Forensics: Collection of Sound Digital Evidence

This summary paper will discuss the concept of forensic evidence and evidence collection methods. Emphasis will be placed on the techniques used to collect forensically sound digital evidence for the purpose of introduction to digital forensics. This discussion will thereafter result in identifying and categorizing the different types of digital forensics evidence and a clear procedure for how to collect forensically sound digital evidence. This paper will further discuss the creation of awareness and promote the idea that competent practice of computer forensics collection is important for admissibility in court.

A Novel Forensic Computing Model

According to the requirement of computer forensic and network forensic, a novel forensic computing model is presented, which exploits XML/OEM/RM data model, Data fusion technology, forensic knowledgebase, inference mechanism of expert system and evidence mining engine. This model takes advantage of flexility and openness, so it can be widely used in mining evidence.

Research and implementation on multi-dimension trust evaluation method with web service

Integrating with practical e-commerce application, this paper introduces a novel multi-dimension evaluation method to depict and calculate the trust values. The multi-dimension evaluation metrics include functional and nonfunctional properties and corresponding weights. The continuous measurement values and the Markov chain mechanism are adopted to compute the trust value and detect the malicious behaviors. The current evaluation has larger influence factor on the next transaction behavior. A trust model is implemented with web service which consists of publication, filtrating, calculating and storage center. It is easily extended and the user only defines each property and its weights according to specific requirements, then the trust values are got. In order to conveniently manage and avoid the dead-lock, some constraint rules are proposed. The results show that the method based on multi-dimension can reflect objectively the dynamic change of trust values.

Integrated Approach to Detect Cyberbullying Text:Mobile Device Forensics Data

Mobile devices and social networks provide communication opportunities among the young generation,which increases vulnerability and cybercrimes activities.A recent survey reports that cyberbullying and cyberstalking constitute a developing issue among youngsters.This paper focuses on cyberbullying detection in mobile phone text by retrieving with the help of an oxygen forensics toolkit.We describe the data collection using forensics technique and a corpus of suspicious activities like cyberbullying annotation from mobile phones and carry out a sequence of binary classification experiments to determine cyberbullying detection.We use forensics techniques,Machine Learning(ML),and Deep Learning(DL)algorithms to exploit suspicious patterns to help the forensics investigation where every evidence contributes to the case.Experiments on a real-time dataset reveal better results for the detection of cyberbullying content.The Random Forest in ML approach produces 87%of accuracy without SMOTE technique,whereas the value of F1Score produces a good result with SMOTE technique.The LSTM has 92%of validation accuracy in the DL algorithm compared with Dense and BiLSTM algorithms.

The Development of Forensic Process Model for Criminal Investigation in Three Southern Border Provinces of Thailand

The purpose of this research is to study the process of forensic science execution in order to use crime investigation in three southern border provinces of Thailand, such as the study of problems and obstacles including the factors that affect forensic examination to use criminal investigation in three southern border provinces, offer the guidance in pattern development of forensic sciences examination in three southern border provinces with standard, and are able to use in criminal investigation effectively. Data were collected from all related agencies. The results of this research have showed that executive process of forensic science is used to investigate the crime in three southern border provinces that can be divided the operations into three main issues as following： crime scene examination, evidence testing, autopsy in case of crime scene, and factors which affect forensic work for using in criminal investigation in three southern border provinces of police practitioners. They should have the knowledge about forensic science, commitment, bravery, and cunning work.

Comparison Study and Forensic Analysis between Experiment and Coupled Dynamics Simulation for Submerged Floating Tunnel Segment with Free Ends under Wave Excitations

This paper presents dynamic-behavior comparisons and related forensic analyses of a submerged floating tunnel(SFT)between numerical simulation and physical experiment under regular and irregular waves.The experiments are conducted in the 3Dwave tank with 1:33.3 scale,and the corresponding coupled time-domain simulation tool is devised for comparison.The entire SFT systemconsists of a long concrete tunnel and 12 tubular aluminummooring lines.Two numerical simulation models,the Cummins equation with 3D potential theory including second-order wave-body interaction effects and the much simpler Morison-equation-based formula with the lumped-massbased line model,are designed and compared.Forensic analyses for mooring-line adjustments in the simulation are carried out in view of the best representation of the physical system.After that,the measured pre-tension distribution and systemstiffness of twelvemooring lines arewell reproduced in the numericalmodel.Subsequently,the dynamic responses and mooring tensions of the SFT are compared under regular and irregular waves.The measured and simulated results coincide reasonably well for both regular-and irregular-wave conditions.

A Parametric Autoregressive Model for the Extraction of Electric Network Frequency Fluctuations in Audio Forensic Authentication

This paper proposes a new method for extracting ENF （electric network frequency） fluctuations from digital audio recordings for the purpose of forensic authentication. It is shown that the extraction of ENF components from audio recordings is realizable by applying a parametric approach based on an AR （autoregressive） model. The proposed method is compared to the existing STFT （short-time Fourier transform） based ENF extraction method. Experimental results from recorded electrical grid signals and recorded audio signals show that the proposed approach can improve the time resolution in the extracted ENF fluctuations and improve the detection of tampering with short alterations in longer audio recordings.

MDMA及其代谢物MDA在大鼠体内的毒物代谢动力学

目的探究单次和连续给药3,4-亚甲基二氧基甲基苯丙胺(3,4-methylenedioxy-N-methylamphetamine,MDMA)后,MDMA及其代谢物4,5-亚甲基二氧基苯丙胺(4,5-methylene dioxy amphetamine,MDA)在大鼠体内的毒物代谢动力学差异,为MDMA的法医学鉴定提供数据依据。方法单次给药组取24只大鼠随机分为5、10、20 mg/kg实验组和对照组,每组6只,实验组腹腔注射给药MDMA,对照组经腹腔注射给药与实验组同等体积的生理盐水。给药后5 min、30 min、1 h、1.5 h、2 h、4 h、6 h、8 h、10 h、12 h通过内眦动脉取血0.5 mL。连续给药组取24只大鼠随机分为实验组(18只)和对照组(6只)。实验组连续腹腔注射递增给药MDMA 7 d,每日给药剂量分别为5、7、9、11、13、15、17 mg/kg,对照组经腹腔注射给药与实验组同等体积的生理盐水。第8天将实验组大鼠随机分为5、10、20 mg/kg剂量组,每组6只,腹腔注射给药MDMA,对照组经腹腔注射与实验组同等体积的生理盐水。给药后5 min、30 min、1 h、1.5 h、2 h、4 h、6 h、8 h、10 h、12 h通过内眦动脉取血0.5 mL。使用液相色谱-三重四极杆串联质谱检测MDMA和MDA含量,运用统计学软件进行数据分析。结果单次给药组血浆中MDMA在给药后5 min达到峰浓度,MDA在给药后1 h达到峰浓度,MDMA和MDA的最长检出时限为12 h。连续给药组第8天MDMA在给药后30 min达到峰浓度,MDA在给药后1.5 h达到峰浓度,MDMA和MDA的最长检出时限为10 h。单次给药组和连续给药组检出时限内MDMA和MDA质量浓度比与给药时间的非线性拟合方程分别为T=10.362C^(-1.183),R^(2)=0.9746;T=7.3973C^(-0.694),R^(2)=0.9615(T为给药时间,C为MDMA和MDA在血浆中的质量浓度比)。结论本研究得到的MDMA及其代谢物MDA在单次和连续给药大鼠体内毒物代谢动力学数据(达峰浓度、达峰时间、检测时限和质量浓度比与给药时间的关系)为相关法医学鉴定提供了理论基础和数据依据。

基于高斯增强模块的相机模型辨别

在多媒体取证中,高通滤波器是卷积神经网络常用的预处理层之一,用于抑制图像内容的影响,只强调高频特征。但与此同时,其他一些包含取证痕迹的有用信息也将被不加区别地剔除。为了解决这一问题,文中提出了一个简单而高效的高斯增强模块(Gaussian Enhancement Module,GEM)来提取“扩展的”高频特征,即在维持原有特征强度的基础上增强高频细节信息。GEM由两个连续的一维低通高斯滤波器组成,以获得一个模糊版本的特征图,并进一步得到相应的扩展高频残差。通过以高频残差作为空间掩膜,它可以自适应地强化脆弱和细微的低级取证特征,并防止在特征传递过程中出现衰减现象。在相机模型辨别数据集上进行实验,通过将该模块插入多个主流骨干网络,GEM仅仅带来非常轻微的模型复杂度的增加,网络性能和鲁棒性却显著提高,表明该模块支持“即插即用”,与特定的网络架构无关。

基于数据驱动模型的反窃电行为精准取证系统

反窃电行为现场蹲守取证的时效性与准确性均较差,导致取证工作效率下降,且取得的证据不完整,设计基于数据驱动模型的反窃电行为精准取证系统。在现场布设反窃电稽查仪、红外摄像头,在采集层获取用户相关用电数据以及视频图像,并通过通信层的集中器将数据传输到主站层。主站层借助数据驱动模型从用电数据以及视频图像中挖掘证据,对获取的证据进行实时整理和归纳,完成反窃电行为精准取证。实验结果表明,利用所设计系统对窃电用户进行检测与识别后所得F1值均大于9,且接近于10,能够实现反窃电行为精准取证。

日本法医学专业人才培养模式及其借鉴

日本法医鉴定人员素质在世界范围内得到普遍认可。日本近代法医学教育事业迅速崛起源于不断吸收外域法医学教育资源与教学经验,最终形成基础教育与专业培训层级分明、课堂教学与案例研讨相辅相成的法医学专业人才培养模式,并通过国内培训与国际交流协作不断提升从业人员的综合素质,为日本法医行业发展输送专业人才。据此,本文以日本法医学专业发展史为切入点,研究其如何在近代逐渐形成法医学教育事业发展雏形,并在此基础上分析日本现代法医学专业人才培养模式的特点,提炼其中的优秀经验予以本地化改造,如强调实践教学环节作用、发挥职业技能培训效能以及促进国际交流合作等,以供我国相关专业人才培养所参考与借鉴。

3D数字化模型在法医人类学教学中的应用探讨

法医人类学是一门理论与实践紧密结合的法医专业学科,然而法医人类学传统教学存在明显的限制,主要有标本紧张、直观性差等,上述问题导致学生上课积极性不高,对重难点知识理解困难,理论实践相互脱节,无法完全达到课程培养目标。3D数字化模型立体感强,可随意旋转缩放,能够清晰展现骨结构形态与差异,为学生提供更直观、清晰的学习体验,帮助学生更好地理解和掌握法医人类学知识。文章探讨如何将3D数字化模型合理融入法医人类学教学,在教学场景、模型获取及课后反馈等方面进行设计,分析3D模型融入法医人类学教学的优势和应用挑战,以期提高教学质量,实现较为理想的教学效果。

JPEG原图重构取证方法

数字图像已被广泛用于办理各类网上业务和作为司法证据。与此同时,利用流行的图像编辑软件,普通用户就可以对图像进行语义篡改而不留下视觉痕迹。因此,对数字图像的原始性和真实性进行辨识已成为迫切的应用需求。基于元数据的图像篡改取证方法因准确性高、计算量小而得到重视。然而,原图重构技术(例如应用MagicEXIF元数据编辑器)的出现使上述方法完全失效。针对这一问题,本文提出一种JPEG图像原图重构取证方法,用于检测图像是否受到重构攻击。通过分析原图重构的过程,以及重构前后图像的像素统计特征差异,本文对深度学习隐写分析模型SRNet(Steganalysis Residual Network)进行轻量化改进:裁剪其冗余的下采样层以减少参数,引入通道注意力机制以提高对关键特征的提取能力,并采用知识蒸馏的方法进一步提升模型的准确率。进一步地,通过分析重构对不同颜色分量的影响,采用YCbCr颜色分量作为模型输入,以提高检测性能。为测试算法的性能,我们收集了由不同品牌和型号的手机拍摄的图像数据,构建了大规模重构图像数据库。实验表明,本文提出的模型在参数量显著减少的情况下性能优于流行的模型,对512×512大小的图像可取得98%以上的检测正确率,且具有良好的跨设备泛化能力。同时,通过应用迁移学习,本文方法对不同版本的重构软件也具有较好的泛化性。

医学会与司法鉴定机构医疗损害鉴定模式的比较

目前医学会和司法鉴定机构均可进行医疗损害鉴定,呈现为鉴定“二元化”现象。文章从鉴定文书格式、鉴定专家选择、鉴定模式、鉴定意见4个方面分析了2类医疗损害鉴定机构存在的差异,主要表现在医学会鉴定文书格式较规范、随机抽取专家更能体现选择的公正性、专家组合议制更科学、分析意见更专业,司法鉴定机构指定专家的方式更具灵活性、分析意见语言逻辑组织更胜一筹。建议制定规范、统一的医疗损害鉴定组织形式,采取“X名临床专家+1名法医”的专家组构成模式,完善鉴定相关制度,以期实现医疗损害鉴定的科学化、规范化。

利用多刚体模型分析两种高坠方式

本研究利用多刚体模型对实际案例中有争议的两种高坠方式进行模拟重建,通过MADYMO软件模拟计算人体从窗户上坠落着地部位及着力点,并对身体主要部位进行物理参数分析。结果显示:当人体以骑跨的姿势从窗户掉落时,人体坠落的轨迹是侧面倾倒下落,身体的侧面先着地;当人体以攀附的姿势从窗户掉落时,人体坠落的轨迹是直立竖直下落,身体的下肢先着地。案例中骨折最严重部位在双下肢及骨盆部位,提示人体落地时首先着地部位为下肢,与多刚体人体模型模拟分析的人体以攀附的姿势从窗户掉落高坠过程一致,因此,分析认为案例中的人体高坠损伤符合人体以攀附的姿势从窗户掉落形成。本研究以实际案例为基础,利用多刚体模型对人体高坠过程进行分析重建并直观展示,为高坠损伤分析及辅助判断高坠性质提供一种可视化的新方法。

基于不同STR分型试剂盒的肿瘤组织身源鉴定方法

目的 建立基于常用STR分型试剂盒的肿瘤组织身源鉴定方法。方法 采用ForenSeq^(TM) DNA Signature Prep试剂盒检测55例配对肿瘤组织样本(肿瘤组织和同一个体正常组织成对)以及75例无关个体全血样本27个常染色体STR基因座的分型情况,并模拟55例肿瘤组织的全同胞、亲子对分型数据,统计成对肿瘤(paired carcinoma,PC)、肿瘤-无关个体(tumor-unrelated individual,UI)、肿瘤-全同胞(tumor-simulated full sibling,FS)与肿瘤-亲子(tumor-simulated parent-offspring,PO)的共有等位基因个数(number of total identical alleles,A_n)及状态一致性(identity by state,IBS)评分。以上述统计结果作为参照,建立8个常用STR分型试剂盒的肿瘤组织身源鉴定预测模型,并尝试构建一个专用于肿瘤组织身源鉴定的模型。使用另外23例配对肿瘤组织样本的检测结果对鉴定模型的准确性、灵敏度及特异度进行验证与评估。结果 (1)在任一试剂盒中,全不同基因座数量(A_0)在PC组与PO组之间差异无统计学意义。1个相同基因座数量(A_(1))、2个相同基因座数量(A_(2))和IBS评分在PC组与UI、FS、PO组之间差异均有统计学意义。(2)不同STR基因座的A_n与IBS评分在不同组别存在差异,其中,13个STR基因座(CSF1PO、D12S391、D19S433、D20S482、D2S1338、D3S1358、D4S2408、D7S820、D8S1179、FGA、TH01、TPOX、vWA)的A_(2)在PC组均高于其他STR基因座;2个STR基因座(D6S1043、PentaE)的A_(2)在UI组低于其他STR基因座。(3)成功构建了8个常用STR分型试剂盒的肿瘤组织身源鉴定预测模型以及15个STR基因座的肿瘤组织身源鉴定模型(15-STRs),灵敏度均达100%,特异度为97.56%~99.88%,准确度为97.59%~99.89%。其中,15-STRs模型的灵敏度为100%,特异度为99.88%,准确率为99.89%,高于常用商业化试剂盒。结论 本研究成功建立了8个常用STR分型试剂盒的肿瘤组织身源鉴定方法,拓展了肿瘤组织身源鉴定的应用范围。通过比较不同基因座在肿瘤组织身源鉴定中的差异,筛选出了15个特别适用于肿瘤组织身源鉴定的STR基因座,为未来肿瘤组织溯源的试剂盒构建提供了数据基础。

我国大麻类毒品犯罪侦防困境及其破解路径

近年来,国际大麻合法化浪潮逐渐蔓延开来,不断冲击着世界各国的禁毒防控体系,也给我国禁毒工作带来了冲击。如今,我国大麻类毒品犯罪呈现出主体多元、手段隐蔽、毒品来源广泛等特点。这给该类犯罪的侦查与防控带来了诸多困境,譬如,缺乏有效的案件线索、侦查取证困难、阵地防控薄弱等。为有效应对大麻类毒品犯罪斗争新形势,我国应从优化侦查预警机制、强化侦查基础工作、探索具有针对性的侦查取证模式、完善大麻类毒品犯罪的侦查阵地防控四个方面破除此类犯罪的侦防窘境。

Mathematical Models for Teenager's Living Age Evaluation Based on CT Image of Medial Clavicular Epiphysis

Objective To explore the correlation between volume rendering(VR) statistics of medial clavicular epiphysis and living age,and establish the mathematical models for living age evaluation using the CT image of medial clavicular epiphysis based on the growth rules of osteoepiphysis of medial clavicle.Methods The CT images of the medial clavicles from 795 teenagers aged 15-25,387 males and 408 females,were collected in East and South China.VR 3D images were reconstructed from 0.60 mm-thick slice CT images.The epiphyseal diameter,sternal end diameter,and their respective diameter ratio(the left: x 1;the right: x 3);epiphyseal area,sternal end area,and their respective area ratio(the left: x 2;the right: x 4),were measured and calculated.All these observations were analyzed using SPSS 19.0 statistical software.The statistical differences in gender and age were analyzed by Mann-Whitney U test.The mathematical models were established using least square.Sixty trained subjects,30 males and 30 females,were tested to verify the accuracy of the established mathematical models.Results In the group of same age,x 1 showed significant difference in gender;the same results were observed in x 2,x 3,and x 4,which suggested that the growth rules of osteoepiphysis of medial clavicle were highly correlated with living age.The accuracy of these mathematical models were all above 67.6%(±1.0 year) and 78.5%(±1.5 year).Conclusion The mathematical models with reasonable accuracy could be manageable in practice to confirm the conclusion of the atlas method.The current study can contribute to the single skeletal age evaluation.