Forensics: Collection of Sound Digital Evidence

This summary paper will discuss the concept of forensic evidence and evidence collection methods. Emphasis will be placed on the techniques used to collect forensically sound digital evidence for the purpose of introduction to digital forensics. This discussion will thereafter result in identifying and categorizing the different types of digital forensics evidence and a clear procedure for how to collect forensically sound digital evidence. This paper will further discuss the creation of awareness and promote the idea that competent practice of computer forensics collection is important for admissibility in court.

A Digital Evidence Fusion Method in Network Forensics Systems with Dempster-Shafer Theory

Network intrusion forensics is an important extension to present security infrastructure,and is becoming the focus of forensics research field.However,comparison with sophisticated multi-stage attacks and volume of sensor data,current practices in network forensic analysis are to manually examine,an error prone,labor-intensive and time consuming process.To solve these problems,in this paper we propose a digital evidence fusion method for network forensics with Dempster-Shafer theory that can detect efficiently computer crime in networked environments,and fuse digital evidence from different sources such as hosts and sub-networks automatically.In the end,we evaluate the method on well-known KDD Cup1999 dataset.The results prove our method is very effective for real-time network forensics,and can provide comprehensible messages for a forensic investigators.

A Transductive Scheme Based Inference Techniques for Network Forensic Analysis

Network forensics is a security infrastructure,and becomes the research focus of forensic investigation.However many challenges still exist in conducting network forensics:network has produced large amounts of data;the comprehensibility of evidence extracting from collected data;the efficiency of evidence analysis methods,etc.To solve these problems,in this paper we develop a network intrusion forensics system based on transductive scheme that can detect and analyze efficiently computer crime in networked environments,and extract digital evidence automatically.At the end of the paper,we evaluate our method on a series of experiments on KDD Cup 1999 dataset.The results demonstrate that our methods are actually effective for real-time network forensics,and can provide comprehensible aid for a forensic expert.

Effects of Motivation and Demography on the Quantitative Plausibility of the Trojan Horse Defence Against Possession of Child Pornography

The Enhanced Complexity Model( ECM) developed previously has been further extended to produce a Motivationally Enhanced Complexity Model( MECM) which enables the degree of motivation,capability and opportunity of a hypothetical Trojan Horse author to be included in quantifying the relative plausibility of competing explanations for the existence of uncontested digital evidence.This new model has been applied to the case of the Trojan Horse defence( THD) against the possession of child pornography.Our results demonstrate that the THD in this case cannot be plausibly sustained unless it can be shown that an ‘off-theshelf'( OTS) Trojan Horse for this task is available and it is not detectable by the target computer,at the material time.

Delayed reception of live blowfly (Calliphora vicina and Chrysomya rufifacies)larval samples: implications for minimum postmortem interval estimates

Forensic entomology evidence collected by police and mortuary staff may be delayed in getting to the entomologist.Live samples may continue developing and alter minimum postmortem interval (PMImin) estimates.This study investigated development of simulated evidential samples of Calliphora vicina Robineau-Desvoidy and Chrysomya rufifacies (Macquart) (Diptera: Calliphoridae) maggots.Maggots of each species were studied in three developmental classes: "small" (late second/early third instar),"mid" (mid third instar) and "large" (late third instar).Seven replicates of 11 maggots in each class were assigned without food to four treatments: (1) 24 h at 20 ℃;(2) 24 h at 4 ℃;(3) 48 h at 20 ℃ and (4) 48 h at 4 ℃.There was a significant difference in absolute length change across treatments,reflecting size for C vicina,and interaction between size,time and temperature for Ch.rufifacies.Calliphora vicina maggots showed minimal mortality,and most second instar larvae moulted by the experiment's end.Chrysomya rufifacies showed heavy mortality and minimal moulting from the second to third instar.Only "large" Ch.rutifacies maggots kept at room temperature for 48 h pupariated.Since these results confirm that development can continue in live unfed maggot samples after their collection,it is not advisable to delay their preservation.

The Rational Thinking of Expert Opinion and Communicating in Courtroom

Since the past half century,expert testimony has played an increasingly important role in Chinese litigation.As the amount of expert testimony has grown,the issues about its admissibility and scientific foundation related to evidence are becoming to be questioned commonly.Since eighteenth central committee(China)adopted the decision of the Central Committee of China on several important issues in promoting the legal system,the evidence was redefined to become the predominance in the whole proceeding.This article reviews the expert knowledge implicit in the opinions.It argues that the expert opinions ask judges to be aware of the role of communicationg between participants.Expert opinion is not only gained from laboratory,but also socially constructed in the rational expression and communication,which requir us think logically in terms of legal perceptions of science and expert knowledge in the empirical world.

Study of Autosomal Short Tandem Repeat Loci Using ITO Method in Full‑Sibling Identification

This study aimed to investigate the application of autosomal short tandem repeat(STR)loci using the ITO method and discriminant function algorithm for full‑sibling(FS)identification.A total of 342 pairs of full siblings(FSs)and 3900 pairs of unrelated individuals(UIs)were genotyped at 51 STR loci.The groups were in accordance with discrimination power(DP)values and the number of loci,and the values of FS index(FSI)of FSs and UIs were calculated by the ITO method.The discriminant functions of FS–UI were established using the Fisher’s discriminant analysis method with SPSS 19.0 software.All the lgFSI values in the FS and UI groups followed a normal distribution,and there were significant differences between the two pairs.A higher average DP value was associated with a more significant difference,as was a greater number of STR loci detected.Receiver operator characteristic curves showed that the accuracy of FS identification can be affected by both locus polymorphism and the number of loci detected.Comparing the rate of false positives and false negatives of discriminant function between the two groups,a higher average DP value and larger number of loci detected were associated with a lower rate of miscarriage of justice and were more helpful for FS–UI identification.The ITO‑based discriminant analysis method has high applicability in FS–UI tests.Testing of a greater number of STR loci promotes FS identification.