Instant messaging (IM) has changed the way people communicate with each other. However, the interactive and instant nature of these applications (apps) made them an attractive choice for malicious cyber activities such as phishing. The forensic examination of IM apps for modern Windows 8.1 (or later) has been largely unexplored, as the platform is relatively new. In this paper, we seek to determine the data remnants from the use of two popular Windows Store application software for instant messaging, namely Facebook and Skype on a Windows 8.1 client machine. This research contributes to an in-depth understanding of the types of terrestrial artefacts that are likely to remain after the use of instant messaging services and application software on a contemporary Windows operating system. Potential artefacts detected during the research include data relating to the installation or uninstallation of the instant messaging application software, log-in and log-off information, contact lists, conversations, and transferred files.
Network forensics enables investigation and identification of network attacks through the retrieved digital content. The proliferation of smartphones and the cost-effective universal data access through cloud has made Mobile Cloud Computing (MCC) a congenital target for network attacks. However, confines in carrying out forensics in MCC is interrelated with the autonomous cloud hosting companies and their policies for restricted access to the digital content in the back-end cloud platforms. It implies that existing Network Forensic Frameworks (NFFs) have limited impact in the MCC paradigm. To this end, we qualitatively analyze the adaptability of existing NFFs when applied to the MCC. Explicitly, the fundamental mechanisms of NFFs are highlighted and then analyzed using the most relevant parameters. A classification is proposed to help understand the anatomy of existing NFFs. Subsequently, a comparison is given that explores the functional similarities and deviations among NFFs. The paper concludes by discussing research challenges for progressive network forensics in MCC.
This study reviews forensic entomological specimens analysed by the Department of Parasitology & Medical Entomology, Universiti Kebangsaan Malaysia for the year 2004. A total of 10 cases (6 males and 4 females) were observed for the entomological specimens. Various types of death scenes were obtained including indoor and outdoor area such as bushes field, rubbish dumping site, and aquatic areas. Identified fly species collected from the death sites were blow flies, Chrysomya megacephala, Chrysomya rufifacies and Lucilia cuprina and unknown sarcophagid larvae, with Ch. megacephala being the most common species found in the ecologically varied death scene habitats. The post-mortem interval (PMI) estimation ranged from one to five days, based on the entomological specimens collected.
With the rapid development of technology, mobile phones have become an essential tool in terms of crime fighting and criminal investigation. However, many mobile forensics investigators face difficulties with the investigation process in their domain. These difficulties are due to the heavy reliance of the forensics field on knowledge which, although a valuable resource, is scattered and widely dispersed. The wide dispersion of mobile forensics knowledge not only makes investigation difficult for new investigators, resulting in substantial waste of time, but also leads to ambiguity in the concepts and terminologies of the mobile forensics domain. This paper developed an approach for mobile forensics domain based on metamodeling. The developed approach contributes to identify common concepts of mobile forensics through a development of the Mobile Forensics Metamodel (MFM). In addion, it contributes to simplifying the investigation process and enables investigation teams to capture and reuse specialized forensic knowledge, thereby supporting the training and knowledge management activities. Furthermore, it reduces the difficulty and ambiguity in the mobile forensics domain. A validation process was performed to ensure the completeness and correctness of the MFM. The validation was conducted using two techniques for improvements and adjustments to the metamodel. The last version of the adjusted metamodel was named MFM 1.2.
The topcoat color of motor vehicles offers vital information while investigating vehicular accidents, especially in instance of hit-and-run, since witnesses seldom perceive and retain the plate details. Differences in color perceptions among individuals with normal vision may lead to confusion in determining the color of the car involved. In this way, witnesses of crash accidents could potentially initiate flawed leads in forensic investigation, and thus affect the administration of justice. In this study, the inter-rater reliability of vehicle color determination by different volunteers was explored. Six individuals observed the topcoat colors of 500 stationary and 500 moving vehicles from five locations, employing a common system of color gradation. The outcome was binary: the vehicle color was either a "match" or "non-match". This was followed by statistical analysis in terms of the colors' frequencies and inter-rater reliability, based on which more suitable color descriptions were determined for subsequent comparisons of stationary and moving vehicles. Higher match frequencies and greater inter-rater reliability were observed when color gradations were disregarded. The frequency of correct matches could have been closely related to their relative on-the-road distribution, regardless of the statuses of observed vehicles. It was also found that black and white were associated with a greater number of matches than were intermediate colors, which should be carefully interpreted during forensic investigation to avoid wrong leads. In conclusion, the present study demonstrated the forensic significance of vehicle topcoat color determination, particularly in cases where witness statements are crucial.
Wherever an impact mark is found, either on the surface or on the recovered projectile, it is important for forensic investigators to extract useful information in solving shooting-related cases. This article reviews a collection of works on examination of impact marks upon striking of projectiles on inanimate objects, emphasizing on the retrievable information from a shooting scene and their forensic significance in shooting event reconstruction. Literature suggested that impact marks on target surfaces and the degree of deformation on striking projectiles vary according to different combinations of ammunition and surface materials. It was noted that conditions in real-case scenarios further differed unpredictably in comparison with controlled studies, where forensic investigation should be treated as case-specific basis. Furthermore, the way forensic science is researched and applied operationally has to be reconsidered to reduce the gap via translational approach for more effective use of forensic evidence.
Forensic odontology has been an interdisciplinary part of forensic science for many years. In Malaysia, this forensic discipline has been practiced for more than two decades however it is still considered a new discipline as there are a limited number of specialists. To date, there are less than ten practicing forensic odontologists in Malaysia. Many dentists do not have a clear perception of this field, thus forensic odontology rarely becomes a career of choice. The purpose of this article is to highlight the attributes of a competent forensic odontologist and encourage dentists towards this challenging career path.
The larval development of Chrysomya albiceps and Lucilia sericata is a well-known and valuable tool for estimating the postmortem interval (PMI). The third instar larvae of Ch. albiceps are facultative predators of the larvae of other necrophagous dipterans, and this behaviour is undoubtedly an important factor to consider. Both species are found together during human autopsies in Spain and other parts of Europe, where they cohabit, so a precise knowledge of their larval coexistence data is essential. The aim of this study is to investigate their coexistence and the intraguild predation of Ch. albiceps on L. sericata under experimental conditions and in real case reports. To analyse intra- and interspecific competition, four densities were used under controlled abiotic conditions [25ºC, 60-70% RH and 12:12 (D:N)]. The experimental data were compared with data corresponding to their coexistence in natural conditions, so annual activity and forensic case reports for both species were studied. The results indicate that the mortality of immature specimens in both species, the preimaginal developmental time, and adult size were affected by competition. In natural conditions, adult coexistence during the spring-summer period was confirmed. The simultaneity of the two species colonising human corpses is frequent in the studied area, with Ch. albiceps being the dominant species, and L. sericata the relevant species for estimating the minimum postmortem interval.
Uniqueness being unprovable, it has recently been argued that individualization in forensic science is irrelevant and, probability, as applied for DNA profiles, should be applied for all identifications. Critiques against uniqueness have omitted physical matching, a realistic and tangible individualization that supports uniqueness. Describing case examples illustrating pattern matches including physical matching, it is indicated that individualizations are practically relevant for forensic science as they establish facts on a definitive basis providing firm leads benefitting criminal investigation. As a tenet of forensic identification, uniqueness forms a fundamental paradigm relevant for individualization. Evidence on the indeterministic and stochastic causal pathways of characteristics in patterns available in the related fields of science sufficiently supports the proposition of uniqueness. Characteristics involved in physical matching and matching achieved in patterned evidence existing in the state of nature are not events amenable for counting; instead these are ensemble of visible units occupying the entire pattern area stretching the probability of re-occurrence of a verisimilitude pattern into infinity offering epistemic support to uniqueness. Observational methods are as respectable as instrumental or statistical methods since they are capable of generating results that are tangible and obviously valid as in physical matching. Applying the probabilistic interpretation used for DNA profiles to the other patterns would be unbefitting since these two are disparate, the causal pathways of the events, the loci, in the manipulated DNA profiles being determinable. While uniqueness enables individualizations, it does not vouch for eliminating errors. Instead of dismissing uniqueness and individualization, accepting errors as human or system failures and seeking remedial measures would benefit forensic science practice and criminal investigation.
Evidence in crime scenes available in the form of biological stains which cannot be visualized during naked eye examination can be detected by imaging their fluorescence using a combination of excitation lights and suitable filters. These combinations selectively allow the passage of fluorescence light emitted from the targeted stains. However, interference from the fluorescence generated by many of the surface materials bearing the stains often renders it difficult to visualize the stains during forensic photography. This report describes the use of background correction algorithm (BCA) to enhance the visibility of seminal stain, a biological evidence that fluoresces. While earlier reports described the use of narrow band-pass filters for other fluorescing evidences, here, we utilize BCA to enhance images captured using commonly available colour filters, yellow, orange and red. Mean-based contrast adjustment was incorporated into BCA to adjust the background brightness for achieving similarity of images' background appearance, a crucial step for ensuring success while implementing BCA. Experiment results demonstrated the effectiveness of our proposed colour filters' approach using the improved BCA in enhancing the visibility of seminal stains in varying dilutions on selected surfaces.
In forensic entomology, larval rearing usually includes the presence of biological contaminants including scuttle flies (Diptera: Phoridae). Scuttle flies are recognized as forensically important insects and have been reported causing nuisance and contamination in laboratory environments. This paper reports for the first time the finding of multiple scuttle fly species affecting colonies of third instar larvae of the Oriental latrine blowfly, Chrysomya megacephala (Fabricius) (Diptera: Calliphoridae), reared indoors at the Forensic Science Simulation Site, Universiti Kebangsaan Malaysia. Adult scuttle flies were discovered inside a rearing container after the emergence of adult C. megacephala., The scuttle fly species are Megaselia scalaris (Loew), M. spiracularis Schmitz and Puliciphora borinquenensis (Wheeler). Notes on the life history and biology of these species are discussed herein.
Hypopygiopsis violacea, a species of fly of forensic importance, was recovered from a corpse and described for the first time. The morphological structures of the second and third instar larvae of four specimens were examined using light microscope. Observations were focused on three main morphological characters: cephalopharyngeal skeleton, anterior and posterior spiracles. Cephalopharyngeal skeleton of second instar larva is darkly pigmented and without accessory sclerite below the mouth hook. The anterior spiracles of second and third instar larvae have 8-9 papillae each, arranged in a single row. The posterior spiracle of second instar larva has two spiracular slits with no thickening of peritreme. This differentiates it from the third instar, whereby the latter has three slits for each posterior spiracle. Cephalopharyngeal skeleton of third instar larva is heavily pigmented. An accessory sclerite is found below the hook part of third instar larva but is absent in second instar. Peritreme of the posterior spiracle of third instar larva is thick almost complete encircling a button. The intersegmental spines of the cuticular surface are dome-shaped and unicuspid. Third instar larva of this species is large with size approximately 15 mm long. These findings provide important identification features of immature stages of Hy. violacea which could be useful in forensic entomology.
Signal fly, Scholastes sp. (Diptera: Platystomatidae) was observed associated with animal carcasses in Malaysia. The first observation was on a monkey carcass, which was killed by using a handgun and immediately placed in a forested area in Gombak, Selangor while the second observation was on a pig that died of natural causes and whose carcass was placed in an oil palm plantation in Tanjung Sepat, Selangor. Both animal carcasses were visited by Scholastes sp. flies during the fresh decomposition period. However, the role Scholastes flies in the decomposition process remains unknown. In this paper, we report the occurrence of Scholastes sp. on animal carcasses in Malaysia for the first time.
A forensic entomological study conducted in an oil palm plantation in Tanjung Sepat, Selangor, Malaysia on 3 August 2007 revealed that a housefly, Musca domestica Linnaeus oviposited its eggs on a freshly dead pig. This finding indicated that housefly might play an important role in forensic investigation in determining post-mortem interval (PMI), although it was not yet found in human corpses or any animal carrion. This preliminary paper presented a first record of Musca domestica eggs found on animal carcass in the country.
Questioned document examination becomes a great interest and one of the broad fields in forensic science. It involves the analysis of ink, handwriting and signature examination, paper’s physical structure analysis and the ageing of a document. Ink analysis in forensic document examination is a challenging process. Questioned documents examiners are dealing with unknown source of ink and minute sample size. Ink extraction needs to be done before the ink analysis. 17 gel pen ink samples were chosen in this study. Solubility test has been done to determine the degree of solubility of ink in a variety of organic solvents. Extraction solvent optimization is a process to evaluate the efficiency of organic solvents to extract ink samples. Ethanoic acid showed the ability to dissolve most of the ink samples and displayed maximum absorbance of UV-Vis spectra.
Fannia prisca Stein, 1918 is newly recorded from peninsular Malaysia. This record is based on 4 male specimens from Mount Berembun, Brinchang, Cameron Highland, Pahang state, peninsular Malaysia. It is previously recorded from China, Mongolia, Korea, Japan, Taiwan, Bonin Island, Thailand and oriental region. The male of Fannia prisca can be differentiated from male Fannia scalaris by the following features: for F. prisca, mid-coxa without spine; mid-tibia normal or without stout triangular ventral projection; and hind tibia usually with 2 av, while F. scalaris has several stout hook-like spines on the anterior margin; mid-tibia with stout triangular ventral projection and hind tibia usually with 3 av. Both F. prisca and F. scalaris can be differentiated from Fannia leucosticta by looking at its hind tibia, which only has 1 av.
Tropical bed bugs, Cimex hemipterus, which commonly feeds on human blood, may be useful in forensic applications. However, unlike the common bed bug, Cimex lectularius, there is no information regarding tropical bed bug, C. hemipterus, being studied for its applications in forensics. Thus, in this study, lab-reared post-feeding tropical bed bugs were subjected to Short Tandem Repeat (STR) and Single Nucleotide Polymorphism (SNP) analyses to establish the usage of tropical bed bugs in forensics. Several post-feeding times (0, 5, 14, 30, and 45 days) were tested to determine when a complete human DNA profile could still be obtained after the bugs had taken the blood meal. The results showed that complete STR and SNP profiles could only be obtained from the D0 sample. The profile completeness decreased over time, and partial STR and SNP profiles could be obtained up to 45 days post-blood meal. The generated SNP profiles, complete or partial, were also viable for HIrisPlex-S phenotype prediction. In addition, field-collected bed bugs were also used to examine the viability of the tested STR markers, and the STR markers detected mixed profiles. The findings of this study established that the post-blood meal of tropical bed bugs is a suitable source of human DNA for forensic STR and SNP profiling. Human DNA recovered from bed bugs can be used to identify spatial and temporal relations of events.
The estimation of the postmortem interval (PMI) is an essential information in death investigations. It is necessary to know the developmental data of the most important necrophagous insect species in every geographical area. Chrysomya megacephala (Fabricius, 1794) (Diptera: Calliphoridae) is one of the most common species associated with human body decomposition, especially in the tropics, so a precise knowledge of its life cycle is crucial. However, despite its ubiquity, developmental data in a range of tropical temperatures is scarce. For this reason, the aim of this study is to provide the developmental data of the blowfly, C. megacephala, in a range of tropical temperatures and to apply these data in forensic entomology. Four temperatures were examined (i.e., 27.0°C 29.5°C, 32.0°C and 34.5°C) and the time of developments from egg to adult were recorded. To build the growth curves, five larvae per day were measured with a digital caliper. Accumulated degree-days were calculated and the isomorphen diagram for this species was plotted. As we predicted, the results showed that the life cycle of this species was affected by the increasing temperature. The implications of these new data for determining the minimum PMI in forensic entomology were discussed.