The invisible evidence: Digital forensics as key to solving crimes in the digital age.

Digital transformation rapidly changes how we live our lives in the post pandemic world. Unfortunately, digital technology is not limited to law abiding organisations and citizens. Criminal organisations and individuals are quick to identify new opportunities with new technologies, and digital transformation is dramatically changing the character of crimes, terror, and other threats. The fast emergence of new crimes is facilitated by possibilities brought by disruptive technologies such as AI, Internet of Things, drones, and cryptocurrencies that can be disastrous tools in the hands of criminals. Consequently, our society needs far better capacity to prevent and investigate criminal acts to protect organisations and citizens. This brings an urgent need to proactively reform digital forensics to significantly increase our capability to meet the strain on society brought by crimes evolving in the digital transformation era. The future of forensic science is already here, characterized by a mix of opportunities and challenges. It is essential to make it harder to effectively use digital technologies for criminal activities, while leveraging the possibilities of digital technologies by those affected, law enforcement agencies, business and organisations. As digital technologies continue to evolve, we need to stay up to date with the latest developments to effectively investigate and prosecute crimes in the digital age. There is an increased reliance on digital evidence, and the amount of heterogeneous digital evidence in criminal cases keep increasing. The forensic science techniques thus become more sophisticated and play an increasingly important role. However, the scientific area is extremely broad, and beyond the capability of most forensic science labs to keep up with the technology forefront development speed. Besides an urgent need to bring up the subject to the political arena, examples of how we can meet the challenges are discussed such as by extending our cooperation, encourage and facilitate cooperation for training and education to handle the extremely broad and rapid development, working out methods for explaining and visualising evidence for the treatment and legal values of digital evidence in prosecution, and cooperation between product developers and crime investigators for swift innovation of digital forensics tools and methodologies for quickly emerging threats. This paper will highlight specific examples where modern digital techniques are used to solve crimes in the physical world as well as crimes committed in the digital domain and discuss how "good AI" can be used to fight "evil AI" and finally touch on the sensitive balance between the increased power of the new digital forensic tools and private integrity.

High precision blood lead radiogenic isotope signatures in a community exposed to Pb contaminated soils and implications for the current Pb exposure of the European population.

Our study provides the most comprehensive dataset for high-precision radiogenic isotopes of lead (Pb) in blood for the western European population. It investigates their potential for elucidating the contribution of soil Pb to blood Pb using a human biomonitoring survey involving 81 adults and 4 children living in the urban area of Liège (Belgium). Soils in the area show moderate (median of 360 mg/kg) to high (95th percentile of 1000 mg/kg) Pb concentrations, due to former metal processing activities. Blood lead levels (BLL) measured in the study population are, on average, quantitatively consistent with a âˆ¼ 20 % increase due to the exposure to Pb from soils, as estimated by a single-compartment biokinetic model. Consistently, its isotopic composition does not represent an endmember that fully accounts for the variability of Blood lead isotope (BLI) compositions measured in the study population. While some individuals show more thorogenic BLI ratios (relatively more enriched in 208Pb), which could be consistent with a greater exposure to local soils and/or by their country of birth, the BLI data mostly follow a trend roughly parallel to the European Standard Lead Pollution (ESLP) line, within the European leaded gasoline field, even two decades after the withdrawal of this source. Differences in BLI are probably associated with factors related to the presence of Pb in dwellings (pipes, paint) and drinking water distribution system, suggesting that the anthropogenic Pb in use, relevant to human exposure, may contain ore components of different origins, including the Australian Pb ore signature.

Electrochemical classification of benzodiazepines: A comprehensive approach combining insights from voltammetry and liquid chromatography - mass spectrometry.

The growing non-medical use of benzodiazepines (BZs) has led to the emergence of counterfeit BZ pills and new psycho-active substances (NPS) in the BZ class on the illicit market. Comprehensive analytical methods for BZ identification are required to allow law enforcement, first aid responders and drug-checking services to analyze a variety of sample types and contents to make timely decisions on the spot. In this work, the electrochemical behavior of diazepam (DZ), clonazepam (CZ) and alprazolam (AP) is studied on graphite screen-printed electrodes, both with and without dissolved oxygen in the solution, to link their redox signals to their chemical structure. After elucidation of their reduction mechanisms using liquid chromatography coupled to high-resolution mass spectrometry, three structural classes (Class 1, Class 2 and Class 3) were defined, each with different redox centers and electrochemical behavior. Subsequently, 22 confiscated pills containing 14 different BZs were correctly assigned to these three structural classes, with the deoxygenated conditions displaying the highest class selectivity. Finally, the three classes were successfully detected after being spiked into five alcoholic beverages in the context of drug-facilitated sexual assault. For analysis in red wine, which complicated the analysis by interfering with Class 1, a dual test strategy in pH 2 and pH 7 was proposed for accurate detection. Its rapid measurements, broad scope and lack of interference from diluents or colors makes this method a promising approach for aiding various services in combating problematic BZ use.

Contextual bias by Forensic Document Examination trainees: An empirical study from China.

The impact of contextual bias has been repeatedly demonstrated across forensic domains; however, research on this topic in China is scarce. To examine the prevalence of contextual bias in pattern feature-comparison disciplines, we conducted an experiment involving 24 forensic document examination students. The aim was to determine whether knowledge of different contextual information influenced their forensic decision-making. Participants were divided into different context groups and tasked with examining whether questioned signatures with ambiguous features matched reference signatures. The results of independent-samples t-tests for their decision score data in the two context groups exhibited a statistically significant difference (p < 0.05, Cohen's d > 0.8). Moreover, the submitted forensic reports by participants disclosed a biased evaluation of handwriting features. These findings show how contextual information can bias forensic decision-making in handwriting examination. Context management with complementary strategies such as case triage, cognitive training and decision-making transparency must be implemented to minimize bias in handwriting examination.

The forensic potential of environmental DNA (eDNA) in freshwater wildlife crime investigations: From research to application.

Environmental DNA (eDNA) is widely used in biodiversity, conservation, and ecological studies but despite its successes, similar approaches have not yet been regularly applied to assist in wildlife crime investigations. The purpose of this paper is to review current eDNA methods and assess their potential forensic application in freshwater environments considering collection, transport and persistence, analysis, and interpretation, while identifying additional research required to present eDNA evidence in court. An extensive review of the literature suggests that commonly used collection methods can be easily adapted for forensic frameworks providing they address the appropriate investigative questions and take into consideration the uniqueness of the target species, its habitat, and the requirements of the end user. The use of eDNA methods to inform conservationists, monitor biodiversity and impacts of climate change, and detect invasive species and pathogens shows confidence within the scientific community, making the acceptance of these methods by the criminal justice system highly possible. To contextualise the potential application of eDNA on forensic investigations, two test cases are explored involving i) species detection and ii) species localisation. Recommendations for future work within the forensic eDNA discipline include development of suitable standardised collection methods, considered collection strategies, forensically validated assays and publication of procedures and empirical research studies to support implementation within the legal system.

The role of a digital twin in supporting criminal investigations - a case report about a possible abuse.

As part of a comprehensive analysis, this case report presents a possible case of child maltreatment that can serve as a basis for forensic and medical examiner investigations. This case concerns the death of an infant who was approximately two months old. During a routine examination by the pediatrician at the end of May 2021, the child was found to have a normal head circumference of 31 cm. No other abnormalities were noted. On June 19, 2021, the child died, and an autopsy revealed a head circumference of 44 cm and a subdural hematoma as the cause of death. Questions arose as to who might have abused the child and when. The only evidence was a low-quality cell phone video taken by the child's parents on June 13, 2021, six days before the child's death, in which the child could be seen lying on a pillow. It was necessary to determine whether the child in this video already had an unnatural head circumference. This study presents a novel workflow that demonstrates how to analyze and deal with low quality video to answer questions like the above. The workflow demonstrates the creation of 3D scenes from digital image and video material. These 3D scenes can be used for object measurement and to support forensic and medical investigations. In the present case, where only low quality smartphone images were available, the presented workflow was used to create a 3D scene of the child lying on the pillow. In this 3D scene, it was possible to determine the child's head circumference. These measurements support the findings of the medical examiner (dated June 24, 2021) and confirm the suspicion that possible child abuse had already taken place on June 13, 2021. The innovative approach makes it possible to identify evidence of possible abuse based on a specific point in time, in this case the child's private footage. It also demonstrates the potential of 3D scene reconstruction in complex forensic and medical scenarios.

The advent of forensic DNA databases: It's time to agree on some international governance principles!

National forensic DNA databases are a valuable investigative tool, that have the potential to increase the efficacy of criminal investigations. Their unfettered expansion in recent years raises unsettling ethical issues that require close attention. DNA database expansion threatens the rights to privacy, non-discrimination, and equality, and can undermine public trust in government. This perspective piece relies on data from an international mapping study of Forensic DNA Databases to document the expansion of these databases, highlight the ethical issues they raise, and propose key recommendations for more responsible use of this infrastructure.

Social Network Forensics Analysis Model Based on Network Representation Learning.

The rapid evolution of computer technology and social networks has led to massive data generation through interpersonal communications, necessitating improved methods for information mining and relational analysis in areas such as criminal activity. This paper introduces a Social Network Forensic Analysis model that employs network representation learning to identify and analyze key figures within criminal networks, including leadership structures. The model incorporates traditional web forensics and community algorithms, utilizing concepts such as centrality and similarity measures and integrating the Deepwalk, Line, and Node2vec algorithms to map criminal networks into vector spaces. This maintains node features and structural information that are crucial for the relational analysis. The model refines node relationships through modified random walk sampling, using BFS and DFS, and employs a Continuous Bag-of-Words with Hierarchical Softmax for node vectorization, optimizing the value distribution via the Huffman tree. Hierarchical clustering and distance measures (cosine and Euclidean) were used to identify the key nodes and establish a hierarchy of influence. The findings demonstrate the effectiveness of the model in accurately vectorizing nodes, enhancing inter-node relationship precision, and optimizing clustering, thereby advancing the tools for combating complex criminal networks.

UGEE-Net: Uncertainty-guided and edge-enhanced network for image splicing localization.

Image splicing, a prevalent method for image tampering, has significantly undermined image authenticity. Existing methods for Image Splicing Localization (ISL) struggle with challenges like limited accuracy and subpar performance when dealing with imperceptible tampering and multiple tampered regions. We introduce an Uncertainty-Guided and Edge-Enhanced Network (UGEE-Net) for ISL to tackle these issues. UGEE-Net consists of two core tasks: uncertainty guidance and edge enhancement. We employ Bayesian learning to model uncertainty maps of tampered regions, directing the model's focus to challenging pixels. Simultaneously, we employ a frequency domain-auxiliary edge enhancement strategy to imbue localization features with global contour information and fine-grained local details. These mechanisms work in parallel, synergistically boosting performance. Additionally, we introduce a cross-level fusion and propagation mechanism that effectively utilizes contextual information for cross-layer feature integration and leverages channel-level correlations for cross-layer feature propagation, gradually enhancing the localization feature's details. Experiment results affirm UGEE-Net's superiority in terms of detection accuracy, robustness, and generalization capabilities. Furthermore, to meet the growing demand for high-quality datasets in image forensics, we present the HTSI12K dataset, which includes 12,000 spliced images with imperceptible tampering traces and diverse categories, rendering it suitable for real-world auxiliary model training.

Brute forcing on secured shell servers emphasising the role of cyber forensics - a quali-quantitative study.

BACKGROUND: Increasing numbers of cyber attacks threaten us personally and professionally. Cyber crimes include obtaining sensitive information (medical or financial) but may extend to organising heinous crimes including murders and aggravated sexual assaults. A major vector of cyber crimes is brute force attacks on secured shell servers. AIM OF STUDY: This research highlights the prevalence of the intensity of brute force attacks on secured shell servers via quali-quantitative analysis of cyber attacks. METHODOLOGY: The brute force attacks were recorded over a period of 20 days with the help of logs taken from five dedicated servers installed in a production environment. RESULTS: There were a minimum of 6470 and maximum of 22,715 attacks on a server per day. The total number of attacks on all the servers during the study period was 1,065,920. The brute force attacks were mainly targeted at the service network accounts. CONCLUSION: Growth of the field of cyber forensics is the optimal solution to prevent the malicious use of internet services and the commissioning of crimes by this means.

Determination of contamination sources and geochemical reactions in groundwater of a mine area using Cu, Zn, and S-O isotopes.

To determine contamination sources and pathways, the use of multiple isotopes, including metal isotopes, can increase the reliability of environmental forensic techniques. This study differentiated contamination sources in groundwater of a mine area and elucidated geochemical processes using Cu, Zn, S-O, and O-H isotopes. Sulfate reduction and sulfide precipitation were elucidated using concentrations of dissolved sulfides, δ34SSO4, δ18OSO4, and δ66Zn. The overlying contaminated soil was possibly responsible for the contamination of groundwater at <5 mbgl, which was suggested by low δ65Cu values (0.419-1.120‰) reflecting those of soil (0.279-1.115‰). The existence of dissolved Cu as Cu(I) may prevent the increase in δ65Cu during leaching of contaminated soil in the sulfate-reducing environment. In contrast, the groundwater at >5 mbgl seemed to be highly affected by the contamination plume from the adit water, which was suggested by high SO42- concentrations (407-447 mg L-1) and δ65Cu (0.252-2.275‰) and δ66Zn (-0.105‰-0.362‰) values at a multilevel sampler approaching those of the adit seepages. Additionally, the O-H isotopic ratios were distinguished between <5 mbgl and >5 mbgl. Using δ65Cu and δ66Zn to support the determination of groundwater contamination sources may be encouraged, particularly where the isotopic signatures are distinct for each source.

Deepfake forensics: a survey of digital forensic methods for multimodal deepfake identification on social media.

The rapid advancement of deepfake technology poses an escalating threat of misinformation and fraud enabled by manipulated media. Despite the risks, a comprehensive understanding of deepfake detection techniques has not materialized. This research tackles this knowledge gap by providing an up-to-date systematic survey of the digital forensic methods used to detect deepfakes. A rigorous methodology is followed, consolidating findings from recent publications on deepfake detection innovation. Prevalent datasets that underpin new techniques are analyzed. The effectiveness and limitations of established and emerging detection approaches across modalities including image, video, text and audio are evaluated. Insights into real-world performance are shared through case studies of high-profile deepfake incidents. Current research limitations around aspects like cross-modality detection are highlighted to inform future work. This timely survey furnishes researchers, practitioners and policymakers with a holistic overview of the state-of-the-art in deepfake detection. It concludes that continuous innovation is imperative to counter the rapidly evolving technological landscape enabling deepfakes.

Performance of Artificial Intelligence Models Designed for Automated Estimation of Age Using Dento-Maxillofacial Radiographs-A Systematic Review.

Automatic age estimation has garnered significant interest among researchers because of its potential practical uses. The current systematic review was undertaken to critically appraise developments and performance of AI models designed for automated estimation using dento-maxillofacial radiographic images. In order to ensure consistency in their approach, the researchers followed the diagnostic test accuracy guidelines outlined in PRISMA-DTA for this systematic review. They conducted an electronic search across various databases such as PubMed, Scopus, Embase, Cochrane, Web of Science, Google Scholar, and the Saudi Digital Library to identify relevant articles published between the years 2000 and 2024. A total of 26 articles that satisfied the inclusion criteria were subjected to a risk of bias assessment using QUADAS-2, which revealed a flawless risk of bias in both arms for the patient-selection domain. Additionally, the certainty of evidence was evaluated using the GRADE approach. AI technology has primarily been utilized for automated age estimation through tooth development stages, tooth and bone parameters, bone age measurements, and pulp-tooth ratio. The AI models employed in the studies achieved a remarkably high precision of 99.05% and accuracy of 99.98% in the age estimation for models using tooth development stages and bone age measurements, respectively. The application of AI as an additional diagnostic tool within the realm of age estimation demonstrates significant promise.

Scavenger-induced scattering of wild boar carcasses over large distances and its implications for disease management.

Vertebrate scavengers provide essential ecosystem services such as accelerating carrion decomposition by consuming carcasses, exposing tissues to microbial and invertebrate decomposers, and recycling nutrients back into the ecosystem. Some scavengers do not consume carcasses on site but rather scatter their remains in the surroundings, which might have important implications for nutrient transport, forensic investigations and the spread of diseases such as African Swine Fever. However, only a few studies have investigated and measured the scatter distances. Using wild boar (Sus scrofa) carcasses and limbs, we monitored scavenging behavior and measured scatter distances of mammals. We placed 20 carcasses (up to 25 kg) and 21 separate limbs equipped with very high frequency (VHF) transmitters and monitored scavenger activity using camera traps in a mountainous region in southeast Germany. Except for one carcass, all other carcasses and limbs were scattered. We measured 72 scatter distances (of 89 scattering events; mean = 232 m, maximum = 1250 m), of which 75% were dispersed up to 407 m. Scavengers moved scattered pieces into denser vegetation compared to the half-open vegetation at provisioning sites. Red foxes (Vulpes vulpes) were the most common scavenger species, contributing to 72 scattering events (58 measured scatter distances). Our results provide evidence of scatter distances farther than previously assumed and have far-reaching implications for disease management or forensic investigations, as the broader surroundings of carcasses must be included in search efforts to remove infectious material or relevant body parts for forensic analysis.

Pennella balaenoptera actively select injured cetacean skin as attachment sites, making them potentially useful forensic tags.

Cetaceans harbor multiple epibionts on their external surface, and these attach to particular microhabitats. Understanding what drives the selection of attachment sites is relevant for refining the use of epibionts as indicators of their hosts. We report on about 100 females of the mesoparasitic copepod Pennella balaenoptera attached to a dead Cuvier's beaked whale Ziphius cavirostris stranded in Tunisia (western Mediterranean); the first report of P. balaenoptera in this country. The copepods were exclusively attached to numerous incisive, likely anthropogenic, wounds found on the host's skin. This finding suggests that newly recruited females may actively seek skin areas where physical penetration is facilitated; a factor that may help explain patterns of microhabitat selection by Pennella spp., and perhaps other pennellids, on their hosts. The estimated age of parasitization by P. balaenoptera (supported by age estimations of the co-occurring epibiotic barnacle Conchoderma virgatum) also suggests that the cetacean host likely survived these injuries, at least initially, and the presumed cause of death was starvation due to entanglement in a fishing net.

Hidden multiple comparisons increase forensic error rates.

When wires are cut, the tool produces striations on the cut surface; as in other forms of forensic analysis, these striation marks are used to connect the evidence to the source that created them. Here, we argue that the practice of comparing two wire cut surfaces introduces complexities not present in better-investigated forensic examination of toolmarks such as those observed on bullets, as wire comparisons inherently require multiple distinct comparisons, increasing the expected false discovery rate. We call attention to the multiple comparison problem in wire examination and relate it to other situations in forensics that involve multiple comparisons, such as database searches.

Protostylid: Contributing and Aggravating Factor for Periodontitis.

Clinicians should be well-versed in the anatomy, variations, and teeth anomalies. Developmental disturbances of the teeth can lead to alterations in size, shape, number, structure, and eruption of the teeth. Developmental disturbances can lead to germination, fusion, concrescence, dilaceration, talons, cusps, dens in dente, etc. Protostylid, an additional cusp on the buccal aspect of the maxillary molar, which is a rare clinical finding, can lead to plaque accumulation, making oral hygiene maintenance difficult. This leads to clinical attachment loss and bone loss. This condition may often go undiagnosed. It should be diagnosed to prevent further complications. This case has been reported to make clinicians aware of the importance of diagnosing the case at the earliest possible time so that complications can be prevented and management is easier. From the perspective of forensic dentistry, this morphological feature, though uncommon, may be useful for the classification and identification of victims in mass causalities and bite marks on bodies or inanimate objects. This is one of the rarest cases of protostylids reported to date. This may not only pose a significant problem in endodontic therapy due to morphological alterations in root canals and periodontal therapy due to grove formation leading to an inability to maintain a plaque-free area (bone loss) but also be of very significant interest from the perspective of forensic dentistry.

Wet SPF: A wet powder suspension for the detection of latent fingermarks on the sticky side of adhesive tape for use in Seychelles.

WET UCIO is an inexpensive carbon-based powder suspension, reportedly as effective as commercially available formulations for latent fingermark detection on the sticky side of adhesive tapes. However, the surfactant solution used in WET UCIO is not readily accessible outside Europe, limiting its use in Seychelles or other non-European jurisdictions. In this study, the UCIO formulation was modified based on a 'frugal forensic' approach, by replacing the surfactant solution with an in-house sodium dodecyl sulfate solution prepared in 5 % aqueous ethanol. A comparative assessment against Wetwop™ using eight different pressure-sensitive adhesive tapes found that the modified formulation was at least as effective as commercial powder suspension. Modifying this technique under the frugal forensic framework has enhanced its accessibility to other jurisdictions and is recommended for validation in Seychelles.

Separation of gold from irradiated actinide material utilizing a 2- thenoyltrifluoroacetone extraction resin.

Post-detonation nuclear forensics capabilities depend on the ability to rapidly isolate radionuclides to improve measurement quality. In this work an extraction chromatography resin was developed utilizing thenoyltrifluoroacetone and 1-octanol supported on Eichrom prefilter resin. The resin was tested in nitric and hydrochloric acid matrices. In nitric acid the resin was able to extract zirconium, while in hydrochloric acid matrices it was possible to extract iron and gallium. In all acid conditions tested, gold was retained but can be eluted from the column with 10 % thiourea.

A new method for quantifying 64Cu in nuclear debris samples.

Quantifying 64Cu in post-detonation nuclear debris samples can provide important diagnostic information regarding the structural materials used within a nuclear device. However, this task is challenging due to the weak gamma emissions associated with the decay of 64Cu, its short half-life (12.701 h), and the presence of interfering fission product radioisotopes. Large quantities of debris sample are generally needed to accurately quantify 64Cu, which can be problematic in sample-limited scenarios where other radiometric analyses are required. Herein, we present a new method for the separation of 64Cu from solutions of mixed fission products and demonstrate the quantification of its activity through use of gas-flow proportional beta counting. The new method was validated through a series of rigorous tests and was shown to improve the detection limit of 64Cu by over two orders of magnitude, from 2.5 × 106 to 1.3 × 104 atoms/sample for 100 min measurements.