Digital Forensic investigations play a vital role in our technologically enhanced world, and it may incorporate a number of different types of evidence — ranging from digital to physical. During a Digital Forensics investigation an investigator may formulate a number of hypotheses, and in order to reason objectively about them, an investigator must take into account such evidence in its entirety, relying on multiple sources. When formulating such objective reasoning an investigator must take into account not only inculpatory evidence but also exculpatory evidence and evidence of tampering. In addition, the investigator must factor in the reliability of the evidence used, the potential for error (tool and human based) and they must factor in the certainty with which they can make various claims. By doing so and creating a detailed audit trail of all actions performed by the investigator they can be better prepared against challenges against their work when it is presented. An investigator must also take into account the dynamic aspects of an investigation, such as certain evidence no longer being admissible, and they must continuously factor these aspects into their reasoning, to ensure that their conclusions still hold. Investigations may draw over a large period of time, and should the relevant information not be captured in detail, it may be lost or forgotten, affecting the reliability of an investigator’s findings and affecting future investigators’ capability to build on and continue an investigator’s work. In this dissertation we investigate whether it is possible to provide a formalised means for capturing and encoding an investigator’s reasoning process, in a detailed and structured manner. By this we mean we would like to capture and encode an investigator’s hypotheses, their arguments, their conclusions and the certainty with which they can make such claims, as well as the various pieces of evidence (digital and physical) that they use as a foundation for their arguments. We also want to capture the steps an investigator took when formulating these arguments and the steps an investigator took in order to get evidence into its intended form. The capturing of such a detailed reasoning process helps to allow for a more thorough reconstruction of an investigator’s finding, further improving the reliability that can be placed in them. By encoding the investigator’s reasoning process, an investigator can more easily receive feedback on the impacts that the various dynamic aspects of an investigation have upon their reasoning. In order to achieve these goals, our dissertation presents a model, called the Chain of Findings, allowing investigators to formulate and capture their reasoning process throughout the investigation, using a combination of goal-driven and data-driven approaches. When formulating their reasoning, the model allows investigators to treat evidence, digital and physical, uniformly as building blocks for their arguments and capture detailed information of how and why they serve their role in an investigator’s reasoning process. In addition, the Chain of Findings offers a number of other uses and benefits including the training of investigators and Digital Forensic Readiness. / Dissertation (MSc)--University of Pretoria, 2013. / gm2014 / Computer Science / unrestricted

Due to the frequent use of plastics in daily life, encountering microplastics as pollution and trace evidence in forensic investigations is a common occurrence. Nylons are a plastic class known to be strong and durable, and they are used in a variety of products. Nylon is also a popular choice among 3D printing materials, and its strength and durability lend themselves to printing tools like keys and firearms. The analysis of microplastics is typically performed using any combination of microscopy, infrared spectroscopy, Raman spectroscopy, and mass spectrometry. Nylons are known to have fluorescent impurities created during the polymer’s synthesis and processing, so this work set out to develop a method to analyze nylon microplastics non-destructively using room-temperature fluorescence spectroscopy. By analyzing impurities in the sample, fluorescence spectroscopy can provide additional information about the microplastic’s source that other non-destructive methods do not. Excitation-emission matrices, excitation and emission spectra, and synchronous fluorescence spectra were collected from pellets of four different nylons. Using these spectra, all nylons could be distinguished from one another. A trace evidence simulation was then performed with fragmented pellets and a 3D printed key, and the trace microplastics were shown to have spectra that were consistent with those of the bulk plastic. This method was then improved by applying chemometric algorithms to the fluorescence data. Fluorescence spectra, excitation spectra, and excitation-emission matrices collected from Nylon 6 and Nylon 6/12 were found to be indistinguishable by visual comparison. Using synchronous fluorescence spectra from the two nylons in conjunction with Principal Component Analysis and Common Dimension – Partial Least Squares – Discriminant Analysis, the two nylons could be fully discriminated. Overall, this work presents a powerful new method to non-destructively analyze nylon microplastics and generate more reliable conclusions about the source of the microplastic than current methods alone.

Medicolegal death investigators (MDIs) are a crucial part of the death investigation process but the profession remains unregulated and lacks a required accreditation or licensing process that many other professions use. Research shows the current medicolegal death investigations system, though a crucial government function, has existing deficits in its functionality that affect service delivery. The current study was based on an educational theory and utilized open ended survey questions. Data from 16 investigators was collected through surveys where relevant information was asked in the context of their situation and questions were specific to the phenomenon being studied. The data was analyzed by identifying individual and group descriptions of the experience to understand the overall meaning of their experience. The investigators interviewed had different experiences and varying beliefs in the importance of their role as an investigator. They were confident in their roles and provided detailed descriptions of their responsibilities. Additionally, investigators do not appear to have any direct issues due to educational differences but did embrace their roles as death investigators with a desire toward ensuring both their personal safety and that of society. Although many have acquired training as a result of their employment, they did not feel that the lack of prior training was a hindrance. This study contributes to the literature by providing data for consideration when developing regulations promoting standards within the system. This includes the health and safety of medicolegal death investigators and filling the gap of recognizing the need for standardized regulations by identifying the need for uniform training and safety practices.

Videos manipulated by machine learning have rapidly increased online in the past years. So called deepfakes can depict people who never participated in a video recording by transposing their faces onto others in it. This raises the concern of authenticity of media, which demand for higher performing detection methods in forensics. Introduction of AI detectors have been of interest, but is held back today by their lack of interpretability. The objective of this thesis was therefore to examine what the explainable AI method local interpretable model-agnostic explanations (LIME) could contribute to forensic investigations of deepfake video.  An evaluation was conducted where 3 multimedia forensics evaluated the contribution of visual explanations of classifications when investigating deepfake video frames. The estimated contribution was not significant yet answers showed that LIME may be used to indicate areas to start examine. LIME was however not considered to provide sufficient proof to why a frame was classified as `fake', and would if introduced be used as one of several methods in the process. Issues were apparent regarding the interpretability of the explanations, as well as LIME's ability to indicate features of manipulation with superpixels.

Over the decades, computer forensics has expanded from primarily examining computer evidence found on hard drives into the examination of digital devices with increasing storage capacity, to the identification of crimes and illegal activities involving the use of computers, to addressing standards and practices deficiencies, and to addressing the need to educate and train law enforcement, computer forensic technicians, and investigators. This dissertation presents the concept mapping case domain modeling approach to aid examiners/investigators in searching and identifying digital evidence and analyzing the case domain during the examination and analysis phase of the computer forensic investigation. The examination and analysis phases of a computer forensic process are two of the most important phases of the investigative process because the search for and identification of evidence data is crucial to a case; any data uncovered will help determine the guilt or innocence of a suspect. In addition, these phases can become very time consuming and cumbersome. Therefore, finding a method to reduce the amount of time spent searching and identifying potential evidence and analyzing the case domain would greatly enhance the efficiency of the computer forensic process. The hypothesis of this dissertation is that the concept mapping case domain modeling approach can serve as a method for organizing, examining, and analyzing digital forensic evidence and can enhance the quality of forensic examinations without increasing the time required to examine and analyze forensic evidence by more than 5%. Four experiments were conducted to evaluate the effectiveness of the concept mapping case domain modeling approach. Analysis of the experiments supports the hypothesis that the concept mapping case domain modeling approach can be used to organize, search, identify, and analyze digital evidence in an examination.

Was führt kriminaltechnische Sachverständige zur Konferenz Entwerfen Entwickeln Erleben Es mag ungewöhnlich sein, dass sich hier Kriminaltechniker bzw. kriminaltechnische Sachverständige zu Wort melden. Bedenkt man, dass sich die Kriminaltechnik ja nahezu ausschließlich naturwissenschaftlicher Methoden bedient, so sind allein hierin schon Berührungspunkte vorgegeben. Für uns ist es die Erprobung einer neuen Methode, sich ganz konkret an den Lehrstuhl Konstruktionstechnik/CAD zu wenden. Wir glauben im Übrigen nicht, dass es ungewöhnlich ist, dass die Kriminaltechnik mit universitären Einrichtungen zusammenarbeitet. Immerhin, wenn man in ihre Geschichte schaut, hat sich die Kriminaltechnik aus Zweigen einzelner Naturwissenschaften entwickelt.

Was führt kriminaltechnische Sachverständige zur Konferenz Entwerfen Entwickeln Erleben Es mag ungewöhnlich sein, dass sich hier Kriminaltechniker bzw. kriminaltechnische Sachverständige zu Wort melden. Bedenkt man, dass sich die Kriminaltechnik ja nahezu ausschließlich naturwissenschaftlicher Methoden bedient, so sind allein hierin schon Berührungspunkte vorgegeben. Für uns ist es die Erprobung einer neuen Methode, sich ganz konkret an den Lehrstuhl Konstruktionstechnik/CAD zu wenden. Wir glauben im Übrigen nicht, dass es ungewöhnlich ist, dass die Kriminaltechnik mit universitären Einrichtungen zusammenarbeitet. Immerhin, wenn man in ihre Geschichte schaut, hat sich die Kriminaltechnik aus Zweigen einzelner Naturwissenschaften entwickelt.

The forensic assessment of young children is a difficult and often daunting task for professionals working in the field of child sexual abuse. A forensic assessment with pre-school children requires that the professional have knowledge of various aspects of the children themselves and the disclosure of abuse, and remain as neutral and objective as possible while conducting the assessment. Literature indicates that the knowledge of the child’s social, behavioural and developmental level is essential in order to conduct a developmental sensitive forensic interview. Although the term “pre-forensic screening” is relatively new in the field of forensics, Hewitt (1999) and Carnes (2006) refer to “pre-screening” and “developmental, behavioural and social assessment”, respectively. The study examined the usefulness of the General Child Assessment Model as a pre-forensic screening technique specifically for children aged 3-5 years. The researcher adopted a qualitative approach to explore the usefulness of the General Child Assessment Model as a pre-forensic screening instrument with professionals working in the clinical as well as forensic field. Seven semi-structured interviews were conducted with professionals trained in the general child assessment model. The interviews focused on the professionals’ use of the model in general, the value they attached to the model, its usefulness as a pre-forensic screening instrument with children aged 3-5 years, strengths and limitations of the model as a pre-forensic screening instrument, and practical recommendations for using the model in the forensic context. The data from the semi-structured interviews was analysed and divided into themes and subthemes, which were further described and linked with relevant literature .It became clear that the use of this assessment model had value in the therapeutic as well as forensic context. The model was described as an important and valuable part of the forensic process as it provides a holistic view of the child in context. The strengths and limitations of the model as a pre-forensic screening instrument were also explored and the participants made practical recommendations to optimise the use of the model as a pre-forensic screening instrument. In addition, a case study was used to evaluate the model as a pre-forensic screening instrument. / Thesis (MSW (Forensic Practice))--North-West University, Potchefstroom Campus, 2013.

The forensic assessment of young children is a difficult and often daunting task for professionals working in the field of child sexual abuse. A forensic assessment with pre-school children requires that the professional have knowledge of various aspects of the children themselves and the disclosure of abuse, and remain as neutral and objective as possible while conducting the assessment. Literature indicates that the knowledge of the child’s social, behavioural and developmental level is essential in order to conduct a developmental sensitive forensic interview. Although the term “pre-forensic screening” is relatively new in the field of forensics, Hewitt (1999) and Carnes (2006) refer to “pre-screening” and “developmental, behavioural and social assessment”, respectively. The study examined the usefulness of the General Child Assessment Model as a pre-forensic screening technique specifically for children aged 3-5 years. The researcher adopted a qualitative approach to explore the usefulness of the General Child Assessment Model as a pre-forensic screening instrument with professionals working in the clinical as well as forensic field. Seven semi-structured interviews were conducted with professionals trained in the general child assessment model. The interviews focused on the professionals’ use of the model in general, the value they attached to the model, its usefulness as a pre-forensic screening instrument with children aged 3-5 years, strengths and limitations of the model as a pre-forensic screening instrument, and practical recommendations for using the model in the forensic context. The data from the semi-structured interviews was analysed and divided into themes and subthemes, which were further described and linked with relevant literature .It became clear that the use of this assessment model had value in the therapeutic as well as forensic context. The model was described as an important and valuable part of the forensic process as it provides a holistic view of the child in context. The strengths and limitations of the model as a pre-forensic screening instrument were also explored and the participants made practical recommendations to optimise the use of the model as a pre-forensic screening instrument. In addition, a case study was used to evaluate the model as a pre-forensic screening instrument. / Thesis (MSW (Forensic Practice))--North-West University, Potchefstroom Campus, 2013.