This research paper discusses the role of virtual environments in digital forensic investigations. With virtual environments becoming more prevalent as an analysis tool in digital forensic investigations, it’s becoming more important for digital forensic investigators to understand the limitation and strengths of virtual machines. The study aims to expose limitations within commercial closed source virtual machines and open source virtual machines. The study provides a brief overview of history digital forensic investigations and virtual environments, and concludes with an experiment with four common open and closed source virtual machines; the effects of the virtual machines on the host machine as well as the performance of the virtual machine itself. My findings discovered that while the open source tools provided more control and freedom to the operator, the closed source tools were more stable and consistent in their operation. The significance of these findings can be further researched by applying them in the context of exemplifying reliability of forensic techniques when presented as analysis tool used in litigation.

Biological material (fluids or tissues) whether from the victim or suspect is often collected as forensic evidence, and methods to obtain and analyze the DNA found in that material have been well established. The type of body fluid (i.e. blood, saliva, semen, vaginal secretions, and menstrual blood) from which the DNA originated is also of interest, and messenger RNA typing provides a specific and sensitive means of body fluid identification. In order for mRNA profiling to be utilized in routine forensic casework, RNA of sufficient quantity and quality must be obtained from biological fluid stains and the methods used for RNA analysis must be fully compatible with current DNA analysis methodologies. Several DNA/RNA co-extraction methods were evaluated based on the quantity and quality of DNA and RNA recovered and were also compared to standard non-co-extraction methods. The two most promising methods, the in-house developed NCFS co-extraction and the commercially available AllPrep DNA/RNA Mini kit, were then optimized by improving nucleic acid recovery and consistency of CE (capillary electrophoresis) detection results. The sensitivity of the two methods was also evaluated, and DNA and RNA profiles could be obtained for the lowest amount of blood (0.2 µL) and saliva and semen (1 µL) tested. Both extraction methods were found to be acceptable for use with forensic samples, and the ability to obtain full DNA profiles was not hindered by the co-extraction of RNA. It is generally believed that RNA is less stable than DNA which may prevent its use in forensic casework. However, the degradation rates of DNA and RNA in the same biological fluid stain have not been directly compared. To determine the relative stability of DNA and RNA, the optimized NCFS co-extraction protocol was used to isolate DNA and RNA from iv environmentally compromised stains. Dried blood, saliva, and semen stains and vaginal secretions swabs were incubated at set temperatures and outside for up to 1 year. Even at 56°C, DNA and RNA were both stable out to 1 year in the blood and semen stains, out to 3 months (DNA) and 1 year (RNA) in the saliva stains, and out to 6 months (DNA) and 3 months (RNA) in the vaginal secretions swabs. The recoverability of both nucleic acids was reduced when the samples were exposed to increased humidity, sunlight, and rain. In general, DNA and RNA stability was found to be similar with a loss in ability to obtain a DNA or RNA profile occurring at the same time point; however, there were instances where RNA body fluid markers were detected when a poor/no DNA profile was obtained, indicating that RNA in dried stains is sufficiently stable for mRNA body fluid typing to be used in forensic casework.

In order to protect the safety of our citizens and to ensure a civil society, we ask our law enforcement, judiciary and intelligence agencies, under the rule of law, to seek probative information which can be acted upon for the common good. This information may be used in court to prosecute criminals or it can be used to conduct offensive or defensive operations to protect our national security. As the citizens of the world store more and more information in digital form, and as they live an ever-greater portion of their lives online, law enforcement, the judiciary and the Intelligence Community will continue to struggle with finding, extracting and understanding the data stored on computers. But this trend affords greater opportunity for law enforcement. This dissertation describes how several disparate approaches: knowledge management, content analysis, narratology, and natural language processing, can be combined in an interdisciplinary way to positively impact the growing difficulty of developing useful, actionable intelligence from the ever-increasing corpus of digital evidence. After exploring how these techniques might apply to the digital forensic process, I will suggest two new theoretical constructs, the Hermeneutic Theory of Digital Forensics and the Narrative Theory of Digital Forensics, linking existing theories of forensic science, knowledge management, content analysis, narratology, and natural language processing together in order to identify and extract narratives from digital evidence. An experimental approach will be described and prototyped. The results of these experiments demonstrate the potential of natural language processing techniques to digital forensics.

Research was conducted on thirteen 100% cotton denim samples using an acid wash, established by Murray, to extract oligosaccharides from the cellulosic material. The oligosaccharide ion groups (+, +, and +) for molecules with degrees of polymerization between two and seven (DP2-DP7) were analyzed using liquid chromatography coupled to mass spectrometry with an electrospray ionization interface (LC-ESI-MS). The results were compared using the least-squares means in a Multivariate ANOVA (MANOVA) test followed by Univariate ANOVA and Tukey HSD tests and demonstrated that the method could correctly determine that two samples were statistically different 85.9% of the time when analyzing the amount (ng) of each of the oligosaccharide ion groups separately, and 82.0% when analyzing the total moles of monosaccharide units released. A dye extraction was performed on the denim materials and the extract analyzed using gas chromatography coupled with mass spectrometry (GC-MS). Indigo dye was present in all of the denim samples except one. When these results were combined with the two oligosaccharide statistical analyses, the discriminating power was increased to 88.5% and 85.9%, respectively. Additional cellulosic materials were also investigated including four white 100% cotton t-shirts as well as five raw cotton samples grown in Tajikistan, Uzbekistan, Egypt, Iran, and Benin West Africa. The analytical methodology gave results for the white cotton t-shirts and raw cotton samples that were inconsistent with those obtained from the denim samples.

The analysis of 110 automotive paint samples was conducted for the research presented here. Laser-induced breakdown spectroscopy (LIBS) was the central instrument utilized for analysis although scanning electron microscopy / energy dispersive x-ray spectroscopy (SEM/EDS) and Fourier transform infrared spectroscopy - attenuated total reflection (FTIR-ATR) analyses were also performed. Two separate methods of LIBS analysis of samples were used: a cross sectional analysis and a drill down analysis. SEM/EDS analysis focused on the cross section while FTIR-ATR analysis concentrated on the clearcoat layer. Several different data/statistical analyses were evaluated including principal components analysis (PCA), two tailed t-tests based on several different metrics (Hit Quality Index (HQI), Pearson's correlation and Sorenson index), multivariate analysis of variance and receiver operating characteristic (ROC) curves. Full spectrum data analysis from LIBS spectra resulted in 99.7% discrimination between different sample comparisons and 12% between same sample comparisons based on HQI and t-tests. Peak analysis of LIBS spectra resulted in 87.5% discrimination between different sample comparisons and 5% between same sample comparisons based on MANOVA. When combining the results of the FTIR-ATR and SEM/EDS analyses, 88% of the samples could be discriminated.

There is a transition nationwide on the analysis of forensic evidentiary stains containing biological material from traditional serology to Polymerase Chain Reaction (PCR) methodologies. The increased sensitivity of PCR, the limited number of alleles at each locus, and the necessity of producing unambiguous data for entry into the FBI's Combined DNA Index System make this study of extraction procedures of utmost importance. A "single tube" extraction procedure for blood stains collected onto FTA™ paper and a modified differential nonorganic extraction method from spermatozoa containing mixed stains were analyzed and compared. The extraction success was evaluated by amplification and typing of the amplified fragment length polymorphism, D1S80. These modifications of the nonorganic method utilized gave an improved separation of the spermatozoa-containing mixed stains.

Condoms have been used in sexual assaults as a means of preventing the transmission of biological fluids. Current sexual assault evidence collection kit processing protocols do not regularly take advantage of the information that can be gathered by examining residues left by condoms during intercourse. A biphasic liquid-liquid extraction technique was developed to separate polar and non-polar condom residues, which had been collected on cotton tipped swabs. This research involved the examination of twenty condom brands by Diffuse Reflectance Infrared Fourier Transform Spectroscopy. Five brands were selected to examine the consistency of this technique when the lubricants were exposed to body and storage temperature conditions for various times and in the presence of oral, vaginal, and blood samples. Additionally, starches collected from the condoms under each of the above conditions were examined. Although all lubricants were identifiable using this IR technique, the nonoxynol-9 (spermicide) containing samples produced spectra which were not identical to those produced by nonoxynol-9 standards. Although there was a decrease in the percent transmittance within IR spectra as the time between the collection and the extraction of the swabs increased, the condom residues of interest remained identifiable at all time points examined. The use of vaginal and oral swabs in the collection caused a negligible amount of background interference, which could be eliminated through spectral subtraction of the swab.

It is not uncommon for criminals to start a fire at a crime scene to conceal evidence of the initial crime. The rationale for this can be attributed to the belief that a fire will destroy all physical evidence. It has been shown in previous research that physical evidence in the form of ignitable liquid residues, fingerprints and even DNA (deoxyribonucleic acid) evidence can still be recovered from the scene of a fire. However, testing of fire debris evidence for multiple forms of evidence has no universally accepted protocol or order of testing. The purpose of this study is two-fold. DNA recovered from simulated fire debris evidence exposed to various ignitable liquids and burn conditions was compared to determine under what scene conditions it could be feasible to recover DNA evidence and generate usable profiles. Additionally, DNA recovered from samples subjected to different time and temperature conditions of heated passive headspace concentration (HPHC) were compared to determine if it was advisable to perform HPHC in an attempt to recover volatile ignitable liquid evidence prior to testing for DNA. The HPHC overall had no significant effect on the degradation or recovered quantities of DNA, and, under the conditions tested, this would not preclude testing for ignitable liquids prior to testing for DNA. The presence of ignitable liquids did not affect the ability to recover DNA or result in degraded DNA, while burning samples prevented DNA from being recovered in all but a few samples, primarily semen samples.

In Belgium, approximately 75 homicides a year go unnoticed. In addition it is estimated that 5 - 10% of the so-called natural deaths are not natural at all. This amounts to 5,000 – 10,000 deaths a year with an incorrect cause of death. Both Belgium – composed of three regions, three communities, and ten provinces – and the United States of America – divided into 50 states – are overseen by a Federal Government, and their police system consist of multiple law enforcement agencies. When looking from a distance, more similarities than differences are seen for the organization of law enforcement agencies. However, differences become apparent when analyzing the responsibilities of the different agencies during crime scene processing and evidence collection. Seen the scope of the forensic science program, the focus will more specifically be on the process, procedures, and actors involved. The goal of this thesis is to (a) analyze the Belgian and U.S. crime scene investigation system, (b) compare the two systems to one another, (c) discuss the weaknesses and strengths behind each system, and finally (d) come up with recommendations. Existing issues will also be evaluated and their impact will be discussed. To achieve the above mentioned goals, information was obtained through literature review and interviews with experts. During the interviews information (e.g. books), not available to the general public, was obtained. Crime scene investigation, for both the U.S. and Belgian system, can be divided into 5 different steps: the initial notification, the first response team, the investigation of the crime scene (documenting, collecting, and processing evidence), the analysis of collected evidence, and the autopsy. In both systems, first responders and emergency medical services will be the first actors present at the scene. Although most procedures and actors involved in the investigation of a crime scene are similar between the United States of America and Belgium, some differences cannot be overlooked. These differences are: the person in charge of completing the death certificate, determining whether or not jurisdiction is accepted, the educational background and composition of the crime scene team, the investigation of the deceased, the requirements needed to become a forensic pathologist, and the cases in which an autopsy is systematically performed. Comparing both crime scene investigation systems showed that each system has its own strengths, weaknesses, and issues. The comparison also showed that both systems can learn from one another, since the combination of already existing processes and procedures, from both crime scene investigation systems, was used to create an “ideal” crime scene investigation system.

The typical differential extraction procedure utilized by the forensic science community to extract male deoxyribonucleic acid (DNA) from the sperm cells of the perpetrator separately from female DNA from the epithelial cells of the victim is both time-consuming and labor-intensive. This has contributed greatly to the backlog of unanalyzed sexual assault evidence collection kits (SAECK) seen in many laboratories today and has encouraged research in new methods that are more efficient and more effective in achieving better sperm DNA recovery. The Cotton Lab has developed a Temperature-Controlled Differential Extraction (TCDE) procedure geared towards attaining better sperm recovery and better distribution of male DNA in the sperm fraction (SF) to generate a single source or distinguishable male profile. The TCDE protocol is a direct-lysis procedure that utilizes highly temperature-controlled enzymes, or enzymes that are active at or near their optimal temperatures. This procedure has been previously shown to decrease extraction time significantly and to extract samples that are suitable for downstream analysis. This research specifically attempted to modify the TCDE procedure in the hopes of obtaining higher sperm DNA recovery and eliminating previous concerns of too much sperm being retained by the cotton swab material. It also compared a slightly modified TCDE procedure where the material fraction (MF) and SF are kept as separate fractions (the Separate Method) and a method that results in a recombined MF and SF (Recombined Method) to see if there was a greater distribution of the total male DNA eluted into the SF. Preliminary experimentation with swabs prepared with semen was performed to help make effective modifications. Then, vaginal swabs from eight different female donors were prepared with semen to mimic forensic casework samples and extracted using the Separate and Recombined Methods for comparison of the two extraction methods. Despite unusual epithelial cell lysis results for some samples, the quantitation of the fractions by quantitative polymerase chain reaction (qPCR) showed that for approximately half of the samples extracted using the Separate Method, a majority of total male DNA was eluted into the SF. For these samples, a single source or distinguishable male profile can be generated. However, it was also demonstrated that even with good separation, a very small proportion of the female DNA in the SF still overwhelms the male DNA that is present in much smaller amounts, particularly for the Recombined Method where there are only two fractions. Though further experimentation is necessary, these modifications proved effective in achieving high sperm recovery in the SF and generating a distinguishable male profile when extracting samples using the Separate Method. This research has confirmed that the TCDE procedure can be faster and less labor intensive while still producing clean DNA profiles in downstream analysis, and thus has the potential to be implemented in forensic laboratories after some of the concerns are addressed.