Source camera identification (SCI) is a critical step for investigators in verifying the origin of evidential images or videos. Identifying the source of multimedia files has become a major challenge for forensic investigators due to the availability of editing software, recent developments in imaging technology, and the increase in the manufacture of smartphones. In this work, we focus on SCI from videos (SCIV), as many crimes today involve videos, and it is particularly challenging due to compression artifacts and misalignments caused by stabilization during video processing. Existing deep learning (DL)-based approaches exhibit comparatively better identification accuracy than conventional approaches, but lack a proper framework and fine-tuning of model parameters for increased performance. This paper explores an accurate and robust framework to extract and learn intrinsic camera features for SCIV. To arrive at the framework, different types of input, such as an original video I-frame, a noise residue, a denoised I-frame, PRNU of an original I-frame, and PRNU of a denoised I-frame, are investigated as possible inputs to a fine-tuned Convolutional Neural Network (CNN)-based DL classifier. This study also investigates the impact of additive noise on SCIV, based on which a hybrid approach is proposed that selectively applies denoising to an I-frame using a predefined noise threshold. MobileNetV3-Small is employed to learn camera intrinsic properties from the selected input, followed by a softmax-based classifier. Extensive experiments on two publicly available datasets demonstrate the effectiveness of our approach, with performance comparisons showing superior accuracy over most of the previous SCIV methods. We also present a threshold-based strategy to perform SCIV in an open-set scenario.
The rapid adoption of Internet of Medical Things (IoMT) devices in healthcare environments has increased exposure to network-based cyberattacks, highlighting the need for effective post-incident forensic analysis. While existing research largely focuses on real-time intrusion detection, comparatively little attention has been given to forensic approaches that support attack reconstruction and attribution in IoMT networks. This paper presents a forensic analysis framework for IoMT network traffic that emphasises interpretable flow-level artefacts, temporal behaviour, and protocol-level evidence. Using an IoMT network traffic dataset, the framework analyses statistical, temporal, volume-related, and protocol indicators derived from flow metadata, without relying on payload inspection or device-specific information. Statistical artefact profiling and inter-arrival time-based temporal reconstruction reveal distinct behavioural patterns across benign and attack traffic, enabling relative timeline reconstruction of attack activity. Protocol-level analysis further supports forensic attribution by linking observed anomalies to exploited network protocols. A lightweight Random Forest model is included solely as a supporting triage mechanism to prioritise suspicious traffic while preserving interpretability. The results demonstrate that meaningful forensic insight can be derived from flow-level artefacts alone, making the framework suitable for privacy-sensitive healthcare environments and complementary to detection-oriented IoMT security research.
Crime investigators rely on gathering and synthesizing information from various sources to reconstruct events and identify criminal activities. Internet of Things (IoT) devices can play a pivotal role in these efforts by capturing events that transpire before, during, and after a crime. However, extracting and analyzing data from IoT devices can be complex without prior technical knowledge and clear procedural guidance. In this case study paper, we outline the methodology for configuring Amazon IoT devices within a controlled laboratory environment to facilitate data collection. We demonstrate how forensic examiners and crime investigators can retrieve data and utilize it in investigations using Amazon IoT hardware and Visual Identification (Visual ID) technology. Specifically, data from Amazon IoT devices such as the Amazon Echo Show can autonomously log human presence without direct interaction, providing critical insights. This extracted information offers valuable evidence to more precisely reconstruct events for investigations.
The exponential growth of text-based digital evidence, particularly in mobile chat logs, challenges current forensic workflows. This is especially acute in investigations of coercive control, where evidence manifests not as a single ‘smoking gun’ but as a cumulative behavioural profiling of psychological abuse often missed by standard keyword searches. To address this data-to-insight gap, we present the Digital Conversation Analysis Pipeline (DCAP), a proof-of-concept Human-in-the-Loop (HITL) framework designed for investigative triage. The pipeline parses heterogeneous text-based evidence and analyses it using a novel hybrid classification architecture. The system detects individual linguistic markers and aggregates them into a cumulative behavioural profile, combining the precision of rule-based forensic search with the contextual recall of a BERT-based model. Acknowledging the strict ethical and privacy constraints that limit access to real-world forensic datasets, the model was initialised on a synthetic dataset and validated using a ‘Hybrid Injection’ stress-test, embedding 200 confirmed real-world toxic samples into the forensic timeline. In comparative experiments, the hybrid model achieved a 0.85 macro F1-score, significantly outperforming standard forensic keyword search baselines. We demonstrate the pipeline’s engineering utility on a simulated 8451-message case file. By isolating the Person Under Investigation (PUI), the system generated an auditable, quantitative triage report that reduced the target’s review volume by 92.8%. While further validation on diverse real-world data is required, this work proposes a foundational ‘warm-start’ framework for AI-assisted lead generation, prioritising explainability and investigator oversight over autonomous decision-making.
In zero_shot device source authentication, Social Network Service (SNS) processing induces severe feature homogenization, masking device-specific fingerprints and triggering a “false confidence” paradox. This is a difficult problem, and despite active studies in recent years, it remains a great challenge. We propose a device-aware forensics framework, which integrates multimodal feature fusion, dual-verification, and a three-component optimization suite: test-time style normalization, mild transfer learning, and advanced confidence calibration. Experiments show our method elevates the camera device detection rate from a baseline of 17% to 94.0% (mean, validated over 10 independent runs), with an average confidence of 0.825 and an Expected Calibration Error (ECE) of 0.197. We reveal a trade-off between detection rate and calibration reliability, validating a “performance first, then calibration repair” optimization path. This work offers insights for building test-time adaptive and high-reliability forensic systems.
