an error of 13–15 h depending on the extraction protocol. Choline, glycine, ethanolamine, and hypoxanthine were the most relevant metabolites in the prediction model.ConclusionThe present study, although preliminary, shows that PF samples collected from a real forensic scenario represent a biofluid of interest for post-mortem metabolomics, with particular regard to the estimation of the time since death.

Computer Forensics and Advanced Methodology

The field of computer forensics emerged in response to the substantial increase in computer-related crimes occurring annually. This rise in criminal activity can be attributed to the rapid expansion of the internet, which has provided perpetrators with increased opportunities for illicit actions. When a computer system is compromised and an intrusion is detected, it becomes crucial for a specialized forensics team to investigate the incident with the objective of identifying and tracing the responsible party. The outcome of such forensic efforts often leads to legal action being taken against those accountable for the wrongdoing. The methodology employed in computer forensics continually evolves alongside advancements in crime approaches, particularly as attackers leverage emerging technologies. To ensure the accuracy of forensic investigations, it is imperative that the scientific knowledge underlying the forensic process be complemented by the integration of technological tools. A plethora of hardware and software options are available to facilitate the analysis and interpretation of forensic data, thereby enhancing the efficiency and effectiveness of investigations. While the fundamental objectives of computer forensics primarily involve the seamless preservation, identification, extraction, documentation, and analysis of data, the widespread adoption of this discipline is contingent upon the law enforcement community's ability to keep pace with advancements in computing technology. Furthermore, the prevalence of diverse computer devices resulting from the emergence of microcomputer technology also plays a crucial role in shaping the field of computer forensics. This research paper aims to provide a comprehensive overview of computer forensics, encompassing advanced methodologies and detailing various technology tools that facilitate the forensic process. Specific areas of focus include the analysis of encrypted drives, disk analysis techniques, analysis toolkits, investigations involving volatile memory, and the examination of captured network packets. By exploring these aspects, this paper aims to contribute to the existing body of knowledge in the field of computer forensics and support practitioners in their pursuit of effective investigative techniques.

Prediction of chronological age and its applications in forensic casework: methods, current practices, and future perspectives.

Estimating an individual's age can be relevant in several areas primarily related to the clinical and forensic fields. In the latter, estimation of an individual's chronological age from biological material left by the perpetrator at a crime scene may provide helpful information for police investigation. Estimation of age is also beneficial in immigration cases, where age can affect the person's protection status under the law, or in disaster victim identification to narrow the list of potential missing persons. In the last decade, research has focused on establishing new approaches for age prediction in the forensic field. From the first forensic age estimations based on morphological inspections of macroscopic changes in bone and teeth, the focus has shifted to molecular methods for age estimation. These methods allow the use of samples from human biological material that does not contain morphological age features and can, in theory, be investigated in traces containing only small amounts of biological material. Molecular methods involving DNA analyses are the primary choice and estimation of DNA methylation levels at specific sites in the genome is the most promising tool. This review aims to provide an overview of the status of forensic age prediction using molecular methods, with particular focus in DNA methylation. The frequent challenges that impact forensic age prediction model development will be addressed, together with the importance of validation efforts within the forensic community.

Molecular Approaches in Soil Microbial Analysis: Forensic Perspective

The growing field of soil microbial forensics provides the legal answer to how microorganisms play a crucial role in criminal investigations. It is an advanced crossdisciplinary science capable of offering significant physical evidence with considerable interest in criminal investigations, environmental crime, and counterterrorism. Microbial forensics of soil consists of different techniques to identify and evaluate microbial abundance, their complexity, and their interaction with soil and surrounding objects. The present review highlights various microbial analysis techniques such as Terminal restriction fragment length polymorphism, Temperature/Denaturing Gradient Gel Electrophoresis, Amplified Ribosomal DNA Restriction Analysis, Length Heterogeneity PCR, Phospholipid-derived fatty acids, Fluorescence in situ hybridization, Stable-isotope probing and metagenomics using nextgeneration sequencing. This article also summarises the challenges faced in soil microbial forensics, various statistical approaches, reference databases commonly used in forensic soil studies, and different methodological approaches used in forensic laboratories. Literature was studied using various online bibliographic databases like Google Scholar, Web of Science, Pub Med, Scopus, and several other search engines. Conclusive evidence generated by this paper signifies the importance of soil microbes to assist forensic scientists and researchers in selecting adequate methods to differentiate soil samples. The present comparative study concluded that targeted molecular analysis of microbes as a forensic soil typing tool has a lot of potential and should be investigated further.

The analysis of SUDEP forensic autopsies leading to preventable events.

The diagnosis of unexpected death by excluding non-natural causes, particularly in subjects with epilepsy, is a topic of interest and it is difficult to identify in the forensic field. Health professionals sometimes are faced with cases of sudden death, generally in young adults with a long history of epilepsy that require, for judicial purposes, an explanation in terms of cause and means to determine the death. SUDEP is an entity diagnosed by the exclusion of other causes that may have led to death, and then for forensic purposes, it requires particular attention and knowledge, and there is difficulty in identifying it. Our contribution aims to illustrate the scientific community pathological findings, medical history, and circumstantial evidence of four cases of sudden death in epileptic subjects. We illustrated four cases of judicial autopsies from the Institute of Forensic Medicine of Palermo, Italy; the purpose was to exclude the criminal intervention in determining the death as non-natural. The study of victims' medical history, the toxicological investigations, and the autopsy findings analyzed both from macroscopic and microscopic aspects have made it possible to highlight some findings that can be traced back to SUDEP despite the small sample of subjects studied. These presented findings of four SUDEP cases could help forensic pathologists in recognizing this entity, by highlighting its characteristics, and allowing for a pathological classification, also in relation to the use of drugs for epilepsy treatment and circumstances of death. To obtain a definite diagnosis of SUDEP, a complex investigation process is required in a multidisciplinary approach. Considering the literature review with criticism, it could allow health professionals to select the characteristics of epileptic patients at risk of sudden death. Processing human behaviors, molecular and histopathological findings of the autopsies, but also the physiological, and pathological human body system functions thanks to Artificial Intelligence, could be the key to explaining SUDEP mechanisms and the future results to prevent it.

On the Application of Microfluidic-Based Technologies in Forensics: A Review.

Microfluidic technology is a powerful tool to enable the rapid, accurate, and on-site analysis of forensically relevant evidence on a crime scene. This review paper provides a summary on the application of this technology in various forensic investigation fields spanning from forensic serology and human identification to discriminating and analyzing diverse classes of drugs and explosives. Each aspect is further explained by providing a short summary on general forensic workflow and investigations for body fluid identification as well as through the analysis of drugs and explosives. Microfluidic technology, including fabrication methodologies, materials, and working modules, are touched upon. Finally, the current shortcomings on the implementation of the microfluidic technology in the forensic field are discussed along with the future perspectives.

A Selection of 14 Tetrameric Microsatellite Markers for Genetic Investigations in Fallow Deer (Dama dama).

The fallow deer (Dama dama) represents significant game management value globally, and human activities are significantly impacting the species. Besides the positive effects, these activities can threaten its existence, health, and value. The aim of the authors was to develop a tetranucleotide microsatellite panel that could be clearly interpreted and used for genetic testing of fallow deer. Such a panel did not exist until now and could be particularly useful in the field of conservation genetics and forensics. A total of 99 tetrameric microsatellites, originally designed for related deer species, were tested on 20 fallow deer individuals from five Hungarian sampling areas. Original and newly designed primers were used to amplify the microsatellite regions using previously published or optimized PCR protocols. The lengths and sequences of specific amplicons were detected using capillary electrophoresis, and the rate of polymorphism was determined. Altogether, 80 markers provided PCR products of adequate quality and quantity. Among them, 15 markers proved to be polymorphic (2-5 alleles/locus), and 14 tetrameric markers were selected for further analysis. Statistical calculations showed that the selected polymorphic microsatellites can potentially enable key individualization in many areas of wildlife and population genetics, thus protecting the species.

Investigating the Effectiveness of Novel Support Vector Neural Network for Anomaly Detection in Digital Forensics Data

As criminal activity increasingly relies on digital devices, the field of digital forensics plays a vital role in identifying and investigating criminals. In this paper, we addressed the problem of anomaly detection in digital forensics data. Our objective was to propose an effective approach for identifying suspicious patterns and activities that could indicate criminal behavior. To achieve this, we introduce a novel method called the Novel Support Vector Neural Network (NSVNN). We evaluated the performance of the NSVNN by conducting experiments on a real-world dataset of digital forensics data. The dataset consisted of various features related to network activity, system logs, and file metadata. Through our experiments, we compared the NSVNN with several existing anomaly detection algorithms, including Support Vector Machines (SVM) and neural networks. We measured and analyzed the performance of each algorithm in terms of the accuracy, precision, recall, and F1-score. Furthermore, we provide insights into the specific features that contribute significantly to the detection of anomalies. Our results demonstrated that the NSVNN method outperformed the existing algorithms in terms of anomaly detection accuracy. We also highlight the interpretability of the NSVNN model by analyzing the feature importance and providing insights into the decision-making process. Overall, our research contributes to the field of digital forensics by proposing a novel approach, the NSVNN, for anomaly detection. We emphasize the importance of both performance evaluation and model interpretability in this context, providing practical insights for identifying criminal behavior in digital forensics investigations.

A Comparative Observational Study of Postmortem Computed Tomography and Traditional Forensic Autopsy Findings in Hanging Cases

Background: The use of advanced radiological techniques is rising in the field of forensics to supplement and validate the evidence. Postmortem Computed Tomography (PMCT) is now used as a standard procedure in many institutions to augment traditional autopsy findings. The application of PMCT in hanging cases will greatly reduce the number of invasive traditional autopsies, as hanging is the most common method of suicide in Northern parts of India. Therefore this observational study was conducted to compare PMCT with traditional autopsy in fifty hanging cases. Result: Out of 50 cases, the age of the subjects ranged between 14 years and 70 years. PMCT with the help of 3D reconstruction was able to detect external ligature marks on the neck in 92% (N=46) of cases giving a sensitivity of 92% (CI = 80.77% to 97.78%). Skin and subcutaneous tissue desiccation were identifiable in 96% (N=48) by PMCT, giving a sensitivity of 96% (CI= 86.29% to 99.51%). The muscle hemorrhage was identified in 4% (N=2) of the cases in traditional autopsy while the authors found difficulty in interpreting the muscle hemorrhage in PMCT. In detecting thyroid cartilage fracture, the sensitivity of PMCT was found to be 100% (CI= 15.81% to 100.00%) and specificity of 100% (CI=92.60% to 100.00%). In detecting hyoid bone fracture, the sensitivity was 100% (CI= 2.50% to 100.00%), and specificity of 100% (CI=92.60% to 100.00%). In addition, there was a great degree of agreement between the two observers for these findings suggesting the reproducibility of the result. Conclusions: A consistency in findings of both the PMCT and traditional autopsy was found. However, CT was unable to detect muscle hemmorhages, compared to traditional autopsy. Authors suggest the use of CT angiography to overcome this shortcoming, till then CT can only augment invasive autopsy findings not replace it

Source Microphone Identification Using Swin Transformer

Microphone identification is a crucial challenge in the field of digital audio forensics. The ability to accurately identify the type of microphone used to record a piece of audio can provide important information for forensic analysis and crime investigations. In recent years, transformer-based deep-learning models have been shown to be effective in many different tasks. This paper proposes a system based on a transformer for microphone identification based on recorded audio. Two types of experiments were conducted: one to identify the model of the microphones and another in which identical microphones were identified within the same model. Furthermore, extensive experiments were performed to study the effects of different input types and sub-band frequencies on system accuracy. The proposed system is evaluated on the Audio Forensic Dataset for Digital Multimedia Forensics (AF-DB). The experimental results demonstrate that our model achieves state-of-the-art accuracy for inter-model and intra-model microphone classification with 5-fold cross-validation.