Ask MetaFilter questions tagged with forensics

Please help me identify some ancient lab equipment from these photos.

soulbarn — Mon, 09 Feb 2009 11:02:39 -0800

Can somebody help me identify this ancient lab equipment? I'm doing some research and have posted two photos to my flickr account, here and here. (PS, I know what the typewriter is!) Thanks!

Just how much can you figure out from an autopsy?

niles — Sat, 31 Jan 2009 10:43:47 -0800

[Science in Movies Filter] In the opera scene in Quantum of Solace, a bodyguard is shot immediately after being dropped of a roof by Bond. MI6 gets the report that Bond shot him and then dropped him off the roof. Maybe I've been watching Bones too much, but is it at all possible to determine the order of the dropping and the shooting by examining the body?

ZomBay Critical Mass

Ambrosia Voyeur — Wed, 13 Aug 2008 17:51:17 -0800

AquaticNecromancyFilter: Combined, the cities of San Francisco, Oakland and Berkeley employ about 3500 uniformed police officers. Do they outnumber the army that could be raised by dark magic from the floor of the San Francisco Bay? Approximately how many entire sets of human skeletal remains are there in that body of water, considering disasters, shipwrecks, bridge jumpers, tidal movement of sediment, etc.? Yes, I'm sure a reanimated skeleton warrior with a missing digit or patella could probably still serve well in the zombie army, but I'm going for an approximate head count, here, so that the skeletons can mix and match parts to create as many complete horrors from the deep as possible.

I always feel like...somebody's watchin' MEEEEE!

mehmet — Mon, 05 May 2008 20:39:50 -0800

[ParanoiaFilter] How can I tell if someone has accessed or opened a file on my computer? I realize I'm being excessively paranoid about this, but MeFi has a lot of people handy with computers, so I figured I'd ask.

Around a week ago, I left my computer unattended for five minutes or so to go use the bathroom. It was logged in and I don't have a screensaver. When I came back, nobody appeared to have used it.

However, after a few days, as I opened a particular file on my computer, I began to wonder if anyone could have accessed it. This particular file had been copied over from another computer, and had never been opened on this computer before.

Unfortunately, opening the file screwed up the "Last Accessed" date. I was able to check that the "Last Accessed" date of all the other files in the folder and sister folders (it's one of several subfolders of a larger folder) was normal (just the date that I copied them over). However, I still wanted to make sure that this file hadn't been accessed.

I checked "My Recent Documents" for the .lnk file, and found that the .lnk had been created at the exact time that I opened it. However, it's easy to delete entries in "My Recent Documents", so I still wasn't completely sure. The behavior of .lnk files is kind of weird - I tried opening files, deleting their .lnks, and opening them again, and found that the creation date for the new .lnk was sometimes the time of the 2nd opening and sometimes the time of the 1st opening (despite that one having been deleted).

After messing around in Local Settings, I found a "History" folder and realized that IE actually logs file-opening activity not only in IE, but also just doing things on my own computer! Sure enough, there was no entry in the IE history for that file other than when I opened it. I even used an index.dat viewer, but I found that IE history items that I deleted in the browser did not show up in the index.dat. So IE history items can be deleted too.

I ran a deleted file recovery program and was unable to find any deleted .lnk or index.dat files of interest. I tried deleting some random .lnk files from My Recent Documents, but they wouldn't show up even after doing a full scan (and this is moments after deleting them). I'm not exactly sure what happens to deleted IE History entries, though I imagine they wouldn't become an entire deleted file.

Anyhow, typing this out has been pretty embarrassing, as I realize how ridiculously paranoid I'm being, but I'd still like to hear if there's any other way to prove that this file was not accessed before I accessed it. Thanks.

What does being a fraud prevention specialist actually entail?

Myles — Mon, 14 Apr 2008 02:25:18 -0800

Anyone here ever been a Fraud Prevention Specialist? What's the job actually like? I was doing some job searching and saw a posting for one, though it seems it's more geared towards online fraud and stuff. First here are the requirements:

Strong computer literacy and knowledge of computer software (MS Office).

Analytical abilities are required to perform investigations.

Ability to work independently and without direction, to take initiative, and to make decisions.

Must be able to prioritize and meet deadlines.

Fraud or investigations experience in a call center or fraud operations environment preferred.

Candidate must have an excellent understanding of Internet browsing, and experience shopping on the Internet.

Professional demeanor in dealing with internal and external customers via phone and email is essential.

Two year degree preferred or prior experience in law enforcement and/or investigations.

And then the formal job description:

The Ideal candidate would review reports for potentially fraudulent transactions and manage calls on fraud issues from operational departments, investigating leads from internal and external sources with proper follow-up and documentation.

You would complete information requests and fraud tasks for assigned cases and provide superior customer service to internal and external customers.

You would also be responsible for making recommendations on how processes can be improved and policies modified. Answer policy questions and act as a help resource for the other fraud analysts.

I know it says it all there, but I'd like to get some input on those who were actually one. It doesn't sound too much that they're asking for, as far as basic requirements. It sounds interesting, and I'd probably apply, but I'd like some feedback first. Thanks.

Email Forensics

about_time — Tue, 12 Feb 2008 14:16:47 -0800

Where can I find information about email headers? I'd like to learn how to look at an email header and answer such questions as "Was this email forged?" and "What is the IP of the sender and the sender's ISP?" Thanks for your help. Examples of email header parsing would be welcome as well.

Life at George Washington University for foreign students

zaebiz — Sat, 26 Jan 2008 03:35:26 -0800

Young New Zealand girl seriously wants to go to George Washington University to study a Masters of Forensic Science next year. That's all I know. That's pretty much all she knows .....but she wants to know more. What should she know? I guess she is just looking for information about what it would be like living there, how could she prepare for it, will it be easy to make friends, what's the school like. Seriously if you know anything about George Washington University or what life would be like for a young female foreigner in DC, that's more than either of us know!

What are the best grad schools that specialize in forensic archaeology?

danb — Mon, 01 Oct 2007 17:15:52 -0800

What are the best grad schools that specialize in forensic archaeology? My friend specifically wants to study archaeological human remains.

Staging a computer crime to help train Miss Marple

procrastination — Mon, 06 Aug 2007 06:00:30 -0800

How can I realistically stage an (alleged) computer crime? I am working on some material for a computer forensic course that I hope eventually to turn into a book. I need to create some realistic evidence for my budding computer examiners to pore over. To do this, I have a particular scenario in mind that involves some suspected insider stock trading. I need to create one or two days of email and chat traffic between lots of different characters for it to be convincing. How can I best do this?

One thought I had was to create all the contents of email and chat ahead of time, then spend two days sending them in order. The main problems I see with this are: A) everything would be coming from the same internet addresses, and part of the training is on how to identify those addresses; B) The time line of events would be very predictable, since it would all come from me in my own timezone; and C) everything would be written in my voice and dependent on my imagination and knowledge, so it would probably lack depth. Not that it isn't doable, it just isn't as convincing. Having worked on examples like this, I know they are often easy to solve as they lack detail.

My second thought was to try and recruit some volunteers to play different parts in this online scenario. I would just provide the scenario, a character with an email account or chat login, and then have everyone improvise as they go along. This actually sounds pretty fun to me, and would provide a lot more depth in the examples. My primary worry about this is making sure the alleged fake crime actually occurs, and that things don't get out of hand.

What ideas do you have for how I might do this? Would anyone be willing to play a small part in this online drama and do a little roleplaying? It would involve assuming a persona and sending some normal email over a couple of days in that role, probably at the end of this week. I couldn't pay you, but I would certainly acknowledge everyone if it turned into a book.

If you want to volunteer, or if you want to communicate offline, you can get me at forensicexample@gmail.com.

Any ideas appreciated! Thanks.

Practicing Digital Forensics in MA

about_time — Mon, 18 Jun 2007 13:17:56 -0800

A few questions about being a digital/computer forensics practitioner in Massachusetts and licensing. 1) Is it true that to be a digital forensics investigator in MA, one must have a private detective license?

2) Is it true one can legally offer services as a digital examiner (instead of an investigator) and not have the license? I ask because it takes three years of working under a P.I. to qualify as someone who can get a P.I. License, and I don't want to do that. If examiners are different, where is this spelled out?

3) Is having a PhD in Computer Engineering or Comp Science and experience with digital forensics (e.g., encase certification) sufficient for practicing digital forensics investigations (or examinations) as a type of "license in a profession" described in Ch. 147 Section 23 paragraph 11?

4) Is there a quick way to get a P.I. license in MA without quiting my job and taking another one for three years under someone who has a license?

Some background on my questions: MA requirements for being a private detective and MA general law concerning licensing chap 147 sections 22-30. (link is to just 22, click next to see other sections.)

Thanks for your help.

Test for presence of blood

johngoren — Fri, 01 Jun 2007 11:03:56 -0800

For obscure journalistic reasons, I need to determine whether a sample of liquid contains blood. I can't really go into detail, but: Let's say I have a vial of liquid. I am investigating reports that it contains trace amounts of human blood. Is there a kind of lab that would perform such a test, and how much would that cost? Or is there an easy test I could do with a chemistry set? Any help much appreciated.

Do law firms ever employ evidence technicians full-time?

tkolstee — Tue, 16 Jan 2007 11:41:42 -0800

Do private law firms employ subject matter experts or evidence technicians? I have a possible interest in exploring a career in forensic science, specifically computer forensics. I'm already familiar with the process, required education, and necessary credentials. The big thing holding me back is the low pay that is typical of law enforcement (or DoD) jobs.

I know that private law firms often use subject matter experts to testify as an expert witness. I assume (please correct me if I'm wrong) that they also use them to perform their own examinations of evidence.

Would a law firm with its own experts on staff represent a conflict of interest? Are these people ever employed by the law firm itself, or do they only work as consultants?

What created that file?

bDiddy — Thu, 09 Feb 2006 11:46:14 -0800

How can I track the source of a file? I have a user who is reporting that something is creating a file in an area that it shouldn't. This folder resides on a Windows server and he is running Windows XP (or 2000, but I'm pretty sure it's XP). He is seeing a file created periodically but has no idea where it's coming from and is concerned that security might have been compromised.

The file is named "clientid.txt" and contains the string, "3145204-218057". The folder it's being created in can only be accessed by him and Domain Admins. The file shows that it was created by this user.

I am thinking that some job or some process is running on his PC that is creating this file, but when I checked he had no jobs running. Maybe a rogue process, but I can't find it. Is there a way to find out what caused a file to be created? If not on an existing file, maybe there's a way to catch a process when it writes a file to a folder?

Again, if I wasn't clear, this is a Windows OS accessing a file share on a Windows network. No Linux servers can access the folder where this is being written. I'd appreciate any help greatly.

Forensic/Speech HS Pieces?

rainbaby — Wed, 29 Jun 2005 07:35:41 -0800

Looking for High School Forensic competition pieces - it's a speech tournament, not science, and The Husband has coached the team for two years already. Maybe somebody has some familiarity with this and can give some suggestions of winning pieces? Categories inside. The pieces need to be long - five to ten minutes. Categories in our state include Poetry (very hard to find long poems), Prose, Dramatic Interp (from a play), Comedic Interp (from a play), Storytelling (kid lit), and Duo acting. The pieces have to be from published works. The students try to find their own pieces, but often have trouble.