Forensic Procedures Research Articles

Analisis Digital Forensik Keaslian Video Rekaman CCTV Menggunakan Metode Localization Tampering

Video is one the valid evidence if the handling process is in accordance with digital forensic procedures. Closed circuit television is a video sourse that is often used as authentic evidence in court. The authenticity of the video is something that is often doubted by certain parties. For this reason, this discusses how to detect the authenticity of video as digital evidence by comparing the original video files and tampering video files resulting from attack frame addition and attack frame delection. The media info tool is used to analyze the metadata and the localization tampering method is used to detect the frame where manipulation occurs. Localization tampering analyzes frame by frame, calculates as histogram and displays a histogram graph. Based on the results of the metadata analysis of the original video file and the video file tampering, it displays different information, which means that the video has been manipulated. Next, analyze the video with the localization tampering method to display the location on the video frame where manipulation has occurred. From the analysis results provide different information both from the calculation of the RGB value and the histogram graph.

Toward Vehicular Digital Forensics From Decentralized Trust: An Accountable, Privacy-Preserving, and Secure Realization

With the increasing number of traffic accidents and terrorist attacks by modern vehicles, vehicular digital forensics (VDF) has gained significant attention in identifying evidence from the related digital devices. Ensuring the law enforcement agency to accurately integrate various kinds of data is a crucial point to determine the facts. However, malicious attackers or semi-honest participants may undermine the digital forensic procedures. Enabling accountability and privacy preservation while providing secure data access control in VDF is a nontrivial challenge. To mitigate this issue, in this article, we propose a blockchain-based decentralized solution for VDF named BB-VDF, in which the accountable protocols and privacy-preserving algorithm are constructed. The desirable security properties and fine-grained data access control are achieved based on smart contract and the customized cryptographic construction. Specifically, we design a distributed key-policy attribute-based encryption scheme with partially hidden access structures, named DKP-ABE-H, to realize the secure fine-grained forensics data access control. Further, a novel smart contract is designed to model the forensics procedures as a finite state machine, which guarantees accountability that each participant performs auditable cooperation under tamper resistant and traceable transactions. Systematic security analysis and extensive experimental results show the feasibility and practicability of our proposed BB-VDF scheme.

The tide of tiger poaching in India is rising! An investigation of the intertwined facts with a focus on conservation.

Poaching and illegal trafficking are major threats to biodiversity, especially when endangered felids are concerned. Tigers are iconic animals, and there is huge demand for their body parts both in the national and international illegal markets. India forms the largest tiger conservation unit in the world and poaching is at its peak even though there are stringent laws and strict enforcement. In the present study, we analytically estimated the tiger seizure cases in India from 2001–2021 using newspaper archives as the main source of data. The data was geo-referenced to understand the details of seizure, demand, and locality. We statistically correlated the seizure rate with the density of tigers, tiger reserves, and various other socio-economic factors. Our result shows that skin, claws, bones, and teeth have more demand, with nails and teeth being the most preferred in local markets. The bones, flesh, and other parts were mostly seized in the border states of the north and eastern states. The intensity of seizures is very high in the states of Maharashtra, Karnataka, Tamil Nadu, and Assam. From our analysis, we predict four trade routes for the export of the seized parts: the Nepal-Bhutan border, Assam border, the Brahmaputra, and the Mumbai port. This corresponds to the five tiger conservation blocks in India, and we observed the seizure rate is high near the Western Ghats region, which has not yet been noticed. Apart from the seizure, we are unconcerned with the seizure's origin or the local trading routes. The study demonstrates the importance of identifying the source population using DNA methods and carefully enforcing the rules in area of poaching. We assert that current approaches are incapable of resolving the issue and that a more precise and effective forensic procedure capable of resolving the issue at the minute local level is critical for precisely tracing trade channels.Supplementary InformationThe online version contains supplementary material available at 10.1007/s10708-022-10633-4.

URGENCY AND MECHANISM OF ELECTRONIC EVIDENCE VALIDATION IN ELECTRONIC COURT EVIDENCE RULES

This research is trying to explain two legal issues in relation to the submission of electronic evidence in e- Litigation evidence system, those are about the urgency of electronic evidence validation in proving a case and how the ideal mechanism of electronic evidence validation at the e-Litigation proof stage is. The discourse of the trial by fully using E-Court which includes the proof stage in it has not yet been implemented due to various obstacles, including regulations, availability of supporting facilities and Human Resources (HR). It is important to study this legal issue in order to optimize E-Court so that judicial modernization with information technology approach can be quicklyimplemented, solely to realize the vision of the Supreme Court and ensure better access to justice in the future. The results of this research conclude that the electronic evidence validation process in E- Litigation is a vital stage that cannot be ruled out in order to determine the validity of an electronic evidence and how important digital forensic procedures in the electronic evidence validation process.

A forensic procedure based on GC–MS, HPLC-HRMS and IBA to analyse products containing sildenafil or the doping agent oxandrolone

The market of falsified or sub-standard medical products is a global scale phenomenon. This issue affects a wide range of medications, including life-saving medical products. In high-income countries the most falsified products are those defined “lifestyle”, which include foremost anabolic steroids and phosphodiesterase 5 inhibitors. The spread of these products in the last years has been possible also because of their online purchase, since they can be bought anonymously and without any medical supervision or prescription. Their use can pose a serious threat for public health, especially because often are manufactured without adherence to quality standards. This leads to final products containing active ingredients different from those declared, at the wrong or unknown dose and contaminated with metals, synthesis by-products and other chemical substances. In this work, we present results on characterisation of illegal pharmaceutical products and doping agents by combining different techniques: chromatography coupled to mass spectrometry for organic analysis and accelerator-based nuclear analytical techniques, such as ion beam analysis (IBA), for elemental analysis. Three IBA techniques, namely PIXE (particle induced X-ray emission), PIGE (particle induced gamma-ray emission) and EBS (elastic backscattering spectrometry) were used in external beam mode to provide an elemental characterisation of the as-is material, placed simply in front of the proton beam, thus avoiding the need of preparing them with pre-analytical steps and greatly enhancing the measurement throughput. Several elements (F, Mg, Al, Si, P, S, Cl, K, Ca, Ti, V, Mn, Fe, Co, Ni, Cu, Zn, Br and Sr) were identified in the analysed products. External beam IBA measurements provided the quantitative elemental characterisation of the illegal pharmaceutical products and doping agents under study, complementary to the organic analysis results by chromatography and mass spectrometry thus allowing a rapid (a few minutes) and non-destructive direct assessment of the material for forensic purposes. For the first time IBA results from doping products are reported and further analysis by IBA involving two different accelerator laboratories (one in Italy and one in Brazil) allowed the comparison of results obtained on the same pharmaceutical product. Starting from the results obtained in our study, the actualisation of new research plans should be evaluated, which could lay the foundation for a classification system of illegal pharmaceutical products, doping products. and other substances, based on chromatography, mass spectrometry and IBA measurements; this could allow drawing inferences about the common characteristics of these substances, e.g. provenience of bulk materials, site of production etc. With this purpose, results obtained from two samples of the same pharmaceutical product by IBA in two different accelerator laboratories (one in Italy and one in Brazil) are compared.

The use of hyoid bone dimensions in age and sex estimation in a Turkish population: a cone-beam computed tomography study.

The aim of the study was to determine sex and age from hyoid bone morphology on cone-beam computed tomography (CBCT). The study sample comprised 130 CBCT images. Eight different measurements were performed for each hyoid bone. Fusion conditions were assigned to each side of the hyoid bone separately as; unfused, partially fused, and totally fused. The hyoid length, width of the left proximal end and stature variables showed sexual dimorphism in all hyoid fusion types (p < 0.05). In young adult age group, a significant difference was found between sex and fusion types (p = 0.025). The body length (81.35%) and stature measurements (76.25%) contributed most significantly to sex estimation. Patient's CBCT scans which enable reproducible and reliable measurements for bone tissues can be used for forensic procedures. Hyoid bone measurements with CBCT are useful methodology for age and sex estimation in forensic sciences with high predictive accuracy.

Advanced forensic procedure for the authentication of audio recordings generated by Voice Memos application of iOS14.

In this study, we propose an advanced forensic examination procedure for audio recordings generated by the Voice Memos application with iPhone Operation System (iOS)14, to verify that these are the original recordings and have not been manipulated. The proposed examination procedure consists of an analysis of the characteristics of audio recordings and of the file system of the device storing the audio recordings. To analyze the characteristics of audio recordings, we compare the encoding parameters (bitrate, sampling rate, timestamps, etc.) and the file structure to determine whether audio recordings were manipulated. Next, in the device examination step, we analyze the media-log history and temporary files of the file system obtained by mobile forensic tools. For comparative analysis, a total of 100 audio recording samples were obtained through the Voice Memos application from five iPhone mobile handsets of different models with iOS14 installed using Advanced audio coding (AAC) or Apple lossless audio codec (ALAC). As a result of analyzing the encoding parameters between the original and manipulated audio recordings, as well as the temporary files contained in the device file system, the difference in the encoding parameters and the very unique trace of the original audio recordings in the temporary files were confirmed when manipulating the audio recordings. In particular, the primary advantage of our proposed method is its potential ability to recover original audio recordings that were subsequently manipulated via the temporary files examined in the device file system analysis.

Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process.

For forensic examiners, investigating the RAID systems of servers has been challenging, as the examiners must reconstruct multiple high-capacity disks to identify digital evidence. Software-based RAID systems' use has been released for personal use, so examiners should consider RAID systems even when they investigate personal computers. Although there is a high probability that the software-based RAID will become a target of crime, there has been little research into digital forensic methodology for software-based RAID, as exemplified by Storage Space. In this paper, we introduce details about the structure of Storage Space found through reverse engineering. Storage Space was analyzed by applying the digital forensic process of NIST. We explain how to reconstruct a virtual disk configured using Storage Space and develop an automated tool to do so. To evaluate our study and the tool developed, we created an experimental scenario and describe in detail the forensic procedure and technical methods for the analysis of Storage Space. Our research can be used as the basis of forensic investigations for Storage Space.

Mobile Digital Forensics Framework for Smartphone User Analysis

Blockchain-based digital forensics technology is an efficient way to prevent forgery/modulation of evidence including collecting and analyzing evidential data using the technology in compliance with smartphone forensics procedures after a smartphone is seized. Moreover, the use of large-capacity storage devices and various digital devices have become a realistic solution for its development of IT in situations where the existing digital forensics analysis methods are regarded as limitations. This paper analyzed user’s status on smartphone application and implemented a smartphone user analysis framework that may extract significant digital evidence in a digital forensic way based on a blockchain perspective. In this paper researched a system that may provide important information to digital forensic analysts through these frameworks. It is expected that the proposed system will be expanded by much more structured data and online unstructured data such as SNS reports.

Forensic citizenship among families of missing migrants along the U.S.-Mexico border

ABSTRACT Since the mid-1990s, US federal policy has funneled unauthorized migration through remote portions of the Sonoran Desert, resulting in thousands of deaths and disappearances. Research about the work to find, care for, and identify those who have died at international borders largely focuses on forensic authorities or humanitarian volunteers. Often left out of such analyses are the families of the missing and dead, who I argue are some of the most critical actors in this work. Drawing on fieldwork done between 2006 and 2021, in this article I discuss how families of missing migrants impact forensic procedures on the US-Mexico border. They do this by learning forensic skills and developing relationships with state forensic authorities. I argue that families of missing migrants are engaged in forms of active citizenship that build relationships of care and obligation among themselves, state forensic authorities, and the missing and dead.

Urge for Novel and Secure Software Framework for Extraction and Decoding of Mobile Artifacts

Mobile Forensics is now days, increasingly becoming more challenging as it is the field of science that is continuously evolving with respect to the rapidly developing technologies and techniques for the extraction of the mobile data and its decoding. Majority of the crimes are getting committed digitally and especially the criminals are preferring mobile handsets than a laptop or desktop machines, leaving the footprints behind which could be evidence against them. The mobile handsets along with their software applications are getting more advanced and sophisticated mainly due to advances in Cloud computing where clouds are used to store data, Anti-forensics where efforts are made to defeat forensic procedures and Encryption which is used to secure the data during transit. But when compared with the pace of development in mobile hardware and software, the forensic tools and techniques are growing very slowly. Hence the contemporary forensic tools and methodologies are becoming increasingly obsolete and hence urges for the advanced forensic tools, methods which could comply with the need of today’s mobile forensics. Hence, this work presents a detailed survey of the contemporary challenges faced by the forensic experts with the current forensic tools and its methodologies and also the need, scope and opportunities associated with the novel and secure software framework that can address the majority of issues occurring while extraction and decoding of mobile artifacts.

Forensic Analysis of Crimes in the Sphere of Information Technologies

The article deals with the issues of foren-sic support for preventing commission of crimes in the field of information tech-nology. It is called to attention that alt-hough introduction of modern infor-mation processes in various spheres of government activities, production and public relations has brought positive re-sults, it has also led to an increase in the cases of committing cyber crimes. Cyber crimes are a new phenomenon in general crime, therefore, the development of ad-vanced techniques to combat them is re-quired. In this process, the forensic sci-ence plays an important role, first of all, for the preparation of recommendations on methods for investigating cyber crimes. Forensic analysis of information technology crimes which are called cyber crimes indicates that their investigation is different from the investigation of other crimes. This is largely due to the fact that computer objects can be both means of committing such crimes and objects of criminal encroachment. Information stored on computer media can be per-ceived and evaluated solely by using computer equipment and digital technol-ogy. Without this, it is impossible to iden-tify persons involved in committing a crime and obtain the evidence necessary to solve the crime. To study and evaluate them as sources of evidence, one needs to resort to the help of specialists, com-puter equipment and sophisticated soft-ware. It distinguishes computer objects from other material objects that is why it is necessary to put computer objects into a separate category of sources of evi-dence in forensic science and criminal procedure.

Forensic psychiatric evaluations of people charged with rape in Croatia

Introduction: Sexual violence is a substantial public health problem that is associated with a major impact on victims, and in Croatia, more than half of reported cases of sexual violence involve rape. To help understand their general profiles and consider any implications arising, the aim of this research was to describe the forensic psychiatric characteristics of people charged with rape. Methods: All evaluations of people charged with rape and sent for evaluation at the largest assessment centre in Croatia during the period 2010-2018 were analysed (n = 56). Results: Alleged offences most often took place in a perpetrator or victim's home (71%), while the next most frequent location was the street (15%). Over 80% of alleged victims were known to the accused. Alcohol use and abuse were present in 73% of the accused, and 29% were drinking at the time of the alleged offence. Alcohol-related disorders were presented in 38% of the accused, while 38% had a personal history of drug use, and antisocial and narcissistic personality disorders were present in 48% and 29%, respectively. Psychotic disorders were rare (1.8%). Most of the accused were found to be criminally responsible; however, forensic psychiatric assessment procedures were inadequate when considering psychosexual assessments. Conclusions: Interventions based around public health and education should be considered in this field, and forensic psychiatric assessments should be prioritized for improvement.

Streamed Video Reconstruction for Firefox Browser Forensics

In criminal investigations, the digital evidence extracted from social media may provide exceptional support. Reviewing the history or cache of the web browser may provide a valuable insight into the activity of the suspect. The growing popularity of Internet video streaming creates a risk of this technology misuse. There are a few published research on video reconstruction forensics on the Chrome browser. There is a difference in the methods applied to reconstruct cached video on Chrome from the methods applied to Firefox or any browser. Our primary focus in this research is to examine the forensic procedures required to reconstruct cached video stream data using Twitter and YouTube on the Firefox browser. Some work has been done to reconstruct a cached video on the Chrome browser, but we need more work on the rest of the browsers, most notably the Firefox browser used in this research. Both examination strategies and contemplations displayed are approved and suitable for the forensic study of various streaming platforms as well as the web browser caches.

Exploring user requirements of network forensic tools

Network forensic tools enable security professionals to monitor network performance and compromises. These tools are used to monitor internal and external network attacks. Technological improvements have enabled criminals to wipe out tracks of cybercrime to elude alterations. Network forensics procedures use processes to expedite investigation by tracking each original packet and event that is generated in the network. There are many network forensic tools, both open source and commercial versions available in the market. In this work, the result of a survey participated by different experts in open source network forensic tools have been presented. The advantages, challenges, and necessities have been identified for network forensic investigation of such tools. A few open source network forensic tools have been studied and performed a comparative analysis based on six key parameters. Further, two malware datasets are analyzed using open source tools to perform investigation and present a comprehensive network forensic analysis comprising IO graphs, Flow graphs, TCP stream, UDP multicast stream, mac-based analysis, and operating system analysis.

Methodological analysis of military forensic science

Emergence of new independent units of forensic science is a logical result of the development of scientific knowledge and forensic expert activity, if such a process takes place on the basis of the developed methodological foundations of forensic science, which ensures the scientific nature of new types of forensic science, organizational and legal procedure for their conduct and the admissibility of their results to ensure justice. Ignoring scientific approaches in implementation of forensic activities in Ukraine and attempts to adapt it to the needs of investigative and judicial practice cannot but cause concern, especially when it comes to an attempt to substitute forensic science for the proof process.&#x0D; Article purpose is to conduct a methodological analysis of the topic, objects and tasks of forensic military science and its place in the modern general classification system of forensic science on the basis of the general theory of forensic expertology.&#x0D; Research methodology was made up of the provisions of materialist dialectics as a universal method of cognition, as well as a set of methods of formal logic for solving individual research tasks: analysis, synthesis, analogy, comparison, comparison, deduction.&#x0D; While research, in order to establish formation consistency of military science as an independent stratification unit, its structural components were analyzed: topic, objects, tasks and specific expertise necessary for their solution.&#x0D; While conducted methodological analysis, it was found that formation of military science as an independent stratification unit of forensic examinations occurred in violation of the methodological foundations developed by forensic science and the evolutionary paths of the genesis of new species of forensic science.&#x0D; As a result of performed research, it was concluded that it is necessary to revise the place and essence of military science in the existing classification system offorensic science in Ukraine which will ensure the unity of the methodological approach to formation of new units of forensic science and guarantee declared principles of forensic science.

Molybdenum in Gunshot Residue: Experimental Evidences and Detection Challenges in the Presence of Lead and Sulfur.

Inorganic gunshot residue (GSR) analysis is carried out by scanning electron microscopy/energy-dispersive X-ray spectroscopy (SEM/EDS) in many forensic laboratories. Characteristic GSR often consists of lead–barium–antimony, commonly associated with sulfur. The strength of forensic GSR evidence increases when unusual elements are found in residues collected both from the suspect and from the discharged firearm. The presence of molybdenum in GSR, due to the use of MoS2 lubricants in firearms, is experimentally demonstrated here for the first time. The most intense molybdenum X-ray emissions are MoL peaks at 2.3 keV which overlap with PbM and SK families due to the poor resolution of EDS detectors. When Pb, S, and Mo are allegedly present in the same particle, the reliability of automatic EDS routines is at risk. Missing identifications or false detections and exclusions may then occur. Molybdenum should be considered as detected only if MoK emissions meet the peak-to-background ratio minimum requirements. A strategy to spot Mo-containing residues is described, based on the automated search of MoS2, using a new “Sulfur only” class added to the classification scheme, followed by careful manual review of all GSR particles at an acceleration voltage of 30 kV. Our proposal improves commonly adopted forensic procedures currently followed in casework.

The case law of the European Court of Human Rights on the use of covert methods

In addition to the changes in the structure of crime, the rise of organised crime, the unprecedented threat of terrorism, the explosive development of technical tools and the flow of information pose such challenges for law enforcement agencies that is difficult to keep up with classic forensic procedures. In Hungary and abroad the traditional investigations are supported with special investigative techniques that - through their conspired application - can help to achieve the desired result more effectively. These methods necessarily violatecertain human rights, which requires strict legislation and appropriate implementation. One of the guaranty elements of legality is effective legal remedy. An important phase of this is the examination of the European Court of Human Rights. Understanding the operation of the court, the case law and the assessment criteria used in their proceedings may provide important information for both legislators and law enforcers.

Три направления преодоления проблем, связанных с разглашением информации конфиденциально военного характера при производстве следственных действий (криминалистические и уголовно-процессуальные аспекты)

Три направления преодоления проблем, связанных с разглашением информации конфиденциально военного характера при производстве следственных действий (криминалистические и уголовно-процессуальные аспекты)

FORENSIC-AUDIT AS AN IMPERATIVE OF ECONOMIC SECURITY AND DEVELOPMENT OF THE COMPANY IN THE CONDITIONS OF GLOBAL TRANSFORMATIONS

Abstract. The article is devoted to topical issues of business protection through the prism of forensics (financial investigations). This new line of financial fraud and fraud investigation services is used to investigate and assist clients in identifying the facts and causes of fraud that may occur due to the absence or inadequate and ineffective system of internal control. The types of economic crimes faced by companies during 2017—2019 were analyzed and it was established that bribery and corruption are the leaders among economic crimes. The article reveals the essence of the concept of «forensic» as the identification of potential problems through legal and financial audit. Forensic procedures as a promising way to protect business in the context of global transformations and emerging cyber risks in an increasingly complex digital business environment have been studied. The article outlines the main directions of forensics in risk management, among which are: investigation of fraud; support in court proceedings; corporate intelligence; computer forensics; compliance with anti-corruption legislation, as well as to use preventive measures to prevent fraud. The classical methods and algorithm of financial investigation are outlined and it is noted that they may differ depending on the purpose for which forensics is conducted, the industry in which the company operates, and others. It is established that forensics for an economic entity ends with a reporting stage, during which the customer is provided with evidence of fraud, as well as the proposed recommendations. It is proposed to use the forensic mechanism when business owners: doubt an important decision; there is a leak of commercial information; mechanisms for working with suppliers have not been established; a large deal is envisaged. Keywords: forensic, audit, internal control, fraud, financial investigations, methods of financial investigation, economic security. JEL Classification F52, H83 Formulas: 0; fig.: 2; tabl.: 1; bibl.: 14.