Forensic Data Analysis Research Articles

Mobile Forensic Data Analysis: Suspicious Pattern Detection in Mobile Evidence

Culprits’ identification by the means of suspicious pattern detection techniques from mobile device data is one of the most important aims of the mobile forensic data analysis. When criminal activities are related to entirely automated procedures such as malware propagation, predicting the corresponding behavior is a rather achievable task. However, when human behavior is involved, such as in cases of traditional crimes, prediction and detection become more compelling. This paper introduces a combined criminal profiling and suspicious pattern detection methodology for two criminal activities with moderate to the heavy involvement of mobile devices, cyberbullying and low-level drug dealing. Neural and Neurofuzzy techniques are applied on a hybrid original and simulated dataset. The respective performance results are measured and presented, the optimal technique is selected, and the scenarios are re-run on an actual dataset for additional testing and verification.

Forensic Data Extraction and Analysis of Left Artifacts on emulated Android Phones: A Case Study of Instant Messaging Applications

The fast-growing nature of instant messaging applications usage on Android mobile devices brought about a proportional increase on the number of cyber-attack vectors that could be perpetrated on them. Android mobile phones store significant amount of information in the various memory partitions when Instant Messaging (IM) applications (WhatsApp, Skype, and Facebook) are executed on them. As a result of the enormous crimes committed using instant messaging applications, and the amount of electronic based traces of evidence that can be retrieved from the suspect’s device where an investigation could convict or refute a person in the court of law and as such, mobile phones have become a vulnerable ground for digital evidence mining. This paper aims at using forensic tools to extract and analyse left artefacts digital evidence from IM applications on Android phones using android studio as the virtual machine. Digital forensic investigation methodology by Bill Nelson was applied during this research. Some of the key results obtained showed how digital forensic evidence such as call logs, contacts numbers, sent/retrieved messages, and images can be mined from simulated android phones when running these applications. These artefacts can be used in the court of law as evidence during cybercrime investigation.

Digital forensic intelligence: Data subsets and Open Source Intelligence (DFINT[formula omitted]OSINT): A timely and cohesive mix

Advances in technologies and changing trends in consumer behaviour have led to an increase in the volume, variety, velocity, and veracity of data available for digital forensic analysis. A benefit of analysis of big digital forensic data is that there may be case-related information contained within disparate data sources. This paper presents a framework for entity identification and open source information cohesion to add value to data holdings from digital forensic data subsets. Application of the framework to test data resulted in locating additional information relating to the entities contained within the digital forensic data subsets, which led to adding intelligence value relating to the entities. Analysis of real-world data confirmed the potential to add value to big digital forensic data to uncover disparate information and open source information. The results demonstrate the benefits of applying the process to achieve greater understanding of digital forensic data in a timely manner.

New Technology for Peace & Protection: Expanding the r2p Toolbox

New technological advances in areas such as digital information, algorithmic forensic data analysis, autonomous surveillance vehicles, advanced robotics, and multispectral sensors (sometimes all working together) can help avert war, introduce more effective peacekeeping and peacemaking initiatives, lessen the impact of conflict on innocent people, and help rebuild war-torn states. When international humanitarian action becomes urgent, by way of knowledge gained through such technologies, then those same peace applications can be used to reduce harmful forms of intervention and to ensure that enforcers are abiding by international law and UN guidance. An ethical failure occurs when such technologies exist to save lives, reduce risks, and secure peace, but are not employed.

Posterior distributions for likelihood ratios in forensic science

Evaluation of evidence in forensic science is discussed using posterior distributions for likelihood ratios. Instead of eliminating the uncertainty by integrating (Bayes factor) or by conditioning on parameter values, uncertainty in the likelihood ratio is retained by parameter uncertainty derived from posterior distributions. A posterior distribution for a likelihood ratio can be summarised by the median and credible intervals. Using the posterior mean of the distribution is not recommended. An analysis of forensic data for body height estimation is undertaken. The posterior likelihood approach has been criticised both theoretically and with respect to applicability. This paper addresses the latter and illustrates an interesting application area.

Big forensic data management in heterogeneous distributed systems: quick analysis of multimedia forensic data

SummaryThe growth in the data volume and number of evidential data from heterogeneous distributed systems in smart cities, such as cloud and fog computing systems and Internet‐of‐Things devices (e.g. IP‐based CCTVs), has led to increased collection, processing and analysis times, potentially resulting in vulnerable persons (e.g. victims of terrorism incidents) being at risk. A process of Digital Forensic Data Reduction of source multimedia and forensic images has provided a method to reduce the collection time and volume of data. In this paper, a methodology of Digital Forensic Quick Analysis is outlined, which describes a method to review Digital Forensic Data Reduction subsets to pinpoint relevant evidence and intelligence from heterogeneous distributed systems in a timely manner. Applying the proposed methodology to real‐world data from an Australian police agency highlighted the timeliness of the process, resulting in significant improvements in processing times in comparison with processing a full forensic image. The Quick Analysis methodology, combined with Digital Forensic Data Reduction, has potential to locate evidence and intelligence in a timely manner. Copyright © 2016 John Wiley & Sons, Ltd.

Chemical profiling: A tool to decipher the structure and organisation of illicit drug markets: An 8-year study in Western Switzerland

Illicit drug analyses usually focus on the identification and quantitation of questioned material to support the judicial process. In parallel, more and more laboratories develop physical and chemical profiling methods in a forensic intelligence perspective. The analysis of large databases resulting from this approach enables not only to draw tactical and operational intelligence, but may also contribute to the strategic overview of drugs markets.In Western Switzerland, the chemical analysis of illicit drug seizures is centralised in a laboratory hosted by the University of Lausanne. For over 8 years, this laboratory has analysed 5875 cocaine and 2728 heroin specimens, coming from respectively 1138 and 614 seizures operated by police and border guards or customs. Chemical (major and minor alkaloids, purity, cutting agents, chemical class), physical (packaging and appearance) as well as circumstantial (criminal case number, mass of drug seized, date and place of seizure) information are collated in a dedicated database for each specimen.The study capitalises on this extended database and defines several indicators to characterise the structure of drugs markets, to follow-up on their evolution and to compare cocaine and heroin markets. Relational, spatial, temporal and quantitative analyses of data reveal the emergence and importance of distribution networks. They enable to evaluate the cross-jurisdictional character of drug trafficking and the observation time of drug batches, as well as the quantity of drugs entering the market every year. Results highlight the stable nature of drugs markets over the years despite the very dynamic flows of distribution and consumption. This research work illustrates how the systematic analysis of forensic data may elicit knowledge on criminal activities at a strategic level. In combination with information from other sources, such knowledge can help to devise intelligence-based preventive and repressive measures and to discuss the impact of countermeasures.

PIZZARO: Forensic analysis and restoration of image and video data

This paper introduces a set of methods for image and video forensic analysis. They were designed to help to assess image and video credibility and origin and to restore and increase image quality by diminishing unwanted blur, noise, and other possible artifacts. The motivation came from the best practices used in the criminal investigation utilizing images and/or videos. The determination of the image source, the verification of the image content, and image restoration were identified as the most important issues of which automation can facilitate criminalists work. Novel theoretical results complemented with existing approaches (LCD re-capture detection and denoising) were implemented in the PIZZARO software tool, which consists of the image processing functionality as well as of reporting and archiving functions to ensure the repeatability of image analysis procedures and thus fulfills formal aspects of the image/video analysis work. Comparison of new proposed methods with the state of the art approaches is shown. Real use cases are presented, which illustrate the functionality of the developed methods and demonstrate their applicability in different situations. The use cases as well as the method design were solved in tight cooperation of scientists from the Institute of Criminalistics, National Drug Headquarters of the Criminal Police and Investigation Service of the Police of the Czech Republic, and image processing experts from the Czech Academy of Sciences.

An Automated Approach for Digital Forensic Analysis of Heterogeneous Big Data

The major challenges with big data examination and analysis are volume, complex interdependence across content, and heterogeneity. The examination and analysis phases are considered essential to a digital forensics process. However, traditional techniques for the forensic investigation use one or more forensic tools to examine and analyse each resource. In addition, when multiple resources are included in one case, there is an inability to cross-correlate findings which often leads to inefficiencies in processing and identifying evidence. Furthermore, most current forensics tools cannot cope with large volumes of data. This paper develops a novel framework for digital forensic analysis of heterogeneous big data. The framework mainly focuses upon the investigations of three core issues: data volume, heterogeneous data and the investigators cognitive load in understanding the relationships between artefacts. The proposed approach focuses upon the use of metadata to solve the data volume problem, semantic web ontologies to solve the heterogeneous data sources and artificial intelligence models to support the automated identification and correlation of artefacts to reduce the burden placed upon the investigator to understand the nature and relationship of the artefacts.

Menace of Frauds in the Indian Banking Industry: An Empirical Study

Banks are the engines that drive the operations in the financial sector and growth of an economy. With the growing banking industry in India, frauds in Banks are also increasing and fraudsters are becoming more sophisticated and ingenious. While it is not possible for Banks to operate in a zero fraud environment, proactive steps such as conducting risk assessments of procedures and policies can help them hedge their risk of contingent losses due to fraud. Thus, time has come when the security aspects of the Banks have to be dealt with on a priority basis. As part of the study, a questionnaire-based survey was conducted in 2012-13 among 345 Bank employees “to know their perception towards bank frauds and evaluate the factors that influence the degree of their compliance level.” This study reveals that “there are poor employment practices and lack of effective employee training; usually over-burdened staff, weak internal control systems, and low compliance levels on the part of Bank Managers, Offices and Clerks. However, technology can play a major part in combating new-age frauds: proactive forensic data analysis and data mining techniques can help governments, regulatory bodies and Banks to counter the increasingly complex nature of frauds.

A custom software solution for forensic mtDNA analysis of MiSeq data

The use of a next generation sequencing (NGS) approach for mitochondrial (mt) DNA analysis in forensic casework is imminent. A feature of the NGS approach is the ability to detect and report mtDNA heteroplasmy, which will significantly enhance the discrimination potential of the testing method. A single software solution that allows for robust and user-friendly analysis of NGS-derived mtDNA sequence is not readily available, especially when considering heteroplasmy. This communication outlines the desired features of a software package for forensic applications, and the progress made towards those aims with the development of a custom version of NextGENe®.

Genolab—Forensic biostatistics with cloud computing

Genolab (www.genolab.eu) is a new cloud based service that is dedicated to kinship analysis and DNA evidence interpretation. It was especially developed to face the future challenge in forensic data analysis and biostatistics in relation of data amount and analysis time by the usage of cloud technology and development of specialized algorithms. This paper presents an overview of the software’s functionalities.

Digital forensics as a service: Game on

The big data era has a high impact on forensic data analysis. Work is done in speeding up the processing of large amounts of data and enriching this processing with new techniques. Doing forensics calls for specific design considerations, since the processed data is incredibly sensitive. In this paper we explore the impact of forensic drivers and major design principles like security, privacy and transparency on the design and implementation of a centralized digital forensics service.

Blind study evaluation illustrates utility of the Ion PGM™ system for use in human identity DNA typing.

AimTo perform a blind study to assess the capability of the Ion Personal Genome Machine™ (PGM) system to sequence forensically relevant genetic marker panels and to characterize unknown individuals for ancestry and possible relatedness.MethodsTwelve genomic samples were provided by a third party for blinded genetic analysis. For these 12 samples, the mitochondrial genome and three PGM™ panels containing human identity single nucleotide polymorphisms (SNPs), ancestry informative SNPs, and short tandem repeats (STRs) were sequenced on the PGM™ system and analyzed.ResultsAll four genetic systems were run and analyzed on the PGM™ system in a reasonably quick time frame. Completeness of genetic profiles, depth of coverage, strand balance, and allele balance were informative metrics that illustrated the quality and reliability of the data produced. SNP genotypes allowed for identification of sex, paternal lineage, and population ancestry. STR genotypes were shown to be in complete concordance with genotypes generated by standard capillary electrophoresis-based technologies. Variants in the mitochondrial genome data provided information on population background and maternal relationships.ConclusionAll results from analysis of the 12 genomic samples were consistent with sample information provided by the sample providers at the end of the blinded study. The relatively easy identification of intra-STR allele SNPs offered the potential for increased discrimination power. The promising nature of these results warrants full validation studies of this massively parallel sequencing technology and its further development for forensic data analysis.

MENACE OF FRAUDS IN THE INDIAN BANKING INDUSTRY: An Empirical Study

Banks are the engines that drive the operations in the financial sector and growth of an economy. With the growing banking industry in India, frauds in Banks are also increasing and fraudsters are becoming more sophisticated and ingenious. While it is not possible for Banks to operate in a zero fraud environment, proactive steps such as conducting risk assessments of procedures and policies can help them hedge their risk of contingent losses due to fraud. Thus, time has come when the security aspects of the Banks have to be dealt with on a priority basis. As part of the study, a questionnaire-based survey was conducted in 2012-13 among 345 Bank employees “to know their perception towards bank frauds and evaluate the factors that influence the degree of their compliance level.” This study reveals that “there are poor employment practices and lack of effective employee training; usually over-burdened staff, weak internal control systems, and low compliance levels on the part of Bank Managers, Offices and Clerks. However, technology can play a major part in combating new-age frauds: proactive forensic data analysis and data mining techniques can help governments, regulatory bodies and Banks to counter the increasingly complex nature of frauds.

Forensic massively parallel sequencing data analysis tool: Implementation of MyFLq as a standalone web- and Illumina BaseSpace®-application

Routine use of massively parallel sequencing (MPS) for forensic genomics is on the horizon. The last few years, several algorithms and workflows have been developed to analyze forensic MPS data. However, none have yet been tailored to the needs of the forensic analyst who does not possess an extensive bioinformatics background.We developed our previously published forensic MPS data analysis framework MyFLq (My-Forensic-Loci-queries) into an open-source, user-friendly, web-based application. It can be installed as a standalone web application, or run directly from the Illumina BaseSpace environment. In the former, laboratories can keep their data on-site, while in the latter, data from forensic samples that are sequenced on an Illumina sequencer can be uploaded to Basespace during acquisition, and can subsequently be analyzed using the published MyFLq BaseSpace application. Additional features were implemented such as an interactive graphical report of the results, an interactive threshold selection bar, and an allele length-based analysis in addition to the sequenced-based analysis.Practical use of the application is demonstrated through the analysis of four 16-plex short tandem repeat (STR) samples, showing the complementarity between the sequence- and length-based analysis of the same MPS data.

Digital investigations for IPv6-based Wireless Sensor Networks

Developments in the field of Wireless Sensor Networks (WSNs) and the Internet of Things (IoT) mean that sensor devices can now be uniquely identified using an IPv6 address and, if suitably connected, can be directly reached from the Internet. This has a series of advantages but also introduces new security vulnerabilities and exposes sensor deployments to attack. A compromised Internet host can send malicious information to the system and trigger incorrect actions. Should an attack take place, post-incident analysis can reveal information about the state of the network at the time of the attack and ultimately provide clues about the tools used to implement it, or about the attackr's identity. In this paper we critically assess and analyse information retrieved from a device used for IoT networking, in order to identify the factors which may have contributed to a security breach. To achieve this, we present an approach for the extraction of RAM and flash contents from a sensor node. Subsequently, we analyse extracted network connectivity information and we investigate the possibility of correlating information gathered from multiple devices in order to reconstruct the network topology. Further, we discuss experiments and analyse how much information can be retrieved in different scenarios. Our major contribution is a mechanism for the extraction, analysis and correlation of forensic data for IPv6-based WSN deployments, accompanied by a tool which can analyse RAM dumps from devices running the Contiki Operating System (OS) and powered by 8051-based, 8-bit micro-controllers.

An Analysis of WhatsApp Forensics in Android Smartphones

WhatsApp is mobile application which allows exchange of messages, videos, audio's and images via Smartphone. The increased use of IM on Android phones has turned to be goldmine for mobile and computer forensic investigators. This paper focuses on conducting forensic data analysis by extracting useful information from WhatsApp and from similar applications installed on Android platform.

Research Integrity: the Experience of a Doubting Thomas

The sensational "reactome array" paper published in Science in 2009 was investigated in Spain by the Ethics Committee of Consejo Superior de Investigaciones Cientificas (CSIC) after Science issued an editorial expression of concern. The paper was retracted in 2010 because of "skepticism" due to "errors" in chemistry. The "errors" were so profound that many readers expressed doubt that they were really errors, but part of an elaborate hoax. I conducted a forensic analysis of mass spectrometry data in the paper's Supporting Online Material (SOM) and was able to prove that thousands of data values were in fact fabricated. The SOM contains signatures of improper extensive spreadsheet manipulations of incorrect atomic and molecular mass values as well as impossibly repetitive deviations of found molecular mass values from their expected values. No evidence of real mass spectrometry data was detected. Both CSIC and Science have been content to retract the paper without acknowledging the fabrications or assigning responsibility for them. Neither CSIC nor Science has expressed interest in having an independent investigation determining how the paper came to be written, reviewed and published. Their weak response to this episode is a daunting signal that there is an impending crisis in research integrity and science journalism.

Estimating Illicit Flows of Capital via Trade Mispricing: A Forensic Analysis of Data on Switzerland

Estimating Illicit Flows of Capital via Trade Mispricing: A Forensic Analysis of Data on Switzerland