Yes / American celebrity aviator Amelia Earhart was lost over the Pacific Ocean during her press-making 1937 round-the-world flight. The iconic woman pilot remains a media interest nearly 80 years after her disappearance, with perennial claims of finds pinpointing her location. Though no sign of the celebrity pilot or her plane have been definitively identified, possible skeletal remains have been attributed to Earhart. The partial skeleton was recovered and investigated by British officials in 1940. Their investigation concluded that the remains were those of a stocky, middle-aged male. A private historic group re-evaluated the British analysis in 1998 as part of research to establish Gardner (Nikumaroro) Island as the crash site. The 1998 report discredited the British conclusions and used cranial analysis software (FORDISC) results to suggest that the skeleton was potentially a Northern European woman, and consistent with Amelia Earhart. A critical review of both investigations and contextual evidence shows that the original British osteological analyses were made by experienced, reliable professionals, while the cranial analysis is unreliable given the available data. Without access to the missing original bones, it is impossible to be definitive, but on balance, the most robust scientific analysis and conclusions are those of the original British finding indicating that the Nikumaroro bones belonged to a robust, middle-aged man, not Amelia Earhart.

Geochemistry plays a vital role in our understanding mechanisms behind major geological systems such as the Earth's crust and its oceans (Albarède, F. 2003). More recently, geo-chemistry has played a vital role in the field of forensic investigation and in period dating. Forensic soil samples have been traditionally analysed via examinations of colour, texture and mineral content by physical or chemical methods. However, these methods leave any organic or water-soluble fractions unexamined. Tephrochronology (the dating of sedimentary sequences using volcanic ash layers) is an important tool for the dating and correlation of sedimentary sequences containing archives and proxies of past environmental change. Its importance in this area has increased since the increased free carbon in out atmosphere has made radio-carbon dating unreliable. Tephrochronology requires successful geo-chemical identification of the tephras, a method reliant on electron probe micro-analysis (EPMA) to analyse major element composition. However, it is often impossible to differentiate key tephra layers using EPMA alone. Raman spectroscopy is commonly used in chemistry, since vibrational information is specific to the chemical bonds and symmetry of molecules, and can provide a fingerprint by which these can be identified. Here, we demonstrate how Raman spectroscopy can be used for the successful discrimination of mineral species in tephra through the analysis of individual glass shards. We further demonstrate how, with the use of oxidative preparation methods, Raman spectroscopy can be used to successfully discriminate between soil types using mineralogy as well as the organic and water-soluble fractions of soils.

Made available in DSpace on 2014-12-17T15:42:13Z (GMT). No. of bitstreams: 1 LeomirASL_DISSERT.pdf: 2074968 bytes, checksum: 7f7bd033e89dd46efc6c92957584d5b9 (MD5) Previous issue date: 2013-07-23 / Coordena??o de Aperfei?oamento de Pessoal de N?vel Superior / This paper investigates the potential of near infrared spectroscopy (NIR) for forensic analysis of human hair samples in order to differentiate smokers from nonsmokers, using chemometric modeling as an analytical tool. We obtained a total of 19 hair samples, 9 smokers and 10 nonsmokers varying gender, hair color, age and duration of smoking, all collected directly from the head of the same great Natal-RN. From the NIR spectra obtained without any pretreatment of the samples was performed an exploratory multivariate chemical data by applying spectral pretreatments followed by principal component analysis (PCA). After chemometric modeling of the data was achieved without any experimental data beyond the NIR spectra, differentiate smokers from nonsmokers, by demonstrating the significant influence of tabacco on the chemical composition of hair as well as the potential of the methodology in forensic identification / Nesse trabalho investiga-se a potencialidade da espectroscopia no infravermelho pr?ximo (NIR) para an?lise forense de cabelo humano, a fim de diferenciar amostras fumantes de n?o fumantes, utilizando-se a modelagem quimiom?trica como ferramenta anal?tica. Foram obtidos um total de 19 amostras de cabelo, sendo 9 de indiv?duos fumantes e 10 de n?o fumantes variando sexo, cor do cabelo, idade e tempo de consumo de tabaco, todos coletados diretamente da cabe?a dos mesmos na grande Natal-RN. A partir dos espectros NIR, obtidos sem nenhum tratamento pr?vio das amostras, foi realizado um estudo explorat?rio dos dados qu?micos multivariados aplicando-se pr?-tratamentos espectrais seguido da an?lise dos componentes principais (PCA). Ap?s modelagem quimiom?trica dos dados, conseguiu-se, sem qualquer outro dado experimental al?m dos espectros NIR, diferenciarem indiv?duos fumantes de n?o fumantes, demonstrando-se a influ?ncia significativa do tabaco na composi??o qu?mica do cabelo, bem como a potencialidade da metodologia na identifica??o forense

Robotic aerial vehicles (RAVs) have been increasingly deployed in various areas (e.g., commercial, military, scientific, and entertainment). However, RAVs’ security and safety issues could not only arise from either of the “cyber” domain (e.g., control software) and “physical” domain (e.g., vehicle control model) but also stem in their interplay. Unfortunately, existing work had focused mainly on either the “cyber-centric” or “control-centric” approaches. However, such a single-domain focus could overlook the security threats caused by the interplay between the cyber and physical domains. <br>In this thesis, we present cyber-physical analysis and hardening to secure RAV controllers. Through a combination of program analysis and vehicle control modeling, we first developed novel techniques to (1) connect both cyber and physical domains and then (2) analyze individual domains and their interplay. Specifically, we describe how to detect bugs after RAV accidents using provenance (Mayday), how to proactively find bugs using fuzzing (RVFuzzer), and how to patch vulnerable firmware using binary patching (DisPatch). As a result, we have found 91 new bugs in modern RAV control programs, and their developers confirmed 32 cases and patch 11 cases.

The growing popularity of instant messaging has led to the conception of several new applications over the span of the past decade. This has opened up an attack surface for cybercriminals to target susceptible app users. GroupMe is a free IM app widely used by students and so far, no comprehensive forensic analysis has been performed to aid forensic practitioners in recovering evidence from GroupMe on smartphones. This research performs a detailed analysis of the digital artifacts left by the app on Android and iOS devices. This was achieved by installing the app on two mobile phones (Samsung Galaxy S7 Edge and iPhone 6), and identifying each artifact created by performing a series of actions in the app ranging from sending texts, to sharing images and documents, along with their location. Using Cellebrite UFED and Magnet AXIOM, a significant number of artifacts were accurately recovered mainly from the “GroupMe.sqlite” and “GroupMe.sqlite-wal” databases. Out of the 335 artifacts populated on the iPhone, 317 were correctly recovered by both UFED and AXIOM, resulting in an accuracy of 94.62%. No GroupMe related artifacts could be recovered from the Android device. This was due to several physical imaging and rooting limitations imposed by the Samsung SM-935A model, which was used during the study.

This master's thesis describes methodologies used in malware forensic analysis including methods used in static and dynamic analysis. Based on those methods a tool intended to be used by Computer Security Incident Response Teams (CSIRT) is designed to allow fast analysis and decisions regarding malware samples in security incident investigations. The design of this tool is thorougly described in the work along with the tool's requirements on which the tool design is based on. Based on the design a ForensIRT tool is implemented and then used to analyze a malware sample Cridex to demonstrate its capabilities. Finally the analysis results are compared to those of other comparable available malware forensics tools.

This thesis focuses on the mining of cryptocurrency with emphasis on analysis of communication between miner and server. It describes basic principles of cryptocurrencies, mining and employed communication protocols. The next part of thesis is about design and implement modification of existing system (catalogue). This modification will add temporality to the catalog, what increase reliability of stored metadata. Description, functionality and purpose of existing system is included in the next text.

This thesis is focused on Bitcoin forensic analysis. Main goal of this thesis was to design and implement system tool for forensic analysis. Theoretical part of this thesis is dedicated to Bitcoin network. Requirements and existing tools are described in following chapters. Rest of the thesis is concerned about implementation of such a tool itself. Implemented system is presented as web application, which allows user to search through blockchain, vizualize financials, display profile pages of Bitcoin users and their Bitcoin wallets.

In Industrial Computer Systems, Programmable Logic Controllers (PLCs) are essential components since they control physical processes. Altering these could have enormous consequences as they can control processes in nuclear plants, gas pipelines and water supplies. Over the years, PLCs have become more and more connected since it facilitates their configuration and programming remotely. More connected does also means that they could be more vulnerable to attacks. Therefore, it would be desirable to be able to do a forensic investigation and interpret the artefacts if an incident happens, especially since PLCs control such vital functions. There exists little research about this area, but it does not discuss how to evaluate or interpret possible artefacts forensic investigation could reveal. This thesis aims to answer what artefacts are left in the system after two specific attacks. The result showed that some artefacts is left. One of the attacks does not leave so much specific artefacts that one could conclude how the attack happened, but for the other one, it was possible to conclude how they got remote access to the system. However, these artefacts were possible to cover up by deleting the IP address that was added in order to get remote access to the system. In other words, the only persistent artefacts left in the system after the attacks and cover-ups was metadata about created, modified, and removed files. Future work would be to expand and include more attacks to get a better overview of the overall forensic abilities of the PLC. / I industriella datorsystem är PLC (Programmable Logic Controllers) viktiga komponenter eftersom de styr fysiska processer. Att ändra dessa kan få enorma konsekvenser eftersom de kan styra processer i kärnkraftverk, gasledningar och vattenförsörjning. Under årens lopp har PLC:er blivit mer och mer uppkopplade eftersom det underlättar deras konfiguration och programmering på distans. Mer uppkopplade betyder också att de kan vara mer sårbara för attacker. Därför vore det önskvärt att kunna göra en kriminalteknisk undersökning och tolka bevisningen om en incident inträffar, särskilt eftersom PLC:er kontrollerar sådana vitala funktioner. Det finns lite forskning om detta område, men den diskuterar inte hur man ska utvärdera eller tolka eventuella bevis som den kriminalteknisk undersökningen kan avslöja. Denna avhandling syftar till att svara på vilka artefakter som finns kvar i systemet efter två specifika attacker. Resultatet visade att en del bevis finns kvar. En av attackerna lämnar inte så mycket specifika bevis att man kunde dra slutsatsen hur attacken gick till, men för den andra gick det att dra slutsatsen hur de fick fjärråtkomst till systemet. Dessa artefakter var dock möjliga att dölja genom att radera IP-adressen som lades till för att få fjärråtkomst till systemet. Med andra ord, det enda ihållande bevisningen som fanns kvar i systemet efter attackerna och mörkläggningarna var metadata om skapade, modifierade och borttagna filer. Framtida arbete skulle vara att expandera och inkludera fler attacker för att få en bättre överblick över PLC:s övergripande forensiska förmågor.

No description available.