Yuandong Zhu

Joshua James

Pavel Gladyshev

A CONSISTENCY STUDY OF THE WINDOWS REGISTRY

Keywords: Windows forensics, registry analysis, counter-counter-forensics

This paper proposes a novel method for checking the consistency of forensic registry artifacts by gathering event information from the artifacts and analyzing the event sequences based on the associated timestamps. The method helps detect the use of counter-forensic techniques without focusing on one particular counter-forensic tool at a time. Several consistency checking models are presented to verify events derived from registry artifacts. Examples of these models are used to demonstrate how evidence of alteration may be detected.

Introduction

Electronic devices often contain large amounts of data of evidentiary value. However, since it is possible for a suspect to alter the devices through software or hardware, it is extremely important in digital investigations to determine whether or not the evidence collected from seized devices has been modified [START_REF] Hilley | Anti-forensics with a small army of exploits[END_REF].

This paper advocates the use of information obtained from the Windows registry to verify the consistency of the collected evidence. The Windows registry is a database that stores information about the hardware, software and user profiles of a Windows machine [START_REF]Windows registry information for advanced users[END_REF]. As such, it an important resource for identifying events that occurred during the use of the machine [START_REF] Carvey | Windows Forensic Analysis[END_REF]. During the normal execution of an operating system, certain events always occur in the same order. Therefore, if information about some events is obtained from the registry, then correlating known sequences of these events in temporal order of their timestamps gives a clue as to whether or not the evidence is internally consistent. For example, the event involving the installation of a particular soft-ware system for the first time must occur before the event involving the running of the software for the first time. If the timestamp associated with installing the software is later than the timestamp associated with running the software, either the timestamp itself or other information about the event was tampered with.

This paper proposes a method to verify the consistency of registry artifacts by obtaining event information from the artifacts and examining their associated timestamps in event sequences. This provides a generic way to detect the use of counter-forensic techniques without focusing on one particular counter-forensic tool at a time. The method also helps detect when timestamps were altered, which gives a digital forensic investigator additional information about the user's activities.

Related Research

Previous research on detecting counter-forensic techniques has proceeded along two lines. One approach (see, e.g., [START_REF] Geiger | Counter-Forensic Privacy Tools: A Forensic Evaluation[END_REF]) tends to solve the problem from very specific perspective. Experiments are performed to understand the behavior of a particular counter-forensic tool; forensic investigators are then provided with information about where traces of the tool may be found. Although the approach is effective, it suffers from the limitation that the results may not apply to other tools. Indeed, it is almost impossible to develop an individual method against each tool because there are so many counter-forensic tools available [START_REF] Hilley | Anti-forensics with a small army of exploits[END_REF].

The second, generic approach engages methods that check the consistency of system properties. For example, Gladyshev and Enbacka [START_REF] Gladyshev | Rigorous development of automated inconsistency checks for digital evidence using the B method[END_REF] developed an algorithm to check the consistency of log files. Willassen [START_REF] Willassen | Hypothesis-based investigation of digital timestamps[END_REF] proposed a technique for discovering evidence of "antedating" by studying the sequence number allocation properties of storage systems. Motivated by these techniques, this paper proposes a general method for verifying the consistency of collected evidence. Although this method may not always be as effective as searching for traces of a counter-forensic tool, it can be used against a wide range of counter-forensic techniques because inconsistencies are detected regardless of the specific technique used to tamper with evidence.

Consistency Checking Method

The consistency checking method proposed in this paper involves two steps: (i) obtain events and their timestamp information from the Windows registry; and (ii) verify the consistency of the identified events using the appropriate consistency checking model.

Events and Timestamps

All events obtained from the registry are categorized as extracted events or inferred events. Extracted events are associated with information that was updated at specific registry locations at specific times; these events can be directly extracted from the registry. Inferred events are deduced from the registry contents based on known relationships between registry information and user and system actions.

Extracted Events

An extracted event is either an update of a registry key or a data value corresponding to a key. The time of the update is determined by the LastWrite timestamp of the associated registry key, which specifies the most recent modification time of the key. Figure 1 illustrates the extraction of events from HKCU\Software\Microsoft\Office\12.0\Word\File MRU. If the extracted event (Ext Event) corresponds to the updating behavior of the key, then the timestamp can be written as:

T Ext Event(Key) = T LastW rite (1)
Since each data value causes the LastWrite time of the associated key to be updated, the timestamp of the event is estimated by:

T Ext Event(V alue Data) ≤ T LastW rite (2)
Upon combining Equations 1 and 2, the timestamp estimation equation that applies to all possible extracted events is given by:

T Ext Event ≤ T LastW rite (3)
A better way to estimate the timestamp for an extracted event associated with a particular record is to use the registry snapshot comparison method [START_REF] Zhu | A comparative methodology for the reconstruction of digital events using Windows restore points[END_REF]. This method helps bind an extracted event to a specific time interval. The comparison method is based on the fact that many Microsoft Windows versions automatically back up system registry hives, creating "system restore points" approximately every 24 hours. By considering each registry snapshot as a previous state of the system registry and comparing a given state of the registry with previous registry snapshots, changes made to the registry between the creation times of two consecutive restore points can be identified. When previous registry snapshots are available, comparing each registry snapshot with its preceding snapshot can identify extracted events that are known to have occurred before the LastWrite timestamp of the key and also after the creation time of the preceding registry snapshot:

T P rec Snapshot ≤ T Identif ied Ext Event ≤ T LastW rite (4)

Inferred Events

Carvey [START_REF] Carvey | Windows Forensic Analysis[END_REF] has described the inference of user and system events from the registry. In general, the time interval between an inferred event and the action that triggered the corresponding update in the registry (i.e., the corresponding extracted event) influences the selection of the consistency checking model that is applied. Thus, inferred events are divided into three groups:

Inferred events that occurred before the corresponding extracted event.

Inferred events that occurred "at the same time" as the corresponding extracted event.

Inferred events that occurred after the corresponding extracted event.

Note that an inferred event and its associated extracted event do not occur simultaneously. However, if the time interval is short enough, the extracted event can be assumed to have occurred "at the same time" as the action that precipitated it.

In the following, we present four examples of inferred events to demonstrate how events may be inferred from registry information.

The first example involves ShellBag information associated with the "Test" folder on a local computer (Figure 2). As described in [START_REF] Zhu | Using ShellBag information to reconstruct user activities[END_REF], the registry value associated with this folder includes the timestamp when the ShellBag information was first updated in the registry. Therefore, three events can be inferred:

Folder "Test" located on the Desktop was created at 08/12/2008 20:53:52. Folder "Test" located on the Desktop was accessed at 08/12/2008 20:53:52.

Folder "Test" located on the Desktop was modified at 08/12/2008 20:53:52.

In this example, more than one event is inferred from a single registry record. Since the consistency checking method is based on the events and timestamps that are found, it is important to infer as many events as possible from the registry. Note that all three events are known to have occurred before the corresponding extracted event. The second example involves the FileMRU key, which is located at HKCU\Software\Office\12.0\Microsoft\Word\FileMRU (Figure 3). It stores the paths of Word documents that have recently been opened by Microsoft Office. The information in Figure 3 The third example involves the USBSTOR subkey located at HKLM\ System\ControlSet01\Enum\USBSTOR (Figure 4). The inferred event is that a USB device Disk&Ven Netac&Pro OnlyDisk&Rev 1.11 was connected to the system at 23/09/2008 18:23:51. The timestamp is estimated using the extracted event: Registry key HKLM\System\Cont rolSet-01\Enum\USBSTOR\Disk&Ven Netac&Pro OnlyDisk&Rev 1.11 \5&4d408f08&0 was updated at 23/09/2008 18:23:51. The timestamp of the extracted event can be used for this inferred event because the inferred event belongs to the second type of inferred event (defined above), where the extracted event is assumed to have occurred at the same time as the inferred event.

The fourth example corresponds to the third type of inferred event that occurred after the corresponding extracted event. The value Lease TerminatesTime under the registry key HKLM\SYSTEM\ControlSet001 \Services\Tcpip\Parameters\Interfaces\AdapterID gives the time that the IP address of the adapter expired. This definitely occurred after the adaptor was connected.

Consistency Checking Models

After obtaining event information from the registry, it is necessary to verify the events and their associated timestamp information. This section describes several consistency models that may be used for this purpose. Because each event can be placed in a different position in a time sequence when grouped with other events, it is difficult, if not impossible, to define a consistency checking model for an event without considering the details of other events. We address this issue in a generic manner using a context-based model. Each model is defined with respect to a specific context; the model is applied when the events meet the associated conditions.

Basic Model

The basic event-time bounding model is used to estimate the time frame during which a particular event without time information occurred. This is done by considering its relation in time to other events that are known to have occurred either before or after the event [START_REF] Gladyshev | Formalizing event time bounding in digital investigations[END_REF]. The same concept can also be applied to user data. Since this model also represents the relationships between a sequence of multiple events and their timestamps, it is the basis of other consistency checking models. The event-time bounding model utilizes two rules: Rule 1: If Event A occurred before Event B, and Event B occurred before Event C, then the time that Event B occurred is bounded by the times that Events A and C occurred:

T A < T B < T C (5
M ax(T A 1 , T A 2 , . . . , T Am ) < T B < M in(T C 1 , T C 2 , . . . , T Cn ) (6)

Checking Inferred Events and Extracted Events

The basic model was developed to verify the consistency of inferred events and extracted events. As mentioned earlier, there are three types of inferred events. Therefore, based on their relationship with the corresponding extracted event, three equations can be derived using Equations 3 and 5.

For an inferred event (Inf Event) that occurred before the extracted event, we have:

T Inf Event < T Ext Event ≤ T LastW rite
For an inferred event that occurred at the same time as the extracted event, we have:

T Inf Event = T Ext Event ≤ T LastW rite
For an inferred event that occurred after the extracted event, we have:

T Inf Event > T Ext Event
or, if the time difference ∆ between the action and a future action is known, we have:

T Inf Event = T Ext Event + ∆
In the example in Figure 2, if the LastWrite timestamp of the key is 07/12/2008 11:00:00, then based on the model for inferred events that occurred before the corresponding extracted event, the information conflicts with the inferred event: Folder "Test" was created at 08/12/2008 20:53:52.

Additionally, if multiple inferred events are identified as being associated with the same extracted event, the timestamp of the extracted event will be affected by all the associated inferred events. Therefore, the consistency checking models must be extended according to Equations 3 and 6.

For inferred events that occurred before the extracted event, we have:

M ax(T Inf Events ) < T Ext Event ≤ T LastW rite
For inferred events that occurred at the same time as the extracted event, we have:

M ax(T Inf Events ) = T Ext Event ≤ T LastW rite
For inferred events that occurred after the extracted event, we have:

M in(T Inf Events ) > T Ext Event
The application of the model is illustrated using the UserAssist key at HKCU\Software\Windows\CurrentVersion\Explorer\UserAssist. This key stores a list of values that record information about the execution of software on the computer. Each time a particular software executes, the corresponding value is updated under the UserAssist key. This falls under the model for inferred events that occurred at the same time as the corresponding extracted event. Assume that three values are found under the UserAssist key as shown in Table 1. Upon applying the model, Max(T Inf Events ) is equal to 15:35:12 14/05/2009. If the LastWrite timestamp is 20:04:31 25/04/2009, then the model proves that the event information is inconsistent.

Checking Inferred Events

When examining the registry, it is possible to infer events from different locations in the registry that point to the same user or system action. This is because information is sometimes saved at multiple locations in the registry. The consistency of inferred events can be verified using these related pieces of data.

Zhu, et al. [START_REF] Zhu | Using ShellBag information to reconstruct user activities[END_REF] have proposed several rules that use ShellBag information to determine if a folder was accessed. Specifically, the information under the BagMRU registry key (located at HKCU\Software\Microsoft\ Windows\ShellNoRoam\BagMRU) and the Bags key (located at HKCU\ Software\Microsoft\Windows\ShellNoRoam\Bags) can be used to determine if the folder was accessed during a particular period. If one event, i.e., the folder was accessed at 10/07/2009 7:30:00 is inferred from information in the Bags key, and another event, i.e., the same folder was not accessed between 09/07/2009 9:12:00 and 11/07/2009 18:20:30 is inferred from the BagMRU key, then it follows that the two inferred events are not consistent.

Checking Extracted Events

The consistency between extracted events is due to the fact that some registry keys are always updated after other keys. When events pertaining to registry operation are extracted, their timestamps should appear in the same order. By applying the basic model to this relationship it is possible to say that: if Key B is always updated after Key A, then the most recent extracted event of Key B is definitely after the most recent extracted event of Key A:

M ax(T Ext Events(Key A) ) < M ax(T Ext Events(Key B) )
Because the most recent extracted event of a registry key is equal to the LastWrite timestamp of the key, the consistency check can be expressed as:

T LastW rite(KeyA) < T LastW rite(KeyB) Similarly, if Key B is always updated after other Keys A 1 , A 2 , . . ., A n , then the timestamp of Key B is constrained by the most recent extracted events:

M ax(M ax(T Ext Events(Key A 1 ) ), . . . , M ax(T Ext Events(Key An) ))

< M ax(T Ext Events(Key B) )

Upon replacing the most recent extracted event with the LastWrite timestamp of the key, the consistency check can be written as:

M ax(T LastW rite(Key A 1 ) , . . . , T LastW rite(Key An) ) < T LastW rite(Key B) type keys. In the example in Figure 5, the file C:\TestFolder\test.txt was first stored in the "txt" subkey, and then saved in the "*" subkey. That is to say, the "*" key is always updated after other OpenSaveMRU keys or subkeys. Thus, the "*" key satisfies the conditions described above. Table 2 presents the timestamps of all the keys; the information is inconsistent because the timestamp of the OpenSaveMRU\txt key is later than the timestamp of the OpenSaveMRU\* key.

Checking Registry Events and Other Events

Apart from the registry database, there are other sources that provide information about events that have occurred. Two important sources of events that should be checked for consistency are file timestamps and registry snapshots.

File Timestamps: In most versions of Microsoft Windows, three timestamps are associated with a file, corresponding to when the file was last accessed, last modified and created. Each extracted event obtained from the registry indicates an update of the registry file, so the extracted event should cause the modification timestamp of the registry file to be updated if the file handle is properly closed after the update. The consistency check for this situation is:

M ax(T Ext Event 1 , . . . , T Ext Event n ) ≤ T Reg M od T ime
A better method to implement this check is to compare the Last-Write time of each extracted event with the last modification time of each file because Max(T ExtEvents ) is equal to T LastW riteKey . The consistency check for this situation is:

M ax(T LastW rite 1 , . . . , T LastW rite n ) ≤ T Reg M od T ime Note that this inequality does not apply when the registry file handle is not closed properly due to abnormal termination.

Registry Snapshots: Each registry snapshot is created by updating the contents of the preceding registry snapshot. Therefore, any events that have occurred between two snapshots will appear after the creation time of the preceding snapshot:

T P rec Snapshot < M in(T Ext Event 1 , . . . , T Ext Event n ) T P rec Snapshot < M in(T Inf Event 1 , . . . , T Inf Event n )
Whether an extracted event has occurred or not is determined by comparing the timestamps of a registry key in the snapshot and in the next snapshot. If the timestamp is updated in the newest snapshot, then it implies that the corresponding extracted event did occur. According to Equation 3, the timestamp of the extracted event cannot be after the updated LastWrite timestamp. Therefore, the consistency check for this situation is:

T P rec Snapshot ≤ M in(T U pdated LastW rite 1 , . . . , T U pdated LastW rite n )

Other Consistency Checking Considerations

After identifying inconsistent information, there may be a need to understand how the inconsistency was created. As mentioned above, if the system runs without any intentional changes, it will be consistent all the time. Some of the reasons for inconsistent information are: System Clock Adjustment: Many timestamps are based on the current system clock, especially the LastWrite timestamp associated with each key. If the system clock is temporarily adjusted, it may leave detectible inconsistencies in the timestamps recorded during the altered time period. A consistency check may identify these inconsistencies if they are not overwritten by new information.

Registry Information Modification: It is often the case that the registry API is used to modify registry information. While any part of the registry can be modified, the LastWrite timestamp of the key is also updated because the system considers the invocation of the API as a normal registry operation. Therefore, it is possible to identify this trace by examining the consistency of extracted events. An inconsistent timestamp may imply that tampering has occurred. For example, in Table 2, if RegEdit was used to modify the contents of the jpg subkey at 22:12:28 21/07/2009, the inconsistency shown in Table 2 would be produced.

Registry Hive Modification: A file editor tool can be used to modify the registry hive directly. This is hard to implement in practice because it requires the user to understand the unique structure of the particular registry hive. Also, it is difficult to detect if the registry has been modified in this manner because the registry is not automatically updated when the modification is made unless the timestamp is also edited at the same time.

Conclusions

The method for checking the consistency of registry information involves extracting and inferring events and their corresponding timestamps from the registry database. Appropriate consistency checking models are then used to verify the information that is collected and help detect counter-forensic activity. Our future research will examine the potential of using other registry information as well as data from other sources in sophisticated consistency models.

Figure 1 :Figure 2 :Figure 3 :LFigure 1 .

 1231 Figure 1: Extracting events from HKCU\Software\Microsoft\Office\12.0\Word\File MRU

Figure 2 :Figure 3 :LFigure 2 .

 232 Figure 3: Contents of HKCU\Software\Microsoft\Office\12.0\Word\FileMRU

Figure 1 :Figure 2 :Figure 3 :LFigure 3 .

 1233 Figure 1: Extracting events from HKCU\Software\Microsoft\Office\12.0\Word\File MRU

  implies the (inferred) event that a Word document C:\1.doc was accessed at 13:58:55 16/07/2009 corresponding to the Windows 64-bit timestamp 01CA061D8EC3DF20.

Figure 4 :Figure 5 :

 45 Figure 4: Contents of HKLM\System\ControlSet01\Enum\USBSTOR

Figure 4 .

 4 Figure 4. USBSTOR subkey.

Figure 5 :Figure 5 .

 55 Figure 5: OpenSaveMRU update example

Table 1 .

 1 Interpreted information for the UserAssist key.

	Software Path	Timestamp
	C:\Program Files\Internet Explorer\iexplorer.exe	10:03:01 05/03/2009
	C:\WINDOWS\system32\notepad.exe	15:35:12 14/05/2009
	C:\Program Files\Windows Media Player\wmplayer.exe 19:11:52 22/01/2009

Table 2 .

 2 Interpreted information of OpenSaveMRU.

	Registry Key Path	Timestamp
	OpenSaveMRU\bmp	07:42:16 13/07/2009
	OpenSaveMRU\jpg	22:12:28 21/07/2009
	OpenSaveMRU\txt	21:15:42 09/07/2009
	OpenSaveMRU\*	19:27:09 14/07/2009

Acknowledgements

This research was funded by the Science Foundation of Ireland under the Research Frontiers Program 2007 Grant No. CMSF575.


Kenny Wang

USING A LOCAL SEARCH WARRANT TO ACQUIRE EVIDENCE STORED OVERSEAS VIA THE INTERNET

Keywords: Search warrant, remote cross-border search, webmail

This paper argues that a search warrant issued by a local court does not have the power to search and seize digital evidence stored overseas but accessible via the Internet. Based on the fact that digital evidence can be altered or erased in a very short time, two scenarios are presented to illustrate the lack of power of a local search warrant to acquire digital evidence overseas. Two solutions are presented to overcome the shortcomings of a local search warrant. These solutions can assist law enforcement agencies around the world in searching and seizing digital evidence stored overseas with speed and accuracy, and in addressing court challenges regarding the admissibility and potential illegality of this evidence.

Introduction

Computer-related crimes are not a new type of crime in Hong Kong. Hong Kong has had computer crime laws since 1993 [START_REF]Government of the Hong Kong Special Administrative Region, Computer Crimes Ordinance[END_REF], but the popularity of information and communications technology in recent years has contributed to an increase in the number of computer-related crimes.

For most individuals, a very important function of computers is to store data. Data used by a computer can be stored in various media such as flash drives, hard disks, compact disks and magnetic tapes. Data can also be stored remotely on a server, which may be situated on the same floor as one's office, or on another floor, another building or even another country. Dealing with data that is stored in another country and accessible only via the Internet (web storage) is more complicated in terms of technology and legal jurisdiction, but it is a growing trend. According to Hirst [START_REF] Hirst | Jurisdiction and the Ambit of the Criminal Law[END_REF], " [t]he Internet has an international geographically-borderless nature ... you can find things in it without knowing where they are. The Internet is ambient -nowhere in particular and everywhere at once."

Many law enforcement agencies around the world, including in Hong Kong, have stood up special units to deal with computer-related crimes. Although law enforcement agencies aggressively investigate computer crimes, criminals often avoid detection by utilizing computer technologies. To win these battles, law enforcement needs traditional as well as advanced procedures and tools.

The search warrant is a powerful traditional tool. It empowers law enforcement agents to gain entry into a suspect's premises and to search and seize any items in the premises that may constitute evidence of a crime, including computers. It is increasingly common for criminals to store their information overseas and to access it over the Internet. Is it possible for a law enforcement agent to use a local search warrant to search and seize digital information stored overseas but accessible via the Internet?

This paper analyzes the possibility of using a local search warrant, i.e., a search warrant issued in Hong Kong, to search and seize evidence stored on an overseas computer but accessible via the Internet. More specifically, it focuses on the notion of a "remote cross-border search," which is defined as using a computer within the territory of a country to access and examine data physically stored outside of its boundary [START_REF] Bellia | Chasing bits across borders[END_REF]. The paper also examines the connection between remote cross-border search and extraterritorial jurisdiction. The goal is to help prevent digital evidence from being excluded by a judge because it was obtained illegally. This not only wastes resources but may also expose law enforcement agents to civil or criminal proceedings.

The paper presents two scenarios and analyzes them in the context of various statutes, case law and legal research to determine whether or not a local search warrant can successfully acquire digital evidence that is stored overseas without raising challenges from defense counsel.

Crime Scene

Suppose that a law enforcement agent in Hong Kong is in possession of a search warrant issued by a magistrate. The search warrant empowers him and his colleagues to gain entry into a premises and to search and seize items relevant to the investigation. The target is suspected to have committed fraud. The suspect is a computer expert so it is very likely that his computer contains considerable information related to the case.

The D-Day arrives. The law enforcement agent knocks on the door of the suspect's home. The suspect answers the door. The agent arrests the suspect, cautions the suspect, presents the search warrant, explains it to him and starts the search. The agent sees a notebook computer in the living room. Upon examining the computer, he discovers records of bank accounts and transactions that may be related to the investigation. The agent has found some valuable evidence, but there is more. What is this other evidence?

We consider two scenarios. In the first scenario, the law enforcement agent sees a webmail login page on the computer screen. The suspect has already entered his username and password. All that remains to be done is to hit "Enter" on the keyboard.

In the second scenario, the agent finds a piece of paper on the suspect's desk. The paper contains the name of a webmail service provider (WSP), a username and a password. The agent believes that the username and password belong to the suspect's webmail account, but the suspect remains silent when questioned.

We assume that the WSP is in the United States and some e-mail messages in the webmail account may be vital to the successful prosecution of the suspect. How does the law enforcement agent legally obtain the e-mail evidence so that it is admissible in a Hong Kong court?

Scenario 1

This scenario involves jurisdictional issues between Hong Kong and the United States. The suspect has a webmail account with a U.S.-based WSP. The WSP maintains numerous mail servers that store millions, possibly billions, of e-mail messages belonging to users from around the world. All the mail servers are physically located in the United States; thus, the servers and their contents are under U.S. legal jurisdiction. The Hong Kong law enforcement agent wants all relevant information pertaining to the webmail account such as registration details and e-mail contents, but the information is in the United States. How can the law enforcement agent legally acquire the information from overseas?

Traditional Method

The traditional method for handling the case is to rely on mutual legal assistance (MLA). Two governments sign an MLA whereby each guarantees to provide support to the other on criminal matters. Hong Kong and the United States have an MLA agreement [START_REF]Mutual Legal Assistance in Criminal Matters (United States of America) Order, Chapter 525F[END_REF]. The agreement includes "executing requests for search and seizure." This makes it possible for the U.S. authority that handles the MLA (U.S. Depart-ment of Justice (USDoJ)) to search the WSP in the United States and seize the relevant information (including the e-mails) on behalf of the Hong Kong Department of Justice (HKDoJ). Under MLA, the USDoJ obtains the registration details and e-mail messages belonging to the suspect and sends the information to the HKDoJ, who then passes it to the requesting law enforcement agency.

The MLA arrangement is feasible but slow -standard MLA procedures may take weeks, if not months, to complete. During this time, it is very likely that the digital evidence and possibly the suspect himself have vanished. The suspect, who normally can only be detained up to 48 hours after his arrest, would have been released long ago and could use any Internet-ready computer to delete all the evidence in his webmail account. Even if the suspect was charged and remanded in prison, he could arrange for someone else to access his account and delete his e-mails. The suspect would be confident that, by the time the MLA procedures are completed, his deleted e-mails would have been gone for weeks or even months and would not be recoverable. The point is that no matter how efficient MLA procedures are, law enforcement agents can never be sure that they will be able to seize digital evidence stored outside their jurisdiction [START_REF] Bellia | Chasing bits across borders[END_REF].

Is there any way that the e-mail contents stored overseas can be acquired accurately and with speed so that the evidence is not lost?

Direct Method

The direct method is to access the suspect's webmail account in the United States simply by clicking the "Enter" key on the keyboard. Having accessed the webmail account, all of the suspect's e-mail messages can be downloaded to his computer in Hong Kong so that they come under Hong Kong jurisdiction. Does the local search warrant empower the law enforcement agent in Hong Kong to access digital evidence stored overseas via the Internet?

The answer is in the negative. Before the "Enter" key is depressed and the e-mail messages are downloaded, the messages are still in the United States. The messages would not have been delivered to the suspect's computer in Hong Kong had the download request not been made. As a result, the digital evidence obtained by the law enforcement agent can be regarded as illegally obtained and subject to challenge in court. Could hitting "Enter" on the keyboard and clicking the mouse a few times have such an impact?

The answer is in the affirmative. It is similar to a situation where law enforcement agents execute a search warrant on a subsidiary office in a different location from the main office. During their search, the agents discover that the subsidiary has a computer network that links to the main office. If a piece of digital evidence stored on the server of the main office is accessible via the computer network at the subsidiary, what should the agents do? Of course, they should apply for another search warrant to search the main office. The first search warrant does not empower them to obtain digital evidence stored in the main office. As a result, it is unlikely that a local search warrant in Hong Kong would permit an agent to search and seize e-mail messages stored overseas.

Johnson and Post [START_REF] Johnson | Law and borders: The rise of law in cyberspace[END_REF] argue that the emergence of the Internet has destroyed not only the power of a government to regulate online behavior but also the legitimacy of a sovereign to "regulate global phenomena."

The USDoJ [START_REF]Searching and Seizing Computers and Obtaining Electronic Evidence in Criminal Investigations, Office of Legal Education[END_REF] admits that although digital evidence seized remotely from one district to another district may be admitted by U.S. courts, it is a different matter altogether when the evidence is located outside the United States; moreover, remotely searching data stored outside the country is a complicated matter. Clearly, the USDoJ has some reservations regarding the validity of remote cross-border searches.

Graham [START_REF] Graham | Uncovering and eliminating child pornography rings on the Internet: Issues regarding and avenues facilitating law enforcement's access to "Wonderland[END_REF] comments that for certain cyber crimes, such as child pornography and hate speech, an international enforcement jurisdiction is justified. Dauterman [START_REF] Dauterman | Internet regulation: Foreign actors and local harms -At the crossroads of pornography, hate speech and freedom of expression[END_REF] argues that a state can assert "reasonable jurisdiction" over a person who commits an offense outside the state as long as it causes harmful effects in the state and if there is a substantial connection between the person and the state, the latter should be reasonable to claim extraterritorial jurisdiction. The Arkansas v. Kirwan case [START_REF] Court Of Arkansas | State of Arkansas[END_REF] demonstrates that U.S. courts could claim jurisdiction as long as a suspect's conduct or the result of his conduct occurred within the state. Nevertheless, it is doubtful that the e-mail content in our scenario fulfills any of the requirements for extraterritorial jurisdiction. This is because the offense involved is not a universal crime. Also, even if the suspect has a substantial connection with Hong Kong, it would be hard to prove that storing e-mail overseas causes harmful effects in Hong Kong. Hiding criminal evidence may have a harmful effect on the case, but not to the Hong Kong public. Some U.S. legal scholars favor remote cross-border searches. There is a view that countries like the U.S. long for the unilateral power of remote cross-border searches without assistance from or even the acknowledgement of the country where the data is stored [START_REF] Bellia | Chasing bits across borders[END_REF]. The United States v. Gorshkov [START_REF] Brenner | Approaches to cybercrime jurisdiction[END_REF] and United States v. Ivanov [START_REF]District Court (District of Connecticut), United States v. Ivanov[END_REF] cases show that, when the need arises, U.S. courts are willing to try overseas cyber criminals even though they were not in a U.S. jurisdiction when they committed their crimes, and the courts may admit the digital evidence even if it is obtained by a unilateral remote cross-border search [START_REF] Brenner | Transnational evidence gathering and local prosecution of international cybercrime[END_REF]. Although these two cases were successfully prosecuted, there is a comment that the Gorshkov case cannot give the "conceptual basis" for the legal issue of cross-border search and seizure because it implies that any country that suffers a crime originating from another country can invade the country's sovereignty by remotely searching and seizing property physically located in that country [START_REF] Brenner | Transnational evidence gathering and local prosecution of international cybercrime[END_REF]. Also, there is the possibility that the country that suffered the remote cross-border search could retaliate. In fact, Russia's Federal Security Service brought criminal proceedings against the FBI agent in the Gorshkov case who was responsible for accessing the computers in Russia [START_REF] Brunker | FBI agent charged with hacking, msnbc.com[END_REF].

Based on the cases cited, it appears that the U.S. judiciary has never denied the possibility of extraterritorial jurisdiction; thus, the validity of remote cross-border search may not face many legal challenges in the United States. Goldsmith [START_REF] Goldsmith | The Internet and the legitimacy of remote crossborder searches[END_REF] even argues that cross-border search is a necessary tool against cyber crime, that there are precedents, and that it is inevitable in order to accommodate new technology. On the other hand, Brenner and Schwerha [START_REF] Brenner | Transnational evidence gathering and local prosecution of international cybercrime[END_REF] maintain that it is not clear if U.S. law enforcement agents can "lawfully" use computers in the United States to seize digital evidence stored overseas. They also state that the only certainty is that an agent who has conducted such a seizure can claim that, because the digital evidence could be destroyed or moved, he had to obtain the evidence quickly, possibly even without a search warrant [START_REF] Brenner | Transnational evidence gathering and local prosecution of international cybercrime[END_REF]. Of course, it is up to the court to accept this claim.

The 2001 Cybercrime Act of Australia grants power to law enforcement agents to "operate electronic equipment at the warrant premises to access data (including data not held at the premises)" if the data might be relevant to the case and the equipment can be operated without damaging it. This act appears to "legalize" remote cross-border searches in other countries, but it does not say whether the Australian authority allows other countries to do the same to computers on Australian soil.

It is important to note that legislation and arguments that favor remote cross-border searches can lead to a situation where a law enforcement agency in any country that has Internet connectivity would have jurisdiction to lawfully access any data stored on the Internet. Such a situation would likely result in chaos because every country could claim legal jurisdiction to Internet servers around the world. This would severely restrict the freedom of speech because no matter where a person voices his views on the Internet he may have committed an offense (usually political) in some part of the world. The irony is that many in the United States claim that the Internet is an ideal place for freedom of speech, but now it appears that any government in the world can control any content on the Internet. In fact, if this were to be the case, the U.S. would suffer because any law enforcement agency in the world -from Canada, France, China, Peru, even Iran -could claim jurisdiction over all U.S.-based servers with Internet connections.

In the international arena, law enforcement agents from one country cannot exercise their power in the territory of a second country except with the consent of the government of the second country [START_REF] Bellia | Chasing bits across borders[END_REF]. Berman [START_REF] Berman | The globalization of jurisdiction[END_REF] comments that a target state of a remote cross-border search may feel that the extraterritorial investigations by other states threaten its citizens and may, therefore, impose measures such as privacy protection to limit the scope of investigations or even bar the investigations. In general, a unilateral remote cross-border search violates customary international law [START_REF] Bellia | Chasing bits across borders[END_REF].

Recognizing the problems associated with MLA, the Council of Europe has suggested various measures for the smooth transfer of digital evidence between states. In 2001, the Council of Europe's Convention on Cybercrime [START_REF]Council of Europe, Convention on Cybercrime[END_REF] recommended that a speedy MLA such as fax or e-mail should be used to facilitate the rapid preservation of digital evidence. Article 32 of the Convention on Cybercrime legalizes remote cross-border searches of publicly-available data and other data with the consent of the local authority. Nevertheless, the data in our scenario is not publicly available and seeking WSP content may be fruitless. The WSP does not have any legal obligation to comply with a request from overseas and the WSP is not the owner of the data, so it may not even have the authority to give consent to an overseas authority. Thus, it appears that Article 32 does not provide much assistance in our scenario.

Based on our analysis, the problems related to traditional MLA remain. The Hong Kong law enforcement agent may not unilaterally conduct a remote cross-border search on the suspect's webmail account to avoid the embarrassment that the evidence obtained is inadmissible because an offense was committed by the law enforcement agent during its extraction [START_REF] Wilding | Computer Evidence: A Forensic Investigation Handbook[END_REF].

Is there a better approach? We analyze the second scenario before presenting two solutions.

Scenario 2

This scenario differs from the first scenario in that the law enforcement agent has the username and password of the suspect's webmail account. But the problem is that the search warrant is not valid unless it has an extraterritorial effect. Moreover, it is not feasible for the agent to apply for another search warrant because there is nothing local to search.

Conducting a remote cross-border search and seizure using the suspect's username and password is similar to using a key found in the suspect's premises to open the suspect's safe deposit box in a bank. The matter is more complicated if the safe deposit box is located overseas. It is inconceivable that the law enforcement agent would travel to the country where the deposit box is located, open the deposit box and bring its contents back to Hong Kong. The agent does not have the power to search and seize items in another country. Although it can be argued in this scenario that the law enforcement agent has not left his jurisdiction and is, therefore, not acting without authority, it is doubtful that the evidence acquired via the Internet would be admissible in court.

Two Solutions

Based on the preceding analysis, we should recognize that, although it is technically feasible to conduct a remote cross-border search and seizure, it is an exception rather than a rule for the court to accept the digital evidence. We present two solutions. Note that these solutions are not related to the illegality of the contents (e.g., pornography or hate speech) as in our hypothetical scenarios. Indeed, there is nothing wrong with the e-mail content per se. It is just that the suspect has stored his criminal evidence abroad hoping to take advantage of the jurisdictional restrictions imposed on Hong Kong law enforcement.

Solution 1

The first solution involves duress, but it has been implemented. The Bank of Nova Scotia case [START_REF]Court of Appeals (Eleventh Circuit), United States v[END_REF] demonstrates that, if necessary, U.S. courts are willing to compel foreign banks with U.S. branches to produce bank records held outside the United States that are subject to foreign jurisdiction. Similarly, a magistrate or judge in Hong Kong could issue a local search warrant to search the Hong Kong subsidiary of the WSP (if one exists), and compel it to produce information about the suspect's webmail account and the contents of all e-mail messages. The rationale is that the webmail account, no matter where it is physically located, is treated as a local webmail account. As long as the owner of the webmail account can access it in Hong Kong, courts would ignore where the webmail account and its contents reside and compel the local subsidiary of the WSP to disclose everything about the account.

Because the evidence is given by the Hong Kong subsidiary, it is treated as evidence obtained locally, so the jurisdictional issue does not arise. While this solution appears to eliminate the jurisdictional problem, the irony is that it turns a blind eye to the issue of extraterritorial jurisdiction. As a result, multinational companies such as Yahoo or Microsoft would suffer.

Another important point regarding this solution is that the country that uses it must have strong economic bargaining power that would force multinationals to comply; otherwise the companies could pull out and move to a "friendlier" country. Nevertheless, this solution sets aside the problem of extraterritorial jurisdiction and enables a local search warrant to acquire digital evidence stored outside the jurisdiction.

Solution 2

The second solution attempts to strike a balance between speed and jurisdictional issues; also, it emphasizes the integrity of evidence. In this solution, the Hong Kong law enforcement agent may search and seize the digital evidence immediately using the suspect's computer or using the information on the piece of paper that contains the suspect's webmail username and password. Having seized the evidence, the law enforcement agent should contact the WSP in the United States by fax or e-mail to request the immediate preservation of evidence in the suspect's webmail account pending MLA approval. Meanwhile, the agent should issue a formal MLA request [START_REF] Government | Title 18, Section 2703, United States Code Annotated, Cumulative Annual Pocket Part[END_REF]. This solution is different from the one described in Article 32 of the Convention on Cybercrime because it does not require "lawful and voluntary consent" by the WSP. Note that the WSP will only preserve the digital evidence; it will not surrender the evidence to the Hong Kong agent until and unless ordered to do so by a U.S. court under the MLA request.

This solution preserves digital evidence before it can be deleted. Of course, if the evidence from the WSP is the same as that seized in Hong Kong, the evidence from the WSP can be presented to the court directly. However, in the unlikely event that the evidence from the WSP is different from the evidence seized in Hong Kong, more weight should be given to the evidence from the WSP. This solution is attractive because it conforms with MLA practices. Also, the evidence is preserved speedily and its integrity cannot be questioned because the preservation is done by the WSP, not by the Hong Kong law enforcement agent.

Conclusions

The two solutions presented to overcome the shortcomings of a local search warrant are far from perfect. As long as there are cross-border searches on the Internet, there will be debates on how to maintain law and order in cyberspace without infringing the jurisdiction of another country and the privacy of its citizens. While it is useful to consider streamlining current legal procedures for acquiring digital evidence overseas, in the long term it is important to deal with this issue in the context of MLA agreements. This means that countries may have to negotiate and agree on joint cross-border searches over the Internet. Joint operations require good intelligence and coordination or they could lead to disastrous consequence as in Operation Ore, where thousands of British men were suspected of accessing child porn websites based on credit card payments, when, in fact, some of them were victims of credit card fraud [START_REF] Laville | Legal challenge to web child abuse inquiry, guardian[END_REF]. The European Union provides a good example of transnational cooperation. The European Union has established a border-free travel zone based on its confidence in the border control procedures of its member states [START_REF]Schengen at 24[END_REF]; similar confidence could be placed on its member law enforcement agencies in conducting remote cross-border searches over the Internet.

The emergence of cloud computing poses significant problems for law enforcement agencies. If the WSP engages a cloud computing service provider, its customer data could be stored in data servers around the world. As a result, the law enforcement agent cannot recover any digital evidence from the suspect's computer and from the WSP's servers. Even worse, the WSP would not know the exact physical location of the suspect's data.

Interestingly, our two solutions may work even better in a cloud computing environment. In the first solution, since the exact physical location of the suspect's data is almost impossible to determine, the law enforcement agent has a stronger justification to request the local subsidiary of the WSP to produce the suspect's data regardless of where it is actually stored. In the second solution, the WSP has an urgent need to preserve the suspect's data pending MLA. Because the storage of the suspect's data is outside its control, the WSP has to take steps to preserve the suspect's data immediately or there would be no guarantee that it could produce the suspect's data when the court order arrives.

Countries must address the issue of remote cross-border searches before they encounter increasing numbers of unilateral remote cross-border searches from other countries. If countries with advanced technology do not take the initiative immediately, they may be forced to accept solutions imposed by other countries.


Michael Kwan

Richard Overill

Kam-Pui Chow

Jantje Silomon

Hayson Tse

Frank Law

Pierre Lai

EVALUATION OF EVIDENCE IN INTERNET AUCTION FRAUD INVESTIGATIONS

Keywords: Internet auction fraud, Bayesian network, relevance of evidence

Internet auction fraud has become prevalent. Methodologies for detecting fraudulent transactions use historical information about Internet auction participants to decide whether or not a user is a potential fraudster. The information includes reputation scores, values of items, time frames of various activities and transaction records. This paper presents a distinctive set of fraudster characteristics based on an analysis of 278 allegations about the sale of counterfeit goods at Internet auction sites. Also, it applies a Bayesian approach to analyze the relevance of evidence in Internet auction fraud cases.

Introduction

According to the Data Center of the China Internet [START_REF]Data Center of the China Internet, The First Half of 2008 China Internet User Measurement Data IUI Index Report[END_REF], Chinese users spent 2.56 trillion Renminbi ($698 billion) on the Internet during the first half of 2008, a 58.2% increase over the same period in 2007. Of the total amount, 35% was spent on purchases made via the Internet; the remaining 65% was spent on on-line games and network communities. China already has more Internet users than any other country in the world, and the number of users is expected to nearly double from 253 million in 2008 to 480 million in 2010 [START_REF]Statistical Survey Report on Internet Development in China (Abridged Edition)[END_REF]. By 2010, the volume of online transactions in China will exceed those in Japan and South Korea [START_REF]Statistical Survey Report on Internet Development in China (Abridged Edition)[END_REF].

Internet auctions offer buyers unparalleled selections of products and the opportunity to make great deals. They also provide sellers with a means to reach millions of potential buyers. Meanwhile, criminals are attracted by the low entry costs and tremendous profits of Internet auc-tions. Unscrupulous sellers take advantage of buyers by misrepresenting the quality or condition of their goods. Some have no intention of delivering the goods that are offered for sale. As a result, Internet auction fraud is the most common type of fraud reported in the electronic commerce domain [START_REF] Ochaeta | Fraud Detection for Internet Auctions: A Data Mining Approach[END_REF].

This paper examines the characteristics of Internet auction fraud in Hong Kong related to the sale of counterfeit goods (i.e., goods bearing false trade descriptions or forged trademarks). In addition, it uses Bayesian network models representing the prosecution and defense viewpoints in conjunction with the likelihood ratio as a criterion to determine the relevance of digital evidence in Internet auction fraud cases.

Background and Related Work

This section reviews the nature of Internet auction fraud. Also, it surveys approaches for detecting fraud in online auctions.

Internet Auctions

Internet auctions are successful for many reasons. Potential buyers have sufficient time to search for items of interest and they can bid for items 24 hours a day, seven days a week. The Internet does not impose geographical constraints on buyers and sellers and they are not required to be physically present at an auction. The large numbers of buyers and sellers tend to reduce selling costs as well as sales prices. Many users describe their online auction experience as comparable to gambling. Offering the highest bid provides the same thrill as winning a game.

Ochaeta [START_REF] Ochaeta | Fraud Detection for Internet Auctions: A Data Mining Approach[END_REF] Scheduling and Advertising: In order to attract potential buyers, items in a given category (e.g., art or jewelry) are generally auctioned together on a regular schedule. Popular items are sometimes mixed with less popular items. Items to be sold in upcoming auctions and the dates of upcoming auctions are advertised.

Bidding: The bidding step handles the collection of bids from potential buyers. It implements the bid control rules (e.g., minimum bid, bid increment, bid deposit). It also notifies auction participants when higher bids are received.

Bid Evaluation and Auction Closing: This step implements the auction closing rules and notifies the winners and losers.

Trade Settlement: This final step handles payments to sellers and the transfer of goods to buyers. If the seller is not the auctioneer, this final step also includes the payment of fees to the auctioneer and other agents.

Internet Auction Fraud

Criminals have discovered the Internet to be a highly profitable venue for conducting illicit business activities [START_REF] Gajek | A forensic framework for tracing phishers[END_REF]. Organized crime groups are involved in numerous technology-enabled crimes, including Internet auction fraud [START_REF] Choo | Organized crime groups in cyberspace: A typology[END_REF].

Sakurai and Yokoo [START_REF] Sakurai | A false-name-proof double auction protocol for arbitrary evaluation values[END_REF] have observed that anonymity is an important factor in perpetrating Internet fraud and that the existence of indivisible bids causes difficulty in matching supply and demand. This is because a buyer or seller can submit a false name bid by pretending to be a potential buyer or seller, thereby manipulating the balance of supply and demand. Chae, et al. [START_REF] Chae | Empirical analysis of online auction fraud: Credit card phantom transactions[END_REF] have confirmed these observations, concluding that online auction fraud is successful due to information asymmetry and anonymity.

Chua and Wareham [START_REF] Chua | Self-regulation for online auctions: An analysis[END_REF] have listed some of the reasons for the proliferation of Internet auction fraud. The high degree of anonymity is at the top of the list; it is easy for dishonest users to evade prosecution. Second on the list is the low cost of entry and exit. Interestingly, these are precisely the reasons for the success of Internet auctions.

According to the 2008 Internet Crime Report [9], the median loss per Internet fraud complaint in the United States was $931 in 2008; the total loss was $264.6 million. In all, there were 275,284 Internet crime complaints -auction fraud, non-delivery of purchased goods, credit/debit card fraud, computer intrusions, spam and child pornography. However, Internet auction fraud was the most commonly reported offense, comprising 25.5% of all complaints and 16.3% of the total reported loss. The average median loss per auction fraud complaint was $610. Gregg and Scott [START_REF] Gregg | A typology of complaints about eBay sellers[END_REF] discovered that Internet auction fraud takes various forms, such as delivering goods that are different, of low quality, without ancillary components, defective, damaged or black market items.

Morzy [START_REF] Morzy | New algorithms for mining the reputation of participants of online auctions[END_REF] describe other practices, including bid shielding and bid shilling. Bid shielding is the offering of an artificially high bid for an item to discourage other bidders from competing for the item. At the last moment, the "shielder" withdraws the high bid, enabling the second highest bidder, who is usually an accomplice, to win the auction. Bid shilling involves the use of a false bidder identity to drive up the price of an item on behalf of the seller.

Gregg and Scott [START_REF] Gregg | A typology of complaints about eBay sellers[END_REF] note that accumulation fraud is on the increase. In this type of fraud, a seller builds his reputation by selling large quantities of low-value merchandise over a long period of time. Having earned a good reputation, the seller offers expensive goods, but does not send the goods to buyers after receiving payment for them.

Chua and Wareham [START_REF] Chua | Self-regulation for online auctions: An analysis[END_REF] created the auction fraud taxonomy presented in Table 1. According to Chua and Wareham, all the types of fraud listed are very damaging to Internet auction houses. They undermine user trust, which is disastrous for business.

Ku, et al. [START_REF] Ku | A proposed data mining approach for Internet auction fraud detection[END_REF] note that while both buyers and sellers can be victims of fraud, a buyer is more easily targeted than a seller. They observed that 89% of seller-buyer pairs conducted just one transaction during the time period of their study; at most, there were four transactions between a seller-buyer pair. This means that the repeated transaction rate for the same seller-buyer pair is lower than 2%. If the transaction rate is much higher than 2%, then the transactions between the seller-buyer pair are suspect and could involve bid shilling or bid shielding.

Kobayashi and Ito [START_REF] Kobayashi | A transactional relationship visualization system in Internet auctions[END_REF] observed that many fraudsters tend to make honest deals during the early stages of their auction lives. However, they commit fraud soon after earning good reputations.

Ochaeta [START_REF] Ochaeta | Fraud Detection for Internet Auctions: A Data Mining Approach[END_REF] also observed that fraudsters tend to establish good reputations prior to committing fraudulent acts. Therefore, the reputation building process of fraudsters is different from that of legitimate users. Specifically, fraudsters attempt to gain as much one-time profit as possible and as quickly as practicable. Consequently, fraudsters can be identified based on their reputation-building activities.

Fraudsters attempt to build their reputations by buying or selling numerous cheap items from sellers with good reputations. Additionally, they may buy or sell moderately priced or expensive items to accomplices. These buying and selling activities generally take place over a short period of time.

In order to build good reputations over a short period of time, most Internet auction fraudsters tend to sell large amounts of low-priced products. These sales take place at the beginning of their fraudulent auction lives. Also, fraudsters may attempt to bid for inexpensive items from sellers with good reputations. This is done to establish a favorable reputation by conducting many legitimate transactions.

Internet Auction Fraud in Hong Kong

We conducted a statistical analysis of 278 cases in Hong Kong to reveal the characteristics of Internet auction fraud related to the sale of counterfeit goods. The cases were the result of complaints lodged with the Hong Kong Customs and Excise Department. The following characteristics were observed in the analyzed cases: Fake goods are sold at unreasonably low prices, about 10% of the prices of legitimate goods.

In about two-thirds of the cases (180 out of 278), the goods are sold within seven days of account creation.

Fraudsters have multiple auction accounts that do not carry high trust values or reputation scores (8 out of 10 or higher).

Fraudulent accounts are short lived (less than ten days) and fraudsters tend to switch to other auction accounts before the auction period expires.

Many categories of goods (more than five) are sold (e.g., watches, mobile phones, footwear and sportswear).

Investigative Model

This section describes an investigative model for online auction fraud involving the sale of counterfeit goods. The model employs a Bayesian network to support the reasoning about evidentiary hypotheses.

Hypotheses and Evidentiary Traces

Digital evidence related to twenty prosecuted cases from the 278 complaints of selling counterfeit goods in Internet auctions was used to frame three sub-hypotheses about the actions taken by fraudsters. Because detailed judgments were not available for the prosecuted cases, digital forensic examiners who worked on the cases were interviewed to elicit the sub-hypotheses. The three sub-hypotheses are: Auction-related materials (e.g., images and item descriptions) were downloaded.

The auction item (e.g., price of the item) was manipulated.

The buyer and seller communicated (e.g., via email or instant messaging) about the counterfeit item. These three sub-hypotheses substantiate the overall prosecution hypothesis that an online auction fraud crime was committed in the twenty prosecuted cases. The sub-hypotheses are supported by thirteen distinct evidentiary traces, which were obtained from the responsible digital forensic examiners. The various hypotheses and evidentiary traces are expressed using a Bayesian network model shown in Figure 1.

This investigative model does not of itself substantiate the entire prosecution case. The auctioned item has to be procured by the investigator and then be examined by the trademark owner to ascertain whether or not the item is counterfeit.

In order to evaluate the relevance of the digital evidential traces, a second simple Bayesian network model is created to express the defense viewpoint. Figure 2 presents the defense hypotheses and their associated evidentiary traces. Although the root hypotheses of the defense and prosecution models appear to be the same, they are, in fact, different because of the different supporting sub-hypotheses that express the defense and prosecution viewpoints. However, the same set of evidentiary traces is used in both models.

Evidence Evaluation

We use the likelihood ratio (LR) to evaluate the evidence in Internet auction fraud cases. LR is a general technique that can be applied to any scenario with decision uncertainty. In particular, it is very effective for quantifying the value or relevance of evidence [START_REF] Lucy | Introduction to Statistics for Forensic Scientists[END_REF]. The closer the LR value is to one, the less relevant is the evidence. Evett [START_REF] Evett | Establishing the evidential value of a small quantity of material found at a crime scene[END_REF] generalized the LR approach to represent a situation where it is uncertain if the evidence is the result of the activities of a suspect. The general form proposed by Evett is:

!" # ! # !$ # !% # !" # !"$ # !"% # !"" # !"& # !' # !( # !) # !* # !+ # !, # !$ # !%
LR = P r(E|Hp) P r(E|H d )
where E is the total digital evidence related to the crime, and H p and H d are the overall prosecution hypothesis and the overall defense hypothesis, respectively.

In our simple Bayesian network model, the existence of each individual trace of digital evidence does not imply the existence of any other traces. Since the evidentiary traces are mutually independent, their individual Applying the interpretation adopted by the U.K. Forensic Science Service [START_REF] Keppens | Towards qualitative approaches to Bayesian evidential reasoning[END_REF], an LR value of 95,600 indicates very strong support of the evidence for the prosecution's claim over the defense's claim. The computed LR value indicates very strong evidentiary support for the prosecution's sub-hypothesis H p1 . On the other hand, the LR values indicate that the evidence supports the prosecution's sub-hypotheses H p2 and H p3 moderately strongly.

A limitation exists in the application of the LR approach to evaluate the evidentiary relevance of individual sub-hypotheses. In order to compute LR values, the corresponding sub-hypotheses should exist in the Bayesian network models expressing the prosecution and defense viewpoints. This requirement renders the LR approach inapplicable when the sub-hypotheses in two models do not correspond to each other (e.g., the number of sub-hypotheses in the defense Bayesian network model is larger than the number in the prosecution model).

However, under normal circumstances, the sub-hypotheses in both models will correspond because most of the sub-hypotheses in the defense model stem from the sub-hypotheses in the prosecution model. Evaluating the evidentiary relevance of individual sub-hypotheses can identify the strongest and weakest sub-hypotheses in the models. This enables digital forensic practitioners to identify the most significant and/or the most insignificant groups of evidence that are encompassed by the individual sub-hypotheses.

Evaluation of the Overall Hypotheses

To compute P r(E|H p ), it is necessary to set the root hypothesis H p of the prosecution Bayesian network to "Yes" and then multiply the resulting probability values of E p1 to E p13 . Similarly, to compute P r(E|H d ), it is necessary to set the root hypothesis H d of the defense Bayesian network to "No" and multiply the resulting probability values of E d1 to E d13 . Specifically, we have: The LR value of 164,000 indicates very strong evidentiary support for the prosecution's claim over the defense's claim.

Conclusions

The analysis of allegations of counterfeit goods at Internet auction sites provides interesting insights into fraudster behavior. Bayesian networks and likelihood ratio values offer a powerful mechanism for analyzing the relevance of evidence in such cases. If all the evidentiary traces are initially assumed to be present, the LR values computed from the prosecution and defense models can be used as criteria to determine whether or not it is worthwhile to proceed with the search for evidentiary traces. Specifically, if the LR value is relatively large (greater than 1,000) the search for the implied digital evidence should proceed. This would be followed by applying a cost-effective digital forensic investigation model [START_REF] Overill | A cost-effective model for digital forensic investigations[END_REF] to identify the evidentiary traces and then applying the Bayesian network model [START_REF] Kwan | Reasoning about evidence using Bayesian networks[END_REF] with the retrieved traces. On the other hand, if the LR value is found to be relatively small, the evidence does not strongly support the chosen hypotheses. Therefore, the prosecution should review its hypotheses and/or the implied evidentiary traces.

Hypotheses:Figure 1 .

 1 Figure 1. Bayesian network model for prosecution hypotheses and evidentiary traces.

Figure 2 .

 2 Figure 2. Bayesian network model for defense hypotheses and evidentiary traces.

  P r(E|Hp) ≈ 0.000293; P r(E|H d ) ≈ 0.00000000179 Hence,

Table 1 .

 1 Internet fraud taxonomy.

		Seller as Fraudster
	Bid Shilling	Seller bids on his own items to drive up the
		price
	Misrepresentation	Seller intentionally misrepresents an item
	Fee Stacking	Seller adds hidden costs such as handling
		charges after the auction
	Failure to Ship	Seller does not send the items to the buyers
	Reproductions and Counterfeits Seller advertises counterfeit items as the real
		thing
	Triangulation Fencing	Stolen items are sold
	Shell Auction	Seller sets up an auction solely to obtain bank
		account and credit card information
		Buyer as Fraudster

Bid Shielding

Two buyers collude -one makes a low bid, while the other makes an inflated bid; the higher bidder withdraws before the auction ends Failure to Pay Buyer does not pay for the items Buy and Switch Buyer refuses the items, but keeps the original items and returns inferior items Loss or Damage Claims Buyer claims the items are damaged, disposes of them and requests a refund

Table 2 .

 2 Conclusions drawn on LR values.Evaluation of the Individual Sub-Hypotheses To evaluate the evidentiary relevance or LR values of the individual sub-hypotheses, it is necessary to set the individual sub-hypotheses to "Yes" separately and then multiply the prior probability values of their associated evidence. Thus, the LR value of evidence for hypothesis H p against the evidence for hypothesis H d (P r(E|H p )/P r(E|H d )) is given by: d1 |H d1 ) × P r(E d2 |H d1 ) × P r(E d3 |H d1 ) × P r(E d4 |H d1 ) × P r(E d5 |H d1 )

	Likelihood Ratio Evidentiary Support
	1 to 10		Limited
	10 to 100		Moderate
	100 to 1,000		Moderately Strong
	1,000 to 10,000		Strong
	More than 10,000		Very Strong
	probabilities can be multiplied together to determine the probability of
	E given a root hypothesis. The prior probability values of the individual
	evidentiary traces for the Internet auction fraud models (prosecution and
	defense) were obtained by surveying digital forensic examiners with the
	Hong Kong Customs and Excise Department, and are generally accepted
	values within this community of experts.
	P r(Ep1|Hp1) × P r(Ep2|Hp1) × P r(Ep3|Hp1) × P r(Ep4|Hp1) × P r(Ep5|Hp1)
	P r(E ≈ 0.9 × 0.75 × 0.6 × 0.75 × 0.85 0.9 × 0.05 × 0.6 × 0.01 × 0.01	≈	0.258 0.0000027	≈ 95, 600

Table 2

 2 illustrates the interpretation used by the Forensic Science Service. Similarly, the LR values for H p2 against H d2 and for H p3 against H d3 are given by:

	P r(E|Hp2) P r(E|H d2 )	≈	0.247 0.000319	≈ 774
	P r(E|Hp3) P r(E|H d3 )	≈	0.190 0.000938	≈ 203

Acknowledgements

The authors wish to thank Dr. Jeroen Keppens of the Department of Computer Science, King's College London for his technical assistance.


ED 483 ScSo

École doctorale des sciences sociales Université de Lyon © Vincent Chollier -2014

Available documentation

The study relies on different types of documents: stelae, inscribed statues or funerary chapels with biographical inscriptions, etc. In our case study (Figure 1), Imeneminet mentions twenty-four individuals among his relatives. This document presents many very powerful actors of Ramesses II' reign, linked by kinship terms.

Network boundaries: the «snowball» sampling method

In order to build networks, we use the «snowball» sampling method (Figure 2): i. e. for each character represented in a document -zone 1 -, we look for every other document mentioning him/her, and for each of these documents, we have registered every individual represented -zone 2. We repeat this operation once to reach the last zone -zone 3.

Three reasons not to go further: 1. only scanty documents allow us to go beyond the third zone; 2. we consider individuals from the first zone are not so close to those of the third zone; If we went further we would fall on abstraction.

For the statue-group Naples 1069, this method allows us to extend the Imeneminet's network from 25 individuals in the only zone 1 to 81 in the zone 3.

Scholars need pay particular attention on the way documents are assigned to one individual. Homonymy is the biggest trap. Concerning Ancient Egypt, it is mostly important to understand that the first-born often inherited the name and the titles from his paternal grandfather. That can be a cause of muddle and anachronism. We have to compile the biggest number of sources as possible: that is the historian's job.

1-mode and 2-mode networks

The method presented here aims at studying individuals' relationships by using 2-mode (bipartite) networks. In this case, «document» is the first type of nodes, «individual» the second. Accordingly this method is more accurate, as sometimes documents do not quote any link between people. Moreover, relationship terms are often ambiguous.

For example, the Egyptian word «sn», which can be translated by «brother», does not ever link biological brothers. The same word might even link cousins, an uncle and his nephew, close friends, colleagues, etc.

Also, what only undoubtly links individuals are documents where they are depicted together. The next step in to convert the 2-mode network in 1-mode is the next step which seems to be the most readable graph (Figure 3). Then, in this 1-mode network, a character is linked to another if both appear in the same document.

This poster aims at presenting methodological issues when attempting to study Ancient Egyptian society using social network analysis methods. This presentation develops a case study: a group statue representing twenty-five male and female charac-

ters of the reign of Ramesses II (13 th century BC).

Remaining issues

Some issues are still open, mainly due to the geographical and chronological gap between us and Ancient Egyptians. That is why we have to be very careful with data, and compile them wisely.

Reciprocity of mentioned links

It is hard to know if mentioned links in documents are reciprocal. That would be the case if someone presented famous people on his own monuments.

Incompleteness of documents

Most of the networks remain incomplete due to the badly preservated documents.

Linguistic and cultural gap

The linguistic and cultural gap between scholars and the ancient Egyptian society is still the biggest problem, not only in network studies. This causes much of misinterpretation. Our example on the term «sn» shows that cultural context is mostly important.

Figure 2 .

 2 Figure 2. Schema of the «snowball» sampling method