List of Contributors xvii
 
Foreword xix
 
Preface xxi
 
Acknowledgements xxvii
 
PART ONE MULTIMEDIA EVIDENCE HANDLING
 
1 Digital Forensics Laboratories in Operation: How Are Multimedia Data and Devices Handled? 3
 
1.1 Introduction 3
 
1.2 Digital and Electronics Forensic Service, Metropolitan Police Service, UK 4
 
1.3 Digital Forensics Team (Including Affiliated AV Team), Surrey Police, UK 17
 
1.4 Shanghai Stars Digital Forensic Centre, Third Research Institute of China's Ministry of Public Security 23
 
1.5 Discussions 28
 
1.6 Summary 32
 
1.A Appendix: Questionnaires for Interviewing Surrey Police and Shanghai Stars Digital Forensic Centre 32
 
References 34
 
2 Standards and Best Practices in Digital and Multimedia Forensics 38
 
2.1 Introduction 38
 
2.2 Overview 39
 
2.3 Electronic Evidence and Digital Forensics 48
 
2.4 Multimedia Evidence and Multimedia Forensics 70
 
2.5 Digital Forensics Laboratory Accreditation 77
 
2.6 General Quality Assurance (Management) 79
 
2.7 Training, Education and Certification on Digital and Multimedia Forensics 81
 
2.8 Conclusions 84
 
Acknowledgements 86
 
References 86
 
3 A Machine Learning-Based Approach to Digital Triage 94
 
3.1 Introduction 94
 
3.2 Related Work on Digital Triage 96
 
3.3 A Machine Learning-Based Digital Triage Framework 100
 
3.4 A Child Pornography Exchange Case Study 110
 
3.5 Conclusion 128
 
3.6 Challenges and Future Directions for the Digital Forensics Community 128
 
Acknowledgements 130
 
References 130
 
4 Forensic Authentication of Digital Audio and Video Files 133
 
4.1 Introduction 133
 
4.2 Examination Requests and Submitted Evidence 134
 
4.3 Laboratory Space 138
 
4.4 Laboratory Software and Equipment 138
 
4.5 Audio/Video Authentication Examinations 147
 
4.6 Preparation of Work Notes and Laboratory Reports 171
 
4.7 Expert Testimony 172
 
4.8 Case Examples 173
 
4.9 Discussion 177
 
References 178
 
PART TWO DIGITAL EVIDENCE EXTRACTION
 
5 Photogrammetry in Digital Forensics 185
 
5.1 Introduction 185
 
5.2 Different Methods 188
 
5.3 Measurement Uncertainty 194
 
5.4 Case Studies 195
 
5.5 3D Modelling/Scenario Testing 212
 
5.6 Summary 217
 
References 217
 
6 Advanced Multimedia File Carving 219
 
6.1 Introduction 219
 
6.2 Digtal Data Storage 220
 
6.3 File Carving of Binary Data 225
 
6.4 Multimedia Data Structures 226
 
6.5 File Carving of Multimedia Data 232
 
6.6 Content Identification 241
 
6.7 File Carving Frameworks 253
 
6.8 Conclusions 264
 
Acknowledgements 265
 
References 265
 
7 On Forensic Use of Biometrics 270
 
7.1 Introduction 270
 
7.2 Biometrics Performance Metrics 273
 
7.3 Face: The Natural Means for Human Recognition 274
 
7.4 Ears as a Means of Forensic Identification 283
 
7.5 Conclusions 299
 
References 299
 
8 Multimedia Analytics for Image Collection Forensics 305
 
8.1 Introduction 305
 
8.2 Data and Tasks 308
 
8.3 Multimedia Analysis 309
 
8.4 Visual Analytics Processes 312
 
8.5 ChronoBrowser 313
 
8.6 MediaTable 320
 
8.7 An Example Scenario 323
 
8.8 Future Outlook 325
 
References 326
 
PART THREE MULTIMEDIA DEVICE AN