Transformations for compositional data with zeros with an application to forensic evidence evaluation

In forensic science likelihood ratios provide a natural way of computing the value of evidence under competing propositions such as "the compared samples have originated from the same object" (prosecution) and "the compared samples have originated from different objects" (defence). We use a two-level multivariate likelihood ratio model for comparison of forensic glass evidence in the form of elemental composition data under three data transformations: the logratio transformation, a complementary log-log type transformation and a hyperspherical transformation. The performances of the three transformations in the evaluation of evidence are assessed in simulation experiments through use of the proportions of false negatives and false positives

The Potential for cross-drive analysis using automated digital forensic timelines

Cross-Drive Analysis (CDA) is a technique designed to allow an investigator to “simultaneously consider information from across a corpus of many data sources”. Existing approaches include multi-drive correlation using text searching, e.g. email addresses, message IDs, credit card numbers or social security numbers. Such techniques have the potential to identify drives of interest from a large set, provide additional information about events that occurred on a single disk, and potentially determine social network membership. Another analysis technique that has significantly advanced in recent years is the use of timelines. Tools currently exist that can extract dates and times from the file system metadata (i.e. MACE times) and also examine the content of certain file types and extract metadata from within. This approach provides a great deal of data that can assist with an investigation, but also compounds the problem of having too much data to examine. A recent paper adds an additional timeline analysis capability, by automatically producing a high-level summary of the activity on a computer system, by combining sets of low-level events into high-level events, for example reducing a setupapi event and several events from the Windows Registry to a single event of ‘a USB stick was connected’. This paper provides an investigation into the extent to which events in such a high-level timeline have the properties suitable to assist with Cross-Drive Analysis. The paper provides several examples that use timelines generated from multiple disk images, including USB stick connections, Skype calls, and access to files on a memory card

Juror comprehension and the hard case - Making forensic evidence simpler

The complexity/comprehension nexus as it impacts on juror decision-making is addressed in the particular context of prosecution-led DNA evidence. Such evidence is for jurors the subject of pre-trial preconceptions, and is notoriously difficult to present and argue before a jury. The article looks at the comprehension of forensic evidence by jurors, a task qualified by the opinion of legal professionals whose responsibility it is to present and interpret such evidence in adversarial contexts. Jurors were surveyed post-verdict in trials where forensic evidence featured in circumstantial cases. These insights into comprehension were qualified by contesting views of legal professionals, and critical reflections from independent observation teams regarding the manner in which this evidence was used and its intended impact on the jury. What results is both declared and implicit indicators of comprehension, not so much against broad measures of complexity [Findlay, 2001. Juror comprehension and complexity: strategies to enhance understanding. British Journal of Criminology 41/1, 56.], but rather the particular place of popularly endowed forensic evidence within the circumstantial case. The article explores the utility of a multi-methodological study of comprehension from the perspectives of the proponents, commentators, recipients and observers of the adversarial contest. To this is employed a interactive analysis of important decision-sites and relationships of influence in the trial as they may impact on comprehension and be measured as ‘complex’

An Improved Statistic for the Pooled Triangle Test against PRNU-Copy Attack

We propose a new statistic to improve the pooled version of the triangle test used to combat the fingerprint-copy counter-forensic attack against PRNU-based camera identification [1]. As opposed to the original version of the test, the new statistic exploits the one-tail nature of the test, weighting differently positive and negative deviations from the expected value of the correlation between the image under analysis and the candidate images, i.e., those image suspected to have been used during the attack. The experimental results confirm the superior performance of the new test, especially when the conditions of the test are challenging ones, that is when the number of images used for the fingerprint-copy attack is large and the size of the image under test is small.Comment: submitted to IEEE Signal Processing Letter