Computers and Media
The world in which we live and act is becoming an increasingly digital world. Most of everyday’s communication is digital, by way of smart phones, computers and cameras.
Most of the documents we know are produced as electronic files, as are all text messages (SMS) and the correspondence by means of telephone.
The Institute of Forensic Science operates a laboratory for computers and media which provides solutions for all digital questions in a wide variety of areas: Starting with criminal investigations via damage claims to industrial espionage and security breaches and personal affairs.
There are four topics in which
the computer and media section focuses:
Security Breaches
Cellular positioning
Analysis of events and situations
Speaker recognition
Authentication of files
Authentication of Electronic Files
Most of the information known to us today is stored in electronic files. The files are found on computer drives, recording devices, cameras, telephones, players and in every media storage device.
In addition to electronic files, information is stored on other devices – magnetic audio or video tapes or magnetic cards.
The experts at the Institute of Forensic Science are experts in determining the authenticity of every type of electronic file and record.
?
The authentication of electronic files and other storage devices examines a number of factors, among them the following
The addition of external information
Has information been added to the file after the event that the file was first saved?
The duplication of sections
Whether in a certain recording sections were duplicated, and added as if they were authentic parts of that recording.
The replication or
removal of information
Were sections from another file copied to a certain file, or were parts of the file deliberately deleted?
Various modifications
Have changes been made to the file such as adding intentional noises, amplifying or weakening signals, changing the date or various other changes
The dates of various actions
You can check whether a certain file was edited on dates other than the original one, and what the meaning of these edits is
The sources of the information stored
You can check whether the file stored on a certain device was indeed created on this device, and you can characterize the type of device on which the file was created.
All factors examined provide details about the
originality and reliability of the information.
Speaker Recognition
The identification of a person who is heard speaking in a certain recording is one of the stages in examining the authenticity of electronic files. In addition, voice identification is an independent area of research when there is doubt concerning the identity of a speaker heard in a recording.
The Institute of Forensic Science identifies and compares speakers on the basis of a series of characteristic parameters, and for this purpose, the Institute’s experts make use of specialized forensic software programs.
In most cases, the identification of a speaker does not result in a 100 % level of certainty, but takes place at a lower level of probability. Nevertheless, it is almost always possible to reach a very high level of certainty when excluding a person suspected to be the speaker in a specific recording.
Communications Investigation– Cellular Positioning
Operators of cellular services set up receiving antennae which make it possible to locate telephones.
At the Institute of Forensic Science, we carry out investigations concerning the communications of all cellular networks.
?
Communications investigations concerning cell phones make it possible to provide answers in the following cases
The antenna picking up on the phone
The cell phone’s location at a certain time
The directions in which the cell phone moves
The elimination of a possible location assumed
Denial of possibility
to the loaded location
The investigation of communications is a very
effective tool in criminal investigations.
Nevertheless, one should know that, although the investigation of communications can provide evidence on the device, it cannot do so as far as the owner of the device is concerned.
Analysis of events and situations
In analyzing events and situations, the experts of the Institute of Forensic Science carry out actions of improving, slowing down and dividing the digital media, in order to present the event as it happened
?
Analyzing events and situations answers the following questions
What is the order and sequence of events
What are the directions of movement of those involved
Does anyone involved hold an object in his hand, and what are the possibilities regarding the identity of that object
The location of the various participants throughout the event
Security Breaches and
Recovery of Files
Computers with access to the internet bear the risk of being infiltrated by malware or spyware
?
The investigation of security breaches
provides answers to the following questions
Has the computer been infiltrated
How did the infiltration occur
Is there any malware or spyware on the computer?
How can the computer be protected
Malware can destroy part of the information found on the computer.
In addition to this, files are sometimes erroneously
erased and must be restored.
The recovery process transfers the required file from a place where it is inaccessible to a location where it can be retrieved.
Sometimes, the recovery process might cause permanent damage to the computer’s drive after the required material has been recovered
The computer and media section gives
services in various areas
Analysis of situations and movements, the authenticity of media, people recognition, and speaker recognition.
Traffic accidents
velocity determination, authenticity of media, people recognition.
Civilian conflicts
Analysis of situations and movements, authenticity of media, people recognition,
dating of media formation speaker recognition.
Insurance
File authenticity is checked, and claims made in the context of a filmed event are checked.
Family
File authenticity is checked.
car accidents
The institute's experts can, based on testing the remains of biological material left in the vehicle and comparing DNA, know where the passengers of a vehicle that had an accident sat. This test is very important when there is a suspicion of changing drivers due to an accident.
The department also examines marks left on those involved in the accident by other involved, in order to know the mutual directions of movement, and to understand the factors of the injury.