Funding Body: Institute of Advanced Study (IAS), University of Warwick

Principal Investigator: Professor Jacqueline Hodgson (School of Law, University of Warwick)

Co-Investigators: Dr Sarabjot Singh Anand (Department of Computer Science, University of Warwick), Dr Arshad Jhumka (Department of Computer Science, University of Warwick), Dr Kim Wade(Department of Psychology, University of Warwick), Mr Andrew Roberts (School of Law, University of Warwick), Dr Chang-Tsun Li (Department of Computer Science, University of Warwick)

Project Duration: 1 August 2010 - 31 July 2011

Project Summary

Forensics is the process of collecting, analysing and reporting about data that may subsequently become evidence in a criminal justice system. Digital forensics is about forensics involving digital equipment such as computers, mobile phones, cameras and so on. With the proliferation of such equipment, evidence is increasingly likely to be generated through such media. For example, in cases of paedophilia, incriminating evidence is often found on computers, laptops or mobile phones. Three lines of research investigation are currently being pursued in relation to this topic.

• One project is investigating the problem of event sequencing. Specifically, when dealing with a crime scene, it is important to determine accurately the order in which a sequence of events took place. Indeed, accurate information about the order of an event can assist the police in reconstructing what happened and ultimately contribute to a successful prosecution. Similarly, it can assist the defence. However, this problem is extremely difficult to solve because witness¡¦ reports can be rife with error. For example, several witnesses may (partially) observe the same set of events but may (partially) recall them in various orders. This may be due to a vested interest on the part of the witnesses, collusion among witnesses, contamination across witnesses, and/or coercion by interested parties such as police or perpetrators. In other circumstances, witnesses may omit important details because they have failed to pay to attention to them, or simply failed to recall them. In this project, the thrust is to develop techniques/approaches to (i) (automatically) detect anomalies regarding the ordering of events, (ii) place events in the appropriate (partial) order as accurately as possible. To this end, colleagues in Computer Science and Psychology are already currently conducting pilot experiments to test new digital forensic technology. Specifically, the technology aims to order data and trace the path of words and phrases. Thus, in a series of pilot experiments we are exposing research participants to a video of a mock-crime and asking them to report what they have witnessed. Similar to real-world witness reports, the mock-witness reports in our experiments are fragmented, inconsistent, and sparse. We are using these witness reports to test the reliability and accuracy of the new digital forensic technology¡Xcan this technology reconstruct the original crime scene in an accurate and detailed manner based on the limited and distorted information that the witnesses provide?
• A second project is investigating the origin of digital photos. For example, during a criminal investigation, a digital camera owned by or connected to the suspect may be obtained. Here, determining if incriminating pictures were taken with the said camera could be crucial. As it stands, cameras may leave unique signatures which make it possible to determine if a picture originates from a given camera. Furthermore, some pictures may be tampered with to remove any incriminating evidence. We are currently investigating the possibility of detecting whether a given picture has been tampered with, and also detecting the location where it occurred.
• A third project is investigating the use of telecommunication data (such as mobile phone records) to infer criminal networks. In such cases, with the data available, a series of questions can be answered. For example, an important question may be the possible co-location of accomplices or the sequence in which a series of phone calls has been made to determine the leader of the ring and so on. This project connects with the first project being investigated by examining the consistency of information as it travels through social networks, and how and why information might be distorted at certain points. We are also exploring ways to analyse and visualize these social networks.

However, the questions and issues raised above pose several significant problems. For example, some of this activity will interfere with subjects¡¦ privacy. Capturing and analysing a suspect's mobile phone contents, for example, may disclose a significant amount of personal information. This kind of interference with privacy may be justified where there are sufficient grounds for believing the person to be involved in serious criminal activity. However, it may also reveal personal information about innocent third parties.

Another important issue concerns the manner in which conflicting data is processed and analysed,, be it ordering of events, content of files/documents etc. The reliability of the processes and any assumptions on which they rely will have an important bearing on whether the results of the techniques described above will be admissible as evidence in criminal proceedings, or whether their use will be limited to investigation and intelligence gathering. The principal legal issues, therefore, concern subjects¡¦ privacy rights and the admissibility of expert testimony.

Activilities

We will be holding following two workshops as part of this project:

• Workshop 1: Intelligence, evidence, eyewitness testimony & privacy
  • Date: 16 March 2011
  • Venue: Wolfson Exchange
  • Programme

• Workshop 2: Digital forensic technologies
  • Date: 6 June 2011
  • Venue: Wolfson Exchange
  • Programme
    

Digital Forensics Lab

People

Projects

Publications

Activities