Monday, December 28, 2009

December 2009 (2)

As always the last days of the year are very good to finish deadlines, and finish casework and preparing courses for next year. The ideal situation to finish all work since there are no meetings and it is more quiet at the laboratory since many people have vacation.

From January 1st we have a new law on Forensic evidence active in the Netherlands, with an official register of experts at . So it is interesting how this will work, since there are no experts in this register yet. However it is expected to be a good approach for the quality of forensic expertise in the Netherlands.

Currently we send out a proficiency test for camera identification and also organized the CAMCOM competition, where more people are interested to participate. It is interesting what will happen here.

Also I am working on a workshop on forensic multimedia analysis for the AAFS and looking on how to improve the training we give on digital evidence in general, with more interactive learning.

The good thing is now that I do not have any backlog in casework anymore, since we have better caseload management procedures in place, and this approach seems to work. So for the first time since 1991 I see an approach that works in practice, which also makes visible what are capacity is for casework, and also takes into account the more complicated cases.

Finally also my health improved, since I had issues with some of the medicines for asthma, that worked on coronary spasms with the betamimetics and also with ipratropiumbromide inhalers (which is a complication that is not very common). After good interaction between the cardiologist and the lung doctor, finally since this month I have a treatment that appears to work without all the complications I had before. So it appears after all a good start for 2010.

Sunday, December 13, 2009

Visit Tokyo

At evening also went to Electric City Akihabara. In 1996 I have worked for 3 months in Tokyo, so I know this place well. The prices are the same as in the Netherlands, and even diner and hotel seems to be cheaper then in the Netherlands. I had a 11 hours direct flight with KLM, and after that I just did a short visit there. Public transportation in Tokyo is very clear and all signs are in English as well as there chipcard system which works very well.
Posted by Picasa

December 2009

In November I had a busy month, so not much time to update the ongoing work. Busy with casework as organizing a conference for digital evidence in the Netherlands for the Dutch police. Also a presentation on for European Security Round Table Working Group ESRT on forensic science, which also was a result from a meeting of FIDIS.

Currently we are also distributing a proficiency test for camera identification, where we send out a camera and ask to compare these with ten directories of images. Of course also some work for the AAFS in reviewing membership applications and preparing the handouts for the totally revised workshop on Forensic Multimedia. Another challenge we organize is the CAMCOM-challenge for camera identification for ICPR.

Last week I also attended a meeting in Tokyo of the IOCE, where I gave two presentations : one on 17025 in digital evidence and one on the ENFSI Forensic IT Working group. We also discussed the ISO 27037 standard on Guidelines for identification, collection and/or acquisition and preservation of digital evidence where also from ENFSI Forensic IT there were 84 proposals for changes.

Next year we will have our working group meeting of ENFSI Forensic IT in Moscow in September 2010.

Sunday, October 18, 2009

October 2009

I had a short vacation in Helsink, Finlandi and Tallinn, Estonia. Also I went for two days to the Digital Imaging working group conference of ENFSI. I organized a workshop for identfication of cameras with PRNU , since I was planning to organize a collaborative exercise / proficiency test for this field, and furthermore would like to collaborate in a European project on this, however as always we need to find the time.

I was also maintaining my website, and it appeared that my forum had to be cleaned up, and was not used for a while. On line forums and mailing list are sometimes unpredicatable in their behavior, as I also experience with the FORENS-L list which I host. In the past it was not necessary to moderate, however nowadays it seems to be unavoidable, since flames occur.

This month I have my caseload to handle on the different cases, with also a reconstruction at the scene of crime. Also we are working on the WCIT 2010 on the cybersaftey and security track, which is a public private partnership.

Sunday, September 20, 2009

September (2) 2009

I enjoyed the EAFS conference very much. We organized the workshop on Digital Evidence, and it appeared that we had good attendance from experts within different fields. It remains an issue to make a good workshop were people also can do some hands on and it is not a plenary kind of thing. Of course working in smaller groups can solve this issue. I had also some time to relax in Glasgow, and discuss with colleagues on issues in forensic science.

On Friday morning I chaired a session on Digital Evidence, where Peter Sommer was the keynote speaker. He was giving an overview of the rate of change, and the issue that forensic peer reviewed articles can not follow this rate of change. So not all specific methods in digital evidence that are used in court are peer reviewed, since often one has to do research and reverse engineering to find the particular digital traces, and it is used in that specific case. So if someone would like to follow Daubert exactly, it appears that the exact method is not peer reviewed. Of course a general approach of using digital evidence is described however in digital evidence, also in guidelines of ENFSI . A solution might be a peer review of the method during the case by other experts. Another issue is that most forensic scientist are often loaded with casework and do not have time to publish.

It was good to be at this conferences, and although the papers varied in quality, I had good discussions, and I always learn from these conferences, and see the different approaches within different law systems. The good thing that we also have within our working group is that there is a new standard being developed for collecting Digital Evidence, which should be ready in 2012. It is standard ISO 27037 which will be developed now. I think it is very good since very often digital evidence, such as emails and logfiles will cross borders and jurisdictions if cases are on internet.

After that I had a week to recover, and work on some casework and new Research and Development. Last Friday I went to Brussels and talked to several people of the European Commission concerning the developments in forensic IT within Europe. Also I was discussing on the program of WCIT 2010 which also handles the rate of change, and the issues and solutions around it. The NFI is the organiser of a track within this conference, and we are looking further in this program.

Budgets are currently tighter within most forensic institutes and government agencies, so we always have to consider more efficient ways on processing forensic examination, and maintaining the high quality. It will give new solutions, and approaches, as long as long term investments are continued. Training and education is always necessary on all levels such that the law enforcement knows limitations and possibilities of forensic evidence, and of course it remains important to have good guidelines which are easy to use and easy to understand, such that important forensic evidence will not be destroyed by accident.

Monday, September 07, 2009

September 2009

This month starts with a conference in Wiesbaden, Germany at the BKA of the ENFSI Forensic IT Working group. Really excellent talks, and also ideas for joint European Projects within the EU. It is good that proficiency tests are organized, which is a form of collaborative exercise to check if we all have the same results of a case. Also many developments in the field which is always changing rapidly are discussed. It is important to exchange results of Research and Development, since we would otherwise do the same twice with limited amounts of money. The organization was really excellent by the BKA, and we also visited a wine producer in this area known from the Riesling wine, as was organized as gala dinner in the evening.
The second week if for me the EAFS 2009 in Glasgow. Many forensic scientist will visit this conference, where I am looking forward to speak with many colleagues. I have organized a workshop on the Tuesday and will present two papers on the Friday. The week after that I will be at the NFI, and of course doing casework and looking how things have developed.

Tuesday, September 01, 2009

September 2009

With last month the DFRWS Digital Forensic Research Workshop in Montreal, I had vacation in Boston and Vermont. Vermont is a beautiful green state. It was at the same period as the hurricane Bill, however I did not have much issues with it. It moved with me to Montreal, and then we went over it to Amsterdam. I worked a day at the institute, and I received an request of a proscecutor to clarify my report since there was some discussion on a sentence in my report. It is always good to get this kind of feedback.

Currently I am in Wiesbaden, Germany, at the ENFSI Forensic IT Working group conference . I am preparing the general presentations as chairman, and some of the issues that we have. Of course I will shortly discuss about the NAS-report, and implications, and furthermore on some proficiency testings. It is excellently organized, and the city of Wiesbaden, Germany is very nice.

Next week the European Academy of Forensic Science will have their conference in Glasgow. I am currently preparing a workshop, and some papers on defraser ( and prnu compare also open source.

It is an exciting time, and of course I have to care not to get the H1N1 flue in the meantime, since I have moderate asthma, however it is also statistics that are involved in this. Lots of travelling these months, and I hope we will have some good projects also on PRNU, and I am looking forward to organize a proficiency test on this, and propose it in London during a workshop at the Forensic Digital Imaging Workshop. Perhaps we should already ask for some European funding, since the financial situation is getting worse due to cuts in projects and budgets, which is of course also not good for the economy as a whole, however is sometimes necessary (and I hope the right things are selected, which is not easy). When I come back, of course I will spend lots of time on casework and administative work.

Monday, August 17, 2009

August 2009 (2)

This month I suddenly had to go to a court case in Amsterdam to testify. I had to wait from 2 to 6 pm in the court and witnessed a battle of experts. After that I could testify in the evening, and it gave me also strengthened me in the opinion that good validation, and testing different hypothesis is important in forensic science, together with clear interpretation and statistical evaluation in an understandable way for the court is needed. This was also one of the main issues within the NAS report of Strengthening Forensic Science in the United States.

Currently I am at the DFWRS- conference, and just gave a keynote talk on Opportunities and Challenges in Digital and Multimedia Sciences. It is an excellent conference where also the issue of having good validation based on ground thruth databases is discussed, and the issue of using software for analyzing forensic evidence with minimal standards is reproducible and reliable. The issue of the paradox of the zero-skill tools which are most optimal for wide use within police was also discussed. I also discussed our PRNU-tool with the new version where more batch processing is possible. We need also large databases for open source. Also the camera databases would be excellent to have for verification and validity of camera comparison.

Sunday, August 09, 2009

August 2009

This week I we have the meeting for the International Computational Forensics Workshop at the Netherlands Forensic Institute , where I am looking forward to. The proceedings have been published by Springer.
As you can see we have good weather in Zandvoort where I live.
Next week I will be at the Digital Forensic Research Workshop (DFWRS) conference where I will give the keynote address. I am preparing the presentation, and of course certainly will address the NAS-report, the need of fast peer review within the area of digital Evidence (where I think the journal Digital Investigation works very rapid, since the articles are prepublished now, as also an article of Wiger and me.
This summer I had some time to work on the backlogs, so I think we can do the cases on time now. Summers are always good for working on backlogs, since the number of cases that arrive are less then during normal periods. And the summer period is excellent for working, since you are not disturbed by phone calls and meetings, due to the fact that most colleagues are on vacation. Some people say that this also might happen if there is a flue pandemic, since we are not allowed to have too many meetings then. Working from home is also good for the number of publications, since this is what one easily can do from home (casework is more difficult), and this might also work on having more peer reviewed articles in the area.
In september I will have the ENFSI forensic IT working group meeting in Wiesbaden, and at the EAFS in Glasgow also give a workshop, a paper, a poster and chair a meeting there. It is always a good venue to meet other forensic scientist, and to keep up with the developments.
Today I also received a phone call of the Netherland cyclist union if I would like to work with them on the situation for cyclist in Zandvoort since I wrote the city of Zandvoort a letter concerning the bike lanes. Of course it is nice to do this, since sometimes volunteer work is also nice to do next to your regular job as a forensic scientist.

Saturday, July 18, 2009

July 2009

Just finished some casework for the vacation. It appears that I have more time than originally planned, since I do not have to testify in a case overseas. Sometimes forensic science can be inpredictable in planning. In the meantime I had some work on cases with different opinions of several expert witnesses, and analysing the forensic work behind these.

I am also preparing on the Digital Forensic Research Workshop in Montreal, where I am invited speaker It is an excellent conference with a challenge, and I am looking forward to it. The week before we have our International Workshop of Computational Forensics IWCF09 and I received a message from Springer that the conference proceedings have been nearly finished.

In September, I will have the ENFSI Forensic IT working group (where I am a chair of) conference at the Bundes Kriminal Amt in Wiesbaden, Germany The week after the European Academy of Forensic Sciences, will be held, where I also chair a workshop on Digital Forensics, and have a paper on PRNU and a poster on defraser

In the meantime, we have to finish our proposals for the American Academy of Forensic Sciences , before August 1st, so I have already written some abstracts. Furthermore I am also reviewing some interesting papers and proposals in the mean time, and it seems we have a very interesting year in forensic science.

Also interesting is the work for the WCIT 2010 in Amsterdam, where NFI is doing the cybersecurity and safety track, which is really exciting and I am also helping with some work on this.

In the meantime, I have to do some new research work, and of course some students and colleagues that work on these projects. 2009 has been a very fruitful year already, and I think it is good to collaborate, and realize that the good collaboration with colleagues and project partners is of most importance to be succesful. Where of course good discussions are as important.

Sunday, June 07, 2009

June 2009

Last weeks I had some travelling to Cyprus and Ankara for the FIDIS project and for the ENFSI annual meeting in Ankara. It was organized very well, and also I received the opportunity to give a presentation concerning our working group Forensic IT (which will have a meeting in September in Wiesbaden ). At the meeting most ENFSI-members (directors of Forensic Institutes) where present. The EAFS 2009 meeting in Glasgow was also discussed, where also focus will be on Digital Evidence, and I also have to do some preparation work. It is good to see there is a digital technology track at this conference.

It is also interesting to see the different efforts of forensic registers of practicioners. It appears that the CRFP in the United Kingdom has been ceased, as is also shown on their website In the Netherlands we have a law on forensic expertise, so I expect this to be a more solid register, however it is interesting to see the conversion process from the old system to the new system which will start July 1st.

This year is also a good publication year for me, since several papers, and book chapters have been / will be published. Last years we had many students that also did a lot of research work, and this helps also in the development of tools and of course writing articles. The number of cases that I handle is stable, and of course new challenges are given there. Also research of PRNU is now used in the casework for camera comparison. In real casework it does however not always work, since sometimes other patterns are recognized.

Saturday, May 16, 2009

May 2009

It appears that google latitude also works at this website, since I have added the location from my mobile phone to this site. Currently I am in Cyprus, Paphos, where we have a summit of FIDIS and we have a review meeting of our deliverables. Also the summit book is presented here. Within the network also a warning is given for giving away mobile information without being aware. The project will finish soon, and we had three deliverables on biometric devices, forensic profiling and identification of images.

Friday, April 24, 2009

April 2009 (2)

It was a nice month, with some casework, some work for the Forensic IT working group of ENFSI and developing new tools that are also used in casework such as, which were developed by our team. It includes now also wavelet methods published by Fridrich et. al. and batch processing, since these methods can be time consuming in calculation time.

It is good to see that work in literature is implemented in easy to use open source software, such that published methods in literature are available in the open source community, and it becomes easier to validate the different software approaches. We also have a database with some examples on line at . Of course validation of the uniqueness of PRNU patterns with different cameras is always needed before reporting and drawing conclusions based on the results.

Sunday, April 05, 2009

April 2009

In this time, after my vacation, we finally do not have much backlog, so more time to review articles, and preparing presentations and of course to make new projects. 

I also went to an interesting conference in the Netherlands, about problems in forensic expertise in Amsterdam, organized by the court of Amsterdam, where also lawyers could attend.  This conference also went in depth in to different aspects of forensic science, eyewitness testimonies, forensic psychiatry and how the court interprets the findings. There was also some discussion about the NAS-report , and also having a forensic entitity as meant in this report in the Netherlands. One of the examples that was given, was the Phantom of Heilbron , where 40 cases in Western Europe where linked based on DNA for no apparent reason also with a murder case. It finally appeared to be a contamination case, since the cotton swabs where contaminated by the producer of these swabs with DNA of one of the employees. It is good that this came out, since now other labs are also aware of this kind of contamination, and can look at there quality assurance system to prevent this.

Also the issue that forensic scientists can be biased based on the information they will receive around a case, and that this might influence there conclusion. Ton Broeders  presented a method to prevent this, by doing blind examination in comparison cases.

Wednesday, March 25, 2009

March 2009

This month did not go as smoothly as usual. There were numerous positive aspects, such as publications that got accepted, some nice development in research, backlogs that disappeared in casework, nice European projects and such. Also the credit crisis might influence the money to spend in forensic science, however it is not clear yet. Last week I had a worst week. Since my asthma got worse, I went to the lung doctor. There I received a new medicine with the nice name "Foster" and a fancy purple packing, which is new on the market. Since I had issues with lung medicine before, I asked if it could influence my heart, however the amount was for children oto begin with. So, I took the inhaler when I traveled from the hospital by train to Den Haag. When I was sitting in the train I felt a severe pain on the chest. At that time, I was near the University hospital of Leiden. I went out of the train, and walked to the emergency room of this hospital.

Then it appeared that the ECG was not as usual, and they told me it was wise to do a catheterisation where they could check on coronary spasms. With this procedure, they will inject a fluid and look if a coronary spasm occurs during the catheterisation. After two days at the coronary care, where I had to lay on bed with the cables, they did a catheterisation. Then I had these spasms during the procedure when they injected this fluid. Since I used some other medicines during the test (nitroglycerin and a calcium blocker), the effect was reduced, however I had the same reaction as with the medicine I used when I had the pain on the chest. So possibly I had some coronary spasms due to the medicine I used that morning. I remembered that I also had the same with similar lung medicines, so it appears I was sensitive to this (and this reaction does not often happen). Further all vessels where clean, so that is nice to hear. The angioseal they used for sealing the vessel came out, so I had to stay several hours longer, however it was nice that I could walk again at the end of that day, of course with some bruises. Also the cause was known, so that makes a difference.

Next morning I had a course, so I could even be there, and I enjoyed it even more then usual, since being in a hospital (although the care was excellent), is not the nicest thing to do. Then a week vacation in Turkey, and looking forward to start working again.

Sunday, March 01, 2009

February 2009 (2)

The meeting in Denver was excellent, and our new section Digital and Multimedia sciences has started the first year. I am happy that the members re-elected me as chairperson for another year, so we can build further on the new section. Also the workshop was visited well, and there were many good papers. During the meeting, also the NAS-report was published that the forensic science field is fragmented, and there is need to have more scientific research established in this field, as well as coordination. So, it would be excellent if good actions are made to improve these findings, since many of them are also true in the rest of the world.

It would be nice if this would result in a more research and also more statistics on methods used in forensic science. Of course, many forensic scientists are aware of the issues, however the question is if the court is aware of the limitations that can exist in a forensic report or testimony. There are several efforts made to have a more scientific way of reporting, for example with Bayesian rules and likelihood ratios. The difficult part in these is that the reporting gets more complicated, and the question is if the reader of the reports understands these conclusions. However in these cases it is important to mention that often a subjective scale is used. See for example$file/IBSTE2002_Vol8_3.pdf .

Furthermore we just published our new PRNU comparison for on for camera comparison and the enf collector for collecting variations in the electricity signal

Saturday, February 07, 2009

February 2009

The last post was by Holly, and she wrote on concerns on the distribution of knowledge and people committing crime with this knowledge. The issue is also true the other way around, since we have to exchange knowledge, and have our methods peer reviewed in journals, so use them in court. In many countries legislation exist to shield the information such that it is not used for committing crime, and still the evidence can be used in court. It is also the reason that often events are organized for law enforcement only in this field.

Within FIDIS where I am involved in the package on forensic science, another issue is mainting privacy, since people seem to store lots of information on the internet without realizing that other people can also use it in the future, and one should be aware that even if information is erased, it is often available on backups, so it is also something to be aware of. As we see with the latest developments on the mobile phone (for example latitude of google), also the location of where you are, is visible on the net. With these systems you give permission, and even I tend to use these features, since it can be a nice gadget.

I am looking forward to the meeting of the American Academy of Forensic Science in Denver. I organized a workshop, and we have the first year of our new group in Digital Evidence and Multimedia, where I am currently chairperson of. I will also give a paper on camera identification and ENF.

In August we also organize a workshop the Third International Workshop on Computational Forensics at the Netherlands Forensic Institute, The Hague, The Netherlands [August 13-14, 2009]. Currently there is a call for papers, so we are looking forward to this. It is in conjuction with IAPR and there should be paper proceedings ready by Springer in August.

To Catch a Thief…

There’s an old adage that says that it takes a thief to catch a thief, a saying that leads us to believe that every cop, detective or any other person in law enforcement who’s any good at their job must have a mind that has a little bit of a criminal bent. Unfortunately, the reverse is also true – every criminal who does not want to be caught, ultimately masters the art of covering his tracks and staying just out of reach of the long arm of the law.

Computer forensics is a not just a science, but an art as well – for those who have the innate skills to handle the tasks that go with this field, no technology is too complicated and no thief too difficult to catch. The real problems begin when the criminals begin to use forensics too, not to catch others of their kind, but to sweep away evidence of their crimes and leave nothing behind for the investigators who are sure to follow their tracks.

The age of the computer and the rapid advances we are making in the field of technology is something that would never have been thought possible a few decades ago. It’s this advancement that has made criminals out of some of us – the lure of easy money and the possibility of an almost certain escape is too good an opportunity to pass up for those who don’t have too many ethics or moral values; and this is why we have people breaking into networks and security systems to access credit card and other personal and sensitive information.

Today, while it’s true that the good guys have an arsenal of forensic tools at their disposal to help catch the bad guys, it’s also true that the bad guys are becoming really good at beating the good guys at their own game. They’re going back to school too, so that they can learn the tools of the computer forensic trade in the legitimate way, and then use these methods to prevent and avoid detection.

There are criminals who perpetrate crime when the opportunity presents itself; and there are those who religiously plan and execute their crimes. For the latter kind, nothing is too hard or too difficult. They’re often master strategists who are adept at hiding their tracks and moving from one operation to the other to avoid being caught. And this makes computer forensics a more challenging field – how do we prevent the knowledge that’s available from being misused?
Besides the legitimate forensic tools, there are those that straddle the thin line between legal and illegal; and when these are used in conjunction with those that are allowed to be used, they form the most lethal combination because they trick users into believing that the whole operation is legit.

If education is knowledge and knowledge is power, then we must ensure that this power does not fall into the wrong hands. For when it does, there’s nothing we can expect but disaster on a large scale.

This post was contributed by Holly McCarthy, who writes on the subject of forensic science careers. She invites your feedback at hollymccarthy12 at gmail dot com

Saturday, January 24, 2009

January 2009

January started good. The European network of Forensic Institutes was having a meeting on their Research and Development in Birmingham. When visiting Birmingham, it appeared that the prices where much lower than in the past, also caused by the exchange rate of the pound. It was nice to see that prices are reasonable again in England. I also had this experience when ordering some electronics in England with Ebay.

Within Europe we see that forensic science is developing in a market. In England and Wales, forensic science is more a market, and there is even a regulator. Also in the Netherlands a market is developing in forensic science, and this is progressing with different companies being active on the Dutch market. Of course, it has some challenges in quality assurance, however it is good to have more choice also when coping with backlogs, as long as the quality is also guaranteed of course.

This month I had to finish some publications and reviews. So as always busy, also with some work for the European Commission as an evaluator. Also doing some casework, and giving some presentations, as well as working on projects.