Multimedia Forensics

This book is open access. Media forensics has never been more relevant to societal life. Not only media content represents an ever-increasing share of the data traveling on the net and the preferred communications means for most users, it has also become integral part of most innovative applications in the digital information ecosystem that serves various sectors of society, from the entertainment, to journalism, to politics. Undoubtedly, the advances in deep learning and computational imaging contributed significantly to this outcome. The underlying technologies that drive this trend, however, also pose a profound challenge in establishing trust in what we see, hear, and read, and make media content the preferred target of malicious attacks. In this new threat landscape powered by innovative imaging technologies and sophisticated tools, based on autoencoders and generative adversarial networks, this book fills an important gap. It presents a comprehensive review of state-of-the-art forensics capabilities that relate to media attribution, integrity and authenticity verification, and counter forensics. Its content is developed to provide practitioners, researchers, photo and video enthusiasts, and students a holistic view of the field

Multimedia Forensics

This book is open access. Media forensics has never been more relevant to societal life. Not only media content represents an ever-increasing share of the data traveling on the net and the preferred communications means for most users, it has also become integral part of most innovative applications in the digital information ecosystem that serves various sectors of society, from the entertainment, to journalism, to politics. Undoubtedly, the advances in deep learning and computational imaging contributed significantly to this outcome. The underlying technologies that drive this trend, however, also pose a profound challenge in establishing trust in what we see, hear, and read, and make media content the preferred target of malicious attacks. In this new threat landscape powered by innovative imaging technologies and sophisticated tools, based on autoencoders and generative adversarial networks, this book fills an important gap. It presents a comprehensive review of state-of-the-art forensics capabilities that relate to media attribution, integrity and authenticity verification, and counter forensics. Its content is developed to provide practitioners, researchers, photo and video enthusiasts, and students a holistic view of the field

Temporal Image Forensics for Picture Dating based on Machine Learning

Temporal image forensics involves the investigation of multi-media digital forensic material related to crime with the goal of obtaining accurate evidence concerning activity and timing to be presented in a court of law. Because of the ever-increasing complexity of crime in the digital age, forensic investigations are increasingly dependent on timing information. The simplest way to extract such forensic information would be the use of the EXIF header of picture files as it contains most of the information. However, these header data can be easily removed or manipulated and hence cannot be evidential, and so estimating the acquisition time of digital photographs has become more challenging. This PhD research proposes to use image contents instead of file headers to solve this problem. In this thesis, a number of contributions are presented in the area of temporal image forensics to predict picture dating. Firstly, the present research introduces the unique Northumbria Temporal Image Forensics (NTIF) database of pictures for the purpose of temporal image forensic purposes. As digital sensors age, the changes in Photo Response Non-Uniformity (PRNU) over time have been highlighted using the NTIF database, and it is concluded that PRNU cannot be useful feature for picture dating application. Apart from the PRNU, defective pixels also constitute another sensor imperfection of forensic relevance. Secondly, this thesis highlights the fact that the filter-based PRNU technique is useful for source camera identification application as compared to deep convolutional neural networks when limited amounts of images under investigation are available to the forensic analyst. The results concluded that due to sensor pattern noise feature which is location-sensitive, the performance of CNN-based approach declines because sensor pattern noise image blocks are fed at different locations into CNN for the same category. Thirdly, the deep learning technique is applied for picture dating, which has shown promising results with performance levels up to 80% to 88% depending on the digital camera used. The key findings indicate that a deep learning approach can successfully learn the temporal changes in image contents, rather than the sensor pattern noise. Finally, this thesis proposes a technique to estimate the acquisition time slots of digital pictures using a set of candidate defective pixel locations in non-overlapping image blocks. The temporal behaviour of camera sensor defects in digital pictures are analyzed using a machine learning technique in which potential candidate defective pixels are determined according to the related pixel neighbourhood and two proposed features called local variation features. The idea of virtual timescales using halves of real time slots and a combination of prediction scores for image blocks has been proposed to enhance performance. When assessed using the NTIF image dataset, the proposed system has been shown to achieve very promising results with an estimated accuracy of the acquisition times of digital pictures between 88% and 93%, exhibiting clear superiority over relevant state-of-the-art systems

The twofold role of Cloud Computing in Digital Forensics: target of investigations and helping hand to evidence analysis

This PhD thesis discusses the impact of Cloud Computing infrastructures on Digital Forensics in the twofold role of target of investigations and as a helping hand to investigators. The Cloud offers a cheap and almost limitless computing power and storage space for data which can be leveraged to commit either new or old crimes and host related traces. Conversely, the Cloud can help forensic examiners to find clues better and earlier than traditional analysis applications, thanks to its dramatically improved evidence processing capabilities. In both cases, a new arsenal of software tools needs to be made available. The development of this novel weaponry and its technical and legal implications from the point of view of repeatability of technical assessments is discussed throughout the following pages and constitutes the unprecedented contribution of this wor

A structured approach to malware detection and analysis in digital forensics investigation

A thesis submitted to the University of Bedfordshire in partial fulfilment of the requirement for the degree of PhDWithin the World Wide Web (WWW), malware is considered one of the most serious threats to system security with complex system issues caused by malware and spam. Networks and systems can be accessed and compromised by various types of malware, such as viruses, worms, Trojans, botnet and rootkits, which compromise systems through coordinated attacks. Malware often uses anti-forensic techniques to avoid detection and investigation. Moreover, the results of investigating such attacks are often ineffective and can create barriers for obtaining clear evidence due to the lack of sufficient tools and the immaturity of forensics methodology. This research addressed various complexities faced by investigators in the detection and analysis of malware. In this thesis, the author identified the need for a new approach towards malware detection that focuses on a robust framework, and proposed a solution based on an extensive literature review and market research analysis. The literature review focussed on the different trials and techniques in malware detection to identify the parameters for developing a solution design, while market research was carried out to understand the precise nature of the current problem. The author termed the new approaches and development of the new framework the triple-tier centralised online real-time environment (tri-CORE) malware analysis (TCMA). The tiers come from three distinctive phases of detection and analysis where the entire research pattern is divided into three different domains. The tiers are the malware acquisition function, detection and analysis, and the database operational function. This framework design will contribute to the field of computer forensics by making the investigative process more effective and efficient. By integrating a hybrid method for malware detection, associated limitations with both static and dynamic methods are eliminated. This aids forensics experts with carrying out quick, investigatory processes to detect the behaviour of the malware and its related elements. The proposed framework will help to ensure system confidentiality, integrity, availability and accountability. The current research also focussed on a prototype (artefact) that was developed in favour of a different approach in digital forensics and malware detection methods. As such, a new Toolkit was designed and implemented, which is based on a simple architectural structure and built from open source software that can help investigators develop the skills to critically respond to current cyber incidents and analyses

Simple identification tools in FishBase

Simple identification tools for fish species were included in the FishBase information system from its inception. Early tools made use of the relational model and characters like fin ray meristics. Soon pictures and drawings were added as a further help, similar to a field guide. Later came the computerization of existing dichotomous keys, again in combination with pictures and other information, and the ability to restrict possible species by country, area, or taxonomic group. Today, www.FishBase.org offers four different ways to identify species. This paper describes these tools with their advantages and disadvantages, and suggests various options for further development. It explores the possibility of a holistic and integrated computeraided strategy

Documentation of the Body Transformations during the Decomposition Process: From the Crime Scene to the Laboratory

Forensic science is defined as the application of scientific or technical practices to the recognition, collection, analysis, and interpretation of evidence for criminal and civil law or regulatory issues. A combination of computer science in the field of 3D reconstruction and molecular biology science and techniques were employed in this research aims to document and record a complete picture of the body decomposition process including the changes of the microbiome over the decomposition process. In this thesis, the possibility to reconstruct the crime scene and the decomposition process was investigated. In addition, a 3D model aiming to integrate the biological and thanatological information was generated. The possibility of utilising Autodesk 123D Catch software as a new tool for 3D reconstruction of a crime scene was thoroughly evaluated. First experiments demonstrated that the number of photos required to obtain the best result was specified to be from 20 to 30 photos as a minimum. In addition, significant experiments were performed in different conditions of sizes, locations, and different involved materials. The measurements were obtained from the models using the same software were compared with the real measurements of the tested objects. The result of the correlation between real and estimated measurements showed a very strong agreement ranging from 0.994 to 1.000. With reference to the documentation of the decomposition process, there are different factors, intrinsic and extrinsic, have been reported affecting the decomposition of a carrion/body. These factors mainly interact with the rates of the biological and chemical reaction happening after death. The biological reactions are mainly due to the activity of microorganism and insects. Pigs (Sus scrofa domesticus) were used as a model for human studies and the results obtained have been applied to other mammals without considering the effect of fur on the decomposition process and on the insect and microbial colonisation. In order to investigate this point, rabbits (Oryctolagus cuniculus) with and without fur were used in two sets of experiments at Huddersfield in summer 2014 and in spring 2015. The results obtained in this study showed a similarity of the decomposition stages between animals with and without fur. However, the decomposition process was faster during the summer due to the fast of insect colonisation and activity. In addition, the entomological data collected during the summer and spring experiments were demonstrated that the same taxa nearly were present in both seasons, except Hydrotaea (Diptera, Muscidae), which was presented only in the summer experiment, moreover, only one sample of Lucilia sericata (Calliphoridae) was detected in the spring season. Differences in colonisation time were observed only in spring experiment; animals without fur were colonised two days before animals with fur. The season could have affected the insect’s activity and the spread of the decomposition volatiles. The microbial communities during the decomposition process were investigated using BIOLOG EcoPlate™ and the hypervariable V1-3 region of 16S rRNA gene was used for their molecular identification based on pyrosequencing. Eurofins Genomic Operon using 454-GS Junior pyrosequencing platform (Roche) carried out these analyses. The functional diversity of the bacterial communities on all carcasses samples showed a considerable variability depending on the stage of the decomposition and the sampling region (Oral cavity, skin and interface-sand-carrion) in both seasons. Furthermore, over the molecular analyses of bacterial communities at the phylum level, four main phyla of bacteria were detected among analysed carrion during the decomposition process. These phyla were changed significantly during the stages of the decomposition and between sampling regions. While no difference was observed due to presence or absence of fur. On the other hand, the analysis at the family level was able to highlight differences at the temporal scale but as well as carrion with and without fur. The statistical analysis results showed a significant difference in the bacterial community family distribution among the presence of fur and among the decomposition stages, with significant differences among sampling regions and seasons

2013 Oklahoma Research Day Full Program

This document contains all abstracts from the 2013 Oklahoma Research Day held at the University of Central Oklahoma

Tematski zbornik radova međunarodnog značaja. Tom 3 / Međunarodni naučni skup “Dani Arčibalda Rajsa”, Beograd, 3-4. mart 2015.

In front of you is the Thematic Collection of Papers presented at the International Scientific Confer-ence “Archibald Reiss Days”, which was organized by the Academy of Criminalistic and Police Studies in Belgrade, in co-operation with the Ministry of Interior and the Ministry of Education, Science and Techno-logical Development of the Republic of Serbia, National Police University of China, Lviv State University of Internal Affairs, Volgograd Academy of the Russian Internal Affairs Ministry, Faculty of Security in Skopje, Faculty of Criminal Justice and Security in Ljubljana, Police Academy “Alexandru Ioan Cuza“ in Bucharest, Academy of Police Force in Bratislava and Police College in Banjaluka, and held at the Academy of Crimi-nalistic and Police Studies, on 3 and 4 March 2015.International Scientific Conference “Archibald Reiss Days” is organized for the fifth time in a row, in memory of the founder and director of the first modern higher police school in Serbia, Rodolphe Archibald Reiss, PhD, after whom the Conference was named.The Thematic Collection of Papers contains 168 papers written by eminent scholars in the field of law, security, criminalistics, police studies, forensics, informatics, as well as members of national security system participating in education of the police, army and other security services from Spain, Russia, Ukraine, Bela-rus, China, Poland, Armenia, Portugal, Turkey, Austria, Slovakia, Hungary, Slovenia, Macedonia, Croatia, Montenegro, Bosnia and Herzegovina, Republic of Srpska and Serbia. Each paper has been reviewed by two reviewers, international experts competent for the field to which the paper is related, and the Thematic Conference Proceedings in whole has been reviewed by five competent international reviewers.The papers published in the Thematic Collection of Papers contain the overview of contemporary trends in the development of police education system, development of the police and contemporary secu-rity, criminalistic and forensic concepts. Furthermore, they provide us with the analysis of the rule of law activities in crime suppression, situation and trends in the above-mentioned fields, as well as suggestions on how to systematically deal with these issues. The Collection of Papers represents a significant contribution to the existing fund of scientific and expert knowledge in the field of criminalistic, security, penal and legal theory and practice. Publication of this Collection contributes to improving of mutual cooperation between educational, scientific and expert institutions at national, regional and international level

Forging a Stable Relationship?: Bridging the Law and Forensic Science Divide in the Academy

The marriage of law and science has most often been represented as discordant. While the law/science divide meme is hardly novel, concerns over the potentially deleterious coupling within the criminal justice system may have reached fever pitch. There is a growing chorus of disapproval addressed to ‘forensic science’, accompanied by the denigration of legal professionals for being unable or unwilling to forge a symbiotic relationship with forensic scientists. The 2009 National Academy of Sciences Report on forensic science heralds the latest call for greater collaboration between ‘law’ and ‘science’, particularly in Higher Education Institutions (HEIs) yet little reaction has been apparent amid law and science faculties. To investigate the potential for interdisciplinary cooperation, the authors received funding for a project: ‘Lowering the Drawbridges: Forensic and Legal Education in the 21st Century’, hoping to stimulate both law and forensic science educators to seek mutually beneficial solutions to common educational problems and build vital connections in the academy. A workshop held in the UK, attended by academics and practitioners from scientific, policing, and legal backgrounds marked the commencement of the project. This paper outlines some of the workshop conclusions to elucidate areas of dissent and consensus, and where further dialogue is required, but aims to strike a note of optimism that the ‘cultural divide’ should not be taken to be so wide as to be beyond the legal and forensic science academy to bridge. The authors seek to demonstrate that legal and forensic science educators can work cooperatively to respond to critics and forge new paths in learning and teaching, creating an opportunity to take stock and enrich our discipline as well as answer critics. As Latham (2010:34) exhorts, we are not interested in turning lawyers into scientists and vice versa, but building a foundation upon which they can build during their professional lives: “Instead of melding the two cultures, we need to establish conditions of cooperation, mutual respect, and mutual reliance between them.” Law and forensic science educators should, and can assist with the building of a mutual understanding between forensic scientists and legal professionals, a significant step on the road to answering calls for the professions to minimise some of the risks associated with the use of forensic science in the criminal process. REFERENCES Latham, S.R. 2010, ‘Law between the cultures: C.P.Snow’s The Two Cultures and the problem of scientific illiteracy in law’ 32 Technology in Society, 31-34. KEYWORDS forensic science education legal education law/science divid