A Forensically Sound Adversary Model for Mobile Devices

In this paper, we propose an adversary model to facilitate forensic investigations of mobile devices (e.g. Android, iOS and Windows smartphones) that can be readily adapted to the latest mobile device technologies. This is essential given the ongoing and rapidly changing nature of mobile device technologies. An integral principle and significant constraint upon forensic practitioners is that of forensic soundness. Our adversary model specifically considers and integrates the constraints of forensic soundness on the adversary, in our case, a forensic practitioner. One construction of the adversary model is an evidence collection and analysis methodology for Android devices. Using the methodology with six popular cloud apps, we were successful in extracting various information of forensic interest in both the external and internal storage of the mobile device

The relevance of the evolution of experimental studies for the interpretation and evaluation of some trace physical evidence

In order for trace evidence to have a high evidential value, experimental studies which mimic the forensic reality are of fundamental importance. Such primary level experimentation is crucial to establish a coherent body of theory concerning the generation, transfer and persistence of different forms of trace physical evidence. We contend that the forensic context, at whatever scale, will be specific to each individual forensic case and this context in which a crime takes place will influence the properties of trace evidence. it will, therefore, be necessary in many forensic cases to undertake secondary level experimental studies that incorporate specific variables pertinent to a particular case and supplement the established theory presented in the published literature. Such studies enable a better understanding of the specific forensic context and thus allow More accurate collection, analysis and interpretation of the trace physical evidence to be achieved. This paper presents two cases where the findings of secondary level experimental studies undertaken to address specific issues particular to two forensic investigations proved to be important. Specific pre-, syn- and post-forensic event factors were incorporated into the experimental design and proved to be invaluable in the recovery, analysis and in achieving accurate interpretations of both soil evidence from footwear and glass trace evidence from a broken window.These Studies demonstrate that a fuller understanding of the specific context within which trace physical evidence is generated and subsequently collected, as well as an understanding of the behaviour of certain forms of trace physical evidence under specific conditions, can add evidentiary weight to the analysis and interpretation of that evidence and thus help a court with greater certainty where resources (time and cost) permit

Data reduction and data mining framework for digital forensic evidence: storage, intelligence, review and archive

With the volume of digital forensic evidence rapidly increasing, this paper proposes a data reduction and data mining framework that incorporates a process of reducing data volume by focusing on a subset of information. Foreword The volume of digital forensic evidence is rapidly increasing, leading to large backlogs. In this paper, a Digital Forensic Data Reduction and Data Mining Framework is proposed. Initial research with sample data from South Australia Police Electronic Crime Section and Digital Corpora Forensic Images using the proposed framework resulted in significant reduction in the storage requirements—the reduced subset is only 0.196 percent and 0.75 percent respectively of the original data volume. The framework outlined is not suggested to replace full analysis, but serves to provide a rapid triage, collection, intelligence analysis, review and storage methodology to support the various stages of digital forensic examinations. Agencies that can undertake rapid assessment of seized data can more effectively target specific criminal matters. The framework may also provide a greater potential intelligence gain from analysis of current and historical data in a timely manner, and the ability to undertake research of trends over time

The use of grain size distribution analysis of sediments and soils in forensic enquiry

The use of grain size distribution analysis in forensic enquiry was investigated with reference to four forensic case studies which contained the type of sample restraints and limitations often encountered in criminal case work. The problems of the comparison of trace and bulk samples are outlined and the need for multiple sample analysis is highlighted. It was found that the problems of soil analysis, particularly when the soil was recovered from anthropogenic sources, focused on the lack of identification of pre-, syn- and post-forensic event mixing of materials, thus obscuring the recognition of false-negative or false-positive exclusions between samples. It was found that grain size distribution analysis was a useful descriptive tool but it was concluded that if it were to be used in any other manner the derived results should be treated with great caution. The statistical analyses of these data did not improve the quality of the interpretation of the results

Recent advances in the application of stable isotope ratio analysis in forensic chemistry

This review paper updates the previous literature in relation to the continued and developing use of stable isotope ratio analysis in samples which are relevant to forensic science. Recent advances in the analysis of drug samples, explosive materials, and samples derived from human and animal samples are discussed. The paper also aims to put the use of isotope ratio mass spectrometry into a forensic context and discuss its evidential potential

The Interpersonal Style and Complementarity Between Crisis Negotiators and Forensic Inpatients

Previous negotiation research has explored the interaction and communication between crisis negotiators and perpetrators. A crisis negotiator attempts to resolve a critical incident through negotiation with an individual, or group of persons in crisis. The purpose of this study was to establish the interpersonal style of crisis negotiators and complementarity of the interpersonal interaction between them and forensic inpatients. Crisis negotiators, clinical workers and students (n = 90) used the Check List of Interpersonal Transactions-Revised (CLOIT-R) to identify interpersonal style, along with eight vignettes detailing interpersonal styles. Crisis negotiators were most likely to have a friendly interpersonal style compared to the other non-trained groups. Complementarity theory was not exclusively supported as submissive individuals did not show optimistic judgments in working with dominant forensic inpatients and vice versa. Exploratory analysis revealed that dominant crisis negotiators were optimistic in working with forensic inpatients with a dominant interpersonal style. This study provides insight into the area of interpersonal complementarity of crisis negotiators and forensic inpatients. Whilst further research is required, a potential new finding was established, with significant ‘similarity’ found when dominant crisis negotiators are asked to work with dominant forensic inpatients