Analysis Of Digital Evidence Research Articles

Forensic analysis of Scientific Linux image using commercial and opensource forensic tools

Depending on their needs and personal preferences, people choose to use different operating systems (OS) such as Windows, Linux, and Mac. The scientific Linux Operating System (SLOS) is designed to provide a stable, secure, and high-performance computing environment for scientific research and education in a steady, scalable, and extensible manner. When criminal activities are committed by suspects involving computers and the internet, it calls for digital forensics which involves the use of scientific procedures and tools to carry out the forensic investigation and analysis of digital evidence for legal and investigative purposes. Forensic investigators use commercial and opensource tools for analysis and gathering inculpatory and exculpatory pieces of evidence. This paper presents a comparative analysis of EnCase, FTK, Autopsy, bulk-extractor, and Scalpel for analyzing the Scientific Linux image. The test scenarios were designed to find out if the selected forensic tools can be appropriately used for investigating crimes committed using the SLOS. The test scenarios include extraction and analysis of operating system details, user accounts, web browsing history, and the recovery of deleted and shredded files and this paper compares and evaluates the capability of the tools in retrieving the evidence designed in the scenarios. This systematic comparison and evaluation results would assist digital forensics practitioners, researchers, and law enforcement agencies in making informed decisions regarding the selection of tools for Scientific Linux image forensics.

Cybercrime Intention Recognition: A Systematic Literature Review

Cybercrime Intention Recognition: A Systematic Literature Review

Crime Analysis and Prediction

Data Mining in Crime analysis is a systematic approach to identifying and analyzing patterns and trends in crime. With the increasing adoption of computerized systems, Data Mining in Crime analysis can assist law enforcement in predicting crime. This technique plays a key role in cyber forensics. Cyber forensics involves the collection and analysis of digital evidence to detect and document a cybercrime or security breach. Data mining techniques can help investigators extract valuable insights from the large volume of data typically collected during a cyber forensics investigation. Keywords: Data mining, crime, pattern, analysis, cyber, Forensics, detect, document, breach, security.

A Privacy-Compliant Process for Digital Forensics Readiness

This research paper examines the issue of privacy compliance in digital forensics readiness, specifically in relation to the breach of confidentiality during analysis of collected data on users. This is a problem because the collection and analysis of digital evidence during these investigations can have a potential impact on individuals’ privacy rights. The study’s methodology involves a literature review of relevant research, an analysis of privacy regulations, and a case study of a real-world digital forensics investigation. The main findings of the study indicate that organizations need to develop and implement robust privacy measures and data protection policies to ensure that their digital forensics readiness efforts are privacy compliant and do not compromise user privacy. Some examples of why this is necessary are provided in the research to address these privacy compliance issues, this study proposes a measure, this measure implements technical safeguards to protect user data and maintains its confidentiality. By implementing the proposed measures, organizations can maintain their digital forensics readiness while also protecting user privacy.

ANALISIS BUKTI DIGITAL PADA APLIKASI DISCORD DESKTOP DENGAN MENGGUNAKAN FRAMEWORK DFRWS

A Currently, various communication platforms are available, and one of them is Discord. Discord is utilized by users to interact and share various types of content. However, Discord is often implicated in the distribution of inappropriate content that goes against Discord regulations. This can lead to cybercrime cases such as Child Sexual Abuse Material (CSAM). The main challenge faced is the recovery of digitally deleted data through these communication platforms. The objective of this research is to analyze digital evidence in the form of deleted text messages, images, and documents in the chat rooms of the desktop-based Discord application. The research method employed is the Live Forensic Technique, applying the DFRWS (Digital Forensics Research Workshop) method. The digital forensic analysis process is conducted using the digital forensic tool Magnet Axiom. The research results indicate that the accuracy of digital evidence analysis using Magnet Axiom reaches 94.11%. A total of 16 digital evidence items were successfully recovered out of the total 17 items available

The integration and implications of artificial intelligence in forensic science.

This commentary explores the integration of artificial intelligence (AI) in forensic science and its potential implications. The applications of AI in forensic disciplines such as medicine, forensic anthropology, digital forensics, and taphonomy have enhanced the accuracy and efficiency of identification processes and the analysis of digital evidence. However, this rapid advancement prompts critical considerations in privacy, data protection, bias and fairness, and the accuracy and reliability of AI systems. The inherent challenges of the "black box" nature of AI algorithms call for transparency and accountability to maintain trust and uphold the integrity of forensic investigations. Ethical use, legal compliance, interdisciplinary collaboration, education, data integrity, standardization, human oversight, and societal impact, along with sustainability are identified as pivotal areas requiring urgent attention. The discussion underscores the need for rigorous scrutiny, standardized operating procedures, and proactive dialogue to ensure the responsible advancement of AI in forensic science.

Utilization of Digital Forensics in Proving the Crime of Disseminating Indecent Videos Through Facebook Social Media in the Legal Area of West Kalimantan Police

The research entitled: "Utilization of Digital Forensics in Proving the Crime of Disseminating Indecent Videos Through Facebook Social Media in the KALBAR Police Legal Area" aims to find out and describe the implementation of information and research results in Pontianak city and to find out and analyze the utilization of digital forensics in proving the crime of spreading indecent videos through Facebook social media in the KALBAR police jurisdiction. This research was conducted using a sociological juridical approach method, namely examining and processing data from field research by starting from normative legal aspects supported by documents related to the problem in the form of regulations and cases related to the subject matter Based on research and data analysis, information can be obtained that the implementation of Digital Forensics related to the criminal act of spreading immoral videos through Facebook social media is a process of investigating and analyzing digital evidence related to the crime. In this case, the digital evidence that is the focus is an immoral video that spreads through the Facebook social media platform. Discussed in several important topics, namely; 1. The Role of Digital Forensics Related to the Crime of Dissemination of Indecent Video Through Facebook Social Media, 2. What Factors Become Obstacles in Proof Through Digital Forensics Related to the Crime of Dissemination of Indecent Video Through Facebook Social Media, 3. What Efforts Have Been Made in Optimizing Digital Forensic Evidence Related to the Crime of Immoral Video Dissemination Through Facebook. The conclusion that can be conveyed in this research is that the application of digital forensics involves several important stages, including the identification of digital evidence, storage of digital evidence, analysis of digital evidence, and presentation of findings. Digital forensics has a crucial role in proving legal cases. In Indonesia, the evidentiary system requires a minimum of two valid pieces of evidence and the conviction of the Judge to determine the guilt of the defendant. In the case of cyber crime, electronic evidence must meet both formal and material requirements to be considered valid and admissible in court. Therefore, the application of digital forensics in the investigation of cyber crime, especially the distribution of immoral videos, has an important role in finding relevant electronic evidence and evidence for the judicial process.

Specifying a principle of cryptographic justice as a response to the problem of going dark

Over the past decade, the Five Eyes Intelligence community has argued cryptosystems with end-to-end encryption (E2EE) are disrupting the acquisition and analysis of digital evidence. They have labelled this phenomenon the ‘problem of going dark’. Consequently, several jurisdictions have passed ‘responsible encryption’ laws that limit access to E2EE. Based upon a rhetorical analysis (Cunningham in Understanding rhetoric: a guide to critical reading and argumentation, BrownWalker Press, Boca Raton, 2018) of official statements about ‘going dark’, it is argued there is a need for a domain-specific principle of cryptographic justice to reorient the debate away from competing technocratic claims about the necessity, proportionality, and accountability of digital surveillance programs. This article therefore specifies a principle of cryptographic justice by adapting more general norms of information justice to decision-making about encryption law and policy. The resulting principle is that encryption laws and policies should be designed to empower the comparatively powerless to protect themselves from domination (i.e., morally arbitrary forms of surveillance). It is argued this principle can reorient decision-making about encryption law and policy towards consideration of how cryptography impacts systems-level power dynamics within information societies.

An Event Based Digital Forensic Scheme for Vehicular Networks

The software in today's cars has become increasingly important in recent years. The development of high-tech driver assistance devices has helped fuel this movement. This tendency is anticipated to accelerate with the advent of completely autonomous vehicles. As more modern vehicles incorporate software and security-based solutions, "Event-Based digital forensics," the analysis of digital evidence of accidents and warranty claims, has become increasingly significant. The objective of this study is to ascertain, in a realistic setting, whether or not digital forensics can be successfully applied to a state-of-the-art automobile. We did this by dissecting the procedure of automotive forensics, which is used on in-car systems to track the mysterious activity by means of digital evidence. We did this by applying established methods of digital forensics to a state-of-the-art car.Our research employs specialized cameras installed in the study areas and a log of system activity that may be utilized as future digital proof to examine the effectiveness of security checkpoints and other similar technologies. The goal is to keep an eye on the vehicles entering the checkpoint, look into them if there is any reason to suspect anything, and then take the appropriate measures. The problem with analyzing this data is that it is becoming increasingly complex and time-consuming as the amount of data that has been collected keeps growing. In this paper, we outline a high-level methodology for automotive forensics to fill in the blanks, and we put it through its paces on a network simulator in a state-of-the-art vehicle to simulate a scenario in which devices are tampered with while the car is in motion. Here, we test how well the strategy functions. Diagnostics over IP (Diagnostics over IP), on-board diagnostics interface, and unified diagnostic services are all used during implementation. To work, our solution requires vehicles to be able to exchange diagnostic information wirelessly.These results show that it is possible to undertake automotive forensic analysis on state-of-the-art vehicles without using intrusion detection systems or event data recorders, and they lead the way towards a more fruitful future for automotive forensics. The results also show that modern autos are amenable to forensic automotive analysis.

Cyber bullying Detection on Social Media Using Machine Learning

Cyber bullying has become a growing concern in today's society, with more and more people turning to the internet to harass and intimidate others. Digital forensics is an essential tool for investigating cyber bullying activities, as it allows for the collection and analysis of digital evidence. However, traditional digital forensics techniques can be time-consuming and require a significant amount of human effort. In this paper, we propose the use of machine learning algorithms to aid in the investigation of cyber bullying activities. By training these algorithms on a dataset of known cyber bullying incidents, we can create a predictive model that can automatically classify new instances of cyber bullying. This can significantly reduce the time and effort required for investigations, allowing for a more efficient response to cyber bullying incidents. The challenges associated with using machine learning for cyber bullying detection, including the need for high-quality training data and the potential for bias in the algorithms. We also explore the various types of digital evidence that can be used in cyber bullying investigations, such as social media posts, emails, and instant messages. We present a case study in which we apply our proposed approach to a real-world cyber bullying incident. Our results show that the machine learning algorithm was able to accurately identify the cyber bullying activity with a high level of precision, demonstrating the potential of this approach for improving the efficiency and effectiveness of cyber bullying investigations.

INVESTIGATING THE ROLE OF BLOCKCHAIN TECHNOLOGY IN CYBERSECURITY INCIDENCE RESPONSE AND DIGITAL FORENSIC INVESTIGATION

In the modern interconnected society, large, medium, and small organizations, including governmental and non-governmental organizations, are vulnerable to cyberattacks. When an attack, such as a phishing or ransomware attack, occurs, each of these enterprises must have a dependable or rather established and accurate reference database and platform for appropriate analysis and storage of digital evidence to facilitate a quick and effective response to the attack. Establishing a secure platform for cyber incident response is essential for organizations to minimize the impact of an attack, prevent further damage, and identify and track the source of the attack. This paper critically examines the role of blockchain technology in facilitating safe and secure collection, storage, and analysis of digital evidence in the modern cyber incidence response and digital forensic investigation industry. This paper employs observation, experimentation, and case study methods to investigate how crucial the technology is in different stages of incidence responses and modern forensic investigation. It explores critical aspects such as evidence preservation, the chain of custody, gathering threat intelligence, analyzing computer viruses, and tracking compromised data and funds flow. Its findings imply that the technology is far more efficient than other technologies of the same calibre. By adopting this tool, organizations can improve their incidence response capabilities and increase their chances of successfully identifying and prosecuting cyber attackers. The paper concludes by discussing the potential limitations and challenges of using blockchain technology, offering recommendations for future research on the technology to continue improving the cyber incidence response field. Keywords: Blockchain Technology, Digital Forensics, Forensic Investigation, Incidence Response, Digital Evidence DOI： https://doi.org/10.35741/issn.0258-2724.58.3.59

SoK: cross-border criminal investigations and digital evidence

Abstract Digital evidence underpin the majority of crimes as their analysis is an integral part of almost every criminal investigation. Even if we temporarily disregard the numerous challenges in the collection and analysis of digital evidence, the exchange of the evidence among the different stakeholders has many thorny issues. Of specific interest are cross-border criminal investigations as the complexity is significantly high due to the heterogeneity of legal frameworks, which beyond time bottlenecks can also become prohibiting. The aim of this article is to analyse the current state of practice of cross-border investigations considering the efficacy of current collaboration protocols along with the challenges and drawbacks to be overcome. Further to performing a legally oriented research treatise, we recall all the challenges raised in the literature and discuss them from a more practical yet global perspective. Thus, this article paves the way to enabling practitioners and stakeholders to leverage horizontal strategies to fill in the identified gaps timely and accurately.

ANALISIS YURIDIS BUKTI DIGITAL (DIGITAL EVIDENCE) DALAM PEMBUKTIAN PERKARA TINDAK PIDANA UJARAN KEBENCIAN PADA PUTUSAN PENGADILAN NEGERI MEDAN NO. 3168/PID.SUS/2018/PN.MDN

Law No. 8 of 1981 concerning the Criminal Procedure Code (hereinafter referred to as the Criminal Procedure Code), has set the evidence that can be done in front of the trial. Article 183 of the Criminal Procedure Code implies that a minimum of 2 (two) valid evidence are required. Article 184 paragraph (1) of the Criminal Procedure Code regulates valid evidence, namely: witness statements; expert statements; letter; instructions; and the statement of the defendant. However, since the trial of Jesica Kumala Wongso which was broadcast on television almost every day, it turns out there is one more proof that is not contained in the Criminal Procedure Code, namely: digital evidence. The object of this study is the Medan District Court Decision No. 3168/Pid.Sus/2018/PN.Mdn., Dated May 23, 2019, concerning the use of digital evidence An. Defendant HDL Alias ​​Himma for alleged "criminal acts of hate speech". Law No. 11 of 2008 as amended by Law No. 19 of 2016 concerning Amendments to the Information and Electronic Transaction Law which governs electronic evidence. The problems in this study, namely: the position of proof of digital evidence before the trial is associated with criminal conviction; use of digital evidence in criminal acts of hate speech on social media; and juridical analysis of digital evidence in proving criminal acts of hate speech in Medan District Court Decision No. 3168/Pid.Sus/ 2018/PN.Mdn.

User profiles’ image clustering for digital investigations

Sharing images on Social Network (SN) platforms is one of the most widespread behaviors which may cause privacy-intrusive and illegal content to be widely distributed. Clustering the images shared through SN platforms according to the acquisition cameras embedded in smartphones is regarded as a significant task in forensic investigations of cybercrimes. The Sensor Pattern Noise (SPN) caused by camera sensor imperfections due to the manufacturing process has been proved to be an effective and robust camera fingerprint that can be used for several tasks, such as digital evidence analysis, smartphone fingerprinting and user profile linking as well. Clustering the images uploaded by users on their profiles is a way of fingerprinting the camera sources and it is considered a challenging task since users may upload different types of images, i.e., the images taken by users’ smartphones (taken images) and single images from different sources, cropped images, or generic images from the Web (shared images). The shared images make a perturbation in the clustering task, as they do not usually present sufficient characteristics of SPN of their related sources. Moreover, they are not directly referable to the user’s device so they have to be detected and removed from the clustering process. In this paper, we propose a user profiles’ image clustering method without prior knowledge about the type and number of the camera sources. The hierarchical graph-based method clusters both types of images, taken images and shared images. The strengths of our method include overcoming large-scale image datasets, the presence of shared images that perturb the clustering process and the loss of image details caused by the process of content compression on SN platforms. The method is evaluated on the VISION dataset, which is a public benchmark including images from 35 smartphones. The dataset is perturbed by 3000 images, simulating the shared images from different sources except for users’ smartphones. Experimental results confirm the robustness of the proposed method against perturbed datasets and its effectiveness in the image clustering.

An Appraisal of Digital Documents as Evidence in Islamic Law

Major shifts in the science and technology landscape have made the collection and analysis of digital evidence an increasingly important tool for resolving of crimes as well as the preparation of court cases. Digital documents are known as electronic documents and it can be used as a means of proof in court. However, this kind of method is still need to be discussed in detail regarding its admissibility in the Syariah court. This is because there is no specific provision on the use of it. Thus, this article focuses on the concept of digital documents as evidence in Syariah courts. It also explores the Islamic legal perspective on digital documents as a means of proof by considering the Quran, hadiths, legal maxims, and acts. This article also will focus on the admissibility of digital documents as evidence in Syariah courts. The methodology of this study is a qualitative approach. The data collected is divided into two types: primary sources, such as the Quran, hadiths, legal maxims, and acts; and secondary sources, such as journal articles, books, cases reported in law journals, and kitab fiqh. The data obtained is analyzed using document analysis methods. The results show that there is a high need to accept digital documents as evidence, especially in Syariah courts. This is because, the scientific and technological developments have led to this need to make use of digital documents. Studies show that the use of digital documents as evidence serves to reinforce other evidence presented in court.
 
 Received: 7 September 2020 / Accepted: 2 February 2021 / Published: 10 May 2021

Digital evidence experts in the law enforcement community: understanding the use of forensics examiners by police agencies

Mobile phones are often used in criminal enterprises as well as by individual offenders. In criminal cases, almost 80–90% of the cases criminal computer forensic examiners work on are related to child pornography (Nodeland et al. J Crim Justice Educ 30:71–90, 2018). In an effort to fight electronic crime and to collect digital evidence for criminal acts, law enforcement agencies are incorporating the collection of tools for analysis of digital evidence, also known as computer forensics, into their law enforcement infrastructure. Police agencies are challenged with the need to train officers to collect digital evidence and keep up with large and evolving technologies such as computer operating systems and cell phone technologies. Digital evidence is now being used to prosecute all types of crimes. Skilled officers and examiners are needed to examine this critical need in the criminal justice system. This research surveyed 59 (N = 59) Texas police agencies in their use of digital forensic examiners. The findings reflect that numerous agencies often use a part-time police officer/examiner to investigate the digital evidence that comes into the agency that can limit the expertise in the agency. Implications for this research are discussed.

Mobile phone forensics - a systematic approach, tools, techniques and challenges

Collection and analysis of digital evidence from mobile phones plays vital role to solve many civil and criminal cases. This evidence is a potential source of information which helps the prosecutors win more conviction. Sometime it also helps to crack organised crime and terrorist activities. Digital forensics expert need specialised tools and techniques to extract the evidence from mobile phones for analysis. Extracting the evidence from mobile phones in forensically sound manner is never been an easy task, as the entire process must ensure the integrity of evidence and its admissibility in the court of law. Rapid advancement in technology and frequent release of latest make and models always poses new challenges for the investigator. There are various tools and techniques available for mobile forensics, which are classified based on its complexity and its physical characteristics. Forensics examiner need to assess the complexity of the case and select the tools accordingly. This paper discusses in-detail about the systematic approach, which can be used for mobile forensics. Each approach has its own advantages, disadvantages, cost and complexities which is highlighted in the paper along with the list of standard tools and their key features.

Analysis of Digital Evidence on Denial of Service (DoS) Attack Log Based

This research is carried out an analysis and investigation of digital log file data retrieval from DoS (Denial of Service) attacks, on internet networks that have been detected by IDS (Intrusion Detection System) and using Wireshark as Tools Analysis Network. The research phase begins with the design of an experimental scenario which is often carried out daily where users access the internet network. The next stage is an attack in the form of ping flood on the target computer connected to the internet network, the final stage of data retrieval which will be analyzed later. Testing research using UAT (User Acceptance Test), to prove that the analysis has been received by the user. The results of research conducted to obtain data in the form of an attacker's IP (Internet Protocol), target IP, protocol type, the port used and the time of the attack. In the UAT test results, the obtained value of 18% of students disagrees, 58% of students agree, and 24% of students strongly agree. This research has conducted an analysis of random data attacks using Wireshark applications received by users.

Forensic Analysis of Telegram Desktop-based Applications using the National Institute of Justice (NIJ) Method

Abstract
 The development of telecommunications has increased very rapidly since the internet-based instant messaging service has spread rapidly to Indonesia. Telegram application is one of the growing and well-known application services in Indonesia, Desktop or smartphone-based Telegram applications, it is very possible to use digital crimes by using services, user personal information, or by hacking the Telegram application. This study explains the stages of investigation of cybercrime cases that occurred in desktop-based telegram. The method used for this research refers to the stage of investigation that was carried out in previous studies, namely using the National Institute of Justice (NIJ) method with the stages of the preparation stage, the collection stage, the examination stage, the analysis stage, and the reporting stage. The media used in this study is a desktop-based Telegram application that is synchronized with an Android-based Telegram. In this process, the location of the log file, cache, and digital proof image file was obtained in the conversation of a desktop-based Telegram application. Digital forensic evidence obtained is expected to strengthen evidence of criminal cases in court in the form of digital evidence analysis results.
 Keywords: Telecommunications, Digital Forensic, Telegram, Investigation, Cybercrime

Analysis of Steganographic on Digital Evidence using General Computer Forensic Investigation Model Framework

Steganography is one of the anti-forensic techniques used by criminals to hide information in other messages which can cause problems in the investigation process and difficulties in obtaining original information evidence on the digital crime. Digital forensic analysts are required ability to find and extract the messages that have been inserted by using proper tools. The purpose of this research is to analyze the hidden digital evidence using steganography techniques. This research uses the static forensics method by applying five stages in the Generic Forensics Investigation Model framework, namely pre-process, acquisition & preservation, analysis, presentation, and post-process as well as extracting files that have been infiltrated based on case scenarios involving digital crime. The tools used are FTK Imager, Autopsy, WinHex, Hiderman, and StegSpy. The results on the steganographic file insertion experiment of 20 files indicate that StegSpy and Hiderman are effective on the steganographic analysis of digital evidence. StegSpy can detect the presence of secret messages with 85% success rate. The extraction process using Hiderman for 18 files with containing steganographic messages had 100% successful.