Search Results (83)

The escalating scale and complexity of cybercrime necessitate standardized digital forensic protocols to ensure the integrity and admissibility of digital evidence. This study empirically assesses the use of ISO/IEC 27037 and ISO/IEC 27041 through three real-world digital forensic case studies conducted in organizational settings. A multi-case methodology was employed, encompassing a multinational corporate criminal investigation, an internal employee misbehaviour probe, and an examination into mobile- and cloud-based data leaks. The effect of synchronized standard implementation was evaluated using audit-based and quantitative indicators that measure forensic process quality as a system attribute. The findings demonstrate that the systematic implementation of ISO/IEC 27037 and ISO/IEC 27041 improves investigative traceability, documentation quality, and evidentiary robustness. In the worldwide case study, documentation completeness increased by 18%, and all digital evidence was deemed admissible in judicial proceedings, surpassing the institutional baseline admissibility rate of 82%. In other instances, evidence gathered within the same framework was acknowledged in organizational or disciplinary review processes, resulting in similar enhancements in documentation quality and procedural consistency, notwithstanding technological and organizational limitations. The paper develops and empirically substantiates an integrated procedural validation model that connects evidence-handling practices with method and instrument validation. The results indicate that the synchronized implementation of ISO/IEC forensic standards improves the transparency, dependability, and auditability of digital forensic investigations. Full article

The reconstruction of biological profiles from aged or degraded human skeletal remains represents a major challenge in both forensic and bioarcheological contexts, particularly when conventional identification approaches fail. Recent advances in molecular genetics, biochemical and histological analyses, and biomolecular anthropology have substantially expanded the range of information that can be recovered from compromised remains. This review synthesizes current integrative approaches combining genomic analyses, stable isotope investigations, epigenetic age estimation, proteomic sex determination, and complementary histological techniques to infer sex, ancestry, kinship, age, diet, mobility, and geographic origin. Genetic methods, including next-generation sequencing (NGS), enable increasingly robust inference even from highly degraded samples. Stable isotope analyses provide insights into dietary patterns and mobility, while DNA methylation markers improve age estimation accuracy. Tooth cementum annulation (TCA), although a histological rather than molecular method, contributes an additional chronological indicator within an integrative analytical framework. Rather than treating these approaches independently, this review proposes a multidisciplinary perspective in which complementary datasets collectively support biological profile reconstruction. Integrative interpretation enhances identification potential and provides more nuanced life-history reconstructions, demonstrating the value of combining molecular, biochemical, and histological evidence in forensic and archaeological investigations. Full article

In forensic pathology, accurately estimating the time since injury is essential. Current histological and imaging approaches commonly miss subtle temporal changes, especially in deaths occurring within hours of injury. This review discusses the timing of neuroinflammation after traumatic brain injury and emphasizes possible markers for estimating the time of injury in forensic cases. Promising markers include microglial activation (allograft inflammatory factor 1 and transmembrane protein 119, detectable within 10 min to 2 h), β-amyloid precursor protein accumulation (20–35 min), high-mobility group box 1 translocation (2–6 h), cytokine fluctuations (IL-1β and TNF-α peak between 4 and 24 h, IL-6 shows delayed, extended elevation), sequential leukocyte infiltration (neutrophils from 2 to 48 h, lymphocytes after 3–5 days), blood–brain barrier breakdown markers such as fibrinogen and IgG leakage, loss of tight junction proteins (2–3 h), matrix metalloproteinase-9 activity (peaking at 24–48 h), and reactive astrocytosis with increased glial fibrillary acidic protein levels (from 12 to 24 h onward). The association between injury severity and inflammation is influenced by factors such as age, genetics (e.g., APOE ε4), coexisting conditions, and preexisting inflammation, which reduce the reliability of individual markers. A multiparametric approach may offer the best prospects to improve the accuracy of post-traumatic and post-mortem interval assessment in medicolegal cases. Full article

Background/Objectives: MDMA and MDA are among the stimulant drugs most frequently encountered in forensic casework, and oral fluid represents a practical biological matrix for their detection. However, liquid oral fluid requires refrigeration, is susceptible to degradation, and can be logistically demanding for routine laboratories. Dried Oral Fluid Spots (DOFS) offer a low-cost and stable alternative. This study aimed to develop and validate a DOFS-based analytical workflow for quantifying MDMA and MDA using liquid chromatography and a diode-array detector. Methods: Watercolor paper was selected as the substrate and pretreated with diluted nitric acid to improve analyte desorption. DOFS were prepared using 150 µL of pooled oral fluid, dried for 4 h, and extracted with methanol. Chromatographic separation was performed on a phenyl column using aqueous TFA and acetonitrile mobile phase. Method validation followed the ICH M10 criteria. Results: The method showed linear responses between 12.5 and 5000 ng mL⁻¹, with LOD and LLOQ of 6 and 12 ng mL⁻¹ for both analytes, respectively. Precision and accuracy met acceptance criteria across all QC levels. Recoveries ranged from 84% to98%. DOFS samples demonstrated adequate stability under multiple storage and handling conditions. Conclusions: The optimized DOFS–LC–DAD workflow offers a robust, low-cost, and flexible approach for the analysis of MDMA and MDA in oral fluid for laboratory-based or semi-controlled collection environments. Its compatibility with both LC- and GC-based detectors enhances applicability in diverse forensic laboratory settings. Full article

In digital forensics, one of the complicated tasks is analyzing web browser data due to different types of devices, browsers, and the absence of modern analytical approaches. Browsers store a large amount of information about user activity because users most often access the internet through them. However, existing approaches to analyzing this browser data still have gaps. Existing approaches fail to provide a comprehensive and precise representation of user activity. This article examines the internal architecture of web browsers as stored in the memory and storage subsystems of various devices, including desktop and mobile platforms. A novel method is proposed that integrates machine learning algorithms, such as k-nearest neighbors and Naive Bayes, to automatically analyze browser data, identify suspicious login activities, and construct user behavior profiles. The results indicate that the proposed method and the developed platform can effectively construct individual user behavior profiles. Moreover, this approach not only productively observes top visited domains and main user’s favorite website categories, but also highlights suspicious websites and user’s login attempts. Compared to existing browser forensic tools which have less capabilities, the proposed technique provides increased accuracy (more than 90%) in automated user profiling and detection of suspicious user activity. Full article

The rapid advancement of social media and the exponential increase in online information have made open-source intelligence an essential component of modern criminal investigations. However, existing digital forensics standards mainly focus on evidence derived from controlled devices such as computers and mobile storage, providing limited guidance for social media–based intelligence. Evidence captured from online platforms is often volatile, editable, and difficult to verify, which raises doubts about its authenticity and admissibility in court. To address these challenges, this study proposes a systematic and legally compliant open-source intelligence framework aligned with digital forensics principles. The framework comprises five stages: identification, acquisition, authentication, preservation, and validation. By integrating blockchain-based notarization and image verification mechanisms into existing forensic workflows, the proposed system ensures data integrity, traceability, and authenticity. The implemented prototype demonstrates the feasibility of conducting reliable and legally compliant open-source intelligence investigations, providing law enforcement agencies with a standardized operational guideline for social media–based evidence collection. Full article

Memory forensics is an essential cybersecurity tool that comprehensively examines volatile memory to detect the malicious activity of fileless malware that can bypass disk analysis. Image-based detection techniques provide a promising solution by visualizing memory data into images to be used and analyzed by image processing tools and machine learning methods. However, the effectiveness of image-based data for detection and classification requires high computational efforts. This paper investigates the efficacy of texture-based methods in detecting and classifying memory-resident or fileless malware using different image resolutions, identifying the best feature descriptors, classifiers, and resolutions that accurately classify malware into specific families and differentiate them from benign software. Moreover, this paper uses both local and global descriptors, where local descriptors include Oriented FAST and Rotated BRIEF (ORB), Scale-Invariant Feature Transform (SIFT), and Histogram of Oriented Gradients (HOG) and global descriptors include Discrete Wavelet Transform (DWT), GIST, and Gray Level Co-occurrence Matrix (GLCM). The results indicate that as image resolution increases, most feature descriptors yield more discriminative features but require higher computational efforts in terms of time and processing resources. To address this challenge, this paper proposes a novel approach that integrates Local Interpretable Model-agnostic Explanations (LIME) with deep learning models to automatically identify and crop the most important regions of memory images. The LIME’s ROI was extracted based on ResNet50 and MobileNet models’ predictions separately, the images were resized to 128 × 128, and the sampling process was performed dynamically to speed up LIME computation. The ROIs of the images are cropped to new images with sizes of (100 × 100) in two stages: the coarse stage and the fine stage. The two generated LIME-based cropped images using ResNet50 and MobileNet are fed to the lightweight neural network to evaluate the effectiveness of the LIME-based identified regions. The results demonstrate that the LIME-based MobileNet model’s prediction improves the efficiency of the model by preserving important features with a classification accuracy of 85% on multi-class classification. Full article

Understanding vehicle acceleration behavior during intersection departures is critical for advancing traffic safety, sustainable mobility, and intelligent transport systems. This study presents a high-resolution kinematic analysis of 714 vehicle departures from signalized intersections, encompassing straight crossings, left turns, and right turns, and involving a diverse sample of internal combustion engine (ICE), hybrid electric (HEV), and battery electric vehicles (BEV). Using synchronized Micro Electro-Mechanical Systems (MEMS) accelerometers and Real-Time Kinematic (RTK)-GPS systems, the study captures longitudinal acceleration and velocity profiles over fixed distances. Results indicate that BEVs exhibit significantly higher acceleration and final speeds than ICE and HEV vehicles, particularly during straight crossings and longer left-turn maneuvers. Several mathematical models—including polynomial, arctangent, and Akçelik functions—were calibrated to describe acceleration and velocity dynamics. Findings contribute by modeling jerk and delay propagation, supporting better calibration of AV acceleration profiles and the optimization of intersection control strategies. Moreover, the study provides validated acceleration benchmarks that enhance the accuracy of forensic engineering and road accident reconstruction, particularly in scenarios involving intersection dynamics, and demonstrates that BEVs accelerate more rapidly than ICE and HEV vehicles, especially in straight crossings, with direct implications for traffic simulation, ADAS calibration, and urban crash analysis. Full article

Terminal forensics in large mobile networks is a vital activity for identifying compromised devices and analyzing malicious actions. In contrast, the study described here begins with the domain of terminal forensics as the primary focus, rather than the threat itself. This paper proposes a new multi-criteria decision-making (MCDM) model that integrates complex picture fuzzy sets (CPFS) with the combinative distance-based assessment (CODAS), referred to throughout as complex picture fuzzy CODAS (CPF-CODAS). The aim is to assist in forensic analysis for detecting mobile botnet command and control (C&C) systems. The CPF-CODAS model accounts for the uncertainty, hesitation, and complex numerical values involved in expert decision-making, using degrees of membership as positive, neutral, and negative values. An illustrative forensic case study is constructed where three mobile devices are evaluated by three cybersecurity professionals based on six key parameters related to botnet activity. The results demonstrate that the model can effectively distinguish suspicious devices and support the use of the CPF-CODAS approach in terminal forensics of mobile networks. The robustness, symmetry, and advantages of this model over existing MCDM methods are confirmed through sensitivity and comparison analyses. In conclusion, this paper introduces a novel probabilistic decision-support tool that digital forensic specialists can incorporate into their workflow to proactively identify and prevent actions of mobile botnet C&C servers. Full article

Chlorpyrifos CPF (O,O-diethyl O-(3,5,6-trichloro-2-pyridyl) phosphorothioate), known also as Chlorpyrifos-ethyl, is one of the most utilized organophosphorus pesticides worldwide. Additionally, CPF could be used as a chemical warfare agent surrogate. Although its acute toxicity is not high, it is responsible for both a large number of intoxications and chronic, delayed neurological effects. In this work, it is reported for the first time the qualitative and quantitative response produced by CPF vapors, using a pocket-held Time-of-Flight Ion Mobility Spectrometer (ToF IMS) with a non-radioactive ionization source and ammonia doping, model LCD-3.2E (Smiths Detection Ltd.), operated near ambient temperature (below 30 °C). Spectra of CPF in positive ion mode included two distinct product ion peaks; thus, identification of CPF vapors by IMS relies on these peaks—the monomer M·NH₄⁺ with reduced ion mobility K₀ = ca. 1.76 cm² V⁻¹ s⁻¹ and the dimer M₂·NH₄⁺ with K₀ = ca. 1.47 cm² V⁻¹ s⁻¹ (where M may be assignable to CPF molecule)—and positive reactant ions (Pos RIP) have K₀ = ca. 2.25 cm² V⁻¹ s⁻¹. Excellent sensitivity, with a limit of detection LOD of 0.72 ppb_v (10.5 μg m⁻³) and a limit of quantification LOQ of 2.41 ppb_v (35.1 μg m⁻³), has been noticed; linear response was up to 100 ppb_v, while saturation occurs over ca. 1000 ppb_v (14.6 mg m⁻³). Our results demonstrate that this method provides a robust tool for both off-site and on-site detecting and quantifying CPF vapors at trace levels, which has strong implications for either industrial hygiene or forensic investigations concerning the pesticide Chlorpyrifos, as well as for monitoring of environmental contamination by organophosphorus pesticides. Full article

In this study, bone detection was performed using the YOLO algorithm on a dataset comprising photographs of the scapula, humerus, and femur from cattle, horses, and dogs. Subsequently, convolutional neural networks (CNNs) were employed to classify both the bone type and the species. Trained on a total of 26,148 images, the model achieved an accuracy rate of up to 97.6%. The system was designed to operate not only on mobile devices but also in an offline, “closed model” version, thereby enhancing its applicability in forensic medicine settings where data security is critical. Additionally, the application was structured as a virtual assistant capable of responding to users in both written and spoken formats and of generating output in PDF format. In this regard, this study presents a significant example of digital transformation in fields such as veterinary anatomy education, forensic medicine, archaeology, and crime scene investigation, providing a solid foundation for future applications. Full article

Timely detection of organophosphates in outdoor environments remains a critical challenge for forensic and environmental monitoring. Traditional methods often require transporting samples to centralised laboratories, delaying essential response actions. In this study, we present a novel mobile analytical chemistry workstation that integrates capillary electrophoresis (CE) with capacitively coupled contactless conductivity detection (C4D) on low-cost polydimethylsiloxane (PDMS) microfluidic chips, enabling rapid and accurate on-site analysis of organophosphates. The system features a streamlined workflow that includes in-field sample collection, microfluidic analysis, and the wireless transmission of data to a central command centre for immediate decision-making. The detection system demonstrates a linear range of 2.5 mM to 20 mM for dimethyl methylphosphonate (DMMP), with an estimated limit of detection (LOD) of 2.5 mM. We evaluate the feasibility of combining CE and C4D under field conditions, highlighting both the strengths and limitations of this integrated platform. Full article

The advancement of Internet of Things (IoT), robots, drones, and vehicles signifies ongoing progress, accompanied by increasing complexities and challenges in forensic investigations. Globally, investigators encounter obstacles when extracting evidence from these vast landscapes, which include diverse devices, networks, and cloud environments. Of particular concern is the process of evidence collection, especially regarding fingerprints and facial recognition within the realm of vehicle forensics. Moreover, ensuring the integrity of forensic evidence is a critical issue, as it is vulnerable to attacks targeting data centres and server farms. Mitigating these challenges, along with addressing evidence mobility, presents additional complexities. This paper introduces a groundbreaking infrastructure known as SpiderNet, which is based on cloud computing principles. We will illustrate how this architecture facilitates the identification of devices, secures the integrity of evidence both at its source and during transit, and enables investigations into individuals involved in criminal activities. Through case studies, we will demonstrate the potential of SpiderNet to assist law enforcement agencies in addressing crimes perpetrated within IoT environments. Full article

Di-isopropyl methyl phosphonate (DIMP) has no major commercial uses but is a by-product or a precursor in the synthesis of the nerve agent sarin (GB). Also, DIMP is utilized as a simulant compound for the chemical warfare agents sarin and soman in order to test and calibrate sensitive IMS instrumentation that warns against the deadly chemical weapons. DIMP was measured from 2 ppb_v (15 μg m⁻³) to 500 ppb_v in the air using a pocket-held ToF ion mobility spectrometer, model LCD-3.2E, with a non-radioactive ionization source and ammonia doping in positive ion mode. Excellent sensitivity (LoD of 0.24 ppb_v and LoQ of 0.80 ppb_v) was noticed; the linear response was up to 10 ppb_v, while saturation occurred at >500 ppb_v. DIMP identification by IMS relies on the formation of two distinct peaks: the monomer M·NH₄⁺, with a reduced ion mobility K₀ = 1.41 cm² V⁻¹ s⁻¹, and the dimer M₂·NH₄⁺, with K₀ = 1.04 cm² V⁻¹ s⁻¹ (where M is the DIMP molecule); positive reactant ions (Pos RIP) have K₀ = 2.31 cm² V⁻¹ s⁻¹. Quantification of DIMP at trace levels was also achieved by GC-MS over the concentration range of 1.5 to 150 μg mL⁻¹; using a capillary column (30 m × 0.25 mm × 0.25 μm) with a TG-5 SilMS stationary phase and temperature programming from 60 to 110 °C, DIMP retention time (RT) was ca. 8.5 min. The lowest amount of DIMP measured by GC-MS was 1.5 ng, with an LoD of 0.21 μg mL⁻¹ and an LoQ of 0.62 μg mL⁻¹ DIMP. Our results demonstrate that these methods provide robust tools for both on-site and off-site detection and quantification of DIMP at trace levels, a finding which has significant implications for forensic investigations of chemical agent use and for environmental monitoring of contamination by organophosphorus compounds. Full article

Background: The detection of explosives in crime scene investigations is critical for forensic science. This study explores the application of laser desorption (LD) ion mobility spectrometry (IMS) as a novel method for this purpose utilising a new IMS prototype developed by MaSaTECH. Methods: The LD sampling technique employs a laser diode module to vaporise explosive traces on surfaces, allowing immediate analysis by IMS without sample preparation. Chemometric approaches, including multivariate data analysis, were utilised for data processing and interpretation, including pre-processing of raw IMS plasmagrams and various pattern recognition techniques, such as linear discriminant analysis (LDA) and support vector machines (SVMs). Results: The IMS prototype was validated through experiments with pure explosives (TNT, RDX, PETN) and explosive products (SEMTEX 1A, C4) on different materials. The study found that the pre-processing method significantly impacts classification accuracy, with the PCA-LDA model demonstrating the best performance for real-world applications. Conclusions: The LD-IMS prototype, coupled with effective chemometric techniques, presents a promising methodology for the detection of explosives in forensic investigations, enhancing the reliability of field applications. Full article