Zeno's month

January 2012

2012-01-21T02:49:00.000-08:00

As always we have several things to do starting in January, and it appears I have some more time since I organized my work somewhat more efficiently. Currently I am working with five students on projects on camera identification with PRNU, detection of image manipulation, heart beat detection in video and quantization tables in JPEG. It works often very efficient to have validation studies on several topics, since often journal articles do not directly translate in forensic solutions which have been validated.

Also working on some casework on forensic multimedia, doing some review work and participating in project proposals. Of course since budget cuts are near, it is time to look for new solutions which make work more efficiently. Most often in my experience with some pressure on budgets the nicest solutions are developed, as long as there remains some time for doing research, which is often not easy since forensic casework is of course the most important.

As you might have seen, I also have sometimes guest posts for this blog, which also helps with seeing the contents. The latest is of Melanie Slaugh on mobile forensics. New developments in this field are very rapidly making old methods less useful, so it is important to do very much development in this field, and know forensic properties of new devices that are handled.

December was a month for planning, and January we have to do the real work, also in private life, to make more balance. The good thing it started right with many days that I could take my bicycle to my work, as is usual in the Netherlands. Since I live near the beach, I can go with my bicycle through the dunes without any traffic jams, and it always helps to make new plans, and evaluate the day.

Issues with Cell Phone Forensics guest post by Melanie Slaugh

2012-01-14T05:15:00.001-08:00

Cell phones don’t feel new, but in reality they are. With this newness comes rapid change, sometimes so

rapid that it is difficult for forensic scientists to keep up. Suspects use cell phones in a variety of crimes

and it is up to the forensic scientists to uncover their wrongdoings. But where do you start? What are

some problems that scientists come across?

1. Change- Change is the number one issue for forensic scientists to overcome. Even the cell phone

manufactures don’t always know how to retrieve information stored in new phones, so how can

scientists retrieve the information? Staying up-to-date on new cell phones is difficult, but not

impossible. As fast as they are produced, criminals come up with ways to abuse them. Strangely

enough, this can be useful for forensic scientists. Using online tips can allow scientists to easily

access information that would otherwise remain inaccessible.

2. Passwords – Password protection on cell phones are difficult to overcome, though not

impossible. Depending on the model, passwords can be bypassed in several ways.

3. Internet connection – The smarter cell phones get, the harder they are to delve into. Using an

internet connection instead of SMS or voice makes a forensic scientist’s job much harder.

4. Charge – Unlike computers, much of what is stored in a phones memory is dependent upon the

battery. When the electricity goes, so does the information. Depending on what information you

are looking for and how it is stored, battery or charger power is an important thing to think about.

5. SIM cards and removable media- SIM cards are the heart of a cell phone. They carry important

user information. Likewise, removable media, such as SD cards, can have lots of stored

information on them. It is important that forensic scientists have the proper equipment to read and

analyze the data.

6. Isolation – One thing that is often overlooked is the need to isolate the cell phone before

analyzing it. New text messages can overwrite old information, and connections to the internet

can invalidate old data. It is important to make sure the phone is isolated.

7. Security enhancements- Be especially careful when dealing with cell phones that have been

enhanced in some way. Some users have the ability to put in dead man’s switches, effectively

wiping the contents after an action or a period of time. Malware can also be loaded onto the

phone, placing your computer systems in danger.

There are many ore issues to watch out for, but these are the seven most common. Tracing cell phone data

is an arduous task, but it can be done. All it takes is a little research, a few tools, and a lot of patience.

Melanie Slaugh is enthusiastic about the growing prospects and opportunities of various industries and

writing articles on various consumer goods and services as a freelance writer. She writes extensively for

internet service providers and also topics related to internet service providers in my area for presenting the

consumers, the information they need to choose the right Internet package for them. She can be reached at

slaugh.slaugh907 @ gmail.com.

(http://www.myispfinder.org/).

Author Bio

Melanie Slaugh is enthusiastic about the growing prospects and opportunities of various industries and writing articles on various consumer goods and services as a freelance writer. She writes extensively for internet service providers and also topics related to internet service providers in my area for presenting the consumers, the information they need to choose the right Internet package for them. She can be reached at slaugh.slaugh907 @ gmail.com.

December 2011

2011-12-18T12:54:00.000-08:00

The month started at a very nice organized cybercrime conference in London http://defence.flemingeurope.com/cyber-security-summit/ also forensic aspects, and in depth on Scada and mobile systems.

In December I just had a week vacation in Gibraltar/Spain, since most often we go in vacation in winter and not in summer due to the climate in the Netherlands. It is very amazing to see that the airport runway is crossing the regular road.

Also I had to do internal examination and defend six reports with an external expert, and passed that. As each exam it always takes preparation time, however it good to have discussion about reports that have been written.

In the last week of this year I finally have some time to clean my desk, and preparing presentations which I have not covered already, as well as time time to finalize reports and reviews.

Conference in Chongqing

2011-11-07T02:42:00.000-08:00

Bit Forensic conference in Chongqing

It was the second conference on forensic science, many good speakers from Europe, Australia, Asia and the North America, and very good to see that the government of Chongqing is investing very much in Forensic Science in collaboration with Universities in the United States.

November 2011

2011-11-07T02:36:00.000-08:00

On forensic science many resources are available on the internet, one resource that I saw lately, is a good overview for people that are interested in a carreer in forensic science, http://www.bestforensicscienceschools.com/blog/ or http://www.forensicsciencetechnician.net/blog/ . The specialized universities that have course in forensic science, are numerous. One issue is however that there are many more students in forensic science, compared to the number of jobs available in the field. So often I have students that work on a project for a while, and then later on, of course they will do some other work, related to forensic science, or perhaps something completely different.

This is different for students that specialize in forensic ICT, and currently it is difficult to attract people to these jobs since not many students appear to chose ICT. Also the number of people that are requested in cybersecurity related areas are very many. We see that law enforcement in many countries is expanding in many countries, since we become aware that since many processes are linked to internet, with software and hardware that are mostly not very transparant in how they exactly work. Also we see that systems are updated regularly, due to the complexity of the software and hardware solutions, this remains also a challenge even if the source code is available. Reverse engineering is often work that takes a lot of patience and time, and with the development cycles of products become shorter, it means also that with new versions of software and hardware, only a part can be used again.

Malware developers are also changing there software often, and it is unknown how many systems have been infected, however the number of reports of botnets are huge and develop malware. So either way, there is a lot in forensic ICT to develop, investigate and finally learn from these in making systems more secure.

October 2011

2011-10-04T09:18:00.000-07:00

The month is with relatively many conferences, so one week I am in Montreal, Canada at the Colloquium IT Security Cyber Forensics and Combatting Cybercrime. Much nice forensic research on different aspects on cybercrime analysis and attacks. Also excellent for networking. I also gave an invited talk there, and it is an excellent venue, and also good to practice French language, although there was parrallel translation. The advantage of conferences is also that I have time to review proposals, write some text and look to planning. Also interesting to see that the costs of cybercrime is difficult to estimate, since much is not seen by governments.

Two weeks for casework, and looking for results from experiments of students on different topics as camera identification, enf and iris scanners. Also nice opportunities for European projects in the field.

Then one week at the lab, and the next week to ChongQing, China for the 2nd BIT Forensic Conference. Last year it was very nice, and I am looking forward to be there.

September (2) 2011

2011-09-14T05:26:00.000-07:00

Sometimes things do not work as planned due to circumstances. I should leave to Riga as chairman for the ENFSI Forensic IT Working group meeting, however was in bad luck, due to an accute appidendicitis, and I had surgery for that. So unfortunately no visit to Riga for me this time, with the nice ENFSI group. However since the conference is very well organized and the steering committee is there, I am sure it will be a nice event.

However I hope the plans next week will work better, and as long as the complications are not too severe, it should work. Also the IAFS conference is this week, so I know many people that go to Madeira.

However many things work well, some projects got approved, and of course some interesting casework.

September 2011

2011-08-28T12:58:00.001-07:00

As usual it is busy in September after the vacation. I had a phone conference call with the Board of Directors of the AAFS www.aafs.org at 2 am in the morning. I am getting used to it, however it takes always some time to get back to sleep afterwards, it is good to see the next call is earlier.

The ENFSI Forensic IT Working group meeting in Riga is approaching, as well as other meetings which I have to prepare. Currently also new students come in for projects on biometric devices and PRNU as well as heart beat. In October I have a meeting in Montreal were I am invited speaker and a meeting in China. Later on I have a week vacation, so lots of travelling in the meantime.

Also I was asked for a forensic cruise, and I was wondering what happens there. People seem to enjoy forensic topics on cruises, so who knows perhaps I might join such a cruise as invited speaker in future.

August 2011

2011-08-01T12:01:00.000-07:00

August is always the time for writing articles and papers, and working on backlogs and doing new proposals for projects etc. Just finished submitting abstracts to the AAFS conference in Atlanta in 2012 . Also preparing our ENFSI FIT Working group meeting Forensic IT in Riga .

I am working on a paper for an encyclopedia on identity fraud, and of course the forensic invesigation of this topic. In the past we worked on issues around identity issues with biometric systems and spoofing etc within FIDIS.

Currently also the financial situation in Europe is getting more troublesome, so I expect more government cuts in future. It is always good to be prepared for this, and hopefully forensic science will not be hurt too much. Unfortunately we saw already in the United Kingdom that the government shut down the Forensic Science Service, the largest forensic science lab in Europe at the beginning of this year.

Also interested to see how the CSI effect will evolve, sometimes I get called to court with questions concerning image processing in CSI and why we can not do the same. Perhaps the expectations will go to the regular level again, since nowadays there are many students in forensic science, however it is not easy to get a job, since in general there are not that many vacancies. This is different for forensic ICT where we see that it is more difficult to have vacancies fulfilled in informatics and related areas, since it is expected that casework in cybercrime and related areas will grow.

July 2011

2011-06-29T09:02:00.000-07:00

In June organized an event on video investigation with the police in the Netherlands, also with a BBQ, since it is our tradition. Of course it is somewhat warmer in the summer.

Also preparing some papers for the AAFS, since August 1st is approaching soon, and some other deadlines for papers and reviewing activities. This month I had to limit the number of review requests, since otherwise I could not fetch deadlines. It is often that requests for reviews arrive before the summer, and often it has to be done in a short time.

I also went to Salvador, Brazil, to the conference http://ictinforensics.org/conference/scope.html ICT in forensics. It was an international conference with participants from Europe, US and Asia. I was invited to give a course on some aspects on forensic ICT, especially handling images and video. It was a nice event, and I organized some hands on workshop, and it the day went very fast to me. Doing these events is also good to present and discuss on forensic issues, and widen the view on interpretation of evidence. In this conference besides forensic scientist also prosecutors and attorneys were present, so it was a good audience.

Also our paper http://lpr.oxfordjournals.org/content/10/2/149.abstract on likelihood ratios in cameras was published in law probablity and risk, so it was good to see.

June 2011

2011-06-05T07:42:00.000-07:00

This month finally some time to think and work on the blog again (too much casework last month), at the University of Warwick, where I am in the Scarman House with a fast internet connection. I am working on a presentation for the FP7 Divefor project of the developments at the NFI, such as defraser. It appears that also others are developing plugins with the software, so this is nice for an open source product. The software is used for analysing and repairing video files in a forensic proper way and is interactive. Currently we are developing the H264 further, however that plugin might not be open source anymore, since the return on investment is low otherwise. Which is an issue with open source, unless there is a smarter business model behind it.

It appears that last month I had most reviews ever in a month. Reviewing papers is always good to do, since it makes you reading papers better then otherwise, and good papers always give you new insights. This time I also had several proposals from the NIJ to review.

At the end of this month I will go to Salvador, Brasil, since I was invited to give a short course there at ICT in Forensics. I am looking forward to this meeting, since it might give another view on new developments and bring me new ideas. Currently I am also updating my site at http://forensic.to , since I had some backlog in updating links.

Also the program of our ENFSI Forensic IT Working group meeting in Riga in September is progressing, I already saw some interesting abstracts.

April 2011

2011-04-23T05:43:00.000-07:00

The month started with a week vacation, and then I had time to read and review. Of course it was also a busy month with casework, and we appeared to receive more cases then predicted, so there was not much time for other things. I also had time for several reviews this month, and was also invited for two keynote talks.

Within the Digital Imaging School at the NFI, I gave a course on Photo Response Non Uniformity and using this in practical cases. I tried to have much interaction, so it appeared to work. Also I went to Riga, Latvia for the preparation of our Forensic IT Working group meeting of ENFSI in September. We try to keep the costs low this time, since many government labs have budget cuts. Air fares to Riga tend to be low due several low cost airlines, and the hotels are not expensive. Of course the challenge is to get most of the meeting in collaboration and new projects, so we will have several workshops, and of course also on developments such as forensic examination of cloud computing and updating our best practice documents.

March 2011

2011-03-25T09:32:00.001-07:00

This month I was busy since I had a knee surgery, which went well. So before this date I waited for the urgent issues and casework that had to be handled before deadlines. The recovery period of this knee operation is about two weeks, and it feels like being repaired now.

It appears I am on a list of , and there is a wide variety of blogs available on forensic science, such as Cyber Forensics Blog by DMS member Marcus Rogers
has a few recent posts. http://deforensics.blogspot.com/and the Windows Incident Response Blog by one of our newest DMS
members, Harlan Carvey, is at: http://windowsir.blogspot.com/. Always good to see some discussions on digital and multimedia sciences.

Currently we see more interest also in Nucleair forensics, which is important to handle in specialized labs as such and is important in analysing disasters as in Japan.

Also there is an interesting article in Spectrum of IEEE on the law of Moore, where the author claims the growth of speed of super computers will slow down. It is also nice to read that in 10 years the fastest super computer in 1997 has the same speed as a game console in 2006. However perhaps new architectures and other means will also keep us up with the Moores law.

With my knee surgery I now have some time to read and do some reviews. So I collected all tasks which can be done from home untill this date. Obviously I can not work on casework at home, however writing articles and reading the current state of the art in depth is important to keep up with developments.

February 2011 (2)

2011-02-28T04:10:00.001-08:00

The AAFS conference in Chicago was very well organized with aproximately 3500 persons there. As member of the Board of Director some interesting meetings, as well as seeing good developments in the field. The use of Likelihood Ratios is more often presented, as well as all considerations in the NAS report. Also our workshop Forensic Multimedia was very well attended. As usual the networking during the conference was excellent, and it is good for discussion on the different topics of research.

February 2011

2011-01-30T04:33:00.001-08:00

This month will be busy, since there are several deadlines, and of course the conference of the AAFS in Chicago, where I will organize the Forensic Multimedia workshop and give one paper. It is always an excellent event, with good networking and discussion with other forensic scientists.

Last month I received a question for making tweets on forensics, and some people thought I was discussing actual casework. I will never discuss on the blog or anyware in public on casework were I or any of my colleagues am working on, and which are still in the court, without prior permission. Only forensic meetings and events that are public will be discussed, and of course R&D which is open. The advantage of a blog compared to a tweet is that you can add more text to it, so this kind of misunderstanding are less likely to happen here.

On the forens-l list that I host there are some discussions on the NAS report, and it is good to see that many issues are handled there. Since I moderate the list, the posting improve. In the past I started hosting this unmoderated list, and then it appeared that some discussions did not go well. So I started some moderation, and it appears to work better.

January 2011

2011-01-16T02:34:00.000-08:00

At the beginning of January I went to Tunesia for one week, since the Sahara climate works well against my astma, which is worst in winter. It was the first time that I experienced employees of the hotel striking and demonstrating for the hotel, against goverment. Later on when visiting the Medina in Sousse and Tunis, we saw some riots, so it appeared the start of the election of a new president and government appeared this week. I hope there will be peace again, and perhaps they can use parts of the Sahara for energy production with solar panels in the future, if possible of course.

Also the start of a new year, gives also new experiences. We had a kaizen meeting from lean six sigma for making our work more efficient. So first we are analysing the process. It appears to work well in forensic laboratories to have less backlog, of course in combination with a Service Level Agreement.

Of course also working on some cases, and it appeared I had a backlog in reviewing papers, so I had to do some work on this. Also new year celebrations of my work, and of course new planning and new ideas.

In February I will attend the American Academy of Forensic Science meeting in Chicago, and chair a workshop, give a presentation, and also be in meetings for the Forensic Science Foundation, and to meetings as Director of the Digital and Multimedia Sciences Section. So also some preparations for this event.

December 2010 (2)

2010-12-26T03:42:00.000-08:00

At the end of December we heard of course the bad news of the Forensic Science Service that closes in 2012 due to losses. Since it is the biggest provider of England and Wales (60 percent) owned by the government it is a question what happens with the experience of the forensic scientists. Of course I also heard the bad news from many colleagues who work there, and since they were very active within the forensic communities, such as ENFSI, we will also see changes in these law enforcement forensic communities. Perhaps we learn from what happened there, however perhaps future will give them also new opportunities.

Also in the Netherlands it is investigated what happens if we are working in a market as a forensic service. This report is balanced, since it also provides insight in the issues that can arise in a market. An abstract in English is provided on the website, and describes three scenarios from the full government service to the free market solution for a crime lab with strict market control with a regulator.

An issue with forensic science in a crime lab is that there is not many jobs, and certainly not if budget cuts are in place. There are many students interested in forensic science as such, also due to the CSI effect, so we see a mismatch between the number of jobs and the available jobs. If we take England and Wales as and example, the Forensic Science Service has 1300 scientists and figures state that it is 60 percent of the market. The population of England and Wales is 53 million, so it means that aproximately 40 scientist per million of inhibitants. If we assume that forensic scientist stay on their job on avarage for 20 years, this means 2 vacancies per million inhibitants. Most European countries have less forensic scientists, so the number of vacancies for crime labs is limited, at least in crime labs.

December 2010

2010-11-26T18:02:00.000-08:00

From the last posting on possible errors in forensic science, I received several reactions for methods to reduce errors caused by humans by software. Of course that is a good approach, however one should include it in the whole system.
One issue we also see is the way the conclusions and the report are interpreted by the readers such as judges, juries and prosecutors. Also the combination of conclusions from different sources of evidence is important. For this a Bayesian approach can also be used, which is logically correct. An issue remains that the readers not always read the same, and interpretation by the readers of the report can also give confusion. For that reason, it is important to have good education on statistics, and write clear reports. And there we have the paradox that by writing more logically reports it is less intuitive for the reader, especially in detailed technical reports.

Currently also working on my website http://forensic.to/forensic.html , since sometimes information has to be checked and rechecked again. It seems many persons also use older versions, and ask for updates of these. This week I had to stay at home due to an injury at my knee, so I had time to read articles, reviewing them, and also making phone calls. Working at the computer was less ergonomic. Next week I hope to start working again.

November 2010

2010-11-11T01:36:00.000-08:00

November started with the organization of the Themadagen Digital Evidence for the Dutch Law Enforcement, were we had 270 participants. Furthermore as always a somewhat busy time, however this month some vacation time (since normally I work during the summer holidays). So going south to Cyprus, with nice weather.

Also thinking on forensic science for law enforcement and commercial services and issues like certification. In the Netherlands they are working on a register for certified forensic scientist, which is in the law.

There are several opinions on this development. An opinion is that forensic science for crime cases is not good as a commercial service, since it might cause issues with bias to the client who pays for the services. Others think this can be prevented within the law system by making judges, prosecutors and juries if applicable aware of this issue, and that it will also be solved within a market, as in the UK, with a forensic regulator by using appropiate scientific quality standards.
An issue which we see in England and Wales, is that the police will do more forensic work themselves, so there is no market anymore. In Germany and other countries it appears to work well with private experts.

However, with any system all people should be aware of objective forensic services, and for this reason all research for objectivation of forensic evidence is impportant, were now much effort is spend by the forensic community, in funding of research by the National Institute of Justice and of the FP7 of the European Union.

October 2010 (2)

2010-10-23T13:12:00.001-07:00

This week I went to Dalian, China to BIT's 1st forensic conference . It was a very nice venue and there were several tracks in parrellel. The opening ceremony was indeed impressing, also with Henry Lee, who told he was born in Taiwan, and also emphasised the importance of search strategies in forensic science.

Dr. Gerry LaPorte from the National Institute of Justice, emphasised also the culture within the forensic laboratories in the past that if you would make an error you could forget your carreer in forensic science. This is not good, since there is no room then to learn from past experiences, and improve the system. Also the implications of the NAS report will lead to more research to objectivation.

The conference had many good papers in objectivation, from speaker analysis to handwriting, cybercrime investigation to facial comparison and the limitations that exist there. It was good to see that there is more research on measuring the system and the error rate in forensic science, as well as having statistical analysis for improvement, also with the use of likelihood ratio calculations.

Dalian was also a very nice city to visit, near the waterfront, and with a fast developing center, with good transportation options, and excellent service. The confrence itself was also good for many new contacts within forensic science, and will also be organized next year.

October 2010

2010-10-01T04:31:00.000-07:00

Last month the excellent organized meeting in Moscow of our ENFSI Forensic IT Working group. Many interesting presentations, also from Russian companies in forensic software.

I had also a court case were I had to testify in the week of the meeting, so it was a busy month, since there was also many casework which had to be finished. Also we had an excellent student who developed new and faster algorithms for PRNU comparison. And another student who did very good validation studies for PRNU (camera identification based on Photo Response Non Uniformity).

Also I received a request for posting 20 books you should read. Some of them are very good, however I miss at least a book on digital evidence, since this is becoming more important.

Currently there is also a call for project on forensic investigation of digital evidence from the European Commission in FP7, which attracts several parties.

I am also chairing the organisation of the education days in digital evidence for the Dutch police in November. The program is nearly ready, and it appears there are many new interesting developments.

September 2010

2010-09-05T01:38:00.000-07:00

This month is again more busy, since everything is back from vacation. This month I will go to the ENFSI Forensic IT Working group meeting in Moscow www.enfsi.eu where I am chairman of. Forensic IT relates to cybercrime, and we see that most cybercrimes crosses borders, so a strong effort from the international community is necessary also to share information an solve the crimes.

Last week I gave a talk to students about cybercrime, and the awareness of students on cybercrime seems not to be high yet. Of course the government and companies can protect us from some of the issues related with cybercrime, however it is also good to have a higher awareness with the users, so cases can be solved more rapidly. There are many efforts also from law enforcements and courts to handle more casework, and often changes of laws are necessary also to cope with it internationally.

Of course we will continue with issues such as observer bias and context effects within forensic science (article Whitman and Koppl). In science it is advised do the cases double blind. In practice some courts will send the case with no additional information to compare, however as they also discuss that the simple fact that the samples are submitted causes a bias.

Last weeks some telephone meetings as member of the Board of the AAFS. Since there is time difference between the Netherlands and the US, it meant that I had to wake up at 2 am in the morning, which I am not used to. However the last meeting was at 11 pm, so that works better. Furthermore also giving some contribution on the Interpol review on image analysis.

August 2010

2010-08-01T01:28:00.000-07:00

August is starting with more casework then usual, and also new cases that come in. It might be caused by a new law on experts in the Netherlands that delays the cases somewhat since all cases need a court order.

Also there is a new policy from Dutch government on blogging for their employees, however as far as I can see the posts that I do fit very well in this policy. The policy is limited to the common practice of blogging.

I have submitted a workshop and a paper for the AAFS before August 1st. Furthermore I am working on reviews for the IWCF International Workshop on Computational Forensics in Japan. Also some reviews for journals, which I have to finish soon.

I am also looking forward to the ENFSI Conference Forensic IT in Moscow , where we are working further on. I think there are many good contributions.

Currently we have some possibilities for students to do a project on Image Analysis and camera Identification. Mostly in R&D I work with students for development and implemenation of new algorithms and also validation projects.

Guest article

2010-07-13T12:57:00.000-07:00

When Forensic Science Overreaches

Without a doubt, forensic science has made and continues to make huge contributions to our society. Cases that could never have otherwise been cracked are solved by creative, scientific means. But what happens when forensic science overreaches; when experts make claims that can’t be really be upheld using the strict scientific method? Do innocent people sometimes go to jail simply because your average American citizen has seen too many episodes of CSI and now believes that any statement made by a forensic expert is infallible? The answer to this question is a resounding “yes”.

Forensics as a science.

Like any other scientific field, forensic science is founded on sound scientific principals. Methods of investigation are tested both in the laboratory and the field to determine their accuracy. Statements made in court should be balanced against the limitations of the technology itself and the methods employed to gather the evidence. Unfortunately, juries seem to occasionally have a problem differentiating between deductions made by the investigator and provable facts.

When deduction is confused with fact.

In an article entitled What’s Wrong With Forensic Science that appeared in Newsweek, an example is given of a man who was convicted of a crime he never committed due to the testimony of a forensic scientist who convinced the jury she had matched his designer jeans to evidence at the crime scene. This was in 1989 before the widespread use of DNA evidence. He was acquitted when law enforcement found that his DNA did not match the samples taken at the crime scene. Unfortunately, he wasn’t freed until 2008. The jury had failed to question the deductive process employed by the forensic investigator.

What jurors need to know.

It is paramount for potential jurists to realize that forensic scientists, as humans, can
make mistakes. They can interpret information in the wrong way. They can see connections that aren’t there. A footprint linked to shoes with a certain speck of mud on them should not a guilty verdict make.

Bio: Alexis Bonari is a freelance writer and blog junkie. She is currently a resident blogger at onlinedegrees.org, researching accredited online degree programs. In her spare time, she enjoys square-foot gardening, swimming, and avoiding her laptop.

July 2010

2010-06-27T02:26:00.001-07:00

Last week I testified in a court case on images, and as usual people become confused with the things they see on CSI and the forensic examination of images and video. I often have to explain that sometimes the image processing which is shown at CSI is not realistic, since we have to cope with the limitation of the sensors, and they have a limited resolution. Often on CCTV it is difficult to do a proper forensic comparison of faces and other objects, and a limited conclusion can be drawn from it. However, there are exceptions.

It is getting summer now, and I do not have any backlog anymore in casework, so we can schedule better, however sometimes cases come in at unexpected moments, and it can change very soon. We are also working on new work for the camera identification, as well as forensic examinations of colours from objects. Before August 1st, I will also propose one or two papers, and perhaps a workshop for next years AAFS www.aafs.org meeting. Furthermore, we are currently working on the ENFSI Forensic IT Working group meeting in Moscow in September www.enfsi.org .

June 2010

2010-06-05T02:21:00.001-07:00

Last month was busy with the World Conference on IT where the NFI also signed a MOU with Microsoft. I gave a presentation on the huge efforts that we have to do in reverse engineering of software and hardware for extracting information from devices from manufacturers. Some manufacturers will provide information on their file formats, however others do not know or will not give information, and then we have to spend lots of time on reverse engineering, which also could be spend on examining other products such as reverse engineering malware in forensic casework.

It was also busy with casework and of course the R&D projects. Currently I also have three students that are working on camera identification under the different circumstances. And of course we have many groups of students that are working on various programming tasks, such as our open source software defraser for video analysis and repair. Also there we further progress, as we have version which is much more interactive which will be released soon.

Next week we organize a tour and BBQ as well as a day on forensic video investigation for our customers (currently over 100 people have signed up), and then it gets summer, so somewhat more time to spend on writing reports, articles etc. During the WCIT I was also invited for the Techno Security 2010 in Myrtle Beach to give a presentation, however due to the huge amount of work, I was unable to be there, however I will give some contribution to the conference via Skype.

May 2010

2010-05-07T03:42:00.000-07:00

Last month everything went well, and when I was in Moscow I was impressed with the organization of the meeting in September for ENFSI our working group on Forensic IT. This month we will also have the WCIT 2010 in Amsterdam, where I have received the opportunity to speak on Forensic Science and new developments within digital evidence and related areas.

As usual some casework, and currently due to economic situation, also within in forensic science, many labs have issues with budget cuts, since many labs are government owned, and currently many governments have to reduce costs. However as usual, this situation also give opportunities for new developments to have more efficiency and keeping the same, high quality. The last 20 years that I worked, I experienced several of these cuts, however it is not easy to predict what will happen, and each time there are different solutions.

Fwd: zonsondergang

2010-04-17T12:58:00.001-07:00

The sunset from our house is different from usual due to the ash from the volcano.

April 2010

2010-04-12T12:47:00.000-07:00

Now we do not have backlogs in casework in image analysis anymore, due to the more structured approach of handling cases. It is also a nice month for preparations. The proficiency test for camera identification is working well, and it is good to see that the different labs have comparable results.

At the end of this month, I will go to the steering committee of ENFSI www.enfsi.org in Moscow, since we will have our meeting from our working group in Moscow in September. Furthermore, I am also working on the security track of www.wcit2010.org in Amsterdam.

And defraser, the software for analysis of video has now a very good preview mode, and it will be available soon via http://sourceforge.net/projects/defraser/ . We are exciting about this option, since it makes the software more interactive.

March 2009

2010-02-27T10:40:00.000-08:00

The conference of the AAFS in Seattle was excellent. With our completely revised workshop, we had many good comments. Furthermore, our section Digital and Multimedia Sciences also had very good papers, and of course there were many possibilities for exchange and networking. During this meeting I was elected as Director of our Section for the Board of Directors of the AAFS.

February 2010

2010-02-14T02:43:00.001-08:00

A cold month with lots of snow. However also nice developments are going on. The American Academy of Forensic Sciences with the Annual meeting in Seattle will be a very nice event. I will chair the revised workshop on Multimedia Analysis, where we will also have a hands on training on camera identification. Also analysis of video files will be a part of this, and since I am chairman of the Section Digital and Multimedia Sciences, it is nice to see that the field is expanding further. And this week I am also working on many new students that start with projects and developing software for the open source sourceforge.net that we have for forensic software.

We have several students that work in house, however also many have projects that will be run from the universities / hogescholen in the Netherlands themselves. The students Informatics with a minor on Forensics of the Hogeschool Amsterdam will also start with several projects. Sometimes we had extremely good results. Most often this happens if the project is small, well defined, and ofen development in Java or .NET will give good results. Working on existing projects remains a challenge, since often documentation remains an issue.

In the meantime, we are preparing the conference for our Working Group of Forensic IT of ENFSI in Moscow, Russia. It will be in September, more information is available soon. And in the meantime, I have also some casework and other work to do. However good planning is always half of the work.

January 2010

2010-01-19T12:58:00.000-08:00

It seems January gives lots of changes and opportunities. I first had to clean my website from a trojan which appeared only to be detected with one virus scanner. So I cleaned many html-files manually and check all changes in order to have the best effort. I do not think many users have noticed it, however malware is getting more anoying to fix, and it is always a balance between options on a website and freedom on developing and security.

This month I had some interesting discussions also in courses that I gave in digital evidence in a course on Forensic Economics at the University of Leiden. How do we combine evidence, especially in the fields where no numbers are given, however a subjective conclusion. How do we combine conclusions if there is no calibration between the different fields of expertise ? I worked in different fields of expertise and I know that there are differences between experts and between groups of experts and the conclusions that are drawn. The Bayesian rules might help, however still we need calibration.

Last week I went to inaugural lecture of Prof. dr. Ate Kloosterman, Special Chair of Forensic Biology of the Institute for Biodiversity and Ecosystem Dynamics (IBED). It was an excellent overview he gave of the development of DNA analysis of the years. After that there was a reception, and it was very nice to meet also my many of the past colleagues that I did not see for a long time. After a while I was not feeling well, and went out of the reception, and I fell down, since I was very dizzy. I could not stand anymore, since I was sick. In no time there was an ambulance available and checked my heart and I went rapidly to the hospital OLVG nearby. After many examinations in the hospital (MRI, CT-scans, blood, ECG etc) it appeared that I had very probably an infection of the organ of balance, and had to stay in the hospital for two days. For me it was very difficult, since I could not do anything, I could not stand, or send email or send sms messages anymore. I felt very bad that this happened during this party.

However now I am recovering, and total recovery is expected in two weeks (I still use some anti-nausea medicine Primperan), and walking and going on the bicycle should be more easy. It is also a good period to think, so I had to be at home for a week.

Of course also busy with emailing and organizing. The AAFS conference is also soon, so I am preparing. I also have some time to do some reviews, and we are now solliciting for new students for projects. We are also happy that the proficiency test on PRNU is working well, and currently my colleague Wiger and I submitted a new article on a new and faster algorithm for computing PRNU.

December 2009 (2)

2009-12-28T02:32:00.001-08:00

As always the last days of the year are very good to finish deadlines, and finish casework and preparing courses for next year. The ideal situation to finish all work since there are no meetings and it is more quiet at the laboratory since many people have vacation.

From January 1st we have a new law on Forensic evidence active in the Netherlands, with an official register of experts at http://www.nrgd.nl . So it is interesting how this will work, since there are no experts in this register yet. However it is expected to be a good approach for the quality of forensic expertise in the Netherlands.

Currently we send out a proficiency test for camera identification and also organized the CAMCOM competition, where more people are interested to participate. It is interesting what will happen here.

Also I am working on a workshop on forensic multimedia analysis for the AAFS and looking on how to improve the training we give on digital evidence in general, with more interactive learning.

The good thing is now that I do not have any backlog in casework anymore, since we have better caseload management procedures in place, and this approach seems to work. So for the first time since 1991 I see an approach that works in practice, which also makes visible what are capacity is for casework, and also takes into account the more complicated cases.

Finally also my health improved, since I had issues with some of the medicines for asthma, that worked on coronary spasms with the betamimetics and also with ipratropiumbromide inhalers (which is a complication that is not very common). After good interaction between the cardiologist and the lung doctor, finally since this month I have a treatment that appears to work without all the complications I had before. So it appears after all a good start for 2010.

Visit Tokyo

2009-12-13T02:48:00.000-08:00

At evening also went to Electric City Akihabara. In 1996 I have worked for 3 months in Tokyo, so I know this place well. The prices are the same as in the Netherlands, and even diner and hotel seems to be cheaper then in the Netherlands. I had a 11 hours direct flight with KLM, and after that I just did a short visit there. Public transportation in Tokyo is very clear and all signs are in English as well as there chipcard system which works very well.

December 2009

2009-12-13T02:17:00.001-08:00

In November I had a busy month, so not much time to update the ongoing work. Busy with casework as organizing a conference for digital evidence in the Netherlands for the Dutch police. Also a presentation on for European Security Round Table Working Group ESRT on forensic science, which also was a result from a meeting of FIDIS.

Currently we are also distributing a proficiency test for camera identification, where we send out a camera and ask to compare these with ten directories of images. Of course also some work for the AAFS in reviewing membership applications and preparing the handouts for the totally revised workshop on Forensic Multimedia. Another challenge we organize is the CAMCOM-challenge for camera identification for ICPR.

Last week I also attended a meeting in Tokyo of the IOCE, where I gave two presentations : one on 17025 in digital evidence and one on the ENFSI Forensic IT Working group. We also discussed the ISO 27037 standard on Guidelines for identification, collection and/or acquisition and preservation of digital evidence where also from ENFSI Forensic IT there were 84 proposals for changes.

Next year we will have our working group meeting of ENFSI Forensic IT in Moscow in September 2010.

October 2009

2009-10-18T00:56:00.000-07:00

I had a short vacation in Helsink, Finlandi and Tallinn, Estonia. Also I went for two days to the Digital Imaging working group conference of ENFSI. I organized a workshop for identfication of cameras with PRNU , since I was planning to organize a collaborative exercise / proficiency test for this field, and furthermore would like to collaborate in a European project on this, however as always we need to find the time.

I was also maintaining my website, and it appeared that my forum had to be cleaned up, and was not used for a while. On line forums and mailing list are sometimes unpredicatable in their behavior, as I also experience with the FORENS-L list which I host. In the past it was not necessary to moderate, however nowadays it seems to be unavoidable, since flames occur.

This month I have my caseload to handle on the different cases, with also a reconstruction at the scene of crime. Also we are working on the WCIT 2010 on the cybersaftey and security track, which is a public private partnership.

September (2) 2009

2009-09-20T01:45:00.001-07:00

I enjoyed the EAFS conference very much. We organized the workshop on Digital Evidence, and it appeared that we had good attendance from experts within different fields. It remains an issue to make a good workshop were people also can do some hands on and it is not a plenary kind of thing. Of course working in smaller groups can solve this issue. I had also some time to relax in Glasgow, and discuss with colleagues on issues in forensic science.

On Friday morning I chaired a session on Digital Evidence, where Peter Sommer was the keynote speaker. He was giving an overview of the rate of change, and the issue that forensic peer reviewed articles can not follow this rate of change. So not all specific methods in digital evidence that are used in court are peer reviewed, since often one has to do research and reverse engineering to find the particular digital traces, and it is used in that specific case. So if someone would like to follow Daubert exactly, it appears that the exact method is not peer reviewed. Of course a general approach of using digital evidence is described however in digital evidence, also in guidelines of ENFSI www.enfsi.eu . A solution might be a peer review of the method during the case by other experts. Another issue is that most forensic scientist are often loaded with casework and do not have time to publish.

It was good to be at this conferences, and although the papers varied in quality, I had good discussions, and I always learn from these conferences, and see the different approaches within different law systems. The good thing that we also have within our working group is that there is a new standard being developed for collecting Digital Evidence, which should be ready in 2012. It is standard http://www.iso27001security.com/html/27037.html ISO 27037 which will be developed now. I think it is very good since very often digital evidence, such as emails and logfiles will cross borders and jurisdictions if cases are on internet.

After that I had a week to recover, and work on some casework and new Research and Development. Last Friday I went to Brussels and talked to several people of the European Commission concerning the developments in forensic IT within Europe. Also I was discussing on the program of WCIT 2010 http://www.wcit2010.com/ which also handles the rate of change, and the issues and solutions around it. The NFI is the organiser of a track within this conference, and we are looking further in this program.

Budgets are currently tighter within most forensic institutes and government agencies, so we always have to consider more efficient ways on processing forensic examination, and maintaining the high quality. It will give new solutions, and approaches, as long as long term investments are continued. Training and education is always necessary on all levels such that the law enforcement knows limitations and possibilities of forensic evidence, and of course it remains important to have good guidelines which are easy to use and easy to understand, such that important forensic evidence will not be destroyed by accident.

September 2009

2009-09-07T03:46:00.000-07:00

This month starts with a conference in Wiesbaden, Germany at the BKA of the ENFSI Forensic IT Working group. Really excellent talks, and also ideas for joint European Projects within the EU. It is good that proficiency tests are organized, which is a form of collaborative exercise to check if we all have the same results of a case. Also many developments in the field which is always changing rapidly are discussed. It is important to exchange results of Research and Development, since we would otherwise do the same twice with limited amounts of money. The organization was really excellent by the BKA, and we also visited a wine producer in this area known from the Riesling wine, as was organized as gala dinner in the evening.

The second week if for me the EAFS 2009 in Glasgow. Many forensic scientist will visit this conference, where I am looking forward to speak with many colleagues. I have organized a workshop on the Tuesday and will present two papers on the Friday. The week after that I will be at the NFI, and of course doing casework and looking how things have developed.

September 2009

2009-09-01T14:55:00.000-07:00

With last month the DFRWS Digital Forensic Research Workshop in Montreal, I had vacation in Boston and Vermont. Vermont is a beautiful green state. It was at the same period as the hurricane Bill, however I did not have much issues with it. It moved with me to Montreal, and then we went over it to Amsterdam. I worked a day at the institute, and I received an request of a proscecutor to clarify my report since there was some discussion on a sentence in my report. It is always good to get this kind of feedback.

Currently I am in Wiesbaden, Germany, at the ENFSI Forensic IT Working group conference http://www.enfsi.eu/ . I am preparing the general presentations as chairman, and some of the issues that we have. Of course I will shortly discuss about the NAS-report, and implications, and furthermore on some proficiency testings. It is excellently organized, and the city of Wiesbaden, Germany is very nice.

Next week the European Academy of Forensic Science will have their conference in Glasgow. I am currently preparing a workshop, and some papers on defraser (http://www.sourceforge.net/) and prnu compare also open source.

It is an exciting time, and of course I have to care not to get the H1N1 flue in the meantime, since I have moderate asthma, however it is also statistics that are involved in this. Lots of travelling these months, and I hope we will have some good projects also on PRNU, and I am looking forward to organize a proficiency test on this, and propose it in London during a workshop at the Forensic Digital Imaging Workshop. Perhaps we should already ask for some European funding, since the financial situation is getting worse due to cuts in projects and budgets, which is of course also not good for the economy as a whole, however is sometimes necessary (and I hope the right things are selected, which is not easy). When I come back, of course I will spend lots of time on casework and administative work.

August 2009 (2)

2009-08-17T08:00:00.000-07:00

This month I suddenly had to go to a court case in Amsterdam to testify. I had to wait from 2 to 6 pm in the court and witnessed a battle of experts. After that I could testify in the evening, and it gave me also strengthened me in the opinion that good validation, and testing different hypothesis is important in forensic science, together with clear interpretation and statistical evaluation in an understandable way for the court is needed. This was also one of the main issues within the NAS report of Strengthening Forensic Science in the United States.

Currently I am at the DFWRS- conference, and just gave a keynote talk on Opportunities and Challenges in Digital and Multimedia Sciences. It is an excellent conference where also the issue of having good validation based on ground thruth databases is discussed, and the issue of using software for analyzing forensic evidence with minimal standards is reproducible and reliable. The issue of the paradox of the zero-skill tools which are most optimal for wide use within police was also discussed. I also discussed our PRNU-tool with the new version where more batch processing is possible. We need also large databases for open source. Also the camera databases would be excellent to have for verification and validity of camera comparison.

August 2009

2009-08-09T13:03:00.000-07:00

This week I we have the meeting for the International Computational Forensics Workshop at the Netherlands Forensic Institute , where I am looking forward to. The proceedings have been published by Springer.

As you can see we have good weather in Zandvoort where I live.

Next week I will be at the Digital Forensic Research Workshop (DFWRS) conference where I will give the keynote address. I am preparing the presentation, and of course certainly will address the NAS-report, the need of fast peer review within the area of digital Evidence (where I think the journal Digital Investigation works very rapid, since the articles are prepublished now, as also an article of Wiger and me.

This summer I had some time to work on the backlogs, so I think we can do the cases on time now. Summers are always good for working on backlogs, since the number of cases that arrive are less then during normal periods. And the summer period is excellent for working, since you are not disturbed by phone calls and meetings, due to the fact that most colleagues are on vacation. Some people say that this also might happen if there is a flue pandemic, since we are not allowed to have too many meetings then. Working from home is also good for the number of publications, since this is what one easily can do from home (casework is more difficult), and this might also work on having more peer reviewed articles in the area.

In september I will have the ENFSI forensic IT working group meeting in Wiesbaden, and at the EAFS in Glasgow also give a workshop, a paper, a poster and chair a meeting there. It is always a good venue to meet other forensic scientist, and to keep up with the developments.

Today I also received a phone call of the Netherland cyclist union if I would like to work with them on the situation for cyclist in Zandvoort since I wrote the city of Zandvoort a letter concerning the bike lanes. Of course it is nice to do this, since sometimes volunteer work is also nice to do next to your regular job as a forensic scientist.

July 2009

2009-07-18T13:39:00.000-07:00

Just finished some casework for the vacation. It appears that I have more time than originally planned, since I do not have to testify in a case overseas. Sometimes forensic science can be inpredictable in planning. In the meantime I had some work on cases with different opinions of several expert witnesses, and analysing the forensic work behind these.

I am also preparing on the Digital Forensic Research Workshop in Montreal, where I am invited speaker http://www.dfrws.org/. It is an excellent conference with a challenge, and I am looking forward to it. The week before we have our International Workshop of Computational Forensics IWCF09 http://iwcf09.arsforensica.org/ and I received a message from Springer that the conference proceedings have been nearly finished.

In September, I will have the ENFSI Forensic IT working group (where I am a chair of) conference at the Bundes Kriminal Amt in Wiesbaden, Germany http://www.bka.de/kriminalwissenschaften/enfsi/ki_enfsi_index.html. The week after the European Academy of Forensic Sciences, will be held http://www.eafs2009.com/, where I also chair a workshop on Digital Forensics, and have a paper on PRNU http://sourceforge.net/projects/prnucompare/ and a poster on defraser http://sourceforge.net/projects/defraser/.

In the meantime, we have to finish our proposals for the American Academy of Forensic Sciences www.aafs.org , before August 1st, so I have already written some abstracts. Furthermore I am also reviewing some interesting papers and proposals in the mean time, and it seems we have a very interesting year in forensic science.

Also interesting is the work for the WCIT 2010 in Amsterdam, where NFI is doing the cybersecurity and safety track, which is really exciting http://www.wcit2010.com/ and I am also helping with some work on this.

In the meantime, I have to do some new research work, and of course some students and colleagues that work on these projects. 2009 has been a very fruitful year already, and I think it is good to collaborate, and realize that the good collaboration with colleagues and project partners is of most importance to be succesful. Where of course good discussions are as important.

June 2009

2009-06-07T01:16:00.000-07:00

Last weeks I had some travelling to Cyprus and Ankara for the FIDIS project and for the ENFSI annual meeting in Ankara. It was organized very well, and also I received the opportunity to give a presentation concerning our working group Forensic IT (which will have a meeting in September in Wiesbaden ). At the meeting most ENFSI-members (directors of Forensic Institutes) where present. The EAFS 2009 meeting in Glasgow was also discussed, where also focus will be on Digital Evidence, and I also have to do some preparation work. It is good to see there is a digital technology track at this conference.

It is also interesting to see the different efforts of forensic registers of practicioners. It appears that the CRFP in the United Kingdom has been ceased, as is also shown on their website http://www.crfp.org.uk/. In the Netherlands we have a law on forensic expertise, so I expect this to be a more solid register, however it is interesting to see the conversion process from the old system to the new system which will start July 1st.

This year is also a good publication year for me, since several papers, and book chapters have been / will be published. Last years we had many students that also did a lot of research work, and this helps also in the development of tools and of course writing articles. The number of cases that I handle is stable, and of course new challenges are given there. Also research of PRNU is now used in the casework for camera comparison. In real casework it does however not always work, since sometimes other patterns are recognized.

May 2009

2009-05-16T08:26:00.000-07:00

It appears that google latitude also works at this website, since I have added the location from my mobile phone to this site. Currently I am in Cyprus, Paphos, where we have a summit of FIDIS and we have a review meeting of our deliverables. Also the summit book is presented here. Within the network also a warning is given for giving away mobile information without being aware. The project will finish soon, and we had three deliverables on biometric devices, forensic profiling and identification of images.

April 2009 (2)

2009-04-24T04:00:00.000-07:00

It was a nice month, with some casework, some work for the Forensic IT working group of ENFSI www.enfsi.org and developing new tools that are also used in casework such as http://prnucompare.sourceforge.net/, which were developed by our team. It includes now also wavelet methods published by Fridrich et. al. and batch processing, since these methods can be time consuming in calculation time.

It is good to see that work in literature is implemented in easy to use open source software, such that published methods in literature are available in the open source community, and it becomes easier to validate the different software approaches. We also have a database with some examples on line at http://forensic.to/prnu . Of course validation of the uniqueness of PRNU patterns with different cameras is always needed before reporting and drawing conclusions based on the results.

April 2009

2009-04-05T23:51:00.000-07:00

In this time, after my vacation, we finally do not have much backlog, so more time to review articles, and preparing presentations and of course to make new projects.

I also went to an interesting conference in the Netherlands, about problems in forensic expertise in Amsterdam, organized by the court of Amsterdam, where also lawyers could attend. This conference also went in depth in to different aspects of forensic science, eyewitness testimonies, forensic psychiatry and how the court interprets the findings. There was also some discussion about the NAS-report , and also having a forensic entitity as meant in this report in the Netherlands. One of the examples that was given, was the Phantom of Heilbron , where 40 cases in Western Europe where linked based on DNA for no apparent reason also with a murder case. It finally appeared to be a contamination case, since the cotton swabs where contaminated by the producer of these swabs with DNA of one of the employees. It is good that this came out, since now other labs are also aware of this kind of contamination, and can look at there quality assurance system to prevent this.

Also the issue that forensic scientists can be biased based on the information they will receive around a case, and that this might influence there conclusion. Ton Broeders presented a method to prevent this, by doing blind examination in comparison cases.

March 2009

2009-03-25T03:31:00.000-07:00

This month did not go as smoothly as usual. There were numerous positive aspects, such as publications that got accepted, some nice development in research, backlogs that disappeared in casework, nice European projects and such. Also the credit crisis might influence the money to spend in forensic science, however it is not clear yet. Last week I had a worst week. Since my asthma got worse, I went to the lung doctor. There I received a new medicine with the nice name "Foster" and a fancy purple packing, which is new on the market. Since I had issues with lung medicine before, I asked if it could influence my heart, however the amount was for children oto begin with. So, I took the inhaler when I traveled from the hospital by train to Den Haag. When I was sitting in the train I felt a severe pain on the chest. At that time, I was near the University hospital of Leiden. I went out of the train, and walked to the emergency room of this hospital.

Then it appeared that the ECG was not as usual, and they told me it was wise to do a catheterisation where they could check on coronary spasms. With this procedure, they will inject a fluid and look if a coronary spasm occurs during the catheterisation. After two days at the coronary care, where I had to lay on bed with the cables, they did a catheterisation. Then I had these spasms during the procedure when they injected this fluid. Since I used some other medicines during the test (nitroglycerin and a calcium blocker), the effect was reduced, however I had the same reaction as with the medicine I used when I had the pain on the chest. So possibly I had some coronary spasms due to the medicine I used that morning. I remembered that I also had the same with similar lung medicines, so it appears I was sensitive to this (and this reaction does not often happen). Further all vessels where clean, so that is nice to hear. The angioseal they used for sealing the vessel came out, so I had to stay several hours longer, however it was nice that I could walk again at the end of that day, of course with some bruises. Also the cause was known, so that makes a difference.

Next morning I had a course, so I could even be there, and I enjoyed it even more then usual, since being in a hospital (although the care was excellent), is not the nicest thing to do. Then a week vacation in Turkey, and looking forward to start working again.

February 2009 (2)

2009-03-01T05:19:00.001-08:00

The http://www.aafs.org/ meeting in Denver was excellent, and our new section Digital and Multimedia sciences has started the first year. I am happy that the members re-elected me as chairperson for another year, so we can build further on the new section. Also the workshop was visited well, and there were many good papers. During the meeting, also the NAS-report was published http://www.nas.edu/morenews/20090218.html that the forensic science field is fragmented, and there is need to have more scientific research established in this field, as well as coordination. So, it would be excellent if good actions are made to improve these findings, since many of them are also true in the rest of the world.

It would be nice if this would result in a more research and also more statistics on methods used in forensic science. Of course, many forensic scientists are aware of the issues, however the question is if the court is aware of the limitations that can exist in a forensic report or testimony. There are several efforts made to have a more scientific way of reporting, for example with Bayesian rules and likelihood ratios. The difficult part in these is that the reporting gets more complicated, and the question is if the reader of the reports understands these conclusions. However in these cases it is important to mention that often a subjective scale is used. See for example http://www.intermin.fi/intermin/images.nsf/files/6C8438A4F3468012C2256D0A00284C02/$file/IBSTE2002_Vol8_3.pdf .

Furthermore we just published our new PRNU comparison for www.fidis.net on https://sourceforge.net/projects/prnucompare/ for camera comparison and the enf collector for collecting variations in the electricity signal https://sourceforge.net/projects/nfienfcollector/.

February 2009

2009-02-07T02:51:00.001-08:00

The last post was by Holly, and she wrote on concerns on the distribution of knowledge and people committing crime with this knowledge. The issue is also true the other way around, since we have to exchange knowledge, and have our methods peer reviewed in journals, so use them in court. In many countries legislation exist to shield the information such that it is not used for committing crime, and still the evidence can be used in court. It is also the reason that often events are organized for law enforcement only in this field.

Within FIDIS www.fidis.net where I am involved in the package on forensic science, another issue is mainting privacy, since people seem to store lots of information on the internet without realizing that other people can also use it in the future, and one should be aware that even if information is erased, it is often available on backups, so it is also something to be aware of. As we see with the latest developments on the mobile phone (for example latitude of google), also the location of where you are, is visible on the net. With these systems you give permission, and even I tend to use these features, since it can be a nice gadget.

I am looking forward to the meeting of the American Academy of Forensic Science in Denver. I organized a workshop, and we have the first year of our new group in Digital Evidence and Multimedia, where I am currently chairperson of. I will also give a paper on camera identification and ENF.

In August we also organize a workshop the Third International Workshop on Computational Forensics at the Netherlands Forensic Institute, The Hague, The Netherlands [August 13-14, 2009]. Currently there is a call for papers, so we are looking forward to this. It is in conjuction with IAPR and there should be paper proceedings ready by Springer in August.

To Catch a Thief…

2009-02-07T02:47:00.000-08:00

There’s an old adage that says that it takes a thief to catch a thief, a saying that leads us to believe that every cop, detective or any other person in law enforcement who’s any good at their job must have a mind that has a little bit of a criminal bent. Unfortunately, the reverse is also true – every criminal who does not want to be caught, ultimately masters the art of covering his tracks and staying just out of reach of the long arm of the law.

Computer forensics is a not just a science, but an art as well – for those who have the innate skills to handle the tasks that go with this field, no technology is too complicated and no thief too difficult to catch. The real problems begin when the criminals begin to use forensics too, not to catch others of their kind, but to sweep away evidence of their crimes and leave nothing behind for the investigators who are sure to follow their tracks.

The age of the computer and the rapid advances we are making in the field of technology is something that would never have been thought possible a few decades ago. It’s this advancement that has made criminals out of some of us – the lure of easy money and the possibility of an almost certain escape is too good an opportunity to pass up for those who don’t have too many ethics or moral values; and this is why we have people breaking into networks and security systems to access credit card and other personal and sensitive information.

Today, while it’s true that the good guys have an arsenal of forensic tools at their disposal to help catch the bad guys, it’s also true that the bad guys are becoming really good at beating the good guys at their own game. They’re going back to school too, so that they can learn the tools of the computer forensic trade in the legitimate way, and then use these methods to prevent and avoid detection.

There are criminals who perpetrate crime when the opportunity presents itself; and there are those who religiously plan and execute their crimes. For the latter kind, nothing is too hard or too difficult. They’re often master strategists who are adept at hiding their tracks and moving from one operation to the other to avoid being caught. And this makes computer forensics a more challenging field – how do we prevent the knowledge that’s available from being misused?
Besides the legitimate forensic tools, there are those that straddle the thin line between legal and illegal; and when these are used in conjunction with those that are allowed to be used, they form the most lethal combination because they trick users into believing that the whole operation is legit.

If education is knowledge and knowledge is power, then we must ensure that this power does not fall into the wrong hands. For when it does, there’s nothing we can expect but disaster on a large scale.

By-line:
This post was contributed by Holly McCarthy, who writes on the subject of forensic science careers. She invites your feedback at hollymccarthy12 at gmail dot com

January 2009

2009-01-24T12:33:00.000-08:00

January started good. The European network of Forensic Institutes was having a meeting on their Research and Development in Birmingham. When visiting Birmingham, it appeared that the prices where much lower than in the past, also caused by the exchange rate of the pound. It was nice to see that prices are reasonable again in England. I also had this experience when ordering some electronics in England with Ebay.

Within Europe we see that forensic science is developing in a market. In England and Wales, forensic science is more a market, and there is even a regulator. Also in the Netherlands a market is developing in forensic science, and this is progressing with different companies being active on the Dutch market. Of course, it has some challenges in quality assurance, however it is good to have more choice also when coping with backlogs, as long as the quality is also guaranteed of course.

This month I had to finish some publications and reviews. So as always busy, also with some work for the European Commission as an evaluator. Also doing some casework, and giving some presentations, as well as working on projects.

December 2008 (2)

2008-12-28T02:28:00.000-08:00

With Christmas I received this photograph of the mariage of my grandmother and grandfather in 1929. I like these photographs since they are sometimes more futuristic then one expects.

The end of December is always quiet, since deadlines still can be made before January 1st. I am also doing some evaluation work for the European Commission, and furthermore a new salary model will be implemented at our Institute, where a specialist does not need to be in management to get a higher scale anymore.

I also had to witness in court since the court expected me to do miracles with image processing such is seen in CSI. The issue is as always that I can not make anymore detail in a forensic proper way then is visible on pixel level. This time I had to answer the same kind of questions many times, however in the verdict it became clear that they understood the issue. Recognition of a person is different from identification. I always learn also from the expert witness testimonies. Sometimes they also give advise on how to write technical issues clearer for people that are specialised in law.

It is an issue in writing technical reports for the court, that we have to understand each other well, and sometimes word in technical context might mean something different for a lawyer or a judge. It is always good to be aware of these things.

On another topic currently we are working for FIDIS, and there we make some more open source products. For comparing pictures, the the NFI Comparator has been changed to .net since it will make things more stable (however not workable anymore under other operating systems as was our previous java-implementation. Also the defraser software is expanding now, and currently a new version of PRNU compare is being made which is expected to be available on line in February with implementation of wavelet filtering as described in literature by Fridrich and others. And finally we will also have an ENF-collector available for recording the variations of the 50 Hz-signal which sometimes can be used to find when a certain recording has been made. The ie

On these subjects I will also speak at the conference of the American Academy of Forensic Sciences in Denver. Where I am also happy that we have our first year of the Digital Evidence and Multimedia-section, where I am currently chairman of.

December 2008

2008-11-30T04:08:00.000-08:00

I just came back from a week vacation in the Middle East and then it appeared that Zeno's Forensic Site was suspended for several days due to someone abusing one of the cgi-scripts (indeed hackers seem to develop better tools to be unrecognised). When returning back from my vacation I had a delay of two days due to bad weather in Europe. So, now everything is fixed again, however I learn that it is always wise to monitor everything constantly. And of course, I also have to make backups of the ever expanding website. And after a week of vacation I can start again with a fresh mind.

At my work we had some nice results with the research projects. Several people are working on the projects I wrote on before, such as ENF and PRNU, also for FIDIS. I think we will make also new developments on these open source. And finally the encyclopedia got finished, so thanks to all, I think it will be published in 2009.

Also in European FP7 projects more forensic topics are included, so it appears to work fine. Furthermore I have some backlog with publications etc, however that is the way life is, since casework is first. Next Wednesday I have to go to court to testify as an expert witness in a case.

October 2008 (2) by Kelly Kilpatrick

2008-10-26T03:08:00.000-07:00

Kelly Kilpatrick asked me if she could contribute to this blog with a guest article, and of course I am happy to do so.

5 Computer Forensics Blogs Worth Investigating

The field of computer forensics is constantly changing and evolving due to its inherent nature. Those who are tracked and investigated using forensic methods involving computers are usually trying to stay ahead of the curve, finding new and improved ways to evade their pursuers.

Computer forensics professionals work in a variety of settings, locations, and institutions for different groups that require their services and many of these professionals maintain blogs with news, tips, and advice for their colleagues. Here a few good computer forensics blogs that are worth a look.

Computer Forensics/E-Discovery Blog: This blogger works hard to share information, tips and tricks on a variety of issues related to the field of computer forensics. His proprietary software, Drive Prophet, has been tested by regular visitors to his blog and will be on the market soon. The software will be able to run many reports based on the drive in question and will help maximize time used when investigating hard drives.

Computer Forensics, Malware Analysis, and Digital Investigations: For extremely detailed explanations of a variety of procedures used by computer forensics experts, take a look at this blog. Simple, easy-to-use steps are part of this blogger’s way of giving back to the online computer forensics community. Browse the archives for specific tips you may be looking for.

Forensic Incident Response Blog: If you are interested in real-life scenarios in computer forensics and the proper way to deal with these scenarios, visit the Forensic Incident Response Blog. The protocols for various situations are laid out, including some tips on the latest in remote disk image analysis. Visit this blog for more information.

A Day in the Life of an Information Security Investigator: This blog is full of real world scenarios and advice from a self-proclaimed digital security guru. The blogger has worked for various technological, financial, and military institutions and has a wealth of knowledge to share on a wide array of topics. Browse through his archives and see what you can learn from the Security Monkey.

Forensic Computing: The Forensic Computing blog is a great one that examines the intricate relationship between computer science, information technology, and information security—as they all work together from the perspective of a computer forensic scientist. Looking at these details and how they work in helping to break down the processes utilized by criminals in real world applications is central to the blog. Discussion of digital evidence and admissibility, along with tips and advice make this blog worth a read.

By-line:
This post was contributed by Kelly Kilpatrick, who writes on the subject of the benefits of degree in corrections. She invites your feedback at kellykilpatrick24 at gmail dot com

October 2008

2008-10-05T04:30:00.000-07:00

Starting with the ENFSI meeting in Madrid, the forensic IT working group meeting, it was an excellent start of the month. Many new developments were presented in the different fields, and the organisation in Madrid was excellent.

The week before we had a FIDIS meeting in Dresden, and that was also very nice, so we can work further on PRNU also perhaps on sourceforge. We tried to link the different videos in Youtube with PRNU, however it did not work well yet, perhaps due to compression.

Also casework is going on. When I was in Madrid, I received an invitation to testify in court on a case, however this was such a short notice, that it was not feasible anymore.

Also enough new developments in the organisation, so it looks like a busy month.

Dresden

2008-09-24T10:58:00.001-07:00

September 2008

2008-09-14T01:39:00.000-07:00

Currently working on several nice projects and cases. In August I was at the workshop Computational Forensics in Washington DC and enjoyed the talks that were given. Next year it will be held at the Netherlands Forensic Institute in The Hague.

The projects are now starting again, and one of the projects is ENF where two students are working on, and for FIDIS we are working on a deliverable on PRNU (Pixel Response Non Uniformity) and matching cameras on YouTube, as well as forensic face comparison. This event will be held in Dresden this month.

I am also a very enthousiastic user of the small notebooks of 900 grams which can also be used for presentations and just internet use under way. It is convenient also for presentations and in the train.

Finally I recovered completely from my lung infection I had earlier this year, and currently I feel healthy again. However for that reason I decided earlier this year not to go to Australia in Melbourne in October since the doctor did not recommend to fly 24 hours. The agenda looks excellent of that meeting, and otherwise I certainly would have participated.

July (4)

2008-07-20T02:22:00.000-07:00

This month is really interesting in forensic way. Last Thursday I had to testify in court on a face comparison case. First I had to wait for four hours outside of the court room, before I was called to testify (these are small disadvantages of being a forensic scientist, an expert often has to wait for long times in court, however Dutch courts tend not to call expert witnesses as often as in the United States).

It appeared that they were ready for asking the questions, since all three judges, the two lawyers and the prosecutor were asking questions. It was slightly more difficult compared to other cases, since I was not allowed to have my notes and the reports that we had written in front of me (they took them away). I just had to answer the questions, without looking to any written material.

Then the questioning started. The usual questions were asked concerning expertise, however now there were more questions. We had written our report in a Bayesian conclusion, so I had to explain how this worked, and how it developed. Also some nice questions were concerning the software we used (image visualisation software) and if it was validated, and how it was validated. Furthermore questions concerning proficiency tests between different laboratories and how the field works.

Of course it would be nice if face comparison would be more objective, then with the method that we use now with three different examiners filling in sheets concerning the comparison of the different parts of the face. However the issue is that there is not enough solid research to make it more objective.

This is in many fields in forensic science the case, that the experience of the expert counts for the conclusion. More research should indeed be done in these fields, to make them more objective, and it was for me somewhat disappointing that the European Commission did not put this in the seventh Framework Research projects yet, however I understand they have to make a selection. In the past several efforts have been made in European projects, such as ear comparison fearid etc, however it appears that we need more solid research on the different fields in forensic science to make the conclusions more objective and make the different conclusions of different experts become more calibrated.

July (3)

2008-07-12T01:48:00.000-07:00

Some software is more complicated to develop then other software, and sometimes it takes much more time then expected, however the results count. With one of the projects were I am project leader of, defraser, it appears that we have now a stable product which can be used to analyse MPEG-1, MPEG-2, MPEG-4 and 3GP. Broken video streams can be analyses as well as many others, and since it is open source others can also develop on it. Students from the Hogeschool Amsterdam have developed plugins for AVI and JPEG, and we expect them also to be available soon. You can download it for free from https://sourceforge.net/projects/defraser/ and of course we are more than happy if you can also develop plugins. The software works for broken or parts of 3GP-files for example from mobile phones.

July 2008 (2)

2008-07-07T10:39:00.000-07:00

Just for two days in Brussels at a review meeting for the FIDIS www.fidis.net project at the European Commission. It is nice to see which deliverables have been made in this project. Also got some time to do so planning, en even to update sourceforge with our newest PRNU tool for identifying cameras in Java. It can be found at https://sourceforge.net/projects/prnucompare/ and is made by a student Maarten van der Mark from the Haagse Hogeschool and I was supervisor for this project. It is nice to see how we can develop nice tools in Java, however validation remains important.

One should take many flatfield images (white/grey area) to determine the PRNU. With this possible a small database can be made, and several cameras can be entered. We also would like to add this software to a deliverable of FIDIS, where we try to link cameras on Youtube or other sources.

Dunes of Zandvoort

2008-06-29T01:07:00.001-07:00

When cycling from my work to my home (with train connection), I go through the dunes, which is convenient and nice to see.

July 2008

2008-06-29T00:44:00.000-07:00

It is a month of reviews, writing, planning and doing some casework. Also the vacations are starting these months, so everything is more quiet. However it is a good time to do the work. We will put a Java applet on sourceforge for computing PRNU of cameras. It has been developed by a student at our lab and works very nice for making databases of Pixel Non Response Uniformity of cameras. I will post the link here as soon as it is available, which is expected in a few weeks.

We might consider linking cameras on Youtube with this method (with the University of Dresden) which is one of the research topics of the new deliverable of FIDIS . I am also happy that our deliverable on forensic profiling is ready for review by the European Commission now.

In the meantime I decided (due to my earlier health issues) not to make long trips to Australia, so unfortunately I can not attend the meeting in Melbourne. Also some preparation of the ENFSI meeting of the Forensic IT Working group in Madrid 1-3 October. And also invited as speaker at 2nd International Workshop on Computational Forensics in Washington DC.

June 2008

2008-05-31T11:17:00.001-07:00

Last month I had a lung infection, and was sick for a whole time, so I did not have much time to do work. Perhaps some allergic/hypersensitive reaction which caused this, so still some examinations at the hospital, howevever it seems to be more stable now. It all started when I came back by airplane from Madrid and was hospitalized at the airport due to health issues.

I could just do some emailing and some work from home, and then it is still convenient to have the connection, however since health is also important, I also took a week vacation to recover.

Just had some extra time to do some writing articles from home, do some research, and make some planning, and yes.. time to review articles. Casework is not possible from home, however I still had discussion concerning a case since we had different opinions. I am not sure if I will make trips with airplanes that take more than 12 hours this year. The other things are continuing, so it is all progressing with ENFSI, AAFS and FIDIS. I will submit a proposal for a workshop and a paper I think.

May 2008

2008-05-01T12:38:00.001-07:00

There have been a lot of things going on, and I did not have enough time to fill this blog. Last week I went to Madrid for ENFSI, in order to prepare our meeting for the Forensic IT working group www.enfsi.eu . I am also invited for the 19th conference of ANZFSS http://www.anzfss2008.org.au/ and it is the week before Madrid to give a plenary talk and a workshop.

And finally finished a deliverable for FIDIS www.fidis.net on Forensic Profiling. I took over a small website for our apartements in Zandvoort www.trompborgh.nl . And finally I have to rewrite some chapter of a book on forensic science. And of course some work for the encyclopedia. Still we are wondering if there are partners for EU projects on the forensic toolbox in digital evidence.

There are many holidays in the end of April and beginning of May. In forensic science we always have discussions on time of delivery however quality is always most important.

Also discussions on the market in forensic science. If we look at the Forensic Science Service http://www.forensic.gov.uk, it is an example where it did not work out that well at the moment. It appears that the police groups itself with procurements and that there is not a real open market, since there are only a few bidders. Also the prices of forensic casework are not undermined, and it is questionable if the so much needed Research and Development can be paid for if you leave it open to the market. It is however a relatively small market, where we see the figures of 40-50 millions euros available.

However the market is as such interesting for people that like media attention, and so it can be a spin off for other research. Also in the United States we see that there is not a real market in forensic casework in criminal justice, and of course in civil cases it is a real market.

Also in the Netherlands we see some developments with companies and universities that are starting forensic casework. There are also developments with a register where experts are certified for forensic casework.

Of course it is good to have more source where one can get forensic expertise of, however we should make sure that the quality is maintained. In the common law countries it is more obvious to have defense expert witnesses. They have a market on these, where they read the reports and will give comments on the methods being used.

Also in the system of Dutch Law (which is influenced by Napoleon), we have the prosecutors that are standing magistrates. In some cases a different opinion is needed, and a defense expert might be asked for.

There are people that claim that we should have a market in forensic science. And when I discuss with some of them, they claim I do not understand economics, since the market should work as such. Often the large laboraties are from the state, and are nearly monopolies, since the bills are paid directly by government. If we open the market everyone should have equal rights, of course under the condition that they have a good quality assurance system.

I am not sure what will happen. Since most labs have large backlogs it is also not good that these exist. If there is a market these back logs might vanish. It is good to do some small tests and look what works best. We also see that in healthcare some market working was good, since the waiting times have been improved very much. However there should be enough casework to keep the experience ready for each lab, and with some niche markets this might not work.

March 2008

2008-03-22T03:52:00.000-07:00

It is a very nice start of the month. However it appears that there is some bad weather, so going on bicycle from Zandvoort to Heemstede is not always possible. We have started new projects.

Currently two students are working on PRNU, Pixel response Non Uniformity, and we try to use these methods in court. I am always aware of validation issues, and of course it should be more easy to use for the common user, for that reason we make them publicly available in Java on sourceforge if it works out fine.

Also students from Hogeschool Amsterdam are working on several projects. The project defraser, which is also open source at www.sourceforge.net/defraser, is really developing. We asked students to write plugins for JPEG, AVI en perhaps rewriting it for Linux. The software works for the analysis of videofiles, such as 3GP en MPEG, and could be used as assistance for repairing files. Since I am project leader of the project and also the database, I am very happy it works out fine.

Another project we are looking into is ENF collector. Electric Network Frequency appears to vary due to large generators, as is described by Catalin Grigoras. Currently we are looking into Java-applets for the collection of these, and of course we also need to do some more validation.

This month I also have a meeting of FIDIS www.fidis.net in Berlin. Our deliverable on forensic profiling is nearly ready, and I am very happy with the good collaboration. Also the JIDIS journal is getting good shape now, and our proposal for a new deliverable on identification (PRNU and face comparison) is also getting shape now.

The casework is also good, and sometimes surprising to find new solutions. This month I finished several reports, and now we add a form were the reader of the reports can give comments to the readability, since that is always an issue, especially if we make Bayesian way of conclusions (which are certainly in case with many hypothesis less easy to read).

February 2008

2008-02-23T12:08:00.000-08:00

The AAFS-meeting www.aafs.org in Washington DC was really nice. Finally the Section Digital Evidence and Multimedia got started this week, and I got elected as chairman. It was good to see that all green lights are on and all the efforts of many collegues in this field got rewarded, and it will be good for the forensic community to have this exciting field with fast developments within the scope. Also many presentations and one workshop where at the conference at this field.

January 2008

2008-01-20T13:15:00.000-08:00

This month is just warmer than normal in many senses. With my website I had some issues with traffic and spamming which was difficult to prevent, and as always takes more time than expected, however now everything seems to work again.

Sometimes you experience that some training at work can help you in you household as well. When moving we had a safe where we had lost the key from. As I had done in the past some lock-picking training when I was a tool mark examiner, now it appeared to work. After one hour working it appeared I could enter this safe, so I was happy again.

We also had some results of the somewhat worse housing market when selling our apartments in Amsterdam. It appeared that the buyer could have his mortgage ready much later than expected, since the banks are not so easy anymore. For that reason it was several weeks later than scheduled that the apartment was sold.

We started with several students this year on several research and development projects. It appeared that the deliverable for FIDIS is also progressing now as well as some work for the encyclopedia.

In February I will go to the AAFS, and of course look forward to this. Washington DC is a very nice place, and for Europeans it is not expensive anymore.

Living near sea

2007-12-31T00:03:00.001-08:00

December 2007

2007-12-30T05:18:00.001-08:00

December was a busy month since we moved to near the sea from Amsterdam. It is more fresh air, and the view is beautiful. Also some casework had to be finished, however now I finished all casework I had to do this year.

As always many new plans for 2008. The AAFS www.aafs.org in Washington DC which is held in February should be prepared. I have the three presentations ready now. It will be a turbulent year with many changes, as far as I can see now.

November 2007

2007-11-04T04:18:00.000-08:00

Last week I had to do an internal recertification for the NFI to sign reports. I had to defend eight reports for a committee with one external expert from the Forensic Science Service in the UK. Since all my reports in Dutch they are translated in English, which takes lots of time before the quality of translation is good enough.

I learned my lessons in the past, and did prepare this meeting in a proper way. I had all the files available, and it is also good to see if the files in archive are correctly, and they where ! I finally passed this exam with good resuls and now I am qualified for another four years unless of course there is a decision from the director or perhaps a change of law. It is good, however too much bureaucracy is involved in my opinion.

Now we are thinking on a new deliverable for FIDIS on camera and person identification. I hope to present some of this in the meeting on Monday.

2007-10-21T04:41:00.000-07:00

October 2007

2007-10-11T02:21:00.000-07:00

This month I started with the FIDIS workshop which appeared to be succesful. Also new ideas for new deliverables, however it is always a question of time if this will succeed. Before I went on vacation I had to finish several cases and write reports since it is important to deliver in the requested time for the trials. So before vacation it is as always busy, finishing some tasks.

Currently three students are working on improving our face comparison tool which is available from www.sourceforge.net face2face and NFI comparator. I am testing the results right now. Furthermore the research on pixel artefacts or Photo Response Non Uniformity of CMOS and CCD sensors appears to have better results then expected.

The vacation is to Turkey and Greece, and it is really nice. We went to İzmır, Van and to Chios and Lesvos. Van was not as touristic anymore, however the lake is beautiful.

September 2007

2007-09-09T02:35:00.001-07:00

September is a busy month as always. This month I am looking forward to the ENFSI www.enfsi.eu Forensic IT working group meeting in Dublin, where I am the chairman of. We just migrated our information to the new website www.enfsimembers.eu . It is always more work then expected, and of course one needs to get used to new user interfaces.

On the 1st October we will organize an event on forensic profiling for www.fidis.net . This was expected for a long time, however now it will work out, since now we have many contributors ranging from the University of Lausanne, to the London School of Economics, University of Leuven and the Vrije Universiteit Brussels. Forensic profiling as such is a broad topic. However it means for us finding links between evidence by means of searching and linking databases of information. The different aspects from technological to privacy aspects will be handled in this deliverable.

The R&D projects are currently working out well also with a student. On pixel artefacts in cameras we did some new research with a database of cameras. It is nice to see the results, and I hope some if this will be presented at the AAFS in Washington DC.

The projects that I work on for forensic face comparison (comparator and face2face), and defraser for analysis of formats and codecs are now available on www.sourceforge.net . A group of students will work on the software to merge these projects.

Also busy with casework, and for October we have an internal audit where I have to defend eight reports for a committee. This procedure is a kind of internal certification, however it also means work in preparation.

August 2007

2007-08-25T02:51:00.000-07:00

August is a month that many colleagues are on vacation. It is a good month to do some planning, an making new ideas. At the lab, there are some fewer cases, and in some way it is also good to finish reports, and making a good start for the next months to come when it is busy.

Preparing meetings for FIDIS www.fidis.net on forensic profiling, ENFSI www.enfsi.org Forensic IT working group.

Also with MRI scans I wrote on before and the interpretation of them, it appears that different radiologist make different conclusions. It is interesting to see that there is no golden standard on these things yet.

July 2007

2007-07-08T02:23:00.002-07:00

At the beginning of this month I was the whole week in Brussels for the European Commission. It is always nice to be in Brussels. This week we also have to finish some casework. For a reconstruction at night we have to be late at a place where a crime had happened to have the proper lighting and do a proper reconstruction.

I will have surgery to my wrist later on this week (caused by the catheterisation through my wrist in the hospital which probably damaged the vein and one of the nerves and caused that I have a bumb on it and difficulties with using my hand), so for two weeks I am not able to write that much. It is summer time, so it is time to read, make new proposals, evaluate and finishing the casework. So I also have to be quick for the proposals for the AAFS meeting, since they have to be in before August 1st 2007.

June 2007

2007-06-10T02:27:00.000-07:00

Before the summer vacation many things should be finished. This time we did a court training (defending an expert report) before an audience, and it appeared to be good. Some sharp questions were asked, and it always helps to improve the quality. A new student are starting their projects now (camera identification), and several students are finishing their projects (software development, literature overview of vein scanners and their reliability).

May 2007 (2)

2007-05-20T12:16:00.001-07:00

We had many holidays this month, however also time to finish some casework. Even a presentation in Brussels last week on biometrics was nice to give http://www.intertechusa.com/conferences/conferenceDetail.aspx?displayDetail=overview&WCID=198 . I was the last speaker of the conference, and still there were many nice questions to answer. The whole range from DNA databases and exchange of information on these to the spoofing of fingerprints, irises and the current implementation of the biometric devices were discussed.

May 2007

2007-04-28T01:45:00.000-07:00

April was a nice month. It is always good to go with colleagues to have a drink, and discuss new developments and of course much more as can be seen in the photograph. This month I had to do several cases, and do some investigation with a reconstruction at an ATM, to have good images for comparison of faces. It is difficult to have a similar positioning and the same condition, so each time we are improving this method. Since many wireless options exist, we can use them to make more efficient.

The steering committee of ENFSI was this year in Belfast. It was a nice event, and I enjoyed the city also a lot. The city improves each time that I am there (and also gets more expensive;) We discussed the meeting in Dublin, and had some nice ideas, and of course discussed proficiency tests. More information on the working group is available on www.enfsi.org .

And on the 30th of april (Queens day in the Netherlands) I will give a presentation for FIDIS on biometric devices in forensic science in Parague, and a kind of overview how biometrics is used in forensic science. It is always good to have some time, to update these presentations.

The website is also updated in some form. I also see that the forens-l list http://geradts.com/mailman/listinfo/forens_geradts.com which is hosted there runs again.

Last week I planned several meetings for our R&D-projects, in order to have an update. The software for analysis and repair of AVI, MPEG-1, MPEG-2 and 3GP streams that has been developed in the lab, will be open sourced on sourceforge in June. If possible, we try to open source it, so others can also implement their plugins and of course anyone can review the software.

Colleagues

2007-04-26T09:58:00.000-07:00

April 2007

2007-04-13T04:21:00.000-07:00

Amsterdam central station

I am just using my new phone K800i where I have UMTS and can directly post on this blog and made a photograph out from the window of our appartement in Amsterdam. It seems to be convenient, however for me it was also important that the phone has a radio on it. Today I had a phone conference with this new phone, and tested VOIP over UMTS. It did work, however it appeared that I had some latency issues.

As always enjoying new things. Yesterday some casework and a reconstruction at night, since we had to have similar conditions. This week it was somewhat more quiet due to Eastern, so a good time to think on old projects that should have been finished, and look how to have some new projects and possibilities.

March 2007

2007-03-29T05:24:00.000-07:00

The AAFS www.aafs.org was a very interesting conference in which progress has been made to form a digital evidence and multimedia section. After this conference I didn't have much time, due to backlogs. We had to write new and modified project proposals, do casework, give advise, and had several visitors.

Furthermore I went to Damascus for one week. It was a nice and relaxed vacation. We rented a car and visited many nice sites and visited very good restaurants. Our hotel was in the mountains around Damascus, and it was a good time to relax.

Currently I am sitting at the FIDIS www.fidis.net general meeting. Many interesting talks on identity related issues. As leader of WP 6, it appears we had some trouble with delivering the deliverable on time. The issue is that it was difficult to find a forensic profiler with the necessary clearance on time. Suddenly we are working on a solution by cooperating with the University of Lausanne, and I have a good feeling that this deliverable will be finished in 2006. The nice part of FIDIS is that it is more multi-disciplinary, so I get more insights in different perspectives.

February 2007

2007-02-10T12:34:00.000-08:00

I am looking forward to the AAFS meeting in San Antonio this month. This time, I organize a workshop, give two papers, and even receive an award. I like the good atmosphere of the AAFS, the interesting people to meet, and some good discussions about forensic science. It is 8 hours flying at least, so I will stay one day longer to get used to the time difference.

Currently I am preparing the presentations. However it appears that this time my planning and scheduling is better than before. I got it ready last week, and everything was in time. Also my casework has been in time. We are also doing software project with students, and I am looking what will happen with these. Also as chairperson of the employees representatives, I had several meeting, and since our director will change, we have some interesting times. Also the organization is expanding now, so it looks very optimistic.

December 2006 (3)

2006-12-27T01:03:00.000-08:00

At the end of december, finishing tasks and deadlines. The handouts of the AAFS workshop in February should be ready now. Then I have some work for writing and reviewing articles. Also the FIDIS www.fidis.net network of excellence asks me to write a small contribution to a deliverable, which should be finished soon.

The most suprising is that I have to go to court on the 27 December 2006, to explain a report that I have written on CCTV-evidence. Normally you just can finish and clean tasks, however it belongs to the job. Furthermore I have to be reachable for my work 24 hours a day these two weeks, in case expertise is needed. However it is all nice. I also have to clean up my mailbox, since it appeared I had 9 Gigabytes in my mailbox and the mailserver was not very happy with that. That also takes some work (since I like to have all mail available of the past for the information).

December 2006 (2)

2006-12-15T03:18:00.000-08:00

After the vacation and one week sickness due to some side effects of cholesterol medication where I had this catherisation in a hospital since it appeared to effect the hart, I am finally relaxing. Stopped the medicine, and I was very glad that the effects were disappearing.

When I came back at the office, I had the usual piles of mails and emails and work. It appeared that our director gets a promotion and moves away. Then it appeared that in the week I was in hospital and at home due to the side effects, the conference on digital evidence I organised, did not work out too well. I should have finished the program last week and call the persons if they really would show up. However then it appeared that due to bad luck on one afternoon none of the three workshops worked out.

That week I went to a conference with chairpersons of ENFSI Working group www.enfsi.org . Since I had somewhat too many tasks (and also had to check with the hospital if I could fly again, since I also had many contusions in my arm due to the catherisation, which took more time then expected since they had to test different catheters before the right one came in the right hart chamber). I came in one day later. It was very nice organized in Tallinn, Estonia. Our director is current president of the ENFSI, and it was a good experience. We had an open discussion. Also the declaration of FIDIS in Budapest www.fidis.net where I was involved in earlier was discussed, since it was the biometric passport which was discussed here.

Last week it was nice at the office. I had to do some casework. In one case we had to do many comparison, however we still needed some extra material to draw a conclusion. Also discussions on the profile of the new director (since I am chairman of the employees council). Then later on a received a letter to testify in court for a case I did several months ago. So even on 27 December an appointment. Normally this week it somewhat more quiet.

Also the preparation work for the different tasks I have to do :
- FIDIS writing some contributions
- the encyclopedia writhing a contribution and keeping track of the contributors
- AAFS workshop handout

It suddenly appeared also that two of my projects where cut in their budget. One on the biometric devices and the other one of measurement of noise in camera's for identification (since we would like to validate this). It appeared that I could find alternative budget in the NFI for the second, however I have to spend the money this year. And in government organisations that is not easy.. since these processes take longs. However I am always positive and try to find a solution for that. Mostly if you really spend some time in these processes they speed up. The biometric devices is more interesting, however perhaps partly we can do it with the funding of FIDIS. And most of the times you will find new solutions if you can find them. It makes the work also even nicer ;)

December 2006

2006-11-30T05:58:00.000-08:00

After a nice vacation in the Ukraine and Turkey, where we went from Kiev to Odessa, by ferry over the black sea, to Istanbul, and further south to Izmir. After that we stayed in a five star hotel for only 25 euro per night, since it is the season of the year that not many people go on vacation, we flew back to Brussels and took a train to Amsterdam. It was a nice vacation.

Unfortunately when I came back I had chest pain, and already used nitroglycerine spray prescribed by a cardiologist (which was taken away from me due to the fluid regulations in airplanes), the doctor decided to send me to the emergency service of the hospital by ambulance, because they suspected a heart attack based on the ECG. I got more nitro, and had to stay in corony care for a night with all monitors around me. Then they had to make a catheterisation to the heart which could be done at the same day. The left heart chamber was clear, and in good condition. They did the cathetarisation via the wrist and it took ten different catheters before the reached the right heart chamber. Also this one was fine, so I was satisfied that there was nothing serious. I could go home, and it appeared that everything went well.

At least writing emails gets somewhat more troublesome, due to the contusions on my wrist caused by the catherisation. Then, when I arrived home, I had the same effects with pain on the chest. I was thinking what could have caused this, and suddenly I realised that in the hospital they did not have the medicine Modalim on stock which was prescribed by the home practioner several weeks earlier. It appeared that as soon as I use this medicine the pain came back. So just testing this effect, and hope it helps to resolve the pain. It is indeed somewhat frightening if you have these kinds of experiences, since I try to do enough exercise (by bicycle to the work and three times a week workout at the health club), and also try to keep the diet under control. Anyway, I had seen enough doctors this week, and hope to start up next week with my work.

Well at least, it changed my planning in my agenda. I have to reschedule, and look what to do this month, and which appointments I should skip.

November 2006

2006-11-10T13:30:00.000-08:00

Too many tasks to do, and then a weblog stops working. After some time of many tasks, finally some vacation. Last week I had to be in Krakow for only one day. It was too much travelling for a meeting of two hours. However the meeting was interesting, and motivating.

On November 22, we will have the votings for the Dutch parliament. This time I subscribed to voting via Internet. There appear to be some discussions on voting machines, however I am also interested on the evaluation of this system. The advantage is also that the laws could be changed and someone can elect all 150 candidates, like is currently the case at some political parties. One can elect the order of the persons. It would be a more balanced system then voting for one person, perhaps.

September 2006

2006-09-22T05:18:00.000-07:00

As busy as September is, with some work for a course on the University of Amsterdam, for the union, for preparing the ENFSI Forensic IT working group meeting www.enfsi.org , organzing some conference and writing for a book.

These months there were some requests for articles for a variety of journals and magazines. Also requests for presenting papers. It was also the first time for me, that someone scanned a report which I have signed and put it on the Internet at http://www.maurice.nl/images/op_zoek_naar_een_vlek.pdf .

And I also have to do some reviewing and writing reports. It is always good to look back, and evaluate what happened with the reports that have been written.

As always the number of deadlines that are in October is huge. So this time, I have a short blog due to these issues.

August 2006

2006-08-19T13:46:00.000-07:00

Just doing the normal things in August. Submitting the abstracts for the AAFS in time, making some plans for new publications, which always take more time then expected, doing some work for the projects and watching the casework itself. Often with cases where we need more information or extra things done, people tend to be on vacation, and many cases are paused due to that.

September will always be the busiest month, and that is also a nice month to take some vacation. However this time that will not work. I think I will wait to november, and more opportunities might be there.

This month a publication in Physics world http://physicsweb.org/index/world .

July 2006

2006-07-01T13:33:00.000-07:00

This month gets somewhat more quiet, in order to think issues over. Forensic science keeps attracting more media attraction, and I have to cope with it. Last month I had four workshops at the EAFS-meeting in Helsinki with talks of 45 minutes, on biometrics, face comparison, how to setup or maintain a digital evidence section and integrity of images. As a chair of the union I also had a busy time with restructuring of the organization, and changes towards a more competitive system.

At FIDIS also the review meeting worked out well. I did not have enough time to spend, and this also appeared to be true in the forensic profiling part. The reviewers where not giving a fine review on my publication on this part, and I can imagine that they did since I did not have enough time for it, to make it proper. However, since I have written this paper, it might be useful for other use, and I just enclose it in the weblog for anyone who would like to continue to work on it. So, at this moment, I decided not to continue this research, since it is a dead horse to me.

Forensic Profiling
Author Zeno Geradts
Abstract
In forensic science, the old fashioned traces like fingerprint evidence, cartridge cases of firearms, tool marks and shoeprints are used for over a century either in manual form or in database form. These databases are used for finding links between crimes which were not previously known. Newer, powerful, databases are databases of DNA.
Since more information is available in digital form, from customer databases to biometric databases of faces and fingerprints combined with chip-cards and other information, there exist in theory methods to do profiling in databases and combining the databases from government and police. Privacy laws have to be taken into account when using the combination of databases.
If allowed for serious crimes, the information can be combined, and will provide more useful information if a certain person was at the scene of crime at a certain crime. For less major crimes (for instance burglaries) it is possible to use information from the police databases and combine these for finding a profile of a certain perpetrator. An overview of current databases that are used in extracting forensic evidence is given in this chapter, together with other possible databases that could be used in theory.
An important issue that should be taken in to account is that some information from databases can be not structured, and that structuring information is an important task before analyzing the data. It is also important to consider alternative scenario’s and hypothesis when using profiling.

Introduction
Forensic science is a multi disciplinary field in which many different fields of expertise can form evidence in court. In this chapter we do not limit ourselves to DNA profiling1, however we also look at profiles that can be extracted by combination of any form of information that is available, such as digital evidence.
Current situation
In a forensic laboratory, currently there exist many different databases that in principle can be used to link cases and suspects :

Firearms : Cartridge cases, bullets
Fingerprints
DNA
Faces
Tool marks (e.g. screwdrivers )
Shoe prints
Handwriting
Paint and glass
speaker
….

Unstructured data also exists from e.g. hard drives and cellular phones that have been seized during an investigation.

Many fields in forensic science have been experienced based, and came from practitioners at the police. For example, fingerprint examination exist over a century and until recently not many questions2 where asked concerning the statistics and the scientific research. DNA arrived in forensic labs in the beginning of the nineties, and this was from a scientific background with more statistical data available. However, as is mentioned by Stanley Cohen3, one has to consider why the DNA has been retrieved at a certain place. For reason of wrongful convictions also other evidence has to be taken in account, and forensic profiling can help in combining the information. However still it can also lead to wrong convictions if used in a not proper way4.

Based on earlier research in Workpackage 6, the taxonomy is used in this paper concerning a certain artefact with the implications for a single item, and for the items in the database for forensic science, to use as evidence.

Current Possibilities
We expect that in current and future databases, the data models will become more standardized, in such a way that they can be combined with other databases such as :

Biometrics ( fingerprints, DNA, face, iris etc. )
DNA
Currently many countries have a DNA database for suspects or convicted persons. One of the largest is the database at the Forensic Science Service. The United Kingdom National DNA Database was set up in 1995. As of the end of 2005 it carries the profiles around 3.4 million people, over 585,000 of them taken from children aged under 165.
Fingerprints
Most countries have such a database for criminal records. The largest -known- database in the world is IAFIS at FBI6. The IAFIS contains the fingerprints and corresponding criminal history information for more than 47 million subjects in the Criminal Master File in 2005.
Faces
There are databases of faces. However the problem is that the algorithms for searching in facial database perform poor. Also aging and the way a face is entered in the database will give poor results7. At our laboratory we also examined several state-of-the-art systems and had the same results.
Iris
In the United Arabic Emirates an iris database is used with more then 600.000 iris images. It is claimed8 that the results with this database are extremely good compared to other biometrics. The evaluation is conducted by the patent owner Daughman.
Banking and insurance transactions
In 2007 banking transactions of more than 15.000 euro are monitored in the EU9 for prevention of money laundering and terrorist financing. The US Patriot Act and the Bank Secrecy Act 10 goes futher, and also uses financial transactions to identify a certain person. It is known that with banking transaction it is possible to track and trace persons11. If a person uses his bank card to buy a train ticket, and later on to buy other goods, the location and time where the person is can be followed.
Telecommunication traffic (location GSM and Internet)
Location GSM
With the GSM information can be extracted from the phone or from the network. The call detail records at the provider give more information on the base station where a call or a sms has started. This gives a possibility to track a person12. In the Netherlands the case the “Deventer moordzaak” many experts were examining the possibility that the suspect was over 10 kilometers further than the base station where the suspect was connected to. Due to atmospherical circumstances this is possible, however it is not very likely, as is stated by prof. Jondral of University Karlsruhe13.
Call detail records and data retention
Data retention14 generally refers to the storage of telephony and internet traffic and transaction data by governments and commercial organisations. In the case of government data retention, the data that is stored is usually of telephone calls made and received, emails sent and received and web sites visited. Location data is also collected. The primary objective in government data retention is traffic analysis. By analysing the retained data governments can identify the locations of individuals, an individual's associates and the members of a group.
In Europe the data retention directive is accepted to fight terrorism. Data can be stored for up to two years. The contents of communication is not stored. An exception is (internet) interception in countries where it is legal with court order. For instance a survey by the Dutch Ministry15 of Justice in 1996 found that law enforcement in the Netherlands intercept more telephone calls than their counterparts in the United States, Germany or Britain.
All computer actions and storage
This is data that is stored on the hard disk of a computer. When the hard disk is forensically examined, information can be extracted, for instance email, password and other files. The data of the hard disk has to be seized16.
Records of toll ports / public transportation
automatic number plate recognition
For tracking cars on the street automatic number plate recognition is used17 which is also good for crime prevention of not insured cars or if the tax has not been paid. It can also be used for collecting toll, for instance in the city of London this is operational. Automatic number plate recognition (ANPR) is a mass surveillance method that uses optical character recognition on images to read the license plates on vehicles. As of 2006 systems can scan number plates at around one per second on cars traveling up to 100 mph (160 km/h). They can use existing closed-circuit television or road-rule enforcement cameras, or ones specifically designed for the task. They are used by various police forces and as a method of electronic toll collection on pay-per-use roads, and monitoring traffic activity such as red light adherence in an intersection. Britain will also be the first country where every car journey will be recorded and stored for two years. In 2005 they had 2000 camera's ready18.
Public transportation
Also other forms of transportation persons can be tracked. This is more even so if RFID's are used in the transportation that have an identity on them. In London the Oyster RFID card, is a tool that is used by the police to track persons. The smartcards, used by five million Londoners, record details of each bus, Tube or train journey made by the holder over the previous eight weeks. In January 2006, police requested journey information 61 times, compared with just seven times in the whole of 200419.
Board computer in private transportation (cars etc)
Airbag systems
Nowadays board computers are integrated in cars. Air bag systems and other systems in cars
can leave traces that are importance to forensic scientist. An example20 is a forensic company that advertises : “ We use the Vetronix Crash Data Retrieval System to download the Airbag System Sensing and Diagnostic Module in most General Motors cars, light trucks, vans, and SUVs. A select portion of the Ford automobile line can be accessed as well. Additional Ford models and other manufacturers will come on line in the near future. This technology provides information used by the airbag control module in making deployment decisions. In many GM vehicles, it also can provide 5 seconds of data before a crash, including speed and seatbelt status”
GPS
GPS also contains information on routes driven and stored which might be of interest as evidence. Also GPS units with a communication device (for example http://www.unitrack.com/) which is a remote control system for your vehicle that allows you to monitor, track and control your vehicle over the internet. Also GPS bugs are commercially available, which store 1 month of location on a USB stick http://www.everythingusb.com/trackstick.html . Depending on the legislation these can also be used by police by court order.
Customer loyalty programs (air miles etc.)
An interesting example of how data gained through the use of a customer loyalty card can be quite problematic for the individual customer can be found at slashdot21:
“Tukwila, Washington firefighter, Philip Scott Lyons found out the hard way that supermarket loyalty cards come with a huge price. Lyons was arrested last August and charged with attempted arson. Police alleged at the time that Lyons tried to set fire to his own house while his wife and children were inside. According to KOMO-TV and the Seattle Times, a major piece of evidence used against Lyons in his arrest was the record of his supermarket purchases that he made with his Safeway Club Card. Police investigators had discovered that his Club Card was used to buy fire starters of the same type used in the arson attempt. For Lyons, the story did have a happy ending. All charges were dropped against him in January 2005 because another person stepped forward saying he or she set the fire and not Lyons.”
The location where a person has been and what amount the person has bought is stored in databases, which might be accessible later for forensic evidence.
Surveillance cameras
Many surveillance systems are becoming digital, and it is possible to put all information in a huge database. As mentioned tracking cars based on their license plate is possible (if the license plate is readable and not stolen or copied). Tracking persons automatically is not feasible in on the street systems. Face recognition methods do not work properly. Even with the London attacks all video informations from thousands of camera had to be examined manually22. The alternative is tracking with license plates for cars as mentioned before.
The use of Surveillance cameras and other cameras from mobile phones are getting more important as evidence in court. The approval for use as evidence in court is restricted in Germany (in several stated) compared to the United Kingdom23.
RFID's
A consumer goods tracking system called Radio Frequency Identification (RFID) is entering all of our lives. RFID couples radio frequency (RF) identification technology with highly miniaturized computers that enable products to be identified and tracked at any point along the supply chain.
The system could be applied to almost any physical item, from ballpoint pens to toothpaste, which would carry their own unique information in the form of an embedded chip. [3] The chip sends out an identification signal allowing it to communicate with reader devices and other products embedded with similar chips.
Analysts envision a time24 when the system will be used to identify and track every item produced on the planet if it is not stopped (and with the implementation of ipv6 (the evolving standard for ip-addresses) each item can have it's own ip-address).
RFID employs a numbering scheme called EPC (for "electronic product code") which can provide a unique ID for any physical object in the world. The EPC is intended to replace the UPC bar code used on products today.
Compared to the bar code, however, the EPC goes beyond identifying product categories--it actually assigns a unique number to every single item that rolls off a manufacturing line. [8] For example, each pack of cigarettes, individual can of soda, light bulb or package of razor blades produced would be uniquely identifiable through its own EPC number. It depends however very much on the implementation. Customers can destroy the RFID, or replace them on items, to protect themselves.
Digital traces in domestic applications (e.g. coffee maker, microwave, heater)
If all equipment is connected to the Internet, also possibilities exist that information concerning the use of those leaks to the outside world. Even if memory chips are available on our domestic equipment, time and date information can be extracted, and information of witnesses and suspects can be verified.

Examples
For the passport for example it will be possible to track someone if the ICAO-standard is implemented without any protection. The passport will have a wireless chip in it, and information concerning face and fingerprint can be extracted from a distance. Currently in trials in the Netherlands more protection is used in such a way that one needs more information concerning the machine readable zone of the passport. However if countries do implement it without any protection, then possibilities exist that information concerning the passport they carry can be extracted from a distance.
If a severe crime happens, all CCTV-images in the neighborhood, computers of suspects and witnesses, location information of the GSM network, data that is available from communication providers can be collected. Together with the traces someone can be followed and the identities of the person can be checked with this data.
A simple example around this, is a real world example. Person A says he does not know person B. The bank records give information that they both bought a ticket at the railway system with their banking card in The Hague, with the same machine and and Amsterdam with the same machines and next to each other. This data is confirmed by CCTV-recordings on these dates where both persons A and B where recognized talking to each other.
The same is also true if the use of RFIDs is widely used with a unique code. An example from the real world : suitcases at the Hong Kong airport are labeled with a RFID-label. It is practical possible to follow the suitcase when the person arrives in Amsterdam if an RFID-reader is available at several positions in Europe.
It is also possible to do profiling with several tags. One person may have bought several cloths and items from different manufacturers and carry them with him. When this person enters the shops all tags are read. The combination of tags is a profile for this person. Together with DNA-data and fingerprints, the person might be identified for a crime case.
Another problem that arises, if a person accidentally fills out the wrong data or intentionally. By using a voice over ip-service as Skype one can request a phone number in another country. The mistake is easy to be made to fill out Namibia instead of the Netherlands. With some credit cards the country name is not checked. Since the jurisdiction is different in the Netherlands compared to Namibia, important data might be not be retrieved with a court order to Skype concerning phone calls or call records. Someone can also intentionally pretend to be a citizen of a different country, by using pre-paid credit cards and addresses of hotels.

Discussion
The question arises if the kind of evidence with the combination with many different databases, such as surveillance systems with non-structured data, is feasible. Also the amount of data that is collected grows very rapidly, and the question is if it is feasible to store this data in a proper way.
Furthermore, it is expected that there are more false positives when combining different databases. If a ‘cold’ hit is found in the database, which means that there was no prior information that a certain suspect would be involved in the case, false positives are possible. For example, if DNA would be collected of all citizens of the world, and the search would be against this database, then roughly at least 6 suspects would be found with current methods, and probably more since family relations are not accounted for.
Another issue is that in databases there are many writing and spelling errors25, or even persons that use another identity to protect their privacy. Data in itself is often “dirty”26, which means that many other errors are possible, and should be taken in account.
The final issue is the profile itself that is used to track a certain behavior for law enforcement. An example is a booklet that is given to the citizens of Korea where the profile of a terrorist is mentioned27 :
“For example, terrorist suspects often leave a restroom hurriedly after leaving a backpack or a plastic bag behind, and a person paying with cash is more likely to be a terrorist suspect than a credit card user since terrorists try not to leave any traceable evidence, the pamphlet says.
Terrorist suspects often do not order alcoholic beverages at bars or other similar entertainment spots or order a drink but do not drink it. They also have a tendency to sit in the corner, carefully watching others.
Regarding the appearance of terrorists, the booklet highlights those who have a pot belly or who wear thick clothing despite warm weather and sweat a lot as targets who should be carefully monitored because suicide bombers often wear explosives around their bellies hidden under thick clothes.
The booklet also requests immigration officers or travelers at airports or ports to carefully watch tourists who hold new, temporary or reissued passports. Those who pass bags or documents to strangers should be closely monitored as well.
At railway or subway stations, passengers who randomly change their destination also may be engaged in terrorist activities.”
A profile like this matches many tourists, and real terrorists know where they are looking for to find them. It is also possible to give other people a certain profile, without them knowing it. Copying information and using someone else's identity is easy, since look-a-likes with a lent or stolen id-card are not easy to distinguish28.
These kind of profiling can lead to confirmation bias with the examiner and the judge, which might lead to wrong convictions, if not the other hypothesis (the suspect is not guilty versus the suspect is guilty) is not tested thoroughly. In forensic science this is not the question; it is limited to the material that is received and answering the question concerning the material and a comparison.

Literature
1 Inferences Using DNA Profiling in Forensic Identification and Paternity Cases
Donald A. Berry
Statistical Science, Vol. 6, No. 2 (May, 1991) , pp. 175-189
2 Moenssens, Andre, Fingerprint Identification: A Valid, Reliable "Forensic Science", 18 Criminal Justice, No. 2, 30 (2003). -Mears, Michael, et al
3 The Wrong Men: America's Epidemic of Wrongful Death-Row Convictionsdoor Stanley Cohen Carroll & Graf Publishers, 1 okt 2003
4http://www.innocent.org.uk/
5 http://en.wikipedia.org/wiki/UK_National_DNA_Database status of 12.05.06
6http://www.fbi.gov/hq/cjisd/iafis.htm
7 http://en.wikipedia.org/wiki/Facial_recognition_system at 12/05/06
8 http://www.cl.cam.ac.uk/users/jgd1000/UAEsummary.pdf at 12/05/06
9Directive on money laundering and terrorist financing, 3631/05 + COR1, 11443/05 ADD1
10http://www.cftc.gov/cftc/cftcaml.htm
11“Person location and person tracking - Technologies, risks and policy implications” , Roger Clarke, Information Technology & People Jun 2001 Volume: 14 Issue: 2 Page: 206 - 231
12Forensics and the GSM Mobile Phone System, S. Willassen, International Journal of Digital Investigation, Spring 2003, Vol. 2, Issue 1 http://www.utica.edu/academic/institutes/ecii/publications/articles/A0658858-BFF6-C537-7CF86A78D6DE746D.pdf
13Conclusion drawn by the court of appeal in 's-Hertogenbosch at 9 november 2004, case 01568/04
14 http://en.wikipedia.org/wiki/Data_retention
15http://www.privacyinternational.org/survey/phr2003/countries/netherlands.htm
16Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers, Brian Carrie, Winter 2003, Vol. 1 Issue 4 , http://www.utica.edu/academic/institutes/ecii/publications/articles/A04C3F91-AFBB-FC13-4A2E0F13203BA980.pdf
17 http://en.wikipedia.org/wiki/Automatic_number_plate_recognition
18 http://news.independent.co.uk/uk/transport/article334686.ece
19 http://news.bbc.co.uk/1/hi/england/london/4800490.stm
20 http://www.southeastcollision.com/services.html
21 http://yro.slashdot.org/yro/05/01/29/030223.shtml?tid=158&tid=187
22 http://www.itworld.com/Net/050708closed/
23 http://www.surveillance-and-society.org/articles2(2)/regulation.pdf
24 http://www.spychips.com/documents/Albrecht-Denver-Law.pdf
25Investigative Investigative Data Mining for Security and Criminal Detection, Jesus Mena, Elsevier, 2003
26 A Taxonomy of Dirty Data Won Kim1, Byoung-Ju Choi2, Eui-Kyeong Hong3, Soo-Kyung Kim4 and Doheon Lee5Data Mining and Knowledge Discovery, January 2003 , Pages: 81 - 99
27http://times.hankooki.com/lpage/nation/200410/kt2004100617160211960.htm
28Identity fraud as a challenge to the constitutional state By Dr mr J.H.A.M. Grijpink http://www.computingscience.nl/people/grijpink/docs/Identity%20fraud%20as%20a%20challenge%20to%20the%20constitutional%20state.doc

June 2006

2006-05-27T01:29:00.000-07:00

Too much work is coming in, so I have to select parts which I can do and which I can not do. Also a high profile case takes much of my time, and my complete planning has been destroyed. It is good to look forward to the summertime, where in general not many cases come in and the backlogs can be worked away.

In June I have to prepare the steering committee meeting of the Forensic IT group of ENFSI, and give presentations at several workshops. This is in fact the relaxed part. At my work I have to spread my attention to many things, and here I can focus more on the topics. Unfortunately at the same time that week there is also a review meeting of FIDIS planned, and I can not combine the things. Luckily a colleague of me would like to go there, so this is partly solved.

Also we have organized a digital video workshop at our institute, which also takes some planning, however it should work now. The next time I do not plan all these things after each other, since there is not enough time for preparation.

Another problem that appears that I have heel pain in both of my feet, which makes it harder to walk. With all kinds of medical tests and treatments, as the regular blood tests, night spalks, cortizone injections, X-RAYs and even nuclear imaging, the spots where visible but the pain was not solved. For that reason I am now looking into shockwave therapie (ESWT), which might cure this. I read several journal articles with blind tests, and thought this is worth a try, since it is not destructive. What is very strange, is that the insurance does not pay this treatment, so I have to find some other ways of funding. The surgeon told me that he thought that the method did not work.

When reviewing all methods in literature, I thought it would be good to file a complaint at my insurance not paying for this method. They fund alternative treatment, and even this method has more publications with blind tests see http://heelspurs.com/eswt/index.html behind it, where it appeared to work in a larger population, whereas there are also publications that suggest that it does not work. Of course not that I think that it works. The cortizone injections are even more questionable than this method, and they are funded by the standard health care plan. However I think it is a question of time before they will refund this treatment.

Oh, and BTW the eye surgery with LASIK, I do not have to use any additional fluids anymore, and do not see any side effects. I see sharper then ever before with glasses or contact lenses. T

May (3) 2006

2006-05-07T03:35:00.000-07:00

At my work we see signs of the market, as competitors come in and there is lots of media attention. It is good to have a market in forensic science, as long as the reports do not become biased because of the market. I am always very alert on these things, especially if people want to have nice visualisations or 3D-reconstructions for one opinion, and not for other scenario's that are also possible.

May (2) 2006

2006-05-04T12:51:00.000-07:00

When returning to the work after vacation, it was a holiday week, so I was the only court appointed expert witness in the field of image processing and biometrics that week in. My colleagues had decided that we had to stop the cases, since we had an overflow of cases, and could not accept any cases until July.

It is not easy to refuse cases that come in, and are from the court or from other important requesters. So, this week I had several cases coming in that could not be refused, and that made feasible questions. Much on face comparison, image processing and length measurements / photogrammetry.

We also looked further in several new publications for our research and development projects. One of these was on camera identification on noise. We had several questions around this (how unique is this, compared to pixel defects). For that reason I was requesting for a student project at the University of Delft, or of course any other student that is interested.

Several projects I was working on, had some kind of development. I was very satisfied with the results of our students Informatics when I came back on the biometrics.

One other project is working together with the Amsterdam Police. I had started some project, and everyone is cooperative in words, however in final it did not work out as expected yet. Sometimes you need more patience, and just go ahead with the work. Today, I just listened to the concerns of several departement heads, and mirrored their opinions. I did not disagree or agree with any opinion, and it worked out. As always listening and asking questions concerning their thoughts makes it easier to understand how to proceed. I think in final it will be a great project.

As always I am optimistic, and will just proceeds with the projects. There are many nice things to do, and some of them work, and other do not.

May 2006

2006-04-29T03:32:00.000-07:00

April 2006

2006-03-31T12:21:00.000-08:00

Just at the airport, and looking back to some busy period. I have a delay of three hours with a flight from Vienna to Amsterdam, and so I have more time to think things over. Best of it is that Vienna has free wifi. All of the airports should have it !

Today we had the FIDIS workgroup meeting on identity. I hope to have a workshop on forensic profiling in May. Of course in April I will be quiet, since I just go on vacation for some part.

2006-03-10T13:42:00.000-08:00

March 2006

2006-03-10T13:05:00.000-08:00

February was a nice month with the AAFS meeting http://www.aafs.org , where an effort is made to setup a Digital Evidence and Multimedia section by Carrie Whitcomb of http://www.ncfs.org . We hope that we can start this section next year, since there is lots of interest in forensic science to have such a seperate section. During this meeting I was nominated as chairperson of this new section.

As a chair of the union we had some work on the restructuring of the organization, to make it more efficient and effective. And there are some discussions going on on what kind of work we will do and what kind of work we stop doing, since we have to make some decisions according to the management.

Some casework, and I am still thinking of a report we have to finish. Furthermore we had some discussions in the lab on the certification requirements for face comparison reports. At the moment they are in a process of looking if this can be an actual field as such. Since I am certified for a period of two years instead of four for this field, for the NFI qualifications, I was looking deeper into this discussion. The problem is that the field is not validated and not many statistics are available. This issue is the same as in other fields, like audio, however also old fashioned fields as toolmark comparison also have the same. Our chief scientist said the issue here is that the standards are higher for person identification (such as voice comparison and face comparison) then for identification of objects.

I also decided to go ahead with the encyclopedia of forensic Science and the Engineering science and related sciences chapter. I had some valuable input and look forward to that.

Just some more work of course. Then there are interesting developments at several universities to setup a digital evidence section, which I warmly recommend.

Our projects are also running fine at the moment, and we have also several students working on them. Currently I am moderator of four students in different fields, and it is good to see how new ideas and thought develop.

At home I had installed a device for calling cheaper with VOIP. The device of Sipura works without PC on the regular phone (with Skype I have not seen these devices yet, since most solutions require that you phone must be switched on). With www.voipstunt.com and other services I can call many countries for nothing with a very good quality, which I was surprised of. I put away my old contract for VOIP via my ISP for that reason.

And of course some administrative work to do, and to finish. Such as filling in tax forms and solving administrative errors with double insurances etc.

January 2006

2006-01-15T13:07:00.000-08:00

January is a month with new thoughts and plans. Finishing some casework from 2005, with length measurements and 3D techniques. Also plans with new projects for Biometrics are currently developed. Furthermore, in these months we will have several students for our Research and Development projects.

Also a deliverable of FIDIS www.fidis.org is finished, and I am looking forward to work on the next parts of FIDIS. I hope we will have a new candidate working on profiling.

The next thing is working on some writing of short articles and editing a chapter of a encyclopedia. As chairman of the AAFS engineering section, we have the conference in February, and there is also lots of preparation for the presentations and workshop.

Currently we are also busy working more closely together with the police on forensic service centers. I have some plans with doing more research and development together and analysis of video and biometric information from CCTV-systems.

This month I was also elected as chair of our union. So some additional time to spend. As long as I do not have to much administration, and just do the things I like, it will work out well. It is just the combination of the work, that willl give you a flow of working.

And of course I also have to take care about ENFSI and the EAFS-meeting. We submitted a workshop meeting, and are trying to organize a steering commitee meeting in Helsinki. However we also have to submit some abstracts for this. www.eafs2006.com

As always I am optimistic about the future. This week I was also on Dutch televsion with some kind of CSI-program where I demonstrated the value of 3D models and reconstructions.

2005-12-26T01:35:00.000-08:00

Looking back to 2005

2005-12-26T01:04:00.000-08:00

Just finishing work and cleaning up the administration. This year has been a year with a wide variety of issues. The organization of conferences, doing some casework, several research initiatives and chairing the ENFSI-FIT group and the AAFS Engineering Sciences Section. I look back to nice conferences from ENFSI, IAFS and AAFS this year, and hope the cooperation in 2006 will be even better.

We see that the Internet is evolving and initiatives as the wikipedia are a good example how book publishers have a real problem to survive with their current marketing situation. I also have to write several contributions, however it appears to be more difficult, since information is not as fast as on the Internet. The valuable reviews are of course important, however for the reviewer it is getting more complicated to do an in-depth review. It is for example when I started in forensic science feasible to do some review of source code of software. Also this gets more complicated, since we have to take into account that also the operating systems upgrade very fast, and it is in theory possible that a certain program will work different on a different version of the OS with a bugfix. Having said that, we certainly should put effort in validating and reviewing the information in a prompt and proper way as is feasible.

What did I learn further this year ? As always projects tend to take more time then expected. I have some backlog with several projects. In contrary there are also projects that work better then expected, since not all things are predictable. It is the same with casework. It is nice to think that in some ways we are working in a casino-society as some people call it. The forecasts influence the results, and in this way many processes become inpredictable.

Also this year we did some step forward with the Bayesian conclusions in our report. The readability is still a problem :

In the past we had conclusions as probable etc. Now we have conclusions as there is support for a certain conclusion. This year we had discussions to modify it to from the examination results hypothesis 1 is more probable then hypothesis 2. We will see what happens, however the form of this conclusion might also change.

December

2005-12-06T23:21:00.000-08:00

As allways December is a month to reconsider and finish work (especially the last week of December is very quiet, and is good to do that research you had never time for if you have to go to work). In this month of course casework, and always the conflict between speed and quality. Managers want to have the cases processed faster each time, however the problem is that chances for mistakes are somewhat higher then. However of course, I may not complain, since they are also aware of this issue.

This month some vacation time, a meeting in Rome with the ENFSI chairpersons of the working groups, some meetings etc. I was also busy with our internal certification process. The rules around this system are sometimes to strict in my opinion. Last week a colleague should have an exam with expert witnesses from Germany and the UK. Suddenly they stopped this examination since some of the details in new rules (that were not approved yet), were not fulfilled. It is the bureaucrazy;) that rules. A better alternative might be an independent or perhaps several bodies that does this kind of testing, and not a combination of colleagues. There are several efforts for this, for instance in the UK, the USA and within the ENFSI.

Of course also preparing work for the AAFS-conference and several other meetings. For FIDIS a re-review of a document. All to be finished at the end of December, so perhaps it will not be a quiet month after all.