Computer Geolocation Using Extracted Features

This paper compares the extracted feature data from a sample set of hard drive images in an effort to relate the features to the physical location of the drive. A list of probable zip codes, phone numbers, place names, and IP addresses are extracted from raw drive images and compared to manually identified geolocation data. The results of the individual extractions are then analyzed to determine the feasibility in using automated extraction and analysis techniques for geolocating hard drives. Keywords: hard disk forensics, geocoding, geolocatio

Technical Soddi Defenses: The Trojan Horse Defense Revisited

In 2004, the Trojan horse defense was at a crossroads, having been successfully employed in two child pornography cases in the United Kingdom, resulting in acquittals. Despite the early successes, the Trojan horse defense has failed to become a regularly employed strategy. The original Trojan horse defense has now become part of the more general technical SODDI (Some Other Dude Did It) defense, which includes the possibility of unknown actors using unsecured Wi-Fi connections or having physical access to a computer to perform criminal acts. In the past ten years, it has not been effective in the United States for criminal cases, with no published acquittals in cases where it was the primary defense. Where the technical SODDI defense has been successfully used as leverage in plea negotiations, there has been either poor forensics performed by the prosecution or political pressure to resolve a matter. On the civil side, however, the defense has been wildly successful, effectively shutting down large John Doe copyright infringement litigation against non-commercial violators

Idiographic Digital Profiling: Behavioral Analysis Based On Digital Forensics

Idiographic digital profiling (IDP) is the application of behavioral analysis to the field of digital forensics. Previous work in this field takes a nomothetic approach to behavioral analysis by attempting to understand the aggregate behaviors of cybercriminals. This work is the first to take an idiographic approach by examining a particular subject\u27s digital footprints for immediate use in an ongoing investigation. IDP provides a framework for investigators to analyze digital behavioral evidence for the purposes of case planning, subject identification, lead generation, obtaining and executing warrants, and prosecuting offenders

Technical behaviours of child sexual exploitation material offenders

An exploration of the technological behaviours of previously convicted child sexual exploitation material (CSEM) offenders provides a foundation for future applied research into deterrence, investigation, and treatment efforts. This study evaluates the technology choices and transitions of individuals previously convicted of CSEM offenses. Based on their inclusion in two sex offender registries, anonymous survey results (n=78) were collected from English-speaking adults within the United States. CSEM offenders chose technologies based on both utility and perceived risk; peer-to-peer and web-browsers were the most common gateway technologies and showed substantial sustained usage; a substantial minority of users never stored CSEM and only viewed it; most respondents used more than one technology to view CSEM; CSEM offenders used more countermeasures than the public but did not use encryption at higher rates; almost all CSEM consumers started viewing adult SEM first; and countermeasures were used primarily to reduce psychological strain (anxiety)

TECHNICAL BEHAVIOURS OF CHILD SEXUAL EXPLOITATION MATERIAL OFFENDERS

An exploration of the technological behaviours of previously convicted child sexual exploitation material (CSEM) offenders provides a foundation for future applied research into deterrence, investigation, and treatment efforts. This study evaluates the technology choices and transitions of individuals previously convicted of CSEM offenses. Based on their inclusion in two sex offender registries, anonymous survey results (n=78) were collected from English-speaking adults within the United States. CSEM offenders chose technologies based on both utility and perceived risk; peer-to-peer and web-browsers were the most common gateway technologies and showed substantial sustained usage; a substantial minority of users never stored CSEM and only viewed it; most respondents used more than one technology to view CSEM; CSEM offenders used more countermeasures than the public but did not use encryption at higher rates; almost all CSEM consumers started viewing adult SEM first; and countermeasures were used primarily to reduce psychological strain (anxiety)

Public perceptions of child pornography and child pornography consumers

Understanding the public’s perceptions of child pornography helps identify gaps in awareness and knowledge, impacts legislative decision making, quantifies stigmatization, and provides a baseline for identifying differences between lay and offender populations for clinical purposes. This research provides a comprehensive public survey assessing these issues. An Internet-based sample of 524 adults (mean age = 47 years, 51% female) within the USA were asked about their understanding and beliefs related to child pornography and individuals who view child pornography. The questions covered three topic areas—general perceptions of child pornography, endorsement of child pornography beliefs, and opinions related to the legality of various forms of child pornography as well as the decision making related to sentencing and sex offender registration for child pornography consumers. The research found that the public viewed these offenses as more severe than most other crimes and that there was an overestimation by the public of risks related to recidivism and contact offending. Additionally, the research found that there was support for most of the current sentencing guidelines in the USA, including sex offender registration, and that there was limited support for treatment over incarceration