The prevalence of encoded digital trace evidence in the nonfile space of computer media(,) (.).

Abstract:

:Forensically significant digital trace evidence that is frequently present in sectors of digital media not associated with allocated or deleted files. Modern digital forensic tools generally do not decompress such data unless a specific file with a recognized file type is first identified, potentially resulting in missed evidence. Email addresses are encoded differently for different file formats. As a result, trace evidence can be categorized as Plain in File (PF), Encoded in File (EF), Plain Not in File (PNF), or Encoded Not in File (ENF). The tool bulk_extractor finds all of these formats, but other forensic tools do not. A study of 961 storage devices purchased on the secondary market and shows that 474 contained encoded email addresses that were not in files (ENF). Different encoding formats are the result of different application programs that processed different kinds of digital trace evidence. Specific encoding formats explored include BASE64, GZIP, PDF, HIBER, and ZIP.

journal_name

J Forensic Sci

authors

Garfinkel SL

doi

10.1111/1556-4029.12528

subject

Has Abstract

pub_date

2014-09-01 00:00:00

pages

1386-93

issue

5

eissn

0022-1198

issn

1556-4029

journal_volume

59

pub_type

杂志文章
  • Nonmetric sex determination from the distal and posterior humerus in black and white South Africans.

    abstract::The successful identification of human skeletal remains relies on proven diagnostic techniques for sex determination. This research utilized 608 individuals from South Africa (420 men, 188 women) to conduct a blind nonmetric determination of sex from three features of the distal humerus: olecranon fossa shape, angle o...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2011.01724.x

    authors: Vance VL,Steyn M,L'Abbé EN

    更新日期:2011-05-01 00:00:00

  • Infrared spectra of U.S. automobile original finishes (1998-2000). IX. identification of bismuth oxychloride and silver/white mica pearlescent pigments using extended range FT-IR spectroscopy, XRF spectrometry, and SEM/EDS analysis.

    abstract::Bismuth oxychloride (BiOCl) was the first viable synthetic pearl pigment developed 50 years ago. It was only used for a limited time period in automotive paint (model years 1998-2000), serving to produce luster for a single Chrysler black metallic color. Identification of this pigment in an unknown automotive paint ca...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/1556-4029.12414

    authors: Suzuki EM

    更新日期:2014-09-01 00:00:00

  • Death investigation report forms (DIRFs): generic forms for investigators (IDIRFs) and certifiers (CDIRFs).

    abstract::On the basis of data collection procedures and forms used in various death investigation offices, we developed generic death investigation report forms (DIRFs). One form was designed for documenting information collected by the initial investigator of death, and another form was designed for documenting information co...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Hanzlick R,Parrish RG

    更新日期:1994-05-01 00:00:00

  • Identification of ascorbic acid and its degradation products in black powder substitutes.

    abstract::Low explosives such as smokeless powder, black powder, and black powder substitutes have been used in illicit pipe bombings throughout the United States. Some of the newer black powder substitutes are formulated with ascorbic acid, which gradually decomposes as the powder ages, making it difficult if not impossible fo...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Goodpaster JV,Keto RO

    更新日期:2004-05-01 00:00:00

  • Development of latent fingerprints using a corona discharge.

    abstract::A novel technique for the development of latent fingerprints is presented. It is based on placing a fingerprint-bearing object inside a corona discharge induced plasma. The development of various real and artificial fingerprints on metallic substrates under a wide range of conditions is studied. Using the results of t...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Halahmi E,Levi O,Kronik L,Boxman RL

    更新日期:1997-09-01 00:00:00

  • Evaluation of principal components analysis with high-performance liquid chromatography and photodiode array detection for the forensic differentiation of ballpoint pen inks.

    abstract::Inks from seven black and eight blue ballpoint pens were separated by a high-performance liquid chromatography (HPLC) method utilizing a photodiode array detection (PDA). A classifier flowchart was designed for the chromatographic data based on the presence or absence of certain peaks at different wavelengths to quali...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Kher AA,Green EV,Mulholland MI

    更新日期:2001-07-01 00:00:00

  • Psychodiagnostic testing of sex offenders: a comparative study.

    abstract::Two groups of offenders, one charged with sex crimes as well as with crimes of larceny, and the other charged with sex crimes only, are compared with respect to their demographic characteristics and their intelligence and diagnostic classification as determined via psychological testing. ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Bonheur HH

    更新日期:1983-01-01 00:00:00

  • Performance testing of the new AMPAC fire debris bag against three other commercial fire debris bags.

    abstract::Fire debris evidence is collected and stored in a wide range of containers, including various polymer bags. Four different polymer bags have been investigated, including the NYLON, DUO, ALU, and AMPAC bags. The latter is the successor of the Kapak Fire DebrisPAK™. Microscopy and infrared spectroscopy were used to eluc...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2012.02132.x

    authors: Grutters MM,Dogger J,Hendrikse JN

    更新日期:2012-09-01 00:00:00

  • Do sex offenders minimize psychiatric symptoms?

    abstract::With increasing frequency, forensic psychiatrists are called upon to evaluate sex offenders for the courts and criminal justice system. While many clinicians have observed that denial of paraphilia is common in sex offenders, few studies have examined whether this population has severe psychopathology other than parap...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Grossman LS,Cavanaugh JL Jr

    更新日期:1989-07-01 00:00:00

  • Forensic aspects of trace element variation in the hair of isolated Amazonas Indian tribes.

    abstract::Thermal neutron activation analysis and instrumental gamma-ray spectrometry were used to analyze the elemental constituents in the head hair from sedentary Indian populations in the Venezuelan Amazonas region. Concentration values for 30 elements were determined quantitatively, and the presence of 7 others was detecte...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Perkons AK,Velandia JA,Dienes M

    更新日期:1977-01-01 00:00:00

  • Mitochondrial DNA control region polymorphism in the population of Alagoas state, north-eastern Brazil.

    abstract::The sequences of the two hypervariable (HV) segments of the mitochondrial DNA (mtDNA) control region were determined in 167 randomly selected, unrelated individuals living in the state of Alagoas, north-eastern Brazil. One hundred and forty-five different haplotypes, associated with 139 variable positions, were determ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2007.00619.x

    authors: Barbosa AB,da Silva LA,Azevedo DA,Balbino VQ,Mauricio-da-Silva L

    更新日期:2008-01-01 00:00:00

  • Classification of black powder toners on the basis of integrated analytical information provided by Fourier transform infrared spectrometry and X-ray fluorescence spectrometry.

    abstract::Differentiating between black powder toners used in laser printers and copiers can be challenging for forensic examiners. One hundred and sixty-two samples from 82 different types of cartridges produced by 21 manufacturers that are currently available on the Polish market were studied using Fourier transform infrared ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2006.00167.x

    authors: Trzcińska BM

    更新日期:2006-07-01 00:00:00

  • Multiple animal bite wounds: A case report.

    abstract::A case of multiple animal bite wounds is presented along with the techniques used to apprehend the culprits. The victim was a 13 month-old black female who had in excess of 80 puncture wounds. Initially the wounds were thought to be caused by a mechanical instrument but, after an autopsy, were determined to be caused ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Glass RT,Jordan FB,Andrews EE

    更新日期:1975-04-01 00:00:00

  • Problems of reliability in the phenotyping of erythrocyte acid phosphatase in bloodstains.

    abstract::Erythrocyte acid phosphatase is a useful system for the crime laboratory for both fresh and degraded blood and bloodstains, provided the inherent problems of phenotyping this particular enzyme system are recognized. Because of the great number of variables affecting this enzyme system in vitro, phenotyping should not ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Zajac PL,Grunbaum BW

    更新日期:1978-07-01 00:00:00

  • Fatal recreational inhalation of enflurane.

    abstract::We report here a case of fatal enflurane poisoning by recreational inhalation, apparently the first published report of such a case. ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Walker FB,Morano RA

    更新日期:1990-01-01 00:00:00

  • Gunshot residue in Chicago police vehicles and facilities: an empirical study.

    abstract::Suspects in shooting investigations in Chicago are routinely transported in department vehicles and detained in department facilities prior to gunshot residue (GSR) evidence collection. The GSR test results are used to associate the suspect with primary exposure to GSR. The potential for these vehicles and facilities ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2007.00457.x

    authors: Berk RE,Rochowicz SA,Wong M,Kopina MA

    更新日期:2007-07-01 00:00:00

  • The Slovenian population data on the PCR based loci HLA-DQA1, LDLR, GYPA, HBGG, D7S8, GC, and D1S80.

    abstract::Allele frequencies for the loci HLA-DQA1, LDLR, GYPA, HBGG, D7S8, GC, and D1S80 were determined for a sample population of unrelated individuals from Slovenia. All loci meet Hardy-Weinberg expectations, except the loci GYPA (p = 0.041) and D1S80 (p = 0.009). There is little evidence for association of alleles among th...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Drobnic K,Regent A,Budowle B

    更新日期:2000-05-01 00:00:00

  • Detection and Identification of Kratom (Mitragyna speciosa) and Marijuana (Cannabis sativa) by a Real-Time Polymerase Chain Reaction High-Resolution Melt Duplex Assay.

    abstract::Mitragyna speciosa (MS), a plant commonly known as kratom, is a widely used "legal high" opiate alternative for pain relief. DNA extracted from MS and 26 additional plant species was amplified by PCR using primers targeting the strictosidine beta-D-glucosidase (SGD) and secologanin synthase 2 (SLS2) genes and detected...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/1556-4029.14167

    authors: Cowan AF,Elkins KM

    更新日期:2020-01-01 00:00:00

  • Correlations of injury, toxicology, and cause of death to Galaxy Flight 203 crash site.

    abstract::This report details the medical investigation of the crash of Galaxy Flight 203, on 21 Jan. 1985, near Reno, Nevada. Sixty-eight persons died at the scene, two died during hospitalization, and one victim survived. After completion of autopsies on all victims, pathologists determined causes of death based upon injuries...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Salomone J 3rd,Sohn AP,Ritzlin R,Gauthier JH,McCarty V

    更新日期:1987-09-01 00:00:00

  • Sudden death caused by coronary artery aneurysms: a late complication of Kawasaki disease.

    abstract::The authors describe three cases (two blacks and one Latin American) of sudden death caused by late complications of Kawasaki disease (mucocutaneous lymph node syndrome). At autopsy each heart contained multiple coronary artery aneurysms with luminal stenosis caused by intimal hyperplasia and thrombi. Although virtual...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Wreford FS,Conradi SE,Cohle SD,Lie JT,Dana SE,Puri S

    更新日期:1991-01-01 00:00:00

  • Toxicology and sudden infant death.

    abstract::One hundred thirty cases of sudden infant death occurring in Wayne County, Michigan, (population 2.7 million) were analyzed for possible drugs. The toxicological protocol has been outlined. Six cases were found to be positive, and in five of these the drugs found had been prescribed for a variety of illnesses. In one ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Smialek JE,Monforte JR

    更新日期:1977-10-01 00:00:00

  • Decapitation in suicidal hanging--vital reaction patterns.

    abstract::Complete or incomplete decapitation as a consequence of suicidal hanging is very rare, few cases having been reported in the worldwide literature. Posthanging decapitation is typically related to a drop of several meters. Three cases of complete decapitation and one case of incomplete decapitation by suicidal hanging ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/1556-4029.12001

    authors: Hejna P,Bohnert M

    更新日期:2013-01-01 00:00:00

  • Two fatal cases of dichloromethane or chloroform poisoning.

    abstract::The two cases presented here involve deaths that were due to dichloromethane or chloroform poisoning. The dichloromethane and chloroform were determined in biological specimens by headspace gas chromatography with mass spectrometric detector. In one case, dichloromethane concentrations found were 252 mg/L (blood), 75 ...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Kim NY,Park SW,Suh JK

    更新日期:1996-05-01 00:00:00

  • Practical Considerations in Trace Element Analysis of Bone by Portable X-ray Fluorescence.

    abstract::Forensic anthropologists are more often turning to nondestructive methods to assist with skeletal analyses, specifically for trace elemental analyses. Portable XRF (pXRF) instruments are versatile and are able to be used in diverse settings or for specimens of a shape and size that cannot be accommodated by laboratory...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/1556-4029.13103

    authors: Byrnes JF,Bush PJ

    更新日期:2016-07-01 00:00:00

  • An ELISA method for the identification of salivary amylase.

    abstract::An ELISA method for the detection of salivary amylase in dried stains using a monoclonal anti-human salivary amylase antibody was developed. Studies demonstrated the assay to be sensitive down to 0.0002 Sigma units and showed a linear response between absorbance and salivary amylase activity between 0.002 and 0.2 unit...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Quarino L,Dang Q,Hartmann J,Moynihan N

    更新日期:2005-07-01 00:00:00

  • Maggot development during morgue storage and its effect on estimating the post-mortem interval.

    abstract::When insect evidence is obtained during autopsy, forensic entomologists make decisions regarding the effects of low-temperature (-1 degrees C to 4 degrees C) storage of the body and associated insects when estimating the post-mortem interval (PMI). To determine the effects of storage in a morgue cooler on the temperat...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:10.1111/j.1556-4029.2007.00385.x

    authors: Huntington TE,Higley LG,Baxendale FP

    更新日期:2007-03-01 00:00:00

  • Toneline bite mark photography.

    abstract::In bite mark analyses, the initial photograph is critical for the collection and presentation of evidence. A high-contrast film technique previously used primarily in the graphic arts field has been refined and applied to forensic odontology. The process, called toneline, reduces the interpretational bias of the inves...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Robinson E,Wentzel J

    更新日期:1992-01-01 00:00:00

  • A five-year study of mortality in a busy ski population.

    abstract::A 5-year study of a busy ski population in Utah revealed a total at-risk period of approximately 3.5 million skier-days. While the morbidity (fractures, strains, sprains, and occasionally more severe injuries) associated with skiing is well recognized and considered by most physicians concerned to be distributed somew...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Weston JT,Moore SM,Rich TH

    更新日期:1977-01-01 00:00:00

  • Spontaneous pneumothorax in the newborn: a report of two fatalities.

    abstract::Spontaneous pneumothorax is present in 1 to 2% of healthy full-term newborn infants. Virtually all cases have resolution of the pneumothorax without sequelae and in fact without the condition being diagnosed. Two fatal cases are presented. Anyone doing medicolegal autopsies should be aware of this entity so that X-ray...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Norton LE,DiMaio VJ,Zumwalt RE

    更新日期:1978-07-01 00:00:00

  • The distribution of ethanol in postmortem blood specimens.

    abstract::Ethanol was determined by gas chromatography in a variety of tissues and body fluids secured at autopsy in 61 cases. The specimens tested included right and left heart blood, femoral blood, pericardial fluid, cerebrospinal fluid, vitreous humor, urine, stomach contents, and brain. Statistical analysis of the cases rev...

    journal_title:Journal of forensic sciences

    pub_type: 杂志文章

    doi:

    authors: Briglia EJ,Bidanset JH,Dal Cortivo LA

    更新日期:1992-07-01 00:00:00