Geochemistry plays a vital role in our understanding mechanisms behind major geological systems such as the Earth's crust and its oceans (Albarède, F. 2003). More recently, geo-chemistry has played a vital role in the field of forensic investigation and in period dating. Forensic soil samples have been traditionally analysed via examinations of colour, texture and mineral content by physical or chemical methods. However, these methods leave any organic or water-soluble fractions unexamined. Tephrochronology (the dating of sedimentary sequences using volcanic ash layers) is an important tool for the dating and correlation of sedimentary sequences containing archives and proxies of past environmental change. Its importance in this area has increased since the increased free carbon in out atmosphere has made radio-carbon dating unreliable. Tephrochronology requires successful geo-chemical identification of the tephras, a method reliant on electron probe micro-analysis (EPMA) to analyse major element composition. However, it is often impossible to differentiate key tephra layers using EPMA alone. Raman spectroscopy is commonly used in chemistry, since vibrational information is specific to the chemical bonds and symmetry of molecules, and can provide a fingerprint by which these can be identified. Here, we demonstrate how Raman spectroscopy can be used for the successful discrimination of mineral species in tephra through the analysis of individual glass shards. We further demonstrate how, with the use of oxidative preparation methods, Raman spectroscopy can be used to successfully discriminate between soil types using mineralogy as well as the organic and water-soluble fractions of soils.

This dissertation focuses on the classification of one-dimensional and two-dimensional signals. The one-dimensional signal classification problem involves the classification of brain signals for identifying the emotional responses of human subjects under given drug conditions. A strategy is developed to accurately classify ERPs in order to identify human emotions based on brain reactivity to emotional, neutral, and cigarette-related stimuli in smokers. A multichannel spatio-temporal model is employed to overcome the curse of dimensionality that plagues the design of parametric multivariate classifiers for multi-channel ERPs. The strategy is tested on the ERPs of 156 smokers who participated in a smoking cessation program. One half of the subjects were given nicotine patches and the other half were given placebo patches. ERPs were collected from 29 channel in response to the presentation of the pictures with emotional (pleasant and unpleasant), neutral/boring, and cigarette-related content. It is shown that human emotions can be classified accurately and the results also show that smoking cessation causes a drop in the classification accuracies of emotions in the placebo group, but not in the nicotine patch group. Given that individual brain patterns were compared with group average brain patterns, the findings support the view that individuals tend to have similar brain reactions to different types of emotional stimuli. Overall, this new classification approach to identify differential brain responses to different emotional types could lead to new knowledge concerning brain mechanisms associated with emotions common to most or all people. This novel classification technique for identifying emotions in the present study suggests that smoking cessation without nicotine replacement results in poorer differentiation of brain responses to different emotional stimuli. Future, directions in this area would be to use these methods to assess individual differences in responses to emotional stimuli and to different drug treatments. Advantages of this and other brain-based assessment include temporal precision (e.g, 400-800 ms post stimulus), and the elimination of biases related to self-report measures. The two-dimensional signal classification problems include the detection of graphite in testing documents and the detection of fraudulent bubbles in test sheets. A strategy is developed to detect graphite responses in optical mark recognition (OMR) documents using inexpensive visible light scanners. The main challenge in the formulation of the strategy is that the detection should be invariant to the numerous background colors and artwork in typical optical mark recognition documents. A test document is modeled as a superposition of a graphite response image and a background image. The background image in turn is modeled as superposition of screening artwork, lines, and machine text components. A sequence of image processing operations and a pattern recognition algorithm are developed to estimate the graphite response image from a test document by systematically removing the components of the background image. The proposed strategy is tested on a wide range of scanned documents and it is shown that the estimated graphite response images are visually similar to those scanned by very expensive infra-red scanners currently employed for optical mark recognition. The robustness of the detection strategy is also demonstrated by testing a large number of simulated test documents. A procedure is also developed to autonomously determine if cheating has occurred by detecting the presence of aberrant responses in scanned OMR test books. The challenges introduced by the significant imbalance in the numbers of typical and aberrant bubbles were identified. The aberrant bubble detection problem is formulated as an outlier detection problem. A feature based outlier detection procedure in conjunction with a one-class SVM classifier is developed. A multi-criteria rank-of-rank-sum technique is introduced to rank and select a subset of features from a pool of candidate features. Using the data set of 11 individuals, it is shown that a detection accuracy of over 90% is possible. Experiments conducted on three real test books flagged for suspected cheating showed that the proposed strategy has the potential to be deployed in practice.

Day by day, more and more people are using internet all over the world. It is becoming apart of everyone’s life. People are checking their e-mails, surfing over internet, purchasinggoods, playing online games, paying bills on the internet etc. However, while performingall these things, how many people know about security? Do they know the risk of beingattacked, infecting by malicious software? Even some of the malicious software arespreading over network to create more threats by users. How many users are aware of thattheir computer may be used as zombie computers to target other victim systems? Astechnology is growing rapidly, newer attacks are appearing. Security is a key point to getover all these problems. In this thesis, we will make a real life scenario, using honeypots.Honeypot is a well designed system that attracts hackers into it. By luring the hackerinto the system, it is possible to monitor the processes that are started and running on thesystem by hacker. In other words, honeypot is a trap machine which looks like a realsystem in order to attract the attacker. The aim of the honeypot is analyzing, understanding,watching and tracking hacker’s behaviours in order to create more secure systems.Honeypot is great way to improve network security administrators’ knowledge and learnhow to get information from a victim system using forensic tools. Honeypot is also veryuseful for future threats to keep track of new technology attacks.

AbstractAbstractAbstractAbstract This diploma thesis aims to contribute to the field of speaker recognition in the domain of temporal changes in the speech signal. After a brief introduction into forensic phonetics, it gives an outline of approaches and factors which help or hinder successful recognition. The focus is then shifted to the temporal structure of speech and approaches to its analysis currently in use. The practical section of this thesis consists of an experiment designed to assess the contribution of certain temporal measures to speaker recognition. The variables used here are %V (the proportion of vocalic intervals within a sentence), ΔV and ΔC (the standard deviation of the duration of vocalic/consonantal intervals within a sentence), VarcoV and VarcoC (the previous variables normalised for average interval duration) and the Pairwise Variability Indices, both vocalic and consonantal, raw and normalised. Beside these, another variable is used to capture the local articulation rate and especially final deceleration in the utterances - LAR (the inverse of the distance between successive midpoints of the vocalic intervals). Whereas the first mentioned variables are not very successful in distinguishing the speakers, LAR seems very well suited for capturing speaker idiosyncrasies, although...

The increasing usage of databases in the storage of critical and sensitive information in many organizations has led to an increase in the rate at which databases are exploited in computer crimes. Databases are often manipulated to facilitate crimes and as such are usually of interest during many investigations as useful information relevant to the investigation can be found therein. A branch of digital forensics that deals with the identification, preservation, analysis and presentation of digital evidence from databases is known as database forensics. Despite the large amount of information that can be retrieved from databases and the amount of research that has been done on various aspects of databases, database security and digital forensics in general, very little has been done on database forensics. Databases have also been excluded from traditional digital investigations until very recently. This can be attributed to the inherent complexities of databases and the lack of knowledge on how the information contained in the database can be retrieved, especially in cases where such information have been modified or existed in the past. This thesis addresses one major part of the challenges in database forensics, which is the reconstruction of the information stored in the database at some earlier time. The dimensions involved in a database forensics analysis problem are identified and the thesis focuses on one of these dimensions. Concepts such as the relational algebra log and the inverse relational algebra are introduced as tools in the definition of a theoretical framework that can be used for database forensics. The thesis provides an algorithm for database reconstruction and outlines the correctness proof of the algorithm. Various techniques for a complete regeneration of deleted or lost data during a database forensics analysis are also described. Due to the importance of having adequate logs in order to use the algorithm, specifications of an ideal log configuration for an effective reconstruction process are given, putting into consideration the various dimensions of the database forensics problem space. Throughout the thesis, practical situations that illustrate the application of the algorithms and techniques described are given. The thesis provides a scientific approach that can be used for handling database forensics analysis practice and research, particularly in the aspect of reconstructing the data in a database. It also adds to the field of digital forensics by providing insights into the field of database forensics reconstruction. / Thesis (PhD)--University of Pretoria, 2015. / Computer Science / PhD / Unrestricted

In this thesis, we did a forensic analysis of a Nintendo Switch gaming console. It is both a portable and a stationary device, which makes it so that it could contain valuable information about the usage of the console at home and elsewhere. Multiple methods of data extraction were used, including using an exploit to obtain storage memory, extracting the contents of the SD card and capturing network traffic. The findings from the analysis of these data sources were compared to the information on the user interface. Any information that could not be found on the user interface was reported. The main findings of memory analysis were a detailed log file of user interactions, JSON files with personal information such as email addresses, and crash logs with information about the state of the console during the crash. The SD card mainly contains screenshots with embedded timestamps, and the network capture does not contain any forensically relevant information. The combination of these different types of information could makethe Nintendo Switch a useful source of evidence during an investigation.

This thesis focuses on forensic analysis of network connection in operating systems based on Linux kernel. The paper is divided into chapters that describe principles of digital forensics, packet processing inside Linux kernel and compare forensic software tools. This knowledge is then applied in design of application for network connection forensics in Linux. Designed application is implemented and used in practical process of digital forensic analysis. In conclusion possible extensions are proposed.

This term project deals with digital forensic analysis of web browsers. The first chapters describe the process of forensic analysis, methodologies and procedures used, and also the issues of analysis of web browsers. In particular, the types of information browser stores and security problems that comes with that. Theoretical and practical procedure for obtaining data from Mozilla Firefox web browser was based on the theoretical foundations described in previous chapters. Common linux tools and application created as part of this thesis are used in process of collecting digital evidence. Digital forensic analysis of web broewser was performed based on suggested procedure.

The thesis is focused on digital forensic analysis in operating system Windows. The purpose of this thesis is to provide a preview to the techniques and procedures forensics analysis. There are disclosed available software tools used during forensic analysis. The part of this thesis is also practical process of forensic analysis and developing forensic report

In this thesis we introduces the user interface design and forensic analysis tool for DIORAMA system. With an Android device, DIORAMA provides emergency personnel the ability to collect information in real time, track the resources and manage them. It allows the responders and commanders to mange multiple incidents simultaneously. This thesis also describes the implementations of commander app and responder app, as well as two different communication strategies used in DIORAMA. Several trials and simulated mass casualty incidents were conducted to test the functionalities and performance of DIORAMA system. All responders that participated in all trials were very satisfied with it. As a result, DIORAMA system significantly reduced the evacuation time by up to 43% when compared to paper based triage systems.