Forensic Analysis Tools Research Articles

Improvement of evidence collection module using live response technology on a windows system

Recently, A malware (or malicious code) of information leakage type is increasing for leaking personal data, credit information, financial information, etc. Also, this various forms is fast changing. However, a recent trend of an existing windows forensics module for the type of violation is a lack of adaptability. In this paper malware of information leakage type don't detection with windows forensic analysis tools. So there are improve new evidence collection module using live response technology to identify and respond more quickly technology can offer.

Ethnic background and gender identification using electrothermal vaporization coupled to inductively coupled plasma optical emission spectrometry for forensic analysis of human hair

Multi-elemental analysis of human hair was performed by solid sampling (SS) electrothermal vaporisation (ETV) inductively coupled plasma optical emission spectrometry (ICP-OES) and multivariate analysis then carried out to discriminate general ethnicity and gender. This approach is advantageous over digestion and nebulisation, as it eliminates possible contamination or analyte loss that can occur during digestion, requires a smaller sample mass for analysis, and eliminates the dilution that follows digestion. Hair samples were first washed with water and hexane, and then dried before being ground up. Thirteen samples from different people with various ethnic backgrounds were analysed. Aliquots (of 4 mg) were placed in graphite boats that were then introduced in the ETV furnace using an autosampler. No quantification of the elements in hair was necessary. Point-by-point internal standardization with an Ar emission line was systematically carried out to compensate for sample loading effects on the plasma. Then, peak area was integrated and divided by the actual sample mass before being used in combination with multivariate analysis. Elements showing the highest loadings with principal component analysis (PCA) were considered for linear discriminant analysis (LDA). One group of elements, Li, Mo, S, Sr, Cr, K, Ni, Zn and Pb correctly identified all 13 samples for general ethnicity with LDA, whereas this was not possible with PCA. On the other hand, both PCA and LDA correctly assigned all samples for gender using Mg, S, Sr and Zn. The larger number of elements (9 for general ethnicity versus 4 for gender) is commensurate with the greater variety of ethnicities. The technique was also successfully applied to two blind samples from people living in cities as far as 430 km away from where the samples used for the training set were collected. Clearly, SS-ETV-ICP-OES in combination with LDA shows great potential as a tool for forensic analysis of hair.

Development and validation of an HPLC-DAD method for simultaneous determination of cocaine, benzoic acid, benzoylecgonine and the main adulterants found in products based on cocaine

Here, an HPLC-DAD method was developed and validated for simultaneous determination of cocaine, two cocaine degradation products (benzoylecgonine and benzoic acid), and the main adulterants found in products based on cocaine (caffeine, lidocaine, phenacetin, benzocaine and diltiazem). The new method was developed and validated using an XBridge C18 4.6mm×250mm, 5μm particle size column maintained at 60°C. The mobile phase consisted of a gradient of acetonitrile and ammonium formate 0.05M – pH 3.1, eluted at 1.0mL/min. The volume of injection was 10μL and the DAD detector was set at 274nm. Method validation assays demonstrated suitable sensitivity, selectivity, linearity, precision and accuracy. For selectivity assay, a MS detection system could be directly adapted to the method without the need of any change in the chromatographic conditions. The robustness study indicated that the flow rate, temperature and pH of the mobile phase are critical parameters and should not be changed considering the conditions herein determined. The new method was then successfully applied for determining cocaine, benzoylecgonine, benzoic acid, caffeine, lidocaine, phenacetin, benzocaine and diltiazem in 115 samples, seized in Brazil (2007–2012), which consisted of cocaine paste, cocaine base and salt cocaine samples. This study revealed cocaine contents that ranged from undetectable to 97.2%, with 97 samples presenting at least one of the degradation products or adulterants here evaluated. All of the studied degradation products and adulterants were observed among the seized samples, justifying the application of the method, which can be used as a screening and quantification tool in forensic analysis.

Cheetah: a space-efficient HNB-based NFAT approach to supporting network forensics

The popularity of the Internet has increased the ease of online access to malicious software, and the amount of software designed to perform denial-of-service (DoS) attacks is incalculable. This enables hackers to use online resources to easily launch attacks, posing serious threats to network security. The ultimate solution to increasingly severe DoS attacks is to identify the sources of the attacks; this is known as an IP traceback or forensics. However, the Network Forensic Analysis Tool is limited by the storage space, which significantly reduces the effects of the traceback. We proposed a Cheetah mechanism, which was proposed to overcome the disadvantage of requiring a significant data storage requirement. This involved using mechanic learning to filter irrelevant data, thereby retaining only the evidence related to DoS attacks to perform subsequent tracebacks. The experiment results confirmed that the proposed mechanism can reduce the quantity of data that requires storage and maintain a certain level of forensic accuracy.

Silver nanoparticles doped agarose disk: Highly sensitive surface-enhanced Raman scattering substrate for in situ analysis of ink dyes

Raman spectroscopy is a preferred analytical tool for forensic trace analysis due to its non-invasive nature. This technique has been utilized in examination of organic colorants present in fibers and ink, but high fluorescent nature of these compounds is a problem. In the present study, silver-doped agarose gel disk, having property of quenching fluorescence and enhancing Raman signals, is found to be effective as surface-enhanced Raman scattering (SERS) substrates for analysis of rhodamine 6G (Rh 6G) and crystal violet (CV) dyes. As-prepared and well characterized by UV, TEM-EDAX and XRD techniques, the investigated silver-doped agarose gel disk proves to have minimal invasive as confirmed by the ATR-FTIR method and effective for in situ SERS analysis of blue and red ballpoint ink. The disk is stable upon storage and hence can be re-used and re-examined. The present method offers new possibilities in trace forensic analysis with minimal destruction.

개인정보보호를 위한 안드로이드 로그캣 시스템 연구

최근 스마트폰의 급격한 보급으로 개인정보 침해사고 및 프라이버시 침해를 통한 여러 가지 사회문제가 급속도로 증가하고 있으며, 이에 따라 개인 정보보호를 위한 다양한 연구 및 기술 개발이 이루어지고 있다. 개인의 모든 정보가 거의 들어 있다고 해도 과언이 아닌 스마트폰의 정보유출은 우리의 일상에서 쉽고 빈번하게 발생할 수 있는데, 포렌식 분석 툴을 이용하여 증거를 수집하거나 분석하기란 쉽지 않은 일이다. 현재 안드로이드 포렌식 연구는 비휘발성 메모리로부터 데이터를 수집하여 분석하는 기법에 집중되어 왔으며, 휘발성 데이터에 대한 연구는 미미한 실정이다. 안드로이드 로그는 휘발성 저장매체로부터 수집될 수 있는 휘발성 데이터이다. 안드로이드 로그는 안드로이드 시스템에서부터 애플리케이션에 이르기까지 최근의 모든 구동내역과 관련한 기록이 로그로 저장되기 때문에 안드로이드폰 사용을 추적할 수 있는 자료로 활용이 충분하다. 본 논문에서는 포렌식 분석 툴을 이용하지 않고 로그를 필터링하여 개인의 정보 유출 유무를 판단하여 대응할 수 있는 방법을 제시한다. Various social problems through violating personal information and privacy are growing with the rapid spread of smartphones. For this reason, variety of researches and technology developments to protect personal information being made. The smartphone, contains almost all of the personal information, can cause data spill at any time. Collecting or analyzing evidence is not an easy job with forensic analyzing tool. Android forensics research has been focused on techniques to collect and analyze data from non-volatile memory but research for volatile data is very slight. Android log is the non-volatile data that can be collected by volatile storage. It is enough to use as a material to track the usage of the Android phone because all of the recent driven records from system to application are stored. In this paper, we propose a method to respond to determining the existence of personal information leakage by filtering logs without forensic analysis tools.

Application of Raman spectroscopy in forensic investigation of questioned documents involving stamp inks

Stamp pad inks from different manufacturers across India have been analyzed to investigate the feasibility of Raman scattering as a tool for forensic analysis of questioned documents involving stamp inks. Nine different stamping inks were analyzed by both Raman spectroscopic and HPTLC methods. The results demonstrate the effectiveness of these methods in classifying the investigated stamping inks based on their spectral pattern and HPTLC chromatogram. Raman scattering tool was able to determine the sequence of heterogeneous intersection strokes involving a blue stamp pad ink and other writing instruments, such as ballpoint pen ink (red and black), pencil and laser printer toner. However, this method was unable to resolve the exact sequencing for the intersection strokes involving investigated stamp ink and blue ballpoint ink or gel pen ink (all colors).

LSD and 9,10‐dihydro‐LSD Analyses in Street Drug Blotter Samples via Easy Ambient Sonic‐Spray Ionization MassSpectrometry (EASI‐MS)

Normally, the identification of the LSD drug is performed by forensic laboratories, using the Ehrlich spot test. However, this is a nonspecific analysis. Additionally, the Brazilian Federal Police has identified the presence of a new compound in seized blotters: 9,10-dihydro-LSD, an uncontrolled substance. In this work, easy ambient sonic-spray ionization mass spectrometry in the positive ion mode, EASI(+)-MS, was used to characterize LSD and 9,10-dihydro-LSD compositions directly from the surface of blotters. The presence of LSD in the seized blotter samples were also confirmed via high-performance liquid chromatography with ultraviolet detector. In a set of 41 blotters analyzed by EASI(+)-MS, 28 showed positive results for LSD, seven for 9,10-dihydro-LSD, and another six samples showed negative results for both LSD and 9,10-dihydro-LSD. The combination of thin layer chromatography with EASI-MS also demonstrated to be a relatively simple and powerful screening tool for forensic analysis of street drugs.

DNA methylation-specific multiplex assays for body fluid identification

Recent advances in whole-genome epigenetic analysis indicate that chromosome segments called tissue-specific differentially methylated regions (tDMRs) show different DNA methylation profiles according to cell or tissue type. Therefore, body fluid-specific differential DNA methylation is a promising indicator for body fluid identification. However, DNA methylation patterns are susceptible to change in response to environmental factors and aging. Therefore, we investigated age-related methylation changes in semen-specific tDMRs using body fluids from young and elderly men. After confirming the stability of the body fluid-specific DNA methylation profile over time, two different multiplex PCR systems were constructed using methylation-sensitive restriction enzyme PCR and methylation SNaPshot, in order to analyze the methylation status of specific CpG sites from the USP49, DACT1, PRMT2, and PFN3 tDMRs. Both multiplex systems could successfully identify semen with spermatozoa and could differentiate menstrual blood and vaginal fluids from blood and saliva. Although including more markers for body fluid identification might be necessary, this study adds to the support that body fluid identification by DNA methylation profiles could be a valuable tool for forensic analysis of body fluids.

Development of Nanomaterials for SALDI‐MS Analysis in Forensics

Within the last decade, the escalation of research output in the field of nanotechnology has spurred the development of new nanomaterials for use as assisting agents in surface assisted laser desorption ionization mass spectrometry (SALDI-MS). Specifically modified nanomaterials, coupled with mass spectrometry, have improved the detection sensitivity, specificity, flexibility and reproducibility of SALDI-MS analysis. The technological advancement of LDI-MS has in turn, propelled the use of the analytical technique in the field of forensics. In this report, the various roles and applications of metal-, silicon- and carbon-based nanostructured materials as SALDI matrices in the analysis of forensic samples are described. The advantages of SALDI-MS as an analytical tool for forensic sample analysis are also discussed.

Forensic Engineering Applications Of Gps Data

Digital Sources Of Data Have Become Increasingly Important In The Forensic Engineering Analysis Of Vehicular Collisions. One Such Type Of Data, From Global Positioning System (Gps) Devices, Has Increased In Prevalence Within The Last Decade. As With Other Digital Data Types, It Is Important For Forensic Engineers To Understand The Sources And Types Of Gps Data Before Applying Them Within Their Analysis Framework. Validation Of The Gps Concept And Individual Devices, And Examples Of Gps Accepted Use Within The Engineering Community, Make This Technology An Important And Appropriate Tool For Forensic Engineering Analysis. Gps Data Can Be Acquired From A Variety Of Electronic Data Recorder (Edr) Sources, Both On-Vehicle And Off-Vehicle. Many Gps Data Sources Have Limitations That Can Lead To Misapplications Or Incorrect Conclusions If Not Properly Studied. Appropriate Mathematical Calculations And Analytical Procedures Will Be Addressed, Including The Types Of Collision Events That Can Best Benefit From The Context Of Gps Data. Gps Data Applications In Real-World Forensic Engineering Cases, Including Insurance Claims And Litigation, Reflect The Power Of Robust Analysis And Well As The Potential For Erroneous Conclusions If The Data Are Misused By The Analyst.

Storage and exchange formats for digital evidence

Digital evidence is becoming increasingly important in a wide variety of criminal investigations. The formats used to store and exchange evidence can have a large impact on both the trustworthiness of evidence and the efficiency of the tools processing the evidence. Many digital evidence formats exist today, and it is important to evaluate the suitability of these formats based on their technical capabilities. We perform a comparative evaluation of the suitability of different formats by evaluating them against a set of evaluation criteria. Further, we discuss research based storage and exchange formats that aim to improve the representation, processing, and presentation of the evidence. These formats are key initiatives in developing new and more intelligent forensic analysis tools that take advantage of cloud computing and service oriented systems.

An inter‐laboratory comparative study into sample preparation for both reproducible and repeatable forensic 2H isotope analysis of human hair by continuous flow isotope ratio mass spectrometry

Stable isotope analysis of organic materials for their hydrogen ((2)H), carbon ((13)C), nitrogen ((15)N) or oxygen ((18)O) isotopic composition using continuous flow isotope ratio mass spectrometry (CF-IRMS) is an increasingly used tool in forensic chemical analysis. (2)H isotopic analysis can present a huge challenge, especially when dealing with exhibits comprising exchangeable hydrogen such as human scalp hair. However, to yield forensic data that are fit for purpose, analysis of the (2)H isotopic composition of the same homogeneous human hair sample by any laboratory worldwide must yield the same isotopic composition within analytical uncertainty. This paper presents longitudinal (2)H isotope data for four human hair samples of different provenance, measured by three different laboratories whose sample preparation was based on a two-stage H exchange equilibration method. Although each laboratory employed varying means to comply with the generic features of the sample preparation protocol such as the (2)H isotopic composition of exchange waters or drying down of samples prior to analysis, within each laboratory the Principle of Identical Treatment (P.I.T.) was applied for each individual experiment. Despite the variation in materials and procedures employed by the three laboratories, repeatable and reproducible 'true' (2)H isotope values (δ(2)H(hair,true)) were determined by each laboratory for each of the four stock samples of human scalp hair. The between-laboratory differences for obtained δ(2)H(hair,true) values ranged from 0.1 to 2.5 ‰. With an overall 95% confidence interval of ±2.8 ‰, these differences were not significantly different, which suggests that the general method of two-stage exchange equilibration carried out at ambient temperature is suitable for accurately and reproducibly determining 'true' δ(2)H-values for hair and other proteins provided that certain key conditions are met.

A Survey of Cloud Computing Challenges from a Digital Forensics Perspective

Computing and communication technologies have merged to produce an environment where many applications and their associated data reside in remote locations, often unknown to the users. The adoption of cloud computing promises many benefits to users and service providers, as it shifts users’ concerns away from the physical location of system components and toward the accessibility of the system’s services. While this adoption of cloud computing may be beneficial to users and service providers, it increases areas of concern for computer forensic examiners that need to obtain data from cloud computing environments for evidence in legal matters. The authors present an overview of cloud computing, discuss the challenges it raises from a digital forensics perspective, describe suitable tools for forensic analysis of cloud computing environments, and consider the future of cloud computing.

Further Considerations for the Analysis of ENF Data for Forensic Audio and Video Applications

The Electric Network Frequency (ENF) Criterion is becoming an established forensic analysis tool for determining the originating date and time of a recording and helping to authenticate digital audio and video evidence. To date, proposed comparison metrics for an automated approach have been based on variants of the mean squared error or the correlation coefficient. These algorithms are discussed and empirically compared in the context of ENF pattern matching. The operation of an electrical network under normal and adverse operating conditions is considered in relation to ENF behaviour, and the possible relationships between a network’s ENF dynamics and a networks identity are discussed. This article compliments one previous by the author relating to the theory and practice in the use of an automated approach to the ENF Criterion.

DNA methylation-based forensic tissue identification

Identifying the source tissue of biological material found at crime scenes can be very informative in a number of cases. Despite their usefulness, current visual, catalytic, enzymatic, and immunologic tests for presumptive and confirmatory tissue identification are applicable only to a subset of samples, might suffer limitations such as low specificity, lack of sensitivity, and are substantially impacted by environmental insults. Moreover these assays are incompatible and thus cannot be multiplexed. Thus they are less amenable to automation. In addition their results are operator-dependent. A better alternative approach is tissue identification based on messenger RNA (mRNA) or microRNA (miRNA); however, RNA is not as stable as DNA, and requires the use of non-standard procedures by forensic laboratories. Herein a DNA-based assay is described that enables tissue identification based on detection of tissue-specific methylation patterns. DNA samples are subjected to digestion by a methylation-sensitive restriction endonuclease followed by multiplex amplification of specific genomic targets with fluorescent-labeled primers, capillary electrophoresis of amplification products, and automatic signal analysis by dedicated software, yielding the source tissue of the sample. The single tube assay was designed for easy integration by forensic laboratories (as the assay utilizes the same platforms as current forensic STR profiling). The system is fully automatable, provides operator-independent results, and allows combining tissue identification with profiling in a single procedure. The assay was tested on 50 DNA samples from blood, saliva, semen, and skin epidermis, and the source tissue was successfully identified in all cases. Detection of semen and DNA profiling were combined into one assay and the ability to detect mixtures of semen and saliva in various ratios was demonstrated. The assay correctly detected semen in all samples where it was present, and the calculated percentage of semen was comparable to the fraction of semen in the samples. The results demonstrate that methylation-based tissue identification is more than a proof-of-concept. The methodology holds promise as another viable forensic DNA analysis tool for characterization of biological materials.

Can encrypted traffic be identified without port numbers, IP addresses and payload inspection?

Identifying encrypted application traffic represents an important issue for many network tasks including quality of service, firewall enforcement and security. Solutions should ideally be both simple – therefore efficient to deploy – and accurate. This paper presents a machine learning based approach employing simple packet header feature sets and statistical flow feature sets without using the IP addresses, source/destination ports and payload information to unveil encrypted application tunnels in network traffic. We demonstrate the effectiveness of our approach as a forensic analysis tool on two encrypted applications, Secure SHell (SSH) and Skype, using traces captured from entirely different networks. Results indicate that it is possible to identify encrypted traffic tunnels with high accuracy without inspecting payload, IP addresses and port numbers. Moreover, it is also possible to identify which services run in encrypted tunnels.

Network forensic frameworks: Survey and research challenges

Network forensics is the science that deals with capture, recording, and analysis of network traffic for detecting intrusions and investigating them. This paper makes an exhaustive survey of various network forensic frameworks proposed till date. A generic process model for network forensics is proposed which is built on various existing models of digital forensics. Definition, categorization and motivation for network forensics are clearly stated. The functionality of various Network Forensic Analysis Tools (NFATs) and network security monitoring tools, available for forensics examiners is discussed. The specific research gaps existing in implementation frameworks, process models and analysis tools are identified and major challenges are highlighted. The significance of this work is that it presents an overview on network forensics covering tools, process models and framework implementations, which will be very much useful for security practitioners and researchers in exploring this upcoming and young discipline.

Fractal Analysis and Fractography: What Can we Learn that’s New?

The tenets of fractography are well known. The principles of fractal geometry have been applied to fracture surfaces for several decades. How these two fields can be used in a synergistic manner eludes many. The key element in discovering that a fracture surface is fractal is that the features we observe with the naked or aided eye also occur at the atomic scale! Thus, we should be able to interpret the mirror, mist and hackle boundaries in terms of atomic bond breaking. I will present a consistent hypothesis for relating the bond breaking process at the atomic scale to the features we all observe on the fracture surface of materials. I suggest these can be related through one equation: 2 = E a0 D*, where  is the fracture energy, E is the elastic modulus, a0 is a characteristic dimension related to the structure of the material, and D* is the fractal dimensional increment. In turn, D* = c/r1 for which c is the crack size and r1 is the mirror mist boundary radius. Thus, the energy expended in fracture at the atomic scale is encoded on the fracture surface features we observe. The novel combination of fractography, fracture mechanics and fractal geometry can be combined to create a powerful tool for forensic analysis, research investigations and production analyses.

Nuclear Archeology in a Bottle: Evidence of Pre-Trinity U.S. Weapons Activities from a Waste Burial Site

During World War II, the Hanford Site in Washington became the location for U.S. plutonium production. In 2004, a bottle containing a sample of plutonium was recovered from a Hanford waste trench. Here, state-of-the-art instrumental analyses, reactor model simulations, and investigative science techniques were used to provide insights as to the origin of this unknown sample, a process collectively termed as nuclear archeology. Isotopic age dating conducted on the sample in 2007 indicated the sample was separated from the spent fuel 61.6 +/- 4.5 years earlier. The isotope (22)Na, a detectable product of a secondary nuclear reaction, proved useful as a powerful tool for nuclear forensic analysis as (1) an easily detectable signifier of the presence of alpha emitting actinides, (2) an indicator of sample splitting, and (3) a measure of the time since sample splitting. Analytical results of minor actinide isotopes and reactor model simulations confirmed the material originated from the X-10 reactor in Oak Ridge, TN. Corroborated by historical documents, we concluded this sample was part of the first batch of Pu separated at T-Plant, Hanford, the world's first industrial-scale reprocessing facility, on December 9, 1944. This sample represents the oldest known collection of man-made (239)Pu in the world.