The necessity of elemental analysis techniques to solve forensic problems continues to expand as the samples collected from crime scenes grow in complexity. Laser ablation ICP-MS (LA-ICP-MS) has been shown to provide a high degree of discrimination between samples that originate from different sources. In the first part of this research, two laser ablation ICP-MS systems were compared, one using a nanosecond laser and another a femtosecond laser source for the forensic analysis of glass. The results showed that femtosecond LA-ICP-MS did not provide significant improvements in terms of accuracy, precision and discrimination, however femtosecond LA-ICP-MS did provide lower detection limits. In addition, it was determined that even for femtosecond LA-ICP-MS an internal standard should be utilized to obtain accurate analytical results for glass analyses. In the second part, a method using laser induced breakdown spectroscopy (LIBS) for the forensic analysis of glass was shown to provide excellent discrimination for a glass set consisting of 41 automotive fragments. The discrimination power was compared to two of the leading elemental analysis techniques, µXRF and LA-ICP-MS, and the results were similar; all methods generated >99% discrimination and the pairs found indistinguishable were similar. An extensive data analysis approach for LIBS glass analyses was developed to minimize Type I and II errors en route to a recommendation of 10 ratios to be used for glass comparisons. Finally, a LA-ICP-MS method for the qualitative analysis and discrimination of gel ink sources was developed and tested for a set of ink samples. In the first discrimination study, qualitative analysis was used to obtain 95.6% discrimination for a blind study consisting of 45 black gel ink samples provided by the United States Secret Service. A 0.4% false exclusion (Type I) error rate and a 3.9% false inclusion (Type II) error rate was obtained for this discrimination study. In the second discrimination study, 99% discrimination power was achieved for a black gel ink pen set consisting of 24 self collected samples. The two pairs found to be indistinguishable came from the same source of origin (the same manufacturer and type of pen purchased in different locations). It was also found that gel ink from the same pen, regardless of the age, was indistinguishable as were gel ink pens (four pens) originating from the same pack.

Computers and the internet have become an integral part of our lives. People have grown accustomed to feeling constantly connected to the outside world, and in the past couple of decades online social networks and three-dimensional online virtual worlds have gained great popularity. In addition to social connections, virtual worlds (such as Second Life, a popular virtual world) offer their users opportunities for both work and play, and let them take part in things that might have been impossible in real life. However, the human factor plays a big role in the formation of the virtual community. The feeling of false anonymity online might lead to a feeling of freedom from any laws that govern the real world, and possibly facilitate offensive behaviour. The problem addressed by this study is the need to determine whether digital forensic techniques can be applied to an incident inside the Second Life environment (i.e. offensive behaviour between avatars, while logged in to Second Life), as well as to find possible sources of evidence accessible via the standard Second Life viewer. The former also requires a classification of various offenses committed in Second Life, in order to determine which actions are to be regarded as offences, and whether these actions occur inside or outside of the Second Life environment. In this dissertation the author’s own classification of various real-life offences is provided, together with a mapping of these offences to their alternatives in Second Life. Second Life is analysed and explored from a forensic perspective. A new digital forensic process model, derived from various existing models in the literature, has been developed by the author for this study. The model is designed to accommodate for the specifics of a virtual world environment. An exploratory experiment has been undertaken by the author in order to investigate how inexperienced users perceived Second Life, as well as how they reacted to attacks from other users, to identify the possible sources of evidence, and suggest possible digital forensic techniques based on the gathered data. / Dissertation (MSc)--University of Pretoria, 2015. / Computer Science / MSc / Unrestricted

There are situations in which it is very important to quickly and positively identify an individual. Examples include suspects detained in the neighborhood of a bombing or terrorist incident, individuals detained attempting to enter or leave the country, and victims of mass disasters. Systems utilized for these purposes must be fast, portable, and easy to maintain. The goal of this project was to develop an ultra fast, direct PCR method for forensic genotyping of oral swabs. The procedure developed eliminates the need for cellular digestion and extraction of the sample by performing those steps in the PCR tube itself. Then, special high-speed polymerases are added which are capable of amplifying a newly developed 7 loci multiplex in under 16 minutes. Following the amplification, a postage stamp sized microfluidic device equipped with specially designed entangled polymer separation matrix, yields a complete genotype in 80 seconds. The entire process is rapid and reliable, reducing the time from sample to genotype from 1-2 days to under 20 minutes. Operation requires minimal equipment and can be easily performed with a small high-speed thermal-cycler, reagents, and a microfluidic device with a laptop. The system was optimized and validated using a number of test parameters and a small test population. The overall precision was better than 0.17 bp and provided a power of discrimination greater than 1 in 106. The small footprint, and ease of use will permit this system to be an effective tool to quickly screen and identify individuals detained at ports of entry, police stations and remote locations. The system is robust, portable and demonstrates to the forensic community a simple solution to the problem of rapid determination of genetic identity.

No description available.

Digital forensic investigators have a duty to understand the relevant components of the cases that they work. However, with the constant evolution of technologies, and the release of new platforms and programs, it is impossible for an investigator to be familiar with every application they encounter. It can also be difficult to know how forensic tools handle certain applications. This is why forensic researchers study and document new and emerging technologies, platforms, and applications, so that investigators have resources to utilize whenever they encounter an unfamiliar element in a case.<br><div><br></div><div>n 2017, Microsoft released a new communication platform, Microsoft Teams(Koenigsbauer, 2017). Due to the application’s relatively young age, there has not been any significant forensic research relating to Microsoft Teams. This platform as of April 2021 had 145million daily active users (Wright, 2021), nearly double the number of daily users at the same time in 2020 (Zaveri, 2020). This rapid growth is attributed in part to the need to work from home due to the COVID-19 virus (Zaveri, 2020). Given the size of its user base, it seems likely that forensic investigators will encounter cases where Microsoft Teams is a relevant component but may not have the knowledge required to efficiently investigate the platform.<br></div><div><br></div><div>To help fill this gap, an analysis of data stored at rest by Microsoft Teams was conducted, both on the Windows 10 operating system as well as on mobile operating systems, such as IOS and Android has been conducted. Basic functionality such as messaging, sharing files, participating in video conferences, and other functionalities that Teams provides were performed in an isolated testing environment. These devices were analyzed with both automated forensic tools, and non automated investigation. Specifically, Cellebrite UFED for the mobile devices, and Magnet AXIOM for the Windows device were used. Manual or non-automated investigation recovered, at least partially, the majority of artifacts across all three devices. In this study, the forensic tools used did not recover many of the artifacts that were found with manual investigation. These discovered artifacts, and the results of the tools, are documented in the hopes of aiding future investigations.<br></div><div><br></div>

Forensics, or competitive speech and debate, has a history stretching back to the ancient Greeks. Although practitioners, students, and coaches have long sung its praises, limited research has been done to demonstrate the long-term value of forensics competition for students. This study used narrative interviews to discover the perceived value of forensics competition to individuals who were at least ten years removed from competition and had not remained active in forensics. After interviewing 34 individuals, this study used grounded theory (Glaser, 1965; 2002; Glaser & Strauss, 1967) to analyze the results. Analysis revealed that individuals followed a similar pattern of becoming involved in forensics and remaining as participants. Additionally, they believed they learned academic skills, social skills, and had more opportunities because of their participation in forensics, despite having to overcome some negative effects of participation. Participants noted that they used many of the skills they developed in forensics every day. Participants also demonstrated that forensics was a part of their identity and many remained connected to former teammates, former competitors, and their alma mater. Analysis led to the development of the Narrative of the Professional, which is the story of the forensics competitor.

Mobile applications are an important but fast changing piece of the digital forensics’ world. For mobile forensics researchers and field analysts, it is hard to keep up with the pace of the ever-changing world of the newest and most popular applications teens are using. Mobile forensic tools are quickly becoming more and more supportive of new applications, but with how quickly apps are changing and new ones being released, it is still difficult for the tools to keep up. The research question for this project examines to what extent digital forensic tools support new and emerging applications seen recently in investigations involving teenagers? For this research, a survey was conducted asking digital forensic analysts, and others who investigate digital crimes, what applications they are coming across most frequently during investigations involving teens and whether those applications are being supported by forensic tools. The top three applications from the survey that were not supported by mobile forensic tools, Monkey, Houseparty, and Likee were populated onto a test device and then evaluated and analyzed to see what forensic artifacts were found in those applications. The mobile application artifacts were then compared on two different forensic tools to see which tool obtains the most forensic artifacts from the applications. Through the examination and analysis of the applications and data contained within the apps, it was determined that 61% of the populated forensic artifacts were recovered manually and only 45% were recovered by a forensic tool for the Monkey application. 100% of the populated forensic artifacts were recovered manually and only 29% were recovered by a forensic tool for the Houseparty application. 42% of the populated forensic artifacts were recovered manually and only 3% were recovered by a forensic tool for the Likee application. It was found that the extent of support from digital forensic tools for these types of applications depends greatly on how the application stores the artifacts, but the artifact extraction support was limited for all applications. This research benefits in helping researchers and analysts by understanding the data and artifacts contained within the applications, what forensic artifacts are recoverable, and where to find those important artifacts. This research can help in finding important evidence for future investigations.<br>

As the connectivity of home devices elevates so does the volume and sophistication of cyber attacks consistently grow. Therefore, the need for network security and availability becomes more significant. Numerous sorts of countermeasures like firewalls and router-based packet filtering have been put in place, although these alone are not enough to brace the network from unauthorised access. One of the most efficient methods of stopping network adversaries is using Intrusion Detection and Prevention Systems (IDPS). The goal of an IDPS is to stop security attacks before they can be successfully carried out. In this paper, I looked at four network attacks namely; probing, denial of service, remote to user and user to root and improved their respective Snort rules to optimize processing time and capturing capacity using regular expressions and fast pattern. Snort with improved rules captured 100% of the attacks launched to the network while without the improved rules, Snort captured between 0% to 60% of the attacks launched to the network making an improvement of 40%.

Operating System fingerprinting is a reconnaissance method used by Whitehats and Blackhats alike. Current techniques for fingerprinting do not take into account tunneling protocols, such as IPSec, SSL/TLS, and SSH, which effectively `wrap` network traffic in a ciphertext mantle, thus potentially rendering passive monitoring ineffectual. Whether encryption makes VPN tunnel endpoints immune to fingerprinting, or yields the encrypted contents of the VPN tunnel entirely indistinguishable, is a topic that has received modest coverage in academic literature. This study addresses these question by targeting two tunnelling protocols: IPSec and SSL/TLS. A new fingerprinting methodology is presented, several fingerprinting discriminants are identified, and test results are set forth, showing that endpoint identities can be uncovered, and that some of the contents of encrypted VPN tunnels can in fact be discerned. / Dissertation (MSc (Computer Science))--University of Pretoria, 2005. / Computer Science / unrestricted

Drugs of Abuse (DOAs) are among the single largest contributor to crime in the United States and present a high cost to society in terms of financial costs and physical/mental well-being of individuals. The forensic community requires a variety of validated methods to detect and analyze DOAs in a variety of different sample types, and most developed methods utilize a liquid or gas chromatography (GC or LC) separation system paired to a mass spectrometer (MS) detection detector. Capillary Electrophoresis (CE) based separation techniques have also been experimented with due to this technique’s high efficiency and speed, high resolving power, low sample consumption, and potentially lower cost when compared to GC or LC based techniques, even though the sensitivity of these systems is perceived to be weaker. The goal of this research to develop a CE-MS/MS method utilizing the ZipChipTM to demonstrate it can accurately and reliably detect and quantify DOAs. The DOAs analyzed for this method were opioids and benzodiazepines, and these were 6-monacetylmorphine, 7-aminoclonazepam, codeine, diazepam, dihydrocodeine, 2-Ethylidene-1,5-dimethyl-3,3-diphenylpyrrolidine fentanyl, heroin, hydrocodone, hydromorphone, meperidine, methadone, morphine, norfentanyl, oxycodone, and oxymorphone. Standard Practices for Method Validation in Forensic Toxicology guidelines from the Academy Standards Board (ASB) of Toxicology were used as the template for this validation; samples were prepared and analyzed as neat standards in diluent, blood and urine were assessed for interferences, ionization suppression/enhancement, and extraction recovery. The total runtime for the method was 3.5 minutes, with the retention time range being 1.4 to 2.9 minutes. All samples were prepared using compound standards diluted in metabolite diluent, which consisted of methanol, ammonium acetate, and water prior to injection. The calibration curves consisted of eight calibrator samples that ranged from 0.5 ng/ml to 200 ng/ml for all analytes, and a linear model was used for each compound. The minimum acceptable 𝑅2 value was set to >0.98, and each curve had a weighing factor of 1𝑥2. Each curve for most of the compounds achieved the minimum requirement apart from two Codeine curves (0.9781 and 0.9785) and 7-aminoclonazepam (0.9791). Bias and precision were assessed at three concentrations- 5, 100, and 150 ng/ml. The minimum requirement for bias and precision for a compound was if the percent bias or coefficient of variation was within +/- 20%. Most compounds in this method exhibit acceptable levels of bias (except for Dihydrocodeine which had a bias of 24.58% at 100 ng/ml), and the only compounds to meet the minimum requirement for precision were 6-MAM, 7-aminoclonazepam, diazepam, fentanyl, methadone, and morphine. The limit of detection and limit of quantitation were both set at the lowest calibrator level of 0.5 ng/ml, and no carryover was observed in this method. No interferences occurred due to both deuterated internal standards and from common compounds such as benzylecogine, cocaine, and lidocaine, but blood cause signal interference with fentanyl and urine caused signal interference with methadone and norfentanyl. Ionization suppression and enhancement was observed for a majority of the compounds, and this observation will need to be assessed as to the effect it has on validation parameters in the future. The results collected suggest that accurate, reliable, and sensitive data may be collected if a compound has a specifically paired deuterated internal standard included in the sample. The speed of the suggested method and the minimal sample preparation could be desirable for forensic use. Further testing will need to be conducted to fully validate this method for blood and urine.