Abstract Digital Forensics Research Articles

Forensic Artifacts Associated with Intentionally Deleted User Accounts

Digital forensics is an evolving discipline that looks for evidence in electronic devices. It is being utilised in investigating attacks and accusing cyber criminals. As in physical crimes, a cyber criminal might try every possible technique to hide responsibility about a crime. This can be done by manipulating all kinds of traces that could lead investigators to resolve cases. For example, a criminal can delete files, images, network traces, operating system log files, or browsing history. An easy procedure a criminal might follow to conceal crime activities are: 1) create a new user account; 2) commit a crime through the just-created account; 3) delete the account along with all files and directories that belong to it. To counter this kind of anti-forensic actions, this paper collects evidence from deleted user accounts. We seek artefacts in windows event logs, registry hives, RAM, Pagefile, and hard drive. Interestingly, this paper shows that several clues about deleted accounts can be harvested. To the best of our knowledge, we are the first to tackle such a problem.

Forensic Importance of SIM Cards as a Digital Evidence

Digital Forensics is a branch of Forensic Science pertaining to evidential articles of digital and electronic nature, of which mobile forensics is a major stream. A proliferation of handheld cellular devices and crimes involving mobile phones in the previous years has led to an enormous demand for specialists in the field of mobile forensics. The interesting part is that any mobile phone is incomplete without a SIM card. Therefore, SIM cards are the most common type of forensic evidence to be found in cases where handheld devices are involved, a SIM card is imperative, no matter the phone belongs to the normal mobile phones category or the satellitephones that contain an iDEN (Integrated Digital Enhanced Network) SIM. These cards are all around us and are now being integrated in driving licenses, debit cards, credit cards, ATM cards, Identity cards, etc. Digital Forensic Science is the skill of a forensic expert to apply the knowledge of computer sciences and the investigative measures for a legal cause requiring the analysis of digital evidences. It is the process of identifying, preserving, analyzing, and presenting digital evidence in a manner that is legally acceptable. The motive of the process is to preserve any digital evidence in its most original form while performing a planned analysis by identifying, collecting and validating the digital information for the purpose of reconstructing past events.

The General Digital Forensics Technologies Based on Linux

Digital forensics technologies based on Linux have been popular issue now. It is very necessary to get a general and effective digital forensics method on Linux for its wide usage. It gives a set of general methods in this paper. It combines the static forensics and dynamic forensics according to the different form of data and verifies the validity of these methods with the help from kinds of open source forensics tools.

Digital Forensic Issues in Civil Proceedings

Digital Forensics is an emerging field that has quickly become a key source of evidence in criminal and civil cases. While digital forensics has been challenging to incorporate into both criminal and civil cases, the environment of civil cases does not have the structure of the law enforcement processes to serve as a framework from which to conduct digital forensic examinations. Further, there is often a lack of understanding of digital forensic capabilities and evidence, which has the potential to influence legal judgments and misconstrue outcomes.

Extended Abstract Digital Forensics Model with Preservation and Protection as Umbrella Principles

In this research, a literature review was conducted where twenty (n=20) frameworks and models highlighting preservation of the integrity of digital evidence and protection of basic human rights during digital forensic investigations were studied. The models not discussing the process at an abstract level were excluded. Therefore, thirteen (n=13) of the studied models were included in our analysis. The results indicated that published abstract models lack preserving the integrity of digital evidence and protecting the basic human rights as explicit overarching umbrella principles. To overcome this problem, we proposed an extension to Reith's abstract digital forensics model explicating preservation of integrity and protection of human rights as the two necessary umbrella principles.

A Framework for Digital Forensics and Investigations

Digital forensics investigations are an important task for collecting evidence based on the artifacts left in computer systems for computer related crimes. The requirements of such investigations are often a neglected aspect in most of the existing models of digital investigations. Therefore, a formal and systematic approach is needed to provide a framework for modeling and reasoning about the requirements of digital investigations. In addition, anti-forensics situations make the forensic investigation process challenging by contaminating any stage of the investigation process, its requirements, or by destroying the evidence. Therefore, successful forensic investigations require understanding the possible anti-forensic issues during the investigation. In this paper, the authors present a new method for guiding digital forensics investigations considering the anti-forensics based on goal-driven requirements engineering methodologies, in particular KAOS. Methodologies like KAOS facilitate modeling and reasoning about goals, requirements and obstacles, as well as their operationalization and responsibility assignments. The authors believe that this new method will lead in the future to better management and organization of the various steps of forensics investigations in cyberspace as well as provide more robust grounds for reasoning about forensic evidence.

Toward Effective and Reliable Digital Forensics

Digital forensics is a recently emerged research area, and it has attracted the attention of computer professionals, law enforcement experts and practitioners. It is a multidisciplinary area that includes multiple fields, i.e. law, computer science, finance, networking, data mining and criminal justice. We believe that papers enclosed in this Special Issue will enhance knowledge in digital forensics and will stimulate further research in the important areas of information and network security.

The evaluation of MD5 hash tools as a digital forensics class experiment

Digital forensics tools frequently use the MD5 hash function to verify that a data set has not been altered due to the application of various evidence collection and analysis tools and procedures. Additionally, due to the impact on the personal life of the subject of an investigation, verification of the correct operation of tools and procedures is critical. This paper discusses an experiment that investigates the implementation of several MD5 hash tools. The results demonstrate that without sufficient attention to detail, unreliable tools can be created using reliable components. Additionally, unreliable results can be obtained through the improper application of the tools.