Japan and South Korea achieved marvelous economic progress after WWII. Food consumption increased in quantity and quality, with animal-sourced products conspicuously augmented. Children grew in height unprecedentedly. Japanese children, however, ceased to grow taller in the 1990s, while supply of animal protein was still increasing. Korean children kept growing taller to overtake their Japanese peers by 3 cm in the mid-2000s, but they also stopped to grow any taller afterwards, while animal products kept increasing vigorously toward the end of the 2010s. Children in Japan started to turn away from fruit in the mid-1970s, to eat in the 2000s less than 10% of fruit by the older generations. Children in Korea started to steer away from vegetables in the early 1990s, to eat less than 10% of vegetables eaten by the older generations in their 50s-60s in the mid-2010s. Consuming sufficient animal-sourced products with very little vegetables/fruit, children, particularly in South Korea have been increasing in BMS in the past two decades, with a sign of declining height. Keywords: Animal Protein; BMS; Japan; Teens; South Korea; Vegetables/Fruit
Source code author identification deals with identifying the most likely author of a computer program, given a set of predefined author candidates. There are several scenarios where digital evidence of this kind plays a role in investigation and adjudication, such as code authorship disputes, intellectual property infringement, tracing the source of code left in the system after a cyber attack, and so forth. As in any identification task, the disputed program is compared to undisputed, known programming samples by the predefined author candidates. We present a new approach, called the SCAP (Source Code Author Profiles) approach, based on byte-level n-gram profiles representing the source code author’s style. The SCAP method extends a method originally applied to natural language text authorship attribution; we show that an n-gram approach also suits the characteristics of source code analysis. The methodological extension includes a simplified profile and a less complicated, but more effective, similarity measure. Experiments on data sets of different programming-language (Java or C++) and commented/commentless code demonstrate the effectiveness of these extensions. The SCAP approach is programming-language independent. Moreover, the SCAP approach deals surprisingly well with cases where only a limited amount of very short programs per programmer is available for training. Finally, it is also demonstrated that SCAP effectiveness persists even in the absence of comments in the source code, a condition usually met in cyber-crime cases. 1. The Forensic Significance of Source Code Nowadays, in a wide variety of legal cases it is important to identify the author of a usually limited piece of programming code. Such situations include cyber attacks in the form of viruses, Trojan horses, logic bombs, fraud, and credit card cloning, code authorship disputes, and intellectual property infringement. Identifying the authorship of malicious or stolen source code in a reliable way has become a primary goal for digital investigators (Spafford and Weeber 1993). Please see Appendix 1 for a legal analysis of the forensic significance of source code.
From student to business worker, the popularity and ubiquity of mobile devices is exploding. As these devices saturate modern culture, they continue to grow in functionality. Such devices can now play music, store photos, contacts, and files or even play full-length movies. Apple’s iPod has taken mobile entertainment to the next level by incorporating all of this into a single device. In fact, the iPod has become so popular that sales have topped nearly sixty seven million units (Apple, 2006). With increased popularity however, criminals have found ways to exploit an otherwise altruistic device. The challenge that lies before law enforcement now becomes identifying the evidence an iPod may contain. Since there has been minimal research in portable music players within the digital forensics community, law enforcement may be fighting blind during their investigations. This paper is an update to previous research by Marsico and Rogers (2005) that presents new procedures and methodologies for law enforcement to obtain digital evidence from the new generations of iPods. As software and hardware revisions have changed, this research analyzes what effect this has on the extraction of evidence.
The widely acknowledged problem of reliably identifying the origin of network data has been the subject of many research works. Due to the nature of Internet Protocol, a source IP can be easily falsified which results in numerous problems, including the infamous denial of service attacks. In this paper, two light-weight novel approaches are proposed to solve this problem by providing simple and effective logging and IPTraceback mechanism: Session Based Packet Logging (SBL) and SYN Based Packet Marking (SYNPM). The contribution of these schemes lies in the fact that they are easy to be implemented with little overhead and are practical under sensitive privacy regulations, since they do not need to access detailed contents of each individual communication session. Currently, SBL and SYNPM approaches support only TCP sessions.
In this paper we discuss the potential role of virtual environments in the analysis phase of computer forensics investigations. General concepts of virtual environments and software tools are presented and discussed. Further we identify the limitations of virtual environments leading to the conclusion that this method can not be considered to be a replacement for conventional techniques of computer evidence collection and analysis. We propose a new approach where two environments, conventional and virtual, are used independently. Further we demonstrate that this approach can considerably shorten the time of the computer forensics investigation analysis phase and it also allows for better utilisation of less qualified personnel.
Inconsistencies in various data structures, such as missing log records and modified operating system files, have long been used by intrusion investigators and forensic analysts as indicators of suspicious activity. This paper describes a rigorous methodology for developing such inconsistency checks and verifying their correctness. It is based on the use of the B Method – a formal method of software development. The idea of the methodology is to (1) formulate a state-machine model of the (sub)system in which inconsistencies are being detected, (2) formulate consistency criteria for the state of that model, (3) rigorously verify correctness of these criteria using the B Method, and (4) automatically search evidential data for violations of the formulated consistency criteria using ConAlyzer utility developed for this purpose. The methodology is illustrated on an FTP server example.
The Daubert process used in the admissibility of evidence contains major guidelines applied in assessing forensic procedures, two of which are testing and error rates. The Digital Forensic Science (DFS) community is growing and the error rates for the forensic tools need to be continuously re-evaluated as the technology changes. This becomes more difficult in the case of mobile phone forensics, because they are proprietary. This paper discusses a database driven approach that could be used to store data about the mobile phone evidence acquisition testing process. This data can then be used to calculate tool error rates, which can be published and used to validate or invalidate the mobile phone acquisition tools.
This paper discusses the emerging trend of Personal Desktop Searching utilities on desktop computers, and how the information cached and stored with these systems can be retrieved and analysed, even after the original document has been removed. Focusing on the free Google Desktop application, this paper first analyses how the program operates, the processes involved, files created and altered, and methods on retrieving this data without corrupting the contents. Whilst some discussion is specific to the Google Desktop application, other discussion is applicable to the several other, similar available applications. The limitations of extracting data from Google Desktop and other desktop searching utilities are also discussed, along with possibilities for future research to ensure that the repositories of information that these programs store may be forensically analysed.
Rootkits are malicious programs that silently subvert an operating system to hide an intruder's activities. Although there are a number of tools designed to detect rootkits, these programs are competing with the rootkit for system resources and allowing the rootkit to actively evade detection. By taking a memory image of the system, a forensic examiner can conduct a more thorough search for rootkits and even without discovering one directly, infer the presence of one. This paper explores how an examiner can create such a memory image and use the inherent properties of rootkits to find them in those memory images. Background
This paper focuses on certain manufacturer hidden areas of a hard disk, specifically Host Protected Areas (HPA) and Device Configuration Overlays (DCO). These areas can be problematic for computer forensic investigators, since many of the common industry tools cannot detect the presence of the HPA and DCO. A review of the ATA specifications and recent white papers indicate that these areas can be accessed, modified, and written to by end users using specific open source and freely available tools, allowing data to be stored and/or hidden in these areas. This greatly increases the risk that image acquisitions may not be a true copy of the physical drive in question. This also could result in the obfuscation of data, leading to incomplete or erroneous investigative conclusions. The paper provides an introduction to these commonly used manufacturer areas and discusses their implication to the computer forensics investigative process. Suggestions for future study and testing are also provided.
Nowadays there are many tools for the extraction of data objects [SWGDE] from SIM cards; unfortunately, most of them are proprietary, or their use is restricted to law enforcement and this is contrary to the Daubert test for acceptability from the scientific community. In this paper, we present an open source tool for data objects extraction from SIM and USIM cards which is capable of extracting all observable memory and all the non-standard files that are found in every SIM card. First, a description of the tool from a digital forensics perspective will be provided. Then, the technological background of the tool will be sketched. After that, the core algorithms will be described and explained. Then, motivations for the choice of an XML format for output will be given and the format described. In conclusion, the possible lines of evolution will be presented.
A timestamp is a clock reading attached to a unit of data. Timestamps are widely used in computing and seem to offer an easy way to determine the time of events in digital investigations. Unfortunately, the ability of users to change clock settings reduces the evidential weight of timestamps. Alternative methods of estimating times of events are often needed to corroborate timestamps. One such method is to “sandwich” the unknown time of an event between known times of causally connected events. For example, if event A caused event B and event B caused event C, then the time of B must be between the times of A and C. This type of reasoning is sometimes called “event time bounding.” This paper defines event time bounding as a mathematical problem and presents an algorithm for solving it 1 .
Computer Forensics has grown rapidly in recent years. The current computer forensic investigation paradigm is laborious and requires significant expertise on the part of the investigators. This paper proposes a highly automatic and efficient framework to provide the Case-Relevance information, by binding computer intelligence technology to the current computer forensic framework. Computer intelligence is expected to offer more assistance in the investigation procedures and better knowledge reuse and sharing in computer forensics. Background Cybercrime is a mirror of the dark side of human society in the cyberworld. Its countermeasure, Computer Forensics, also referred as Digital Forensic Science, has been explicitly defined as, The use of scientifically derived and proven methods toward the preservation, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping to anticipate unauthorized actions shown to be disruptive to planned operations. [14] The process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable via the application of computer technology to the investigation of computer based crime is called Forensic Computing [11] or Digital Evidence Investigation. As almost every piece of digital evidence could be challenged, computer forensic investigators are required to follow a rigorous process path. The work of the First Digital Forensics Research Workshop (DFRWS) [14] established a solid ground and allowed
This paper gives informal introduction into the finite state machine approach to analysis of digital evidence and explores its use as a defence tool – for finding weaknesses in the forensic analysis performed by the opposing party. The key concepts of the finite state machine approach are reviewed, and an example analysis of a published case study is performed. It is shown how the described approach can be used to generate alternative scenarios of the incident.
Information technology has become infused with many aspects of everyday life. Naturally, aspects of information technology have become more common in both civil and criminal law. However, the people called upon to address these technological issues are typically versed exclusively in either law or technology. The authors contend that a new discipline is emerging from the intersection of forensics and information technology. They argue for a formalization of the process by which this discipline evolves and a broadening of the definitions currently in place. A case study is presented to illustrate the shortcomings of current, narrowly defined terms and the need for individuals with broader expertise. The authors conclude by proposing some of these areas of expertise.
In some investigations of digital crime, the question of who was at the keyboard when incriminating documents were produced can be legitimately raised. Authorship attribution can then contribute to the investigation. Authorship methods which focus on linguistic characteristics currently have accuracy rates ranging from 72% to 89%, within the computational paradigm. This article presents a computational, stylometric method which has obtained 95% accuracy and has been successfully used in investigating and adjudicating several crimes involving digital evidence. The article concludes with a brief review of the current admissibility status of authorship identification techniques.
TULP2G is a forensic software framework for acquiring and decoding data stored in electronic devices. The framework consists of a layered architecture with communication, protocol, conversion, and export plug-ins to acquire, decode, and report evidence in customizable layouts. All acquired data is stored in an XML formatted evidence file along with information for auditing purposes. XML files can also be used to customize the framework with different user interface languages. A profile mechanism is built in to save and load framework configuration settings for common investigations. Conversion and export plug-ins can also be used to decode data acquired with other data acquisition methods. TULP2G is implemented in C# using .NET1.1 and released under a BSD license. All software, including source code is available at http://tulp2g.sourceforge.net/. Currently available plug-ins are mainly targeted towards GSM phone examinations, but the applied open source strategy tries to stimulate other parties in developing more examination functionality.
The iPod is one of the most popular digital music devices in today's marketplace. The newest versions of the iPod have become more PDA/storage like than ever before. With this new functionality the iPod has recently found its way into the criminal world. With the continued growth of the digital music device market, the iPod's use in criminal activity will only continue to increase. This paper discusses some of the features of the iPod and how a criminal could use them. A literature review found little or no documentation or discussion on the forensic analysis of the iPod or similar devices. Therefore, this research outlines what should be considered when an iPod is found at the crime scene, and offers a critical analysis of some common forensic tools and their ability to collect and analyze data from an iPod. Suggestions for future research are also provided.
This paper is the result of an intensive six-month investigation into encryption technologies conducted at the Computer Forensic Research & Development Center (CFRDC) at Utica College. A significant number of encryption applications were collected and cataloged. A roadmap for the identification of the unique characteristics of encrypted file formats was created. A number of avenues were explored and the results documented. The actual process is not outlined comprehensively due to proprietary needs; however, the following briefly details the process and the significance of our findings.
Traditional digital forensics methods are based on the in-depth examination of computer systems in a lab setting. Such methods are standard practice in acquiring digital evidence and are indispensable as an investigative approach. However, they are also relatively heavyweight and expensive and require significant expertise on part of the investigator. Thus, they cannot be applied on a wider scale and, in particular, they cannot be used as a tool by regular law enforcement officers in their daily work. This paper argues for the need for on-the-spot digital forensics tools that supplement lab methods and discuss the specific user and software engineering requirements for such tools. The authors present the Bluepipe architecture for on-the-spot investigation and the Bluepipe remote forensics protocol that they have developed and relate them to a set of requirements. They also discuss some of the details of their ongoing prototype implementation.
