Digital Forensic Applications Research Articles

Pengaruh kompetensi auditor, penggunaan analitik big data, dan penggunaan forensik digital terhadap kualitas audit investigatif

Investigative audits are crucial in uncovering indications of state losses and criminal acts of corruption in Indonesia. The quality of investigative audits influences the success of the law enforcement process and the justice system's integrity. Factors such as auditor competency, Big Data analytics, and digital forensics are important in improving the quality of investigative audits. This research aims to test the impact of auditor competency, Big Data analytics, and digital forensics on improving the quality of investigative audits. A purposive sampling method was used with 127 BPK auditor respondents. The data analysis method used is multiple linear Regression. The research achievements show that auditor competency, the use of Big Data analytics, and the application of digital forensics significantly impact the quality of investigative audits. BPK institutions should pay attention to selecting auditors with a high level of competency, use Big Data analytics, and apply digital forensic technology to improve their investigative audit performance. Public interest statements This research directly contributes to improving the quality of investigative audits, which has the potential to promote transparency and accountability in public financial management. The findings provide practical guidance for audit institutions to enhance their selection, training, technology, and audit practices, empowering them to make positive changes.

기계학습 기반 클라우드 디지털 포렌식 적용 및 비교분석

기계학습 기반 클라우드 디지털 포렌식 적용 및 비교분석

Digital forensics in healthcare: An analysis of data associated with a CPAP machine

The need for digital forensic services across all sectors is not a new concept, nor is the increasing demand seen globally. However, the devices on which we perform digital forensics have changed and continue to evolve. For each device new approaches need to be developed or adapted to facilitate the secure preservation and analysis of the data it contains. The healthcare sector has seen particular adoption of a range of devices, from traditional through to cutting edge. The Covid-19 pandemic facilitated the need for a more boundary-agnostic level of care for patients, and medical devices are becoming increasingly more interconnected to facilitate remote care. This presents challenges in that devices are no longer “secured” in medical premises and will often be found in patient's homes, making them more exposed to attack, but also in a position to record significant amounts of personal data. The integration of information technology in medical environments has influenced the need for the development of a digital forensic process to perform analysis on medical devices. One such device is a continuous positive airway pressure (CPAP) machine, used by patients who suffer from Obstructive Sleep Apnea (OSA). It is estimated that 3-9% of the world's population suffer from this disorder, the normal medical treatment is the use of some form of CPAP machine. The research undertaken focuses on the ResMed AirSense 10 CPAP machine and a complete forensic postmortem analysis of the data contained and recorded by the device. The application of digital forensics to a traditional medical device, such as a CPAP machine, requires an adapted version of digital forensics, but in general the same tools and processes can be used. Through the analysis conducted, all patient data was located on a removable FAT32 formatted SD card, allowing the recovery of specific medical information about the device and personally identifiable information about the patient. The recovered data was then visualised using a variety of tools and systems. Information that can be derived from the visualisations include a sequence of events, to some extent how the device was operating, and the clinical information recorded on the device.

Utilization of Digital Forensics in Proving the Crime of Disseminating Indecent Videos Through Facebook Social Media in the Legal Area of West Kalimantan Police

The research entitled: "Utilization of Digital Forensics in Proving the Crime of Disseminating Indecent Videos Through Facebook Social Media in the KALBAR Police Legal Area" aims to find out and describe the implementation of information and research results in Pontianak city and to find out and analyze the utilization of digital forensics in proving the crime of spreading indecent videos through Facebook social media in the KALBAR police jurisdiction. This research was conducted using a sociological juridical approach method, namely examining and processing data from field research by starting from normative legal aspects supported by documents related to the problem in the form of regulations and cases related to the subject matter Based on research and data analysis, information can be obtained that the implementation of Digital Forensics related to the criminal act of spreading immoral videos through Facebook social media is a process of investigating and analyzing digital evidence related to the crime. In this case, the digital evidence that is the focus is an immoral video that spreads through the Facebook social media platform. Discussed in several important topics, namely; 1. The Role of Digital Forensics Related to the Crime of Dissemination of Indecent Video Through Facebook Social Media, 2. What Factors Become Obstacles in Proof Through Digital Forensics Related to the Crime of Dissemination of Indecent Video Through Facebook Social Media, 3. What Efforts Have Been Made in Optimizing Digital Forensic Evidence Related to the Crime of Immoral Video Dissemination Through Facebook. The conclusion that can be conveyed in this research is that the application of digital forensics involves several important stages, including the identification of digital evidence, storage of digital evidence, analysis of digital evidence, and presentation of findings. Digital forensics has a crucial role in proving legal cases. In Indonesia, the evidentiary system requires a minimum of two valid pieces of evidence and the conviction of the Judge to determine the guilt of the defendant. In the case of cyber crime, electronic evidence must meet both formal and material requirements to be considered valid and admissible in court. Therefore, the application of digital forensics in the investigation of cyber crime, especially the distribution of immoral videos, has an important role in finding relevant electronic evidence and evidence for the judicial process.

Comparative Analysis of Cloning-Hashing Applications for Securing Digital Evidence

The development of the Internet has resulted in an increasing variety of cyber crimes. Cybercrime is closely related to digital evidence, so cybercriminals tend to delete, hide, and format all collected data to eliminate traces of digital evidence. This digital evidence is very vital in proving at trial, so it is necessary to develop applications to secure digital evidence. This study aims to compare the results of cloning and hashing in securing digital evidence and evaluate the performance of a digital forensic application developed under the name Clon-Hash Application v1 compared to applications commonly used by investigators including Autopsy, FTK Imager, md5.exe in terms of its function, the result, CPU usage. The results of the research conducted show that the cloning process is perfectly successful, as evidenced by the hash value results which are the same as paid applications and there are even several other applications that have not been able to display the hash value. Hash values in the Clon-Hash v1 application also vary from MD5, SHA1, and SHA256 which do not exist in other applications. Applications developed are better in terms of function, results, and CPU usage.

Digital Evidence in Police Investigation: A Comparative Analysis of Challenges Faced in India, the UK and the United States

This research explores the challenges posed by the use of digital evidence in criminal investigations, particularly in the context of fair trial and the presumption of innocence. The article identifies three key issues that could compromise the impartiality and presumption of innocence in investigations, namely, improper and inconsistent use of technology, outdated procedural assurances and a lack of reliability testing in practice. The findings highlight the need for legislative intervention, enforcement of standards and implementation of validation procedures for digital evidence to protect innocent individuals and all parties involved in criminal proceedings. The article also examines how digital evidence practices adhere to fair trial standards and how technology-assisted investigations affect criminal procedures. The study draws on data obtained from a project conducted by the Economic and Social Research Council on the application of digital forensics in police forces in England and the United States. The research provides insights into the evolving nature of investigations in connection to the rising demand for digital expertise and the distribution and coordination of related resources in the police forces.

Behavioural Analytics in Cyber Security for Digital Forensics Application

The paper emphasizes the human aspects of cyber incidents concerning protecting information and technology assets by addressing behavioral analytics in cybersecurity for digital forensics applications. The paper demonstrates the human vulnerabilities associated with information systems technologies and components. This assessment is based on past literature assessments done in this area. This study also includes analyses of various frameworks that have led to the adoption of behavioral analysis in digital forensics. The study's findings indicate that behavioral evidence analysis should be included as part of the digital forensics examination. The provision of standardized investigation methods and the inclusion of human factors such as motives and behavioral tendencies are some of the factors attached to the use of behavioral digital forensic frameworks. However, the study also appreciates the need for a more generalizable digital forensic method.

Internet of Things for Digital Forensics Application in Saudi Arabia

Despite the extensive empirical literature relating to the Internet of Things (IoT), surprisingly few attempts have sought to establish the ways in which digital forensics can be applied to undertake detailed examinations regarding IoT frameworks. The existing digital forensic applications have effectively held back efforts to align the IoT with digital forensic strategies. This is because the forensic applications are ill-suited to the highly complex IoT frameworks and would, therefore, struggle to amass, analyze and test the necessary evidence that would be required by a court. As such, there is a need to develop a suitable forensic framework to facilitate forensic investigations in IoT settings. Nor has considerable progress been made in terms of collecting and saving network and server logs from IoT settings to enable examinations. Consequently, this study sets out to develop and test the FB system which is a lightweight forensic framework capable of improving the scope of investigations in IoT environments. The FB system can organize the management of various IoT devices found in a smart apartment, all of which is controlled by the owner’s smart watch. This will help to perform useful functions, automate the decision-making process, and ensure that the system remains secure. A Java app is utilized to simulate the FB system, learning the user’s requirements and security expectations when installed and employing the MySQL server as a means of logging the communications of the various IoT devices.

Extraction of Color Information and Visualization of Color Differences between Digital Images through Pixel-by-Pixel Color-Difference Mapping

A novel method of extracting color information on a pixel-by-pixel basis or by the average of the regions of interest (ROIs) from digital images is proposed and demonstrated using newly developed and customized image-processing/analysis software (PicMan). For quantitative and statistical analyses of color, the newly developed software can be used for digital archive or digital forensic applications in various fields. The color differences between unrelated, similar, or identical scenes and or objects were quantified in various formats of desired color spaces such as RGB, HSV, XYZ, CIE L*a*b*, Munsell color, and hexadecimal color values. The color differences were visualized as images of pixel-by-pixel mapping of the ΔL*, Δa*, Δb*, ΔERGB, ΔEHSV, and ΔE*L*a*b* values and block comparison images of desired block sizes. Various color analyses and color-difference mapping examples using an aged and damaged oil painting before and after restoration were introduced. The effects of the image file format differences between PNG and JPG on color distortion are demonstrated by statistics and pixel-by-pixel color-difference mapping. A portrait of Chuk-ki Yoo (兪拓基, 1691–1767) on silk from the 18th century from Korea was used for further color analysis for whole and selected areas. A collector’s ownership stamp of Chuk-ki Yoo stamped in red ink on the text areas in one of his book collections was extracted using the image-processing software and superimposed on the original image as a visualization enhancement example. Image analysis, processing, modification, enhancement, and highlighting, as well as statistical color analysis of digital images in most formats, can conveniently and efficiently be performed using one piece of dedicated software (PicMan). The pixel-by-pixel color information extraction and color comparison technique can be very effective for a variety of applications in art and cultural heritage objects.

Libforensics For Developing Digital Forensics Applications

The evolution of computers, increase in cybercrime and the demand by law requirements for the production of admissible forensic reports require the application of digital/computer technologies and require the development of a methodology to systematically search digital devices for significant evidence. Cyber and computer fraud are growing by the passing of the day with less than two percent of the reported cases resulting in confidence leading to securing justice and or convictions. This study explores the digital forensic applications and ease of integration of the existing forensic applications. It was the view of the researcher that there exists a gap of monolithic in forensic applications and the cyber universe. One requires different applications to conduct a forensic investigation into a crime revolving around different digital universes. The study proposed research into the development of a single enterprise digital forensic application capable of examining all aspects of the universe regardless and producing an admissible report in the court of law Keywords: Forensic, Cybercrime, Monolithic, Digital universe, Cyberspace, Cyber ecosystem BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: James Hebidzi Senanu (2022): Libforensics For Developing Digital Forensics Applications. Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 335-338 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P53

Proving Reliability of Image Processing Techniques in Digital Forensics Applications

Binary images have found its place in many applications, such as digital forensics involving legal documents, authentication of images, digital books, contracts, and text recognition. Modern digital forensics applications involve binary image processing as part of data hiding techniques for ownership protection, copyright control, and authentication of digital media. Whether in image forensics, health, or other fields, such transformations are often implemented in high-level languages without formal foundations. The lack of formal foundation questions the reliability of the image processing techniques and hence the forensic results loose their legal significance. Furthermore, counter-forensics can impede or mislead the forensic analysis of the digital images. To ensure that any image transformation meet high standards of safety and reliability, more rigorous methods should be applied to image processing applications. To verify the reliability of these transformations, we propose to use formal methods based on theorem proving that can fulfil high standards of safety. To formally investigate binary image processing, in this paper, a reversible formal model of the binary images is defined in the Proof Assistant Coq. Multiple image transformation methods are formalized and their reliability properties are proved. To analyse real-life RGB images, a prototype translator is developed that reads RGB images and translate them to Coq definitions. As the formal definitions and proof scripts can be validated automatically by the computer, this raises the reliability and legal significance of the image forensic applications.

Realities of application of digital forensics during criminal proceedings

Realities of application of digital forensics during criminal proceedings

A Dataset of Photos and Videos for Digital Forensics Analysis Using Machine Learning Processing

Deepfake and manipulated digital photos and videos are being increasingly used in a myriad of cybercrimes. Ransomware, the dissemination of fake news, and digital kidnapping-related crimes are the most recurrent, in which tampered multimedia content has been the primordial disseminating vehicle. Digital forensic analysis tools are being widely used by criminal investigations to automate the identification of digital evidence in seized electronic equipment. The number of files to be processed and the complexity of the crimes under analysis have highlighted the need to employ efficient digital forensics techniques grounded on state-of-the-art technologies. Machine Learning (ML) researchers have been challenged to apply techniques and methods to improve the automatic detection of manipulated multimedia content. However, the implementation of such methods have not yet been massively incorporated into digital forensic tools, mostly due to the lack of realistic and well-structured datasets of photos and videos. The diversity and richness of the datasets are crucial to benchmark the ML models and to evaluate their appropriateness to be applied in real-world digital forensics applications. An example is the development of third-party modules for the widely used Autopsy digital forensic application. This paper presents a dataset obtained by extracting a set of simple features from genuine and manipulated photos and videos, which are part of state-of-the-art existing datasets. The resulting dataset is balanced, and each entry comprises a label and a vector of numeric values corresponding to the features extracted through a Discrete Fourier Transform (DFT). The dataset is available in a GitHub repository, and the total amount of photos and video frames is 40,588 and 12,400, respectively. The dataset was validated and benchmarked with deep learning Convolutional Neural Networks (CNN) and Support Vector Machines (SVM) methods; however, a plethora of other existing ones can be applied. Generically, the results show a better F1-score for CNN when comparing with SVM, both for photos and videos processing. CNN achieved an F1-score of 0.9968 and 0.8415 for photos and videos, respectively. Regarding SVM, the results obtained with 5-fold cross-validation are 0.9953 and 0.7955, respectively, for photos and videos processing. A set of methods written in Python is available for the researchers, namely to preprocess and extract the features from the original photos and videos files and to build the training and testing sets. Additional methods are also available to convert the original PKL files into CSV and TXT, which gives more flexibility for the ML researchers to use the dataset on existing ML frameworks and tools.

An Enhanced Blockchain-Based IoT Digital Forensics Architecture Using Fuzzy Hash

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that uses the fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

Smart Digital Forensic Framework for Crime Analysis and Prediction using AutoML

Over the most recent couple of years, the greater part of the information, for example books, recordings, pictures, clinical, forensic, criminal and even the hereditary data of people are being pushed toward digitals and cyber-dataspaces. This problem requires sophisticated techniques to deal with the vast amounts of data. We propose a novel solution to the problem of gaining actionable intelligence from the voluminous existing and potential digital forensic data. We have formulated an Automated Learning Framework ontology for Digital Forensic Applications relating to collaborative crime analysis and prediction. The minimum viable ontology we formulated by studying the existing literature and applications of Machine learning has been used to devise an Automated Machine Learning implementation to be quantitatively and qualitatively studied in its capabilities to aid intelligence practices of Digital Forensic Investigation agencies in representing, reasoning and forming actionable insights from the vast and varied collected real world data. A testing implementation of the framework is made to assess performance of our proposed generalized Smart Forensic Framework for Digital Forensics applications by comparison with existing solutions on quantitative and qualitative metrics and assessments. We will use the insights and performance metrics derived from our research to motivate forensic intelligence agencies to exploit the features and capabilities provided by AutoML Smart Forensic Framework applications.

Mapping digital forensic application requirement specification to an international standard

A potential security incident may go unsolved if standardized forensic approaches are not applied during lawful investigations. This paper highlights the importance of mapping the digital forensic application requirement specification to an international standard, precisely ISO/IEC 27043. The outcome of this work is projected to contribute to the problem of secure DF tool creation, and in the process address Software Requirements Specification (SRS) as a process of digital evidence admissibility.

New Approaches to the Application of Digital Forensics in Cybersecurity: A Proposal

New Approaches to the Application of Digital Forensics in Cybersecurity: A Proposal

Decision-theoretic model to identify printed sources

When trying to identify a printed forged document, examining digital evidence can prove to be a challenge. Over the past several years, digital forensics for printed document source identification has begun to be increasingly important which can be related to the investigation and prosecution of many types of crimes. Unlike invasive forensic approach which requires a fraction of the printed document as the specimen for verification, noninvasive forensic technique uses the optical mechanism to explore the relationship between the scanned images and the source printer. To explore the relationship between source printers and images obtained by the scanner, the proposed decision-theoretical approach utilizes image processing techniques and data exploration methods to calculate many important statistical features, including: Local Binary Pattern (LBP), Gray Level Co-occurrence Matrix (GLCM), Discrete Wavelet Transform (DWT), Spatial filters, the Wiener filter, the Gabor filter, Haralick, and SFTA features. Consequently, the proposed aggregation method intensively applies the extracted features and decision-fusion model of feature selections for classification. In addition, the impact of different paper texture or paper color for printed sources identification is also investigated. In the meantime, the up-to-date techniques based on deep learning system is developed by Convolutional Neural Networks (CNNs) which can learn the features automatically to solve the complex image classification problem. Both systems have been compared and the experimental results indicate that the proposed system achieve the overall best accuracy prediction for image and text input and is superior to the existing approaches. In brief, the proposed decision-theoretical model can be very efficiently implemented for real world digital forensic applications.

디지털 포렌식 수준 평가 지표 개발에 관한 연구

정보통신기술의 급속한 발달로 정보의 디지털화가 가속화되면서 범죄수사뿐만 아니라 기업 및 개인 분쟁에 이르기까지 디지털 포렌식의 활용이 증대되고 있으나 디지털 증거가 갖는 위 변조의 용이성으로 인해 가치를 제대로 인정받지 못하고 있다. 특히, 국내에서는 디지털 포렌식 수행 조직의 수준에 대한 객관적인 검증 제도나 평가 방법이 부재하여 이에 대한 신뢰성 판단을 법관의 심증에 의존하고 있는 실정이다. 따라서 본 연구에서는 국내외 디지털 포렌식과 정보보호 분야의 수준 평가 방법 및 기준을 검토하여 디지털 포렌식 조직, 인원, 기술, 시설 그리고 국내 사법기관에서 적용하고 있는 수행 절차를 중심으로 국내 실정에 적합한 디지털 포렌식 수준 평가 모델 및 지표를 개발 하였다. 이를 통해 디지털 증거의 신뢰성에 관한 사법기관의 판단 기준과 디지털 포렌식 조직의 구성 운영 평가를 위한 기준이 마련될 수 있을 것이다. With the acceleration of information digitization caused by fast growth of Information Technology, the application of digital forensics has increased but it is underestimated because digital evidence is easy to forge. Especially, the evaluation of the reliability of digital forensics organization is judged only by judges domestically because there is no objective verification system or evaluation method of the capability of digital forensics organization. Therefore, the evaluation model and indices of the capability of digital forensics concentrated on the digital forensics organization, personnel, technology, facilities and the procedure in domestic justice system was presented in this research after reviewing the domestic and foreign evaluation method and the standard of the capability of digital forensics and information security. The standard for judicial evaluation of digital evidence and composition, management, evaluation of digital forensics organization would be presented based on this research.

Modelling and refinement of forensic data acquisition specifications

This paper defines a model of a special type of digital forensics tools, known as data acquisition tools, using the formal refinement language Event-B. The complexity and criticality of many types of computer and Cyber crime nowadays combined with improper or incorrect use of digital forensic tools calls for more robust and reliable specifications of the functionality of digital forensics applications. As a minimum, the evidence produced by such tools must meet the minimum admissibility standards the legal system requires, in general implying that it must be generated from reliable and robust tools. Despite the fact that some research and effort has been spent on the validation of digital forensics tools by means of testing, the verification of such tools and the formal specification of their expected behaviour remains largely under-researched. The goal of this work is to provide a formal specification against which implementations of data acquisition procedures can be analysed.