Academic literature on the topic 'Forensic evidence'

This dissertation focuses on the forensic validation of computer evidence. It is a burgeoning field, by necessity, and there have been significant advances in the detection and gathering of evidence related to electronic crimes. What makes the computer forensics field similar to other forensic fields is that considerable emphasis is placed on the validity of the digital evidence. It is not just the methods used to collect the evidence that is a concern. What is also a problem is that perpetrators of digital crimes may be engaged in what is called anti-forensics. Digital forensic evidence techniques are deliberately thwarted and corrupted by those under investigation. In traditional forensics the link between evidence and perpetrator's actions is often straightforward: a fingerprint on an object indicates that someone has touched the object. Anti-forensic activity would be the equivalent of having the ability to change the nature of the fingerprint before, or during the investigation, thus making the forensic evidence collected invalid or less reliable. This thesis reviews the existing security models and digital forensics, paying particular attention to anti-forensic activity that affects the validity of data collected in the form of digital evidence. This thesis will build on the current models in this field and suggest a tentative first step model to manage and detect possibility of anti-forensic activity. The model is concerned with stopping anti-forensic activity, and thus is not a forensic model in the normal sense, it is what will be called a “meta-forensic” model. A meta-forensic approach is an approach intended to stop attempts to invalidate digital forensic evidence. This thesis proposes a formal procedure and guides forensic examiners to look at evidence in a meta-forensic way.

Cloud computing is gaining acceptance and also increasing in popularity. Organisations often rely on cloud resources as an effective replacement for their `in-house' computer systems. In the cloud, virtual resources are provided from a larger pool of resources, these resources being available to multiple different clients. When something suspicious happens within a digital environment, a digital forensic investigation may be conducted to gather information about the event. When conducting such an investigation digital forensic procedures are followed. These procedures involve the steps to be followed to aid in the successful completion of the investigation. One of the possible steps that may be followed involves isolating possible evidence in order to protect it from contamination and tampering. Clouds may provide a multi-tenancy solution across multiple geographical locations. When conducting an investigation into physical equipment the equipment may be isolated. This may be done, for example, by placing a cell phone in a Faraday bag in order to block signals or unplugging a computer's network cable to stop the computer from either sending or receiving of network traffic. However, in the cloud it may not be applicable to isolate the equipment of the cloud because of the multi-tenancy and geographically separated nature of the cloud. There is currently little research available on how isolation can be accomplished inside the cloud environment. This dissertation aims at addressing the need for isolation on the cloud by creating new methods and techniques that may be incorporated into an investigation in order to isolate cloud resources. Isolation can be achieved by moving the unnecessary evidence to a different location and retaining the required evidence or by moving the required evidence in such a manner that the evidence would not be contaminated. If isolated evidence were to be moved to a digital forensic laboratory, the question arises as to whether it would be possible to create such a laboratory on the cloud utilise the benefits of cloud computing and enable the investigation to be conducted on the cloud without moving the isolated evidence from the cloud. The dissertation will develop various models of isolation. These models are then tested in experimental conditions. The experiments were conducted on Nimbula Director 1.0.3 and VMware vSphere 5.0. The models were successfully applied in the experiments. It was found that investigations could benefit from the use of the proposed models for isolation. However, the experiments also highlighted that some of the models are not applicable or that a combination should be used. The experiments also indicated that the methods to be used would depend on the circumstances of the investigation. A preliminary "cloud laboratory" was designed and described in terms of which a digital forensic laboratory can be created on the cloud resources, thus enabling an investigation to be conducted inside the cloud environment.<br>Dissertation (MSc)--University of Pretoria, 2013.<br>Computer Science<br>unrestricted

Objectives This thesis is based on 4 papers that were all written with the same intent, which was to describe and demonstrate how epidemiologic concepts and data can serve as a basis for improved validity of probabilistic conclusions in forensic medicine (FM). Conclusions based on probability are common in FM, and the validity of probabilistic conclusions is dependant on their foundation, which is often no more than personal experience. Forensic epidemiology (FE) describes the use and application of epidemiologic methods and data to questions encountered in the practice of FM, as a means of providing an evidence-based foundation, and thus increased validity, for certain types of opinions. The 4 papers comprising this thesis describe 4 unique applications of FE that have the common goal of assessing probabilities associated with evidence gathered during the course of the investigation of traumatic injury and death.   Materials and Methods Paper I used a case study of a fatal traffic crash in which the seat position of the surviving occupant was uncertain as an example for describing a probabilistic approach to the investigation of occupant position in a fatal crash. The methods involved the matching of the occupants’ injuries to the vehicular and crash evidence in order to assess the probability that the surviving occupant was either the driver or passenger of the vehicle at the time of the crash. In the second and third papers, epidemiologic data pertaining to traffic crash-related injuries from the National Automotive Sampling System-Crashworthiness Data System (NASS-CDS) was used to assess the utility and strength of evidence, such as vehicle deformation and occupant injury of a particular severity and pattern, as a means of assessing the probability of an uncertain issue of interest. The issue of interest in Paper II was the seat position of the occupant at the time of a rollover crash (similar to Paper I), and the association that was investigated was the relationship between the degree of downward roof deformation and likelihood of a serious head and neck injury in the occupant. The analysis was directed at the circumstance in which a vehicle has sustained roof deformation on one side but not the other, and only one of the occupants has sustained a serious head or neck injury. In Paper III the issue of interest was whether an occupant was using a seat belt prior to being ejected from a passenger vehicle, when there was evidence that the seat belt could have unlatched during a crash, and thus it was uncertain whether the occupant was restrained and then ejected after the seat belt unlatched, or unrestrained. Of particular interest was the relative frequency of injury to the upper extremity closest to the side window (the outboard upper extremity [OUE]), as several prior authors have postulated that during ejection when the seat belt has become unlatched the retracting seat belt would invariably cinch around the OUE and cause serious injury. In Paper IV the focus of the analysis was the predictability of the distribution of skull and cervical spine fractures associated with fatal falls as a function of the fall circumstances. Swedish autopsy data were used as the source material for this study. Results In Paper I the indifferent pre-crash probability that the survivor was the driver (0.5) was modified by the evidence to arrive at a post-test odds of 19 to 1 that he was driving. In Paper II NASS-CDS data for 960 (unweighted) occupants of rollover crashes were included in the analysis. The association between downward roof deformation and head and neck injury severity (as represented by a composite numerical value [HNISS] ranging from 1 to 75) was as follows: for each unit increase of the HNISS there were increased odds of 4% that the occupant was exposed to &gt;8 cm of roof crush versus &lt;8 cm; 6% for &gt;15 cm compared to &lt;8 cm, and 11% for &gt;30 cm of roof crush compared to &lt;8 cm. In Paper III NASS-CDS data for 232,931 (weighted) ejected occupants were included in the analysis, with 497 coded as seat belt failures, and 232,434 coded as unbelted. Of the 7 injury types included in the analysis, only OUE and serious head injury were found to have a significant adjusted association with seat belt failure, (OR=3.87, [95% CI 1.2, 13.0] and 3.1, [95% CI 1.0, 9.7], respectively). The results were used to construct a table of post-test probabilities that combined the derived sensitivity and (1 - specificity) rates with a range of pre-crash seat belt use rates so that the results could be used in an investigation of a suspected case of belt latch failure. In Paper IV, the circumstances of 1,008 fatal falls were grouped in 3 categories of increasing fall height; falls occurring at ground level, falls from a height of &lt;3 meters or down stairs, and falls from ≥3 meters. Logistic regression modeling revealed significantly increased odds of skull base and lower cervical fracture in the middle (&lt;3 m) and upper (≥3 m) fall height groups, relative to ground level falls, as follows: (lower cervical &lt;3 m falls, OR = 2.55 [1.32, 4.92]; lower cervical ≥3 m falls, OR = 2.23 [0.98, 5.08]; skull base &lt;3 m falls, OR = 1.82 [1.32, 2.50]; skull base ≥3 m falls, OR = 2.30 [1.55, 3.40]). Additionally, C0-C1 dislocations were strongly related to fall height, with an OR of 8.3 for the injury in a ≥3 m fall versus ground level. Conclusions In this thesis 4 applications of FE methodology were described. In all of the applications epidemiologic data resulting from prior FM investigations were analyzed in order to draw probabilistic conclusions that could be reliably applied to the circumstances of a specific investigation. It is hoped that this thesis will serve to demonstrate the utility of FE in enhancing evidence-based practice in FM.

<p>Den forensiska vetenskapen innefattar en mängd olika vetenskaper som tillämpas för att bistå och besvara frågor av intresse för rättsväsendet. Skoavtrycksjämförelser har använts sedan slutet av 1700-talet för att bistå i brottsutredningar. Genom att undersöka egenskaper hos ett skoavtryck kan en forensiker ge utredaren värdefull information om skon och ibland även om bäraren. I bästa fall är skoavtrycket så unikt att det kan individualiseras och identifieras till en specifik sko.</p><p>För att underlätta och förbättra den forensiska bevisvärderingen är det av stort intresse att statistiskt erhålla förekomsten av ett bevis. Genom att samla in data gällande sulmönster och sedan etablera en databas kan styrkan hos ett specifikt skoavtryck fastställas. I denna studie samlades 687 avtryck in slumpmässigt och lades in i ett visualiserat databasklassificeringssystem, SIMSALAPIM, varpå en statistisk utvärdering utfördes.</p><p>Resultatet i denna studie visar på att ett specifikt sulmönster generellt förekommer endast en gång i databasen, varför det kan sägas att ett skoavtryck tillför en viss styrka/värde som forensiskt bevis även om det inte besitter några individualiserande detaljer. Vidare, genom ytterliggare statistiska utvärderingar, kunde även ett samband mellan ålder och typ av sko ses.</p><br><p>The Forensic Science comprises a variety of sciences that are applied in order to assist and answer questions of interest to the legal system. Since the end of the 18th century footwear impression comparison has been applied to assist in crime investigations. By examining the characteristics of a footwear impression the forensic scientist may provide the investigator with valuable information about the footwear and sometimes even about the wearer. Ultimately, the footwear impression is so unique that it can be individualized and identified to a specific shoe.</p><p>In order to facilitate and improve the forensic evidence evaluation it is of great interest to statistically establish the prevalence of evidence. By collecting data of outsole patterns and then recording it in a database the strength of a specific footwear impression can be determined. In this survey 687 impressions were randomly collected and recorded in a visualised database classification system, SIMSALAPIM1, whereupon a statistical evaluation was performed.</p><p>The result of this survey indicates that a specific outsole pattern typically only occurs once in the database, wherefore it can be stated that any footwear impression provides some strength/value as forensic evidence even though there are no individual characteristics present. Moreover, through additional statistical evaluations, a relation between age and shoe type also was revealed.</p>

This thesis explores the extent to which forensic archaeology and forensic anthropology are utilised within Great Britain and to what extent they aid, or do not aid, medico-legal investigation of death. Chapter One introduces the topic and considers the need for an exploration of these issues. In Chapter Two, the differences between the American and British situations are examined and an explanation for the differences proposed, based on the development of the academic ‘parent’ disciplines during the last century. Chapter Three explores issues around accreditation and registration in the UK. The role of the courts in maintaining standards of expert evidence is examined. National and European schemes are considered. After considering the practitioners in this way, Chapter Four looks at the methods, and how the practitioners’ experience informs their choice of method. One specific topic for each discipline is discussed in depth and the complexity of choice illustrated. The difficulty in assessing the full scope for use of forensic archaeology and forensic anthropology are detailed in Chapter Five, with the marked lack of available research data. The problems inherent in media-derived data are considered. The scope for use of the two disciplines is discussed and illustrated with examples from the Media Derived Case List In Chapter Six, a complex multiple-burial multiple-murder case is discussed; and interviews across one police force area are discussed. These illustrate the use and usefulness of forensic archaeology in practice. Conclusions are drawn in Chapter Seven, and radical recommendations are made.

The Information and Communications Technology (ICT) environment constitutes an integral part of our daily lives. Individual computer users and large corporate companies are increasingly dependent on services provided by ICT. These services range from basic communication to managing large databases with corporate client information. Within these ICT environments something is bound to go wrong for a number of reasons, which include an intentional attack on information services provided by an organisation. These organisations have in turn become interested in tracing the root cause of such an incident with the intent of successfully prosecuting a suspected malicious user. Digital forensics has developed signi cantly towards prosecuting such criminals. The volumes of information and rapid technological developments have contributed to making simple investigations rather cumbersome. In the digital forensics community a number of digital forensic process models have been proposed encapsulating a complete methodology for an investigation. Software developers have also greatly contributed toward the development of digital forensics tools. These developments have resulted in divergent views on digital forensic investigations. This dissertation presents the IDFPM - Integrated Digital Forensic Process Model. The model is presented after examining digital forensic process models within the current academic and law enforcement literature. An adapted sequential logic notation is used to represent the forensic models. The terminology used in the various models is examined and standardised to suit the IDFPM. Finally, a prototype supports a limited selection of the IDFPM processes, which will aid a digital forensic investigator.<br>Dissertation (MSc)--University of Pretoria, 2012.<br>Computer Science<br>unrestricted

The unique decision making task entrusted to lay juries in adversarial legal systems has attracted the attention of legal psychologists for decades, but more recently technological advances in forensic science have highlighted the importance of understanding how jurors perceive this often ambiguous and complicated type of evidence. This thesis begins by investigating the forensic awareness of lay participants, and the ability of mock jurors to discriminate between varying probative values of forensic evidence. The findings suggest that the perception of weak forensic evidence is affected by contextual information, and there was wide disagreement among participants about the probative value of weak evidence. In an effort to explain the variance in perceived evidence strength, a measure of pre-trial attitudes about forensic science was developed (the Forensic Evidence Evaluation Bias Scale – FEEBS) and administered to 446 participants ranging from students, to jury eligible members of the public, to actual jury venire persons. The results of exploratory and confirmatory factor analyses identified two distinct clusters of attitudes measured by the FEEBS, which correspond conceptually to the hypothesised juror beliefs described in the CSI Effect literature. These attitudes were found to have a significant indirect effect on verdict preference, for trial vignettes describing murder, robbery, and sexual assault scenarios containing weak (or absent) forensic DNA evidence. The implications of these findings for voir dire hearings are discussed, with reference to the cognitive models of juror decision making and the CSI Effect literature.

Computer crimes have become very complex in terms of investigation and prosecution. This is mainly because forensic investigations are based on artifacts left oncomputers and other digital devices. In recent times, perpetrators of computer crimesare getting abreast of the digital forensics dynamics hence, capacitated to use someanti-forensics measures and techniques to obfuscate the investigation processes.Incases where such techniques are employed, it becomes extremely difficult, expensive and time consuming to carry out an effective investigation. This might causea digital forensics expert to abandon the investigation in a pessimistic manner.ThisProject work serves to practically demonstrate how numerous anti-forensics can bedeployed by the criminals to derail the smooth processes of digital forensic investigation with main focus on data hiding and encryption techniques, later a comparativestudy of the effectiveness of some selected digital forensics tools in analyzing andreporting shreds of evidence will be conducted.

The field of digital forensics is concerned with finding and presenting evidence sourced from digital devices, such as computers and mobile phones. The complexity of such digital evidence is constantly increasing, as is the volume of data which might contain evidence. Current approaches to interpreting and assuring digital evidence rely implicitly on the use of tools and representations made by experts in addressing the concerns of juries and courts. Current forensics tools are best characterised as not easily verifiable, lacking in ease of interoperability, and burdensome on human process. The tool-centric focus of current digital forensics practise impedes access to and transparency of the information represented within digital evidence as much as it assists, by nature of the tight binding between a particular tool and the information that it conveys. We hypothesise that a general and formal representational approach will benefit digital forensics by enabling higher degrees of machine interpretation, facilitating improvements in tool interoperability and validation. Additionally, such an approach will increase human readability. This dissertation summarises research which examines at a fundamental level the nature of digital evidence and digital investigation, in order that improved techniques which address investigation efficiency and assurance of evidence might be identified. The work follows three themes related to this: representation, analysis techniques, and information assurance. The first set of results describes the application of a general purpose representational formalism towards representing diverse information implicit in event based evidence, as well as domain knowledge, and investigator hypotheses. This representational approach is used as the foundation of a novel analysis technique which uses a knowledge based approach to correlate related events into higher level events, which correspond to situations of forensic interest. The second set of results explores how digital forensic acquisition tools scale and interoperate, while assuring evidence quality. An improved architecture is proposed for storing digital evidence, analysis results and investigation documentation in a manner that supports arbitrary composition into a larger corpus of evidence. The final set of results focus on assuring the reliability of evidence. In particular, these results focus on assuring that timestamps, which are pervasive in digital evidence, can be reliably interpreted to a real world time. Empirical results are presented which demonstrate how simple assumptions cannot be made about computer clock behaviour. A novel analysis technique for inferring the temporal behaviour of a computer clock is proposed and evaluated.