Challenges In Digital Forensics Research Articles

Cybercrime and the Law: Addressing the Challenges of Digital Forensics in Criminal Investigations

A lack of standards and regulations for handling digital evidence is impeding its admissibility in court proceedings. This article addresses the challenges of digital forensics in criminal investigations due to the rise of cybercrime. The literature existing studies on digital forensics, legal frameworks, and cybercrime is reviewed in order to find possible solutions. The results demonstrate the importance of collaboration between the legal and technological sectors in developing standardized norms and processes for digital evidence collection and processing. The findings also highlight the importance of digital forensics in criminal investigations and the need for a robust legal framework to combat cybercrime effectively. This note emphasizes the vital significance of digital forensics in criminal investigations and the need to develop standardized rules and procedures for the management of digital evidence. The recommendations presented in this article may assist policymakers and law enforcement authorities in designing legal framework capable of effectively confronting cybercrime.

Digital forensics challenges and readiness for 6G Internet of Things (IoT) networks

AbstractThe development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

Detecting the software usage on a compromised system: A triage solution for digital forensics

One of the challenges of digital forensics is the high volume of investigative cases. To address this problem, researchers have proposed various triage methods. Detecting the applications that have run on the compromised system under inspection can be an excellent triage method that gives the investigator an overview of the system. In this paper, we construct the signature of software usage on a system using file path artifacts. We propose a software signature detection engine (SSDE) to identify the usage of the software on the system under investigation. The SSDE consists of two subsystems: the signature construction subsystem, which builds the software signature using the TF-IDF weighting scheme, and the signature detection subsystem, which identifies the executed set of software on the target system. We consider several parameters with different values in the design of SSDEs, leading to more than 500 SSDE models. We test the SSDE models against 14 pseudo-real systems from the M57 Patents scenario and evaluate their performance. The experimental results show that about 38% of SSDE models achieve near-perfect Precision, and about 18% of them achieve near-perfect Recall. We introduce the top models and determine which parameter values lead to the superior models. Besides, we compare the SSDE models with some doc2vec-based models. The results show that SSDE models have higher average Precision, slightly lower average Recall, and much less computational time.

Liabilities of Shared System in Forensic Analysis

In today’s connected world, there is a tendency for connectivity even in the sectors which conventionally have been not so connected in the past, such as power systems substations. Substations have seen considerable digitalization of the grid hence, providing much more available insights than before. This has all been possible due to connectivity, digitalization, and automation of the power grids. Interestingly, this also means that anybody can access such critical infrastructures from a remote location, and gone are the days of physical barriers. The power of connectivity and control makes it a much more challenging task to protect critical industrial control systems. This capability comes at a price, in this case, increasing the liabilities and risk of potential cyber threats to substations. (ASIF, FARHAN , & EKSTEDT) Keywords: Digital Evidence Backlog, Digital Forensic Challenges BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Eric Sowah Badger (2022): Liabilities of Shared System in Forensic Analysis Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 191-196 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P31

Integration of Cloud in Mobile Forensics

With emerging technology and the connection of electronic devices to the internet, Internet of Things (IoT) has become part of human life. From the development of smartphones to smartwatches and smart-homes, electronic devices now have the capability of performing human activities or aiding humans in performing activities such as turning hall lights on or off with their voice. Although a large number of people use these devices for the greater good, a few individuals or group of people hide behind these devices to perform malicious activities. In order to apprehend and prosecute perpetuators who hide behind smart devices for evil gains, forensic examinations or investigations must be conducted. This review aims to identify digital forensic challenges in IoT. The inclusion criteria for this paper were international journals, articles, conference papers and case studies published from 2019 to 2022. Thematic analysis was used to analyze and synthesis the literature. Three themes emerged from the analysis; automated compromised smart-home tracer; data volatility and reconstruction; IoT forensic investigation framework. This integrative review combines evidence of digital forensic challenges in diverse IoT devices. Keyword IoT forensics, IoT challenges, Digital forensics, Smart-home forensics.

Digital Forensic Challenges in Internet of Things (IoT)

With emerging technology and the connection of electronic devices to the internet, Internet of Things (IoT) has become part of human life. From the development of smartphones to smartwatches and smart-homes, electronic devices now have the capability of performing human activities or aiding humans in performing activities such as turning hall lights on or off with their voice. Although a large number of people use these devices for the greater good, a few individuals or group of people hide behind these devices to perform malicious activities. In order to apprehend and prosecute perpetuators who hide behind smart devices for evil gains, forensic examinations or investigations must be conducted. This review aims to identify digital forensic challenges in IoT. The inclusion criteria for this paper were international journals, articles, conference papers and case studies published from 2019 to 2022. Thematic analysis was used to analyze and synthesis the literature. Three themes emerged from the analysis; automated compromised smart-home tracer; data volatility and reconstruction; IoT forensic investigation framework. This integrative review combines evidence of digital forensic challenges in diverse IoT devices. Keyword IoT forensics, IoT challenges, Digital forensics, Smart-home forensics.

Deep siamese network for limited labels classification in source camera identification

Source Camera Identification is a well-known digital forensic challenge of mapping an image to its authentic source. The current state-of-the-art provides a number of successful and efficient solutions to this problem. However, in almost all such existing techniques, a sufficiently large number of image samples is required for pre-processing, before source identification. Limited labels classification is a realistic scenario for a forensic analyst where s/he has access only to a few labelled training samples, available for source camera identification. In such contexts, where obtaining a vast number of image samples (per camera) is infeasible, correctness of existing source identification schemes, is threatened. In this paper, we address the problem of performing accurate source camera identification, with a limited set of labelled training samples, per camera model. We use a few shot learning technique known as deep siamese network here, and achieve significantly improved classification accuracy than the state–of–the–art. Here, the main principle of operation is to form pairs of samples from the same camera models, as well as from different camera models, to enhance the training space. Subsequently, a deep neural network is used to perform source classification. We perform experiments on traditional camera model identification, as well as intra–make and intra–device source identification. We also show that our proposed methodology under limited labels scenario, is robust to image transformations such as rotation, scaling, compression, and additive noise.

A Review of Application Challenges of Digital Forensics

A Review of Application Challenges of Digital Forensics

Analyzing Cyber-Attack Intention for Digital Forensics Using Case-Based Reasoning

Cyber-attacks are increasing and varying dramatically day by day. It has become challenging to control cyber-attacks and to identify the perpetrators and their intentions. In general, the analysis of the intentions of cyber-attacks is one of the main challenges in digital forensics. In many cases of cyber-attacks, the analysis of the intent of the attacks determines the strategy and tools used in the attack, thus facilitating the process of identifying the perpetrator of the attack with greater accuracy. In this paper a model will be proposed to analyze the intentions of cyber-attacks. In this proposal, a set of steps will be conceived by linking them with a case-based reasoning methodology. This model will be examined by analyzing the intent of attacks for some cases and comparing the results with other methods of analyzing the intent of attacks. Hopefully the results will determine the intent of cyber-attacks more accurately.

Distributed password cracking with BOINC and hashcat

Considering today's challenges in digital forensics, for password cracking, distributed computing is a necessity. If we limit the selection of password-cracking tools strictly to open-source software, hashcat tool unambiguously wins in speed, repertory of supported hash formats, updates, and community support. Though hashcat itself is by design a single-machine solution, its interface makes it possible to use the tool as a base construction block of a larger distributed system. Creating a “distributed hashcat” which supports the maximum of hashcat's original features requires a smart controller that employs different distribution strategies in different cases. In the paper, we show how to use BOINC framework to control a network of hashcat-equipped nodes and provide a working solution for performing different cracking attacks. We also provide experimental results of multiple cracking tasks to demonstrate the applicability of our approach. Last but not least, we compare our solution to an existing hashcat-based distributed tool - Hashtopolis.

Blockchain-Based Distributed Cloud Storage Digital Forensics: Where's the Beef?

The current state of the art in digital forensics has primarily focused on the acquisition of data from cloud storage. Here, we present a new challenge in digital forensics: blockchain-based distributed cloud storage, using STORJ as a technology example.

Accelerating Digital Forensics through Parallel Computing

Digital crimes in the era of big data and cloud computing imposes significant challenges in digital forensics. Cloud environment provides low cost, easy management and reasonable solutions. Moreover, it supports big data structures and solutions (i.e., security, privacy and digital forensics). In order to achieve a secure digital forensics analysis in cloud environment, researchers have proposed solutions with expensive communication cost and computation overheads. Among these solutions Nasereldin et al. proposed a protocol which solves the problem of authenticity and integrity of evidence using signcryption technique. This leads to low communication and implementation overheads. Furthermore, identity-based cryptography is used to solve Public Key Infrastructure (PKI) problems. In addition, it is characterized by the ability to divide the message into small messages which is suitable for pipelining techniques. Nasreldin et al.'s signcryption protocol is based on Elliptic Curve Cryptography (ECC) which is implemented by using different mathematical operations. In this protocol, ECC mathematical operations take huge time during the execution of the algorithm. ECC consists of point doubling and point addition operations. These operations require the execution of many Montgomery modular multiplications that consume time. In this study, we introduce a technique to speed up ECC operations in order to enhance the efficiency of Nasreldin et al. protocol. In particular, we propose a multi-stage parallel design which consists of three stages. First, we speed up the point doubling and point addition operation. Secondly, we enhance the execution time of Montgomery multiplications. Finally, pipelining is used to obtain a better performance. The results show that the proposed design enhances Nasreldin et al. protocol’s execution time by 47.1, 64.7, 73.5 and 79.4%, assuming that the number of nodes is 2, 4, 6 and 12, respectively.

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

Education and training in digital forensics requires a variety of suitable challenge corpora containing realistic features including regular wear-and-tear, background noise, and the actual digital traces to be discovered during investigation. Typically, the creation of these challenges requires overly arduous effort on the part of the educator to ensure their viability. Once created, the challenge image needs to be stored and distributed to a class for practical training. This storage and distribution step requires significant time and resources and may not even be possible in an online/distance learning scenario due to the data sizes involved. As part of this paper, we introduce a more capable methodology and system as an alternative to current approaches. EviPlant is a system designed for the efficient creation, manipulation, storage and distribution of challenges for digital forensics education and training. The system relies on the initial distribution of base disk images, i.e., images containing solely base operating systems. In order to create challenges for students, educators can boot the base system, emulate the desired activity and perform a “diffing” of resultant image and the base image. This diffing process extracts the modified artefacts and associated metadata and stores them in an “evidence package”. Evidence packages can be created for different personae, different wear-and-tear, different emulated crimes, etc., and multiple evidence packages can be distributed to students and integrated into the base images. A number of additional applications in digital forensic challenge creation for tool testing and validation, proficiency testing, and malware analysis are also discussed as a result of using EviPlant.

Challenges in digital forensics

Various terms have been used to describe the intersection between computing technology and violations of the law-including computer crime, electronic crime, and cybercrime. While there remains little agreement on terminology, most experts agree that the use of electronic devices to commit crime has increased dramatically and is now commonplace. It is the role of the digital investigator to bring cybercriminals to justice. Cybercrime however differs from traditional crime and presents a variety of unique challenges including the variety of electronic devices available, amount of data produced by these devices, the absence of standard practices and guidelines for analyzing that data, the lack qualified personnel to perform investigations and the lack of resources to provide on-going training. This paper examines these challenges

On Efficiency of Distributed Password Recovery

One of the major challenges in digital forensics today is data encryption. Due to the leaked information about unlawful sniffing, many users decided to protect their data by encryption. In case of criminal activities, forensic experts are challenged how to decipher suspect's data that are subject to investigation. A common method how to overcome password-based protection is a brute force password recovery using  GPU-accelerated hardware. This approach seems to be expensive. This paper presents an alternative approach using task distribution based on BOINC platform. The cost, time and energy efficiency of this approach is discussed and compared to the GPU-based solution.

Taxonomy of Challenges for Digital Forensics.

Since its inception, over a decade ago, the field of digital forensics has faced numerous challenges. Despite different researchers and digital forensic practitioners having studied and analysed various known digital forensic challenges, as of 2013, there still exists a need for a formal classification of these challenges. This article therefore reviews existing research literature and highlights the various challenges that digital forensics has faced for the last 10years. In conducting this research study, however, it was difficult for the authors to review all the existing research literature in the digital forensic domain; hence, sampling and randomization techniques were employed to facilitate the review of the gathered literature. Taxonomy of the various challenges is subsequently proposed in this paper based on our review of the literature. The taxonomy classifies the large number of digital forensic challenges into four well-defined and easily understood categories. The proposed taxonomy can be useful, for example, in future developments of automated digital forensic tools by explicitly describing processes and procedures that focus on addressing specific challenges identified in this paper. However, it should also be noted that the purpose of this paper was not to propose any solutions to the individual challenges that digital forensics face, but to serve as a survey of the state of the art of the research area.