25 April 2015, Volume 40 Issue 2
    

  • Select all
    |
    Focus
  • A Survey of Video Forensic Technology
    ZHANG Xu,LI Zhi-hui,WANG Xin,PENG Si-long,XU Xiao-jing,WANG Shi-jun
    Forensic Science And Technology. 2015, 40(2): 87-93. https://doi.org/10.16467/j.1008-3650.2015.02.001
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Digital videos and photographs can be altered rather easily since the broad availability of tools for the acquisition and processing in recent years, and using tampered images and videos to extort and threat becomes more and more serious. All these reasons raise the need to verify whether a multimedia content, which can be acquired by a video surveillance system, downloaded from the internet, or received by a digital TV broadcaster, is original or not. Previous work mainly focuses on image forensics, and it is only in recent years that forensic experts have begun specific research into video forensics. Compared with image forensics, video forensics have new challenges such as computing power because of the large amount and the complexity of data, and high compression factor; however, video signals have distinctive characteristics such as encoded mode, spatial and temporal characteristics, and ways of tampering giving video forensics a more abundant contents and broader application prospects. Signal processing experts have been investigating video forensic strategies and have made some progress, using the peculiarities of video signals and footprints left by alterations. Previous overview papers mainly address image forensic technology and only a few details are provided about video forensic analysis, so we present an overview of the video forensic techniques that have been proposed in the literature in this paper. Considering each frame as single image and many of image forensic tools can be applied to video signals as well, we first give a preliminary review of image forensics which provides the foundations for analogous techniques targeting video content in Section 1, such as camera artifacts, compression and geometric/physical inconsistencies. Next, we give a survey of video forensic technology focusing on various aspects related to video forensics such as acquisition, compression, and editing operations, and summarize the strengths and weaknesses of each solution. Then we address video acquisition in Section 2, presenting several strategies to identify the device that captured a given video content. Then, we consider the traces left by video coding, which are used to determine, e.g., coding parameters, coding standard, number of multiple compression steps or network footprints in Section 3. Video doctoring is addressed in Section 4, which presents forensic analysis methods based on detecting inconsistencies in acquisition and coding-based footprints, as well as methods that reveal traces left by the forgery itself such as inconsistencies in content and copy-move detection in video. As the design of novel forensic strategies aimed at image and video paralleled by the investigation of corresponding anti-forensic methods, we provide a brief introduction to anti-forensic techniques in Section 5. Video forensics is becoming research focus gradually, receiving more and more attention, and still presents many unexplored issues that wait for further study and deeper exploration.
  • High Precision 3D Facial Image Database
    XU Lei,LI Zhi-hui,WANG Jun-juan,XIE Lan-chi,ZHANG Ning,WANG Yong-qiang,GUO Jing-jing
    Forensic Science And Technology. 2015, 40(2): 94-97. https://doi.org/10.16467/j.1008-3650.2015.02.002
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Three-dimensional (3D) facial database can be wildly used in computer vision, animated drawing designing, medicine and etc. In forensic science, facial image database is used to classify face features, calculate the distribution of face features, and train the model. These analyses are the base for face identification and recognition. 3D facial image database can provide more information than traditional 2D database. For example, the special structure and shape in 3D facial image include multi-view profile. The 3D facial image capturing methods include multi-view geometry information, structured light and 3D scanning. These methods have different capturing devices and environments. There are several typical 3D facial image databases such as the MPI from MPI lab and the BJUT-3D from BJUT, which have some disadvantages in resolution and precision. In this paper, we first reviewed MPI and BJUT-3D databases and their capturing environments. Then we established our high precision 3D facial image database of Chinese people. 1100 3D facial images had been captured, including their color texture and depth (geometry shape or point cloud) information with Artec Spider, a portable 3D scanner. The number of sampling points of the geometry shape was more than 20 million. The number of triangle surfaces of 3D image was more than 40 million. The results showed that the images in our database exhibited higher precision than those in BJUT-3D database when considering face shape, resolution and texture. Meanwhile, these images presented more details in mouth, nose, eyes etc. than the images in the other databases. The established database would support our further work in 3D facial identification and algorithm evaluation.
  • Acquisition and Pre-processing of 3D Facial Image
    WANG Jun-juan,XU Lei,LI Zhi-hui,XIE Lan-chi,ZHANG Ning,GUO Jing-jing
    Forensic Science And Technology. 2015, 40(2): 98-101. https://doi.org/10.16467/j.1008-3650.2015.02.003
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Three-dimensional (3D) facial image provides diversified information and becomes more and more important. However, acquiring 3D facial images is a challenge especially when we need to get a large number of high-resolution images. It includes device selecting, quality controlling, data pre-processing and so on. In the past three months, over 1100 3D facial images had been captured for our project. This paper proposed some technique improvements when capturing 3D facial images. The first one was device selecting. Artec Spider portable 3D scanner was selected based on an extensive performance comparison. The scanner could capture depth information and color texture. We could get high-resolution 3D image with scan resolution of 0.1mm. The second one was to control the image quality when we captured a large number of samples. Due to the portability of the scanner, the capturing results could be affected by the operator. To avoid this problem, we designed a fixed scanning path to get more stable and reliable results. The third one was data pre-processing. The original scanning result was a combination of curved surfaces, which were aligned by auto-registration. We proposed some manual intervention methods to enhance the composed precision. The final one was the efficiency. It was important to sample a large scale region with reliable data and relatively short time. We analyzed the relation of pre-processing time, image quality and the number (frame) of curved surfaces, and concluded that the optimum number of sample frame was 500~700.
  • Image/Video Evidence
    LI Zhi-hui,XU Xiao-jing,WANG Yong-qiang,LI Zhi-gang
    Forensic Science And Technology. 2015, 40(2): 102-104. https://doi.org/10.16467/j.1008-3650.2015.02.004
    Abstract ( ) Download PDF ( ) HTML   Knowledge map Save
    Image/video materials, which are widely used in criminal investigation, are an important type of evidence. However, there are few discussions on how to use this type of evidence in case investigation and lawsuit. This paper focuses on the evidence features of image/video materials and discusses related problems. Firstly, we review how the Chinese Laws define the image/video evidence and some issues that need to be paid attention are proposed. Secondly we lay our respect on the legitimacy of this type of evidence and the way to guarantee the legitimacy. Thirdly we think over the authentication of the image and video evidence, pointing out that the authentication must be safeguarded with both procedural legitimacy and right techniques. Finally we emphasize the relevancy of the image and video evidence, setting our definition about it, and concluding the approach to enhance the relevancy in conjunction with subjective and objective essentials.
    • Research Articles
  • Victimology in Homicide Crime Scene Analysis (Part I)
    MIN Jian-xiong
    Forensic Science And Technology. 2015, 40(2): 105-107. https://doi.org/10.16467/j.1008-3650.2015.02.005
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Victimology, an emerging discipline, narrowly a branch of criminology, studies the relationship between victims and crime, victims and offenders. Presently most scholars pay more attention to victims' legal status, compensation, prevention, and other things involved. Even if the study is concerning with the relationship between victim and crime, it aims to deeply understand the crime. There are few home and abroad studies about how to use the information of victims for analysis of homicide crime scene. The author tries to use it as a resort to analyze the homicide scene according to the interactions between victims and offenders and in combination with the practical experiences, serially expounding views and opinions to be published in this magazine. The article includes six parts and will be published in installment. After an overview of victimology, twenty-four representative cases analyses are presented to systematically construct and discuss the relationship between homicide scene analysis and such aspects as individual identity, life background, body injury, behavioral responses and life state of victims, with the purpose of assistance in determining criminal motives and characterizing the criminals. The article serves as an informative and valuable resource to draw more peers' attentions to further improve the accuracy of homicide scene analysis, and therefore play a greater role in crime investigation.
  • Study on Fingerprint Examiner's Stability of Feature Selection
    LIU Shi-quan,MI Zhong-liang,LUO Ya-ping,WU Jian
    Forensic Science And Technology. 2015, 40(2): 108-113. https://doi.org/10.16467/j.1008-3650.2015.02.006
    Abstract ( ) Download PDF HTML   Knowledge map Save
    The decision of fingerprint identification depends on the fingerprint examiner's knowledge and experience. The fingerprint identification process is a recognition process which can be described as a process from perceptual cognition to rational cognition. During the process, one of the factors that impacts the quality of fingerprint identification is the capability of the fingerprint examiner. Fingerprint examiners select corresponding minutiae on fingermark in comparison phase and the capability can be measured by fingerprint examiners' stability of minutiae selection. Some research has demonstrated that stability of minutiae selection has influenced the quality of fingerprint identification conclusion, hence it is critical for conducting such fundamental research on stability of minutiae selection for Chinese fingerprint examiners. Our research is focused on analysis of stability of minutiae selection between analysis phase and comparison phase and can help us to understand: how fingerprint examiners understand the minutiae of fingermark in analysis phase; how to control fingerprint impacts fingerprint examiners' decision in minutiae selection in comparison phase; what is the relationship between stability of minutiae selection and fingerprint identification ability. In this study 106 fingerprint agencies around China were invited to take a proficiency test and finish four trials from the same source. The data were collected by web-based software and were analyzed by R statistical software. The results show that different analysts performed differently and fingerprint quality impacted the stability of minutiae selection. If fingerprint quality values were high, examiners reported highly stable minutiae selection, while they reported highly unstable minutiae selection if quality values were low, especially on the border of high quality and low quality area. Stability of minutiae selection can be effectively measured by I, which is defined as Minutiae Variability Index. This suggests that there is a need for developing a tool to assess the quality of fingermarks to predict the performance of fingerprint examiners during the fingerprint identification process. According to distribution of I, manager can effectively evaluate identification ability of agency or examiner and then take effective measurement to improve the stability of minutiae selection (such as document identification activity and add more verification stage) and make sure the quality of the fingerprint identification.
  • Forensic Evaluation of the Time of Rib Fracture
    NI Wei-yong,QIAN Zhao-jun
    Forensic Science And Technology. 2015, 40(2): 114-117. https://doi.org/10.16467/j.1008-3650.2015.02.007
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective Rib fracture is a common injury in clinical forensic identification. According to the current injury degree and disability grade identification standard, different counts of rib fracture will result in different identification of injury degree and disability grade. The theoretic exploration of identification time of rib fracture can give an appropriate identification time for forensic clinical identification staff and avoid missed diagnosis or mistakes. Methods A retrospective study of 40 injury cases involved in rib fracture from 2011 to 2013 in Lishui was conducted. Chest multi-slice CT scanning was performed right immediately, and 2, 4, 6 weeks after injury, respectively. The correlation between the CT findings and timing was studied. The count and location of rib fracture were calculated for each CT examination. The missed diagnosis cases were classified. Bone fractures associated with both fracture line and callus growth and bone fracture with callus growth only in CT scanning were differentiated. The reason for the change of rib fracture count was analyzed. Results Of the 40 cases, 14 and 26 cases showed no changes and an increase in rib fracture sites, respectively. In the newly found 87 rib fractures by reexamination, 62% of them (54) were anterior to the anterior axillary line, 25%(22) were between the anterior axillary line and the posterior axillary line, 17%(11) were posterior to the posterior axillary line. Fracture lines and callus growth could be seen in 69 of the 87 rib fractures. All of them were incomplete fractures, which manifested as mild local interrupted bone cortex in the internal or external sites of ribs. Only local callus growth without obvious fracture lines could be seen in the other 18 fracture sites, which all located on the 2~7 anterior ribs. The count of rib fracture increased in 26 patients with CT scanning in 2 and 4 weeks following injury, while it tended to be steady after 4 weeks. Conclusions Fracture healing can be divided into three stages, including organization of hematoma stage, porotic stage and callus remodeling stage. In the early stage of rib fracture, the fracture line becomes more obvious by the breathing movement, organization of hematoma and the process of osteoclast eliminating the dead bone. But rib fracture may be missed diagnosis because of the unobvious fracture line in the early stage after injury. Rarefaction of bone and thin of bone cortex are main factors which is caused by the old age or the position of anterior rib to make the fracture line unobvious to display in CT images. As the repairing of fracture and calcium deposition in the callus, a gradual increase in density can be found in CT scanning. The direction of the fracture line close to the axle of the CT scanning could cause missed diagnosis of the hairlike fracture line. The thickness of layer over 1mm of CPR and MPR images would easily cause missed diagnosis. Our study shows that injury degree identification followed by CT examination in 4 weeks after injury in individuals with rib fractures is recommended because rib fracture site could be confirmed by callus growth. Missed diagnosis or mistakes can effectively be avoided in this way.
  • QIAcube System in Touch DNA Extraction
    XU Han-fei,FAN Jing-lai,FU Wei-xin,CHEN Li-zhang,YOU Han-jie
    Forensic Science And Technology. 2015, 40(2): 118-121. https://doi.org/10.16467/j.1008-3650.2015.02.008
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective To explore the applicability of QIAcube Forensics Casework DNA extraction system into extracting touch DNA and evaluate the effect. Methods 30 samples were transferred from forensic biological evidence using tape-lifting technique, 30 samples transferred by yarns and 30 samples transferred using double swab technique. All these 90 samples were extracted by QIAcube, EZ1 and SiO2 extraction systems respectively, then quantified and detected by STR typing. Results Up to 44.4% touch DNA were successfully detected by QIAcube extraction system, with successful rate of 56.7% in tape-lifting group, 46.7% in yarns group and 30.0% in double swab group. Both forensic biological evidence of tape lifting group and yarns group got good STR typing results using QIAcube extraction system,and the DNA concentrations were higher than that of swab group. QIAcube and SiO2 extraction system got good STR typing , especially at the large fragment loci,and the concentrations of extracted DNA were higher than that of EZ1 extraction system. Up to 44.4% touch DNA were detected by QIAcube extraction system, while the SiO2 extraction system was 43.2% and the EZ1 extraction system was 26.9%. There was no statistical difference in DNA concentration between QIAcube and SiO2 system, which were both obviously higher than that of EZ1 extraction system. Conclusions QIAcube extraction system is an effective method to extract DNA from forensic biological evidence, applicable into forensic practice.
  • Determination of Zaleplon and 5-O-zaleplon in Urine by UPLC/MS/MS
    ZHANG Lei-ping,HUANG Shuang,SHU Cui-xia,REN Xin-xin,CUI Guan-feng,LUAN Yu-jing,DU Hong-yan
    Forensic Science And Technology. 2015, 40(2): 122-126. https://doi.org/10.16467/j.1008-3650.2015.02.009
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective Zaleplon, a pyrazolopyrimidine drug, is one of non-benzodiazepine sedative hypnotic drugs. As a new kind of hypnotic, it is an improvement of traditional benzodiazepines in treatment of insomnia. In 2007, the International Association of Forensic Toxicologists (TIAFT) listed zaleplon as one of the new type of abuse drugs since it was often used in drug-facilitated cases. Zaleplon acted rapidly, and victims were less able to recall the circumstances under which the offence occurred due to its amnesic properties. The hypnotic acts within 0.5h and has short half-life (0.9~1.1h). Because its ultra-short half-life, low frequency of use, and short window of detection, zaleplon has been detected in few clinical and forensic cases. Urine samples are most likely to be useful in cases of drug-facilitated crimes as its detection window is longer than that of blood or plasma samples. 5-O-zaleplon is a main metabolite of zaleplon in biological body. In order to improve detectable rate of zaleplon poisoning cases, we established an ultra-performance liquid chromatography tandem mass spectrometry (UPLC/MS/MS) assay for simultaneous determination of zaleplon and its main metabolite 5-O-zaleplon in urine samples. Methods Aliquots of 0.2mL urine samples were used for the analysis. Zaleplon and its main metabolite 5-O-zaleplon were extracted with two-step method using acetonitrile to precipitate protein and 96-well plates to deplete phospholipid. The separation was performed on a ZORBAX Eclipse Plus C18 (2.1mm×100mm, 1.8µm) analytical column by Shimadzu 30A-LC ultra-performance liquid chromatography. The MS/MS analysis was performed on API 5500 QTRAP tandem mass spectrometry. The column temperature was maintained at 40℃, while the sample plate was maintained at 4℃. By comparing different chromatographic column, different mobile phase, different gradient, and optimization conditions of mass spectrometry, we established the liquid chromatography-tandem mass spectrometry method. The mobile phases consisted of acetonitrile (mobile phase B) and water containing 0.1% formic acid (mobile phase A), and the flow rate was 0.4mL/min. MS-MS in the multiple reaction monitoring (MRM) mode via positive electrospray ionization mode (ESI+) was used. The retention times and the two parent/daughter ion pairs were used for qualitative analysis, and the first parent/daughter ion pair was used for quantitative analysis. Results Zaleplon and 5-O-zaleplon in urine samples were separated well. There were no interferences of endogenous impurity. The chromatographic separation time was 4 min. Calibration curve of zaleplon was linear within the range of 0.1~50ng/mL and calibration curve of 5-O-zaleplon was linear within the range of 0.25~50ng/mL. Regression equations were y=70393x+33700 and y=34491x+16854, respectively. The limits of detection for zaleplon and 5-O-zaleplon were 0.05ng/mL and 0.1ng/mL. The recoveries of zaleplon and 5-O-zaleplon were more than 90%. The inter-day and intra-day precisions were less than 10%. Conclusions This method is rapid, sensitive and effective. It is suitable for determination of zaleplon and its main metabolite 5-O-zaleplon in urine sample. It can be a solution to prolong the window of detection and applied to forensic toxicological analysis.
  • Application of ICP-MS in Liquor Examination
    HAN Xing-xing,GUO Hong-ling,MEI Hong-cheng,QUAN Yang-ke
    Forensic Science And Technology. 2015, 40(2): 127-130. https://doi.org/10.16467/j.1008-3650.2015.02.010
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective As the cases about manufacturing and selling fake and shoddy liquor increase, examination and identification of different liquor precisely is becoming an important technical support to crack down on such illegal and criminal activities. Inductively coupled plasma mass spectrometry (ICP-MS) is highly sensitive and has low detection limit (ppb level or even lower) and capability of simultaneous multi-element determination. Therefore, this paper tried to quantitate multi-trace-elements in liquor simultaneously by inductively coupled plasma mass spectrometry, and to establish a method for classifying or even identifying different kinds of liquors according to their multi-element content parameters. Methods Under the optimized condition of ICP-MS, we established the standard working curve of 7Li, 39K, 51V, 63Cu, 75As, 88Sr, 208Pb with their standard solution. For the liquors to be examined, pipetting 20mL into a beaker and heating and evaporating to certain volume, digesting with nitric acid (spectrum pure), transferring to the volumetric flask and diluting with ultrapure water to the volume, and then analyzed by ICP-MS. Results The content of each elements in the liquor was calculated by the standard working curve method. The contents of the 7 kinds of element were divided into four ranges, coded as A, B, C, D, respectively. 21 kinds of common liquors was coded according to their 7Li, 39K, 51V, 63Cu, 75As, 88Sr, 208Pb level and the corresponding content ranges. Each of these liquors obtained a seven-letters code, and it was easily to distinguish them from each other accurately according to their seven-letters code. Conclusions The ICP-MS method established in this paper is sensitive, accurate, and capable of simultaneous multi-element determination. Combining ICP-MS quantitation method and multi-element content classifying method, different kinds of liquor could be identified accurately. These methods can be widely used in liquor examination.
  • Electric Resistance Measurement and Spectral Imaging in the Examination of Added and Overwrite Handwriting
    Han Wei,Huang Jian-tong,Zhang Yu-sheng
    Forensic Science And Technology. 2015, 40(2): 131-134. https://doi.org/10.16467/j.1008-3650.2015.02.011
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective Generally, the optical properties, chemical and physical characteristics of writing inks are helpful to identify the added and overwrite handwriting in the examination of questioned document, but it does not work for most carbonaceous ink marks. This paper provides a non-destructive, convenient and effective testing method for identifying the added and overwrite handwriting by black gel ink. Methods Added and overwrite handwritings with black gel ink were examined by electric resistance measurement and spectral imaging technique. The difference of resistance value and spectrograms between questioned carbonaceous ink marks and known black pen marks were analyzed for determining authenticity of the writings. Results The handwritings written by black gel inks made with different types of pigments were classified by their resistance value and spectrograms. Conclusions The electric resistance measurement and spectral imaging technique, which breaks through the limitation of morphology inspection in detecting altered handwriting written by carbonaceous black gel inks, basing on the quantitative detection, can make the final conclusion more scientific and reliable.
  • Examination of Smeared and Covered Black Gel Pen Handwriting by Transmission Spectral Imaging
    HOU Jin-ling,ZHANG Jian
    Forensic Science And Technology. 2015, 40(2): 135-137. https://doi.org/10.16467/j.1008-3650.2015.02.012
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective To establish a non-destructive, efficient and direct method for visualizing the handwriting covered and smeared by black gel pen inks. Methods 306 smeared and covered handwriting samples prepared with 18 kinds of black gel pen were analyzed by using Nuance420 Spectral Imaging with the technique of transmission spectral imaging, compared with reflective spectral imaging. The results were divided into two types: visual and non-visual. The standard of classification was whether common people who had never seen the original handwritings could correctly recognize the smeared and covered characters. Results Of 306 test samples, 231 samples were visual and 75 ones were non-visual with transmission spectral imaging technique. The visualized rate was 75.49%, by contrast with the visualized rate of 51.96% with reflective spectral imaging. Conclusions Transmission spectral imaging could differentiate the handwriting smeared and covered by black gel pen inks with the exception that the original writings and the smearing and covering layer used same or similar composition inks. Therefore, the technique of transmission spectral imaging is an efficient choice to uncover the smeared and covered handwritings by black gel pen, which can be applied in questioned document examination.
  • USB Device Usage Traces in Windows Environment
    DUAN Yan-bing,LUO Wen-hua
    Forensic Science And Technology. 2015, 40(2): 138-141. https://doi.org/10.16467/j.1008-3650.2015.02.013
    Abstract ( ) Download PDF HTML   Knowledge map Save
    In the practice of digital forensics, the key evidence to prove the criminal facts mostly exists in the mounted USB devices. To obtain the usage traces of inspecting USB devices ever being mounted is a typical identification requirement of digital forensics. There are some existing forensic tools that support the analysis of such information. However, extracting traces in actual work is not accurate (especially USB device serial number) and not complete (such as lacking the information of USB drive letter). It is difficult to meet the need of forensic practice. In order to make up for deficiencies, this paper investigates USB devices usage traces from two aspects based on the perspective of the electronic data forensics. One is using the registry to inspect USB devices usage traces. The registry is the main and important source of USB devices usage traces. This paper describes the forensics of USB key and USBSTOR key in detail, and gives the extracting method of temporal information and correlation method with MountedDevices key. It also provides the analysis of UMB key that is the new increase of Windows 7 system. UMB key covers the important information for USB key and USBSTOR key, which indicates the information of USB drive letter and makes up for the defect of MountedDevices key. The other aspect is using the system files to inspect USB devices usage traces. This also has direct significance for meeting forensic requirements. Setupapi.dev.log file in Windows 7 system partition contains the data about the equipment replacement, the driver change and the important system modification. The investigation and analysis of Setupapi.dev.log file usually obtains the same effect as that of registry. The system log in Windows 7 event log increases the audit to USB devices. It records the unloading information of USB devices. The shortcut files in Recent folder contain the target file attributes and users' operation information, which can change with user behaviors. Using WFA tool and Windows 7 files with extension automaticDestinations-ms can resolve the target file information of the shortcut files in the Recent folder. IconCache.db is the icon cache file for windows system. Users' behaviors using Windows system can gradually add to the IconCache.db file, including the information of file icon, storage path and so on. Using IconCache.db file also can analyze the usage traces of USB devices. When users connect USB storage devices to computer system, the information will be added to the IconCache.db database if the root directory contains executable program. In addition, this paper expounds how to rely on the system files to make a supplementary investigation of USB usage traces in the case of the relevant registry keys being cleared. Proved by practice, the method is accurate and efficient.
  • Bypass for Screen Lock of Android Smart Phone
    WANG Ji-mo,JI Chao-hao,PEI Hong-qing
    Forensic Science And Technology. 2015, 40(2): 142-145. https://doi.org/10.16467/j.1008-3650.2015.02.014
    Abstract ( ) Download PDF HTML   Knowledge map Save
    It is quite common to come across a locked mobile phone in case investigations. How to bypass the screen's lock presents a challenge towards digital forensic investigators. This article focused on bypassing the locked screen of Android smart phones. Three different types of Android passcodes, gesture, PIN code and complex, were introduced along with their storage principle and file structures. To make the brute forcer successfully get the pattern code depended on acquiring the passcode key file. Bypassing the screen lock could be achieved by using ADB (Android debug bridge). Two different approaches to solve the problems on getting passcode were suggested with the conditions of mobile phone's USB debugging mode at on or off. When USB debugging mode was on, investigators could try to gain root access into the phone and apply adaptable method to decrypt or remove the screen lock. But if the USB debugging mode was off, the custom recovery method could be used to flash on the phone to gain the access into file system. The bypassing of a Samsung GT-i9300 phone's passcode was taken as an example to demonstrate the actual application of the methods described in the paper.
    • Reviews
  • Progress of Solid-phase Extraction Coupled with Chromatograph-Mass Spectrum in Toxicological Screening
    ZHANG Ze-nan,CHANG Jing,WANG Fang-lin,YU Zhong-shan,ZHANG Yun-feng,CUI Guan-feng
    Forensic Science And Technology. 2015, 40(2): 146-150. https://doi.org/10.16467/j.1008-3650.2015.02.015
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Solid-phase extraction (SPE) is one of sample pretreatment technologies developed in recent years, which separates target compounds from biological complex matrixes and impurity by using the sorbent absorption. The sample pretreatment process of SPE is simple and convenient, which has been widely used in pharmaceutical analysis, food testing, environment monitoring, forensic science and other fields. Solid-phase extraction can separate target substance from complex matrix with high recovery, which makes it play an important role in the field of forensic science. As the method for separation and analysis, chromatography-mass spectrometry can separate components from each other according to their different properties, and provide abundant structural information in the analysis, while has high specificity and sensitivity and wide scope of application, etc. Solid-phase extraction-chromatography-mass spectrum with the characteristics of high-effective extraction, purification, fast detection speed and high sensitivity, is currently an important means for toxicological screening, which combines the advantages of solid phase extraction and chromatography mass spectrometry technology. It has been extensively used for environmental monitoring, drug analysis, and forensic science field recently. The key of the application of solid-phase extraction and chromatography-mass spectrometry technology in forensic science is to optimize the conditions of simultaneous screening of drugs with different properties from complex biological matrix. The progress of solid-phase extraction-chromatography-mass spectrometry technology in the toxicological analysis is reviewed in this paper, according to the natures of drugs including acidic drugs, basic drugs, as well as common pesticides and different types of biological samples including biological fluids, tissues, and hairs , in order to provide reference for forensic toxicological analysis.
  • Research Progress of Immunohistochemical Markers for the Postmortem Diagnosis of Myocardial Infarction
    ZHANG Shu-guang,JIA Fu-quan,WU Yan
    Forensic Science And Technology. 2015, 40(2): 151-154. https://doi.org/10.16467/j.1008-3650.2015.02.016
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Myocardial infarction, one of the main mechanisms of cardiac sudden death, is caused by the reduction or even worse interruption of coronary artery blood supply to render local myocardial necrosis through serious and lasting ischemia and hypoxia, making the death cause difficult to determine in forensic medicine. Postmortem corpse is often involved with physical and chemical changes, tissue autolysis, and affected by the external environment, thus letting the diagnosis hardly ascribe to myocardial infarction. The technology of immunohistochemistry brings more objective detections and more observable indicators for the pathologic and organic diagnosis of acute myocardial infarction. Immunohistochemical indicators, characteristic of high sensitivity, strong specificity and stability, have been affiliated to diagnose the post-death myocardial infarction in forensic pathology. Presently it is being divided into three categories, intrinsic myocardial intracellular adhesion proteins, plasma components of myocardial cells and expressed substances induced by anoxic cardiomyocyte. This paper reviewed the immunohistochemical indicators currently paid more studies by domestic and overseas researchers in the forensic postmortem diagnosis of myocardial infarction along with those in the research forefront in addition to prospecting the tendency of future research. For the actual cases, the combinatorial detection of several immunohistochemical indicators will provide reliable evidence for the forensic diagnosis of myocardial infarction in succession of complete exclusion of violent, poisoned plus certain kinds of natural deaths.
    • Technical Notes
  • Elimination of Blood Interference in Paint Evidence Analysis
    SUN Zhen-wen,QIAO Ting,TAO Ke-ming,QUAN Yang-ke
    Forensic Science And Technology. 2015, 40(2): 155-157. https://doi.org/10.16467/j.1008-3650.2015.02.017
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Paint evidence is usually encountered in hit-and-run accident. Transfer of trace paint occurs frequently in the striking process of the objects involved. It's unavoidable that the paint smears are contaminated with environmental substances. Besides common contaminants, such as fibers, oils and dusts, the contamination may also come from blood or other materials. In order to achieve reliable conclusions, some countermeasures are required to recognize these interferences. This paper introduces a comparison examination of smeared paint samples from the victim's clothes and the known paint chips of the suspected hit-and-run truck. Microscopic examination of physical features of the paint samples was performed with a stereomicroscope first; the organic components and elemental compositions were then analyzed with Fourier transform infrared spectroscopy (FT-IR) and scanning electron microscopy with energy-dispersive X-ray spectroscopy (SEM/EDS), respectively. There were some spectral differences between the smears collected from the “bloodstain” area and those from the other area of the victim's clothes. FT-IR results indicated that there were two possibilities: (1) the smears on the victim's clothes might come from two different kinds of paint; and/or (2) the smears collected from the “bloodstain” area of the victim's clothes might be contaminated by other substances. Contamination of the “bloodstain” area was not discernible with visual inspection. However, being aware that the sample could have been contaminated by blood, we examined a piece of known bloodstain by IR, it showed strong bands at 1658 cm-1, 1544 cm-1 and 1240 cm-1 which were respectively attributed to the amide I, II and III, the typical absorption bands of protein. After software-enabled subtraction of the blood spectrum, the resultant spectrum of the smear sample collected from the “bloodstain” area showed no essential difference from those of the samples taken from the other areas, therefore, the smears collected from the victim's clothes were supposed to be the same kind of paint. As the IR spectrums of the smears on the victim's clothes and the paint from the suspected truck had no essential differences, combined with the results of SEM/EDS elemental analysis, the smears on the victim's clothes very likely came from the suspected truck. The application of infrared spectral subtraction can help determine the chemical component of smeared samples.
  • Genetic Polymorphism of 3 STR Loci of Han Population in Fujian
    ZHENG Wu,YANG Kun,ZHAN Yi-yu,HUANG He-ming,XU Cai-long,JIANG Dao-he
    Forensic Science And Technology. 2015, 40(2): 158-159. https://doi.org/10.16467/j.1008-3650.2015.02.018
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective To investigate the genetic polymorphism of 3 short tandem repeat loci (D6S1043、D12S391 and D1S1656) of Han population in Fujian, China. Methods PCR amplification and capillary electrophoresis were used to determine the genotypes of 3 STR loci for 400 non-relative individuals. Results 21 alleles were identified in D6S1043 while 13 ones in D12S391 and 15 in D1S1656. The heterozygosities of the loci D6S1043, D12S391 and D1S1656 were 0.877, 0.850 and 0.840, respectively, with polymorphic information contents of 0.870, 0.830 and 0.810, discrimination powers 0.972, 0.956 and 0.952, and probability of paternity exclusion 0.749, 0.694 and 0.674, respectively. Statistical analysis of 3 STR loci showed that their discrimination power was greater than 0.9 with both their polymorphic information content and the heterozygosity greater than 0.8. Conclusions These 3 STR loci (D6S1043, D12S391 and D1S1656) can be applied in the individual identification and paternity test in Han population of Fujian, China.
  • A Fast Method of Pubic Symphysis Age Estimation Using Excel
    WU Dong,WANG Kai
    Forensic Science And Technology. 2015, 40(2): 160-161. https://doi.org/10.16467/j.1008-3650.2015.02.019
    Abstract ( ) Download PDF HTML   Knowledge map Save
    The traditional method to calculate age by observing the pubic symphysis requires the investigator to import obtained variable value into equation one by one, therefore relatively time-consuming and prone to miscalculation. A simple and convenient approach is introduced for age estimation of pubic symphysis using Excel. There are three steps. Firstly, the equation of quantitative theory Ι and that of stepwise multiple regression are implanted into Excel. Secondly, LOOKUP and SUM formulas in Excel are used for data processing. And thirdly, Excel table is converted into a specific format where the pubic symphysis age will come up after “morphological changes” is simply clicked sequentially. This method is relatively simple, quick and prone to few errors.
  • Touch DNA Testing in Car Accident Investigation
    JI Zhong-hua
    Forensic Science And Technology. 2015, 40(2): 162-163. https://doi.org/10.16467/j.1008-3650.2015.02.020
    Abstract ( ) Download PDF HTML   Knowledge map Save
    This paper introduces analysis of fingerprint DNA collected from accidental vehicles. Fingerprint on the steering wheel and gear lever was developed with 502 glue, and EZ-tape was used to collect the shed cells. DNA was extracted with Chelex-100 and magnetic bead-based method, and DNA purification and quantification were performed. PCR reaction was optimized by properly adding 4μL of DNA template and increasing PCR cycle number to 32. PCR products were run in ABI3130 with 10s extension of the injection time, and STR profiles were determined. This method had been successfully applied in 2 car accidents and the drivers were identified.
  • Rapid Detection of Zopiclone
    ZHAO Hai-yu,KAN Xu-sheng
    Forensic Science And Technology. 2015, 40(2): 164-165. https://doi.org/10.16467/j.1008-3650.2015.02.021
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Zopiclone, one kind of new generation of sedative-hypnotic of the cyclopyrrolone compounds, has different chemical structures and different pharmacological function from that of the first and second generations of the hypnagogue like barbitals and benzodiazepines. Recently, in a robbery case, the suspects utilized the zopiclone to anesthetize the victims. In our laboratory, the blood sample of the victim was treated with acetonitrile to precipitate the proteins and the supernatant was separated through an Allure PFP Propyl column (5μm, 100mm×2.1mm) with the mobile phase containing acetonitrile (diluted to 70% by the buffer of 10mmol/L ammonium acetate mixed with 0.1% formic acid). The AB Sciex 4000Qtrap mass spectrometer equipped with an electro-spraying ionization source was used to detect two ion combinations of m/z 389.3/345.4 and m/z 389.3/245.2 by multiple reaction monitoring (MRM) for qualitative analysis of zopiclone. Finally, zopiclone was detected in the blood of the victims.
  • Identification of N,N-diallyl-5-methoxytryptamine in Seized Tablets by GC/MS
    ZHENG Shui-qing,LIANG Chen,WANG Wei,ZHANG Run-sheng
    Forensic Science And Technology. 2015, 40(2): 166-167. https://doi.org/10.16467/j.1008-3650.2015.02.022
    Abstract ( ) Download PDF HTML   Knowledge map Save
    Objective To establish a method for identification of N,N-diallyl-5-methoxytryptamine by GC/MS. Methods The sample was extracted with methanol in ultrasonic bath. And the supernatant was injected into GC/MS. Results Unknown component (tR=10.45min) presented characteristic fragment ion peaks at m/z 110.1 (base peak), 270.1, 174.1, 160.1, 145.0, 130.1 and 117.1. According to relevant literatures and mass spectrometry analysis, this drug was identified as N,N-diallyl-5-methoxytryptamine. This compound belonged to tryptamines. Conclusions Method established in this paper is simple, accurate, and suitable for identification of N,N-diallyl-5-methoxytryptamine.
  • Imaging Perspective Measurement in Scene Reconstruction
    LIU Jun
    Forensic Science And Technology. 2015, 40(2): 168-169. https://doi.org/10.16467/j.1008-3650.2015.02.023
    Abstract ( ) Download PDF HTML   Knowledge map Save
    A growing number of traffic accidents have occurred in recent years. The determination of the main liability in traffic accident will cause controversy. Crime scene investigators need to fix the scene of the accident by photography and field survey measurement. However, some inaccuracies and omissions may occur when taking a photograph due to many reasons and thus cause some problems in determination of traffic accident liabilities. By applying imaging perspective measurement method and image superposition method with Photoshop CS4 (Referred to as PS) software, it can solve part of these problems. We take a traffic accident occurred in Shaanxi province for example to illustrate. When the crime scene investigators took a photograph at the scene of the accident, they missed some details, which made it difficult to determine the liabilities. Then the methods mentioned above was used and the results indicated that the car parking between the slow lane and the emergency lane should be mainly responsible for the accident. The experimental results demonstrate that imaging perspective measurement method can be accurate and the image superposition method can provide a reference. The actual application should also depend on the specific situation.
  • A New Data-recovering Method for Video Surveillance Device
    GUO Li-li,KANG Yan-rong,LONG Yuan,ZHOU Dong-lin
    Forensic Science And Technology. 2015, 40(2): 170-172. https://doi.org/10.16467/j.1008-3650.2015.02.024
    Abstract ( ) Download PDF HTML   Knowledge map Save
    An electronic forensic case, in which video data was deleted from its video surveillance device named “Juanvision”, was presented for us to recover the video data. Some traditional methods were tried but did not work. Through searching and analyzing the documents developed by the manufacturer of that video surveillance, we found the software named Diskbackup. The data-recovery method was established by analyzing the binary encoding of the video time and utilizing Diskbackup. The deleted data was successfully recovered, and the method established was proven to be more efficient, accurate.

Author Center

Review Center

Journal Online

京ICP备09053967号-3
Copyright © Forensic Science and Technology, All Rights Reserved.
Tel: 010-66269489，010-83752624　E-mail: xsjsbjb@163.com
Powered by Beijing Magtech Co., Ltd.