Implementing statistical learning methods through Bayesian networks. Part 1: A guide to Bayesian parameter estimation using forensic science data

Likelihood ratios for changepoints in categorical event data with applications in digital forensics

We investigate likelihood ratio models motivated by digital forensics problems involving time-stamped user-generated event data from a device or account. Of specific interest are scenarios where the data may have been generated by a single individual (the device/account owner) or by two different individuals (the device/account owner and someone else), such as instances in which an account was hacked or a device was stolen before being associated with a crime. Existing likelihood ratio methods in this context require that a precise time is specified at which the device or account is purported to have changed hands (the changepoint)-this is the known changepoint likelihood ratio model. In this paper, we develop a likelihood ratio model that instead accommodates uncertainty in the changepoint using Bayesian techniques, that is, an unknown changepoint likelihood ratio model. We show that the likelihood ratio in this case can be calculated in closed form as an expression that is straightforward to compute. In experiments with simulated changepoints using real-world data sets, the results demonstrate that the unknown changepoint model attains comparable performance to the known changepoint model that uses a perfectly specified changepoint, and considerably outperforms the known changepoint model that uses a misspecified changepoint, illustrating the benefit of capturing uncertainty in the changepoint.

Discrimination between right- and left-handed writers based on sister lines

Forensic document examiners are often confronted with questioned documents written with ballpoint pens. Depending on the force applied (or pressure) as well as the angle between the pen and the surface, sister lines running parallel to the inked strokes can be left by the lip of the housing ball. In a real case, sister lines were observed on the left side of inked strokes of a questioned signature. To assess whether the writer of that signature was a left-handed or a right-handed writer based on this result, an experimental study was carried out. Handwritten samples and signatures from 182 right-handed and 18 left-handed writers were collected with different ballpoint pens. For every writer, the presence or absence of sister lines was recorded. Sister lines were observed in 49% of the writers of the studied population (in 50% of the right-handed and ca. 39% of the left-handed writers). Most individuals who left sister lines showed a writing angle of 50°-55°. The location of sister lines was tabulated to inform probabilities of observing sister lines at a given location, if the writer is a right-handed or left-handed writer. In the case at hand, a likelihood ratio of 48 was obtained in support of the proposition of a left-handed writer, rather than a right-handed writer. Applying Bayes' theorem, such value moves the prior probability of 15% that the writer of the questioned signature is left-handed to a posterior probability of 89%.

DNA transfer when using gloves in burglary simulations

Several studies have demonstrated that DNA can be indirectly transferred from an individual onto a surface. Therefore, the presence of DNA that is compatible with a given person does not necessarily mean that this person has touched the surface on which the DNA was recovered. The present work simulates cases, where DNA is recovered on a door handle and compared to several reference DNA profiles. The DNA profile of the trace shares DNA components with a person of interest (POI). When asked about the DNA results, the POI says he has nothing to do with the incident and has never been at the scene. However, a possibility would be that the DNA came from his recently stolen gloves. Someone else, the alternative offender (AO), could have opened the door wearing his gloves (POI's gloves), and transferred his DNA (POI's DNA). Based on the above-mentioned scenario, 60 burglary simulations experiments were carried out to generate data to assess DNA results given these allegations. The quantity and quality of DNA profiles (NGM SElect) recovered when the POI opened/closed the door bare-handed or when someone else performed the same activity but using POI's gloves, were compared. The gloves were regularly worn during at least three months by their owner during the winter. On the contrary, the AO wore them only for two minutes. Among the traces collected on the door handles, less than 50% of the traces led to interpretable DNA profiles. In 30% of the cases (3/10), when the door was opened/closed with bare hands, the DNA found on the door handle led to a mixed DNA profile with the POI's DNA aligning with the major contributor. For the experiments where the AO opened/closed the door with the POI's gloves, the POI's DNA was compatible with 22% (11/50) of the mixed DNA profile, aligning with the major in 8% of the cases (4/50). The DNA profiles of the offices' occupants were observed on the door handles, but not the AO's. In addition to the results of the experiments, we show two examples of how one can assess results observed in casework. Given the possibility of indirect transfer of minute DNA quantities, this research emphasizes the need to evaluate DNA results given the activities when the POI has a legitimate reason that can explain the presence of their DNA.

Using case specific experiments to evaluate fingermarks on knives given activity level propositions

Bayesian networks have shown to be a useful tool for the evaluation of forensic findings given activity level propositions. In this paper, we demonstrate how case specific experiments can be used to assign probabilities to the states of the nodes of a Bayesian network for the evaluation of fingermarks given activity level propositions. The transfer, persistence and recovery of fingermarks on knives is studied in experiments where a knife is either used to stab a victim or to cut food, representing the activities that were disputed in the case of the murder of Meredith Kercher. Two Bayesian networks are constructed, exploring the effect of different uses of the experimental data by assigning the probabilities based on the results of the experiments. The evaluation of the findings using the Bayesian networks demonstrates the potential for fingermarks in addressing activity level propositions.

Stabbing simulations and DNA transfer

Technical developments have made it possible to analyze very low amounts of DNA. This has many advantages, but the drawback of this technological progress is that interpretation of the results becomes increasingly complex: the number of mixed DNA profiles increased relatively to single source DNA profiles and stochastic effects in the DNA profile, such as drop-in and drop-out, are more frequently observed. Moreover, the relevance of low template DNA material regarding the activities alleged is not as straightforward as it was a few years ago, when for example large quantities of blood were recovered. The possibility of secondary and tertiary transfer is now becoming an issue. The purpose of this research is twofold: first, to study the transfer of DNA from the handler and secondly, to observe if handlers would transfer DNA from persons closely connected to them. We chose to mimic cases where the offender would attack a person with a knife. As a first approach, we envisaged that the defense would not give an alternative explanation for the origin of the DNA. In our transfer experiments (4 donors, 16 experiments each, 64 traces), 3% of the traces were single DNA profiles. Most of the time, the DNA profile of the person handling the knife was present as the major profile: in 83% of the traces the major contributor profile corresponded to the stabber's DNA profile (in single stains and mixtures). Mixture with no clear major/minor fraction (12%) were observed. 5% of the traces were considered of insufficient quality (more than 3 contributors, presence of a few minor peaks). In that case, we considered that the stabber's DNA was absent. In our experiments, no traces allowed excluding the stabber, however it must be noted that precautions were taken to minimize background DNA as knives were cleaned before the experiments. DNA profiles of the stabber's colleagues were not observed. We hope that this study will allow for a better understanding of the transfer mechanism and of how to assess and describe results given activity level propositions. In this preliminary research, we have focused on the transfer of DNA on the hand of the person. Besides, more research is needed to assign the probability of the results given an alternative activity proposed by the defense, for instance when the source of the DNA is not contested, but that the activities are.