Computer Forensic Investigation Research Articles

Enhanced Cauchy Matrix Reed-Solomon Codes and Role-Based Cryptographic Data Access for Data Recovery and Security in Cloud Environment

In computer systems ensuring proper authorization is a significant challenge, particularly with the rise of open systems and dispersed platforms like the cloud. Role-Based Access Control (RBAC) has been widely adopted in cloud server applications due to its popularity and versatility. When granting authorization access to data stored in the cloud for collecting evidence against offenders, computer forensic investigations play a crucial role. As cloud service providers may not always be reliable, data confidentiality should be ensured within the system. Additionally, a proper revocation procedure is essential for managing users whose credentials have expired. With the increasing scale and distribution of storage systems, component failures have become more common, making fault tolerance a critical concern. In response to this, a secure data-sharing system has been developed, enabling secure key distribution and data sharing for dynamic groups using role-based access control and AES encryption technology. Data recovery involves storing duplicate data to withstand a certain level of data loss. To secure data across distributed systems, the erasure code method is employed. Erasure coding techniques, such as Reed-Solomon codes, have the potential to significantly reduce data storage costs while maintaining resilience against disk failures. In light of this, there is a growing interest from academia and the corporate world in developing innovative coding techniques for cloud storage systems. The research goal is to create a new coding scheme that enhances the efficiency of Reed-Solomon coding using the sophisticated Cauchy matrix to achieve fault tolerance

Improved Cauchy Reed-Solomon Codes for Cloud Data Retrieval and Secured Data Storage using Role-Based Cryptographic Access and forensic investigation

Doling out client consent strategies to PC frameworks presents a huge test in guaranteeing legitimate approval, especially with the development of open frameworks and scattered stages like the cloud. RBAC has turned into a broadly involved strategy in cloud server applications because of its versatility. Granting access to cloud-stored data for investigating potential wrongdoings is crucial in computer forensic investigations. In cases where the cloud service provider's reliability is questionable, maintaining data confidentiality and establishing an efficient procedure for revoking access upon credential expiration is essential. As storage systems expand across vast networks, frequent component failures require stronger fault tolerance measures. Our work secure data-sharing system combines role (Authorized) based access control and AES encryption technology to provide safe key distribution and data sharing for dynamic groups. Data recovery entails protecting data dispersed over distributed systems by storing duplicate data and applying the erasure code technique. Erasure coding strategies, like Reed-Solomon codes, guarantee disc failure robustness while cutting down on data storage expenses dramatically. They do, however, also result in longer access times and more expensive repairs. Consequently, there has been a great deal of interest in academic and business circles for the investigation of novel coding strategies for cloud storage systems. The objective of this study is to present a novel coding method that utilizes the intricate Cauchy matrix in order to improve Reed-Solomon coding efficiency and strengthen fault tolerance.

Forensik Video Pada CCTV Menggunakan Framework Generic Computer Forensics Investigation Model (GCFIM)

The level of crime recorded by CCTV (Closed Circuit Televison) cameras continues to increase, criminals who are proven to have committed certain criminal acts will be punished in accordance with statutory regulations. The problem is how a case recorded on a CCTV camera can be used as digital evidence at trial. And how to handle it if there is evidence that has been manipulated or changed by irresponsible parties to eliminate traces of digital evidence. Digital evidence is closely related to ensuring the security, privacy and integrity of data when following the stages of the forensic digital identification process. The identification model using the Generic Computer Forensic Investigation Model (GCFIM) Framework is used for the investigation stage in finding information related to video recording metadata on CCTV cameras, in order to provide structured and valid information to be accepted in court as digital evidence. The results of this study obtained information on the data testing process using the Generic Computer Forensic Investigation Model (GCFIM) framework and for the metadata analysis process using two tools, namely exiftool and mediainfo. Testing is done on the original video and tempering video. Regarding the metadata of the original video and tempering video, there is a very significant difference in the size of the original video 4.6Mb while the tempering video is 4.2Mb, the duration of the original video is 38s for the tempering video 32s and the modification date / time for the original video 2020:03:21 while the tempering video is 2022:08:04. It can be concluded that exiftool and mediainfo can be utilized to obtain metadata information from data, with the aim of strengthening digital evidence at the time of trial regarding the validity of the data

Computer Forensics and Examination of Digital Evidence on Windows Operating System

İnternet ve bilişim sistemleri üzerinde işlenen suçları tespit etmek amacıyla gerçekleştirilen adli bilişim incelemelerinin önemi, her geçen gün daha iyi anlaşılmaktadır. Bu minvalde suç ve suçlunun tespiti konusunda hukuka uygun dijital delillerin elde edilmesinin önemi çok büyüktür. Adli bilişim incelemelerinde, birçok farklı yöntem ile dijital deliller elde edilebilir. Özellikle bilişim sistemleri üzerinde kullanılan işletim sistemleri buna çok iyi bir örnektir. Küresel ölçekte olduğu gibi ülkemizde de gerek kişisel kullanımlarda gerekse kurumsal şirketlerde Windows işletim sistemi yaygın olarak kullanılmaktadır. Sanal dünya üzerinde işlenen suçların ve mağduriyetlerin çoğunluğu bu sistem üzerinde yaşanmaktadır. Bu nedenle çalışmada, Windows işletim sistemi üzerinde adli bilişim çalışması yapma gereksinimi duyulmuştur. Adli bilişim alanındaki güncel çalışmalar literatüre daha çok kavramsal ve hukuksal düzenleme olarak katkıda bulunmaktadır. Bu çalışmada ise metodolojik ve teknik analizler birlikte kullanılarak Windows PowerShell ve üçüncü parti yazılımlarla adli bilişim çalışması yapılması amaçlanmıştır. Böylece sistem bileşenleri üzerindeki dijital deliller, metedolojik ve teknik yöntemlerle analiz edilip, elde edilen sonuçlar görsel verilerle ortaya konulmuştur.

RESEARCH ON COMPUTER EQUIPMENT AND SOFTWARE PRODUCTS IN INVESTIGATION OF CRIMES RELATED TO ILLEGAL TRAFFICKING OF DRUGS, PSYCHOTROPIC SUBSTANCES OR THEIR ANALOGUES

This article outlines current issues of research on computer traces in the investigation of crimes at the stage of pre-trial investigation related to illegal trafficking of narcotic drugs, psychotropic substances or their analogues. The main ways of conducting drug trafficking in Ukraine using modern information technologies, that is, using computer technology (mostly mobile devices, personal portable computers) and software products (programs for communicating by means of calls and messages through the Internet, Web browsers, etc.) on the World Wide Web are analyzed. Based on the analysis of research and publications of scientists as well as on the basis of empirical research during computer forensic investigations connected with investigation of illegal distribution of narcotic drugs, methods of illicit goods distribution on the Internet along with methods for investigating computer technologies, which directly relate to drug trafficking using modern information technologies, has been considered. Types of data that can be extracted using specialized software in laboratories of computer research during computer forensic investigation, and which, in turn, can function as factual data and is the evidence of commission of crimes related to drug trafficking, psychotropic substances or their analogues are considered, namely, we are talking about such data as: information from messenger programs, web browsers, text messages, as well as from user files (including graphic, audio and video files); In addition, guiding questions that can be addressed to a forensic expert while computer forensic investigation in criminal investigations related to illegal production, manufacture, purchase, storage, transportation, transfer, sale of narcotic drugs, psychotropic substances or their analogues are suggested.

Steganalysis Bukti Digital pada Media Storage Menggunakan Metode GCFIM

Steganography is an anti-forensic technique that allows a criminal to hide information in other messages, so that during an examination it will be difficult to obtain evidence of the crime information. Therefore we need a technique to detect hidden messages in the data. This technique is known as steganalysis. Steganalysis is an anti-steganography science whose main purpose is to study the hiding characteristics of data on digital media and detect the existence of secret messages that are hidden using steganography techniques. The purpose of this study is to apply steganalysis techniques to detect the presence of messages that are hidden in other messages by using the forensic method, namely Generic Computer Forensic Investigation Model (GCFIM). In this study, the process of inserting steganographic messages using the Hiderman application, while the steganalysis process uses the StegSpy application. The results obtained in this study were the process of steganalysis using the help of the StegSpy application proved to be successful in detecting the presence of hidden messages in the five files that were scanned by steganographic messages.

Cyber Forensic Challenges: Escaping Holes for Cyber Attackers Series 01: Extracting Forensic Evidences from Non- Functional Computer Devices

According to Forensic Terminology, Cyber Forensic Challenge is a state, a competitive situation, unavailability of reliable evidences and bottleneck constraint in Computer Forensic Investigation and its Procedures. A Forensic Challenge can either be Technical, Admistrative or Legislative/Legal and Anti-Forensic is an example of Technical Challenge, it adds complexity in acquiring and accessing an evidence or sets of evidences during Forensic Investigation. In real-world scenarios, it hurdles Forensic Examiners from acquiring an image of evidences to continue with Forensic Examinations and makes the Attackers or Adversaries "Scape Goats" during Criminal Prosecution or in a Corporate Forensic Investigation, as where it arises. In Public Computer Forensic domains, one of the Challenges is unavailability of Public Repositories of MACs, Bluetooth, IMEI and NFC Addresses -of Mobile Phones, WiFi Routers, Printers, Biometric Scanners and other IOT Devices(such as Amazon Alexa, Smart Watch and FitBit). Globally, not adequate, but there are reasonable numbers of such Repositories to overcome the challenges in the concerned fields and countable numbers of systems dedicated to such collections and innovative ones to name are CEIR(Central Equipment Identity Repository) for IMEI Databases(India), WIGLE for WiFi SSID(Global) but there is still shortfalls of ethical Repositories of Bluetooth Addresses (Private and Public) and Identifiers associated with NFC and RFID !

Detection and Forensics of Encryption Behavior of Storage File and Network Transmission Data

In recent years, with the widespread application of encryption technology, criminals can hide malicious data without being discovered by security regulatory authorities, which has brought serious challenges to computer forensic investigation. Therefore, it is urgent to study the technology of detection and forensics of encrypted data. This paper proposes a method for encryption detection based on a deep convolutional neural network. The method first converts the raw data into two-dimensional matrixes as the input of the convolutional neural network. Then, the multiscale feature extraction mechanism with multiple activation functions is utilized to provide representative features as the input of subsequent layers. Next, the residual learning operation can further enhance the discrimination of features. By this mean, a network which can automatically extract and learn global contextual information of encrypted data is constructed. The experiment results show that the proposed method achieves high accuracy in the detection of storage file and network transmission data compare to the competitive methods and the detection accuracy on different types of mixed data is higher than 99%. Moreover, the proposed method can accurately detect data encrypted with different algorithms. The average detection rate of DES-encrypted data is higher than that of competitors by more than 5%.

Regex: an experimental approach for searching in cyber forensic

The expeditious improvement and advancement in technology have shaped computers as ammunition, which may lead to a huge loss if used for wrong motives. The objective of computer forensics involves correctly examine and collect the digital evidence in such a manner so that they are justifiable in court. Due to the growing importance of cyber world security and the sincerity of cybercrime, it is essential for security professionals to know the technology used in forensics and keyword searching is the most handful technique for identifying potential evidence from the pool of files. This paper aims to provide a proper understanding of regular expressions keyword search technique used in computer forensics investigation. In this paper, we perform the experiments using Prodiscover tool to reduce the search space by identifying and filtering the known files to speed up the searching process of evidence identification.

A probability distribution function for investigating node infection and removal times

AbstractConsidering the important issue of computer infections by worms spread via networks, the theme of source identification has been a prominent research field that aims at investigating infection propagation including acquiring knowledge about the infection and the node removal times when a worm infection happens. This information helps in identifying the patient zero in the worm attack and may be used by computer forensic investigators and network administrators to spot the culprits and to identify related network vulnerabilities. In this paper, we tackle this problem by developing new probabilistic models based on Bayesian networks. We learn a probability distribution to calculate, at every time step, the probability that each node is infected by a scanning worm, using historical data and features extracted from the network and application layers. With the mentioned probability distribution, the node infection status can be inferred using feature values at each time step. We propose a four‐step method to investigate the time of infection and removal of each node probabilistically. First, features are extracted and derived from network traffic data. There are no suitable training and test datasets publicly available for our tests; therefore, we developed the training and test datasets using simulations of the Code Red II worm. Second, a prior model is built using training data. Third, the probabilistic model is built by the estimation of distribution algorithm. Fourth, the infection probability of nodes is inferred given the probability distribution and feature values at each time step. It has already been shown that the number of infectious nodes can be probabilistically approximated backward in time through the stochastic Back‐to‐Origin Markov model. We combine our first model with the prior stochastic Back‐to‐Origin Markov model to develop our second model. To evaluate our first and second models, we conducted experiments that show that these models can pinpoint the source node and the infection time of nodes with acceptable accuracy. It should be noted that our method could be employed with other propagating worm types including ransomware worms.

Design of Security Technique through Secure Logging for Cloud Forensics

Cloud computing has a new edge computing paradigm these days. Sometimes cloud computing architectures don’t support for computer forensics investigations. Analyzing various types of logs and logging mechanism plays an important role in computer forensics. Distributed nature and the multi-tenant cloud models, where many users share the same processing and network resources, collecting, storing and analyzing logs from a cloud is very hard. User activity logs can be a valuable source of information in cloud forensic investigations. Generally, Cloud service providers have access to activity logs of cloud user and CSP can tamper the logs so that investigator cannot reach to the real culprit. In such an environment, log security is one of challenge in the cloud. Logging technique is used to monitor employee’s behavior, to keep track of malicious activities and prevent cloud networks from intrusion by well-known organizations. Ensuring the reliability and integrity of logs is crucial. Most existing solutions for secure logging are designed for traditional systems rather than the complexity of a cloud environment. In the proposed framework secure logging environment is provided by storing and processing activity logs and encrypting using advanced encryption method. It detects DDoS (distributed denial of service) attack on cloud infrastructure by using the published logs on cloud and thus helpful in cloud forensics. It is detected by the investigator using available application activity logs in the cloud server. Searchable encryption algorithm will be used to increase the security of the logging mechanism and to maintain confidentiality and privacy of user data. Proof of past (PPL) logs is created by storing logs at more than one place. This PPL helps in the verification process of changed logs by CSP the actual implementation of this application on AWS Infrastructure as a service ( IAAS ) cloud shows real-time use of this structure.

Digital Forensic Analysis on Android Smartphones for Handling Cybercrime Cases

As the times progressed, forensic science has developed rapidly. The science of forensics extends to new areas of technology ranging from digital forensics, computer forensics and mobile forensics. Mobile forensics in analyzing and collecting data is obtained from various resources, such as operating systems, communication lines and also various storage media. The most popular mobile operating system of the day is a smartphone based on android operating system. With android technology, criminals can use that technology as a crime medium ranging from overriding crime ideas, crime targets and crime scenarios. In this Final Project use forensic mobile application to get data residing in cell phone actors, in the form of text, sound, picture and video that have or not yet deleted in smartphone. In this study, a model for investigating the crime scene is the author using the Generic Computer Forensic Investigation Model (GCFIM). On the GCFIM model the investigator may be able to return to the previous stage because of the possibility of a changeable situation (both physical and digital), the investigation tools used, the crime tools used, and the level of investigative expertise. In this research also added weighting method of word TF-IDF, where this method can help to find keyword in digital evidence in the form of word / text.

A Survey of Various Frameworks and Solutions in all Branches of Digital Forensics with a Focus on Cloud Forensics

Digital forensics is a class of forensic science interested with the use of digital information produced, stored and transmitted by various digital devices as source of evidence in investigations and legal proceedings. Digital forensics can be split up to several classes such as computer forensics, network forensics, mobile forensics, cloud computing forensics, and IoT forensics. In recent years, cloud computing has emerged as a popular computing model in various areas of human life. However, cloud computing systems lack support for computer forensic investigations. The main goal of digital forensics is to prove the presence of a particular document in a given digital device. This paper presents a comprehensive survey of various frameworks and solutions in all classes of digital forensics with a focus on cloud forensics. We start by discussing different forensics classes, their frameworks, limitations and solutions. Then we focus on the methodological aspect and existing challenges of cloud forensics. Moreover, the detailed comparison discusses drawbacks, differences and similarities of several suggested cloud computing frameworks providing future research directions.

FORENSIK KOMPUTER HUMAN INTERFACE DEVICE BADUSB BERBASIS MICROCONTROLLER ATMEGA32U4 ARDUINO LEONARDO PADA REGISTRY SISTEM OPERASI MICROSOFT WINDOWS 7

One attack mode on information security is to use a BadUSB device that is connected to the target computer, using this technique various information such as memory dump activities to get the password and embed the reverse shell can be done in a matter of seconds on Microsoft Windows 7 operating system. This paper is an introduction to how computer forensic investigations can be carried out on computers to bring cyber criminals to court. Although the computer forensic technique discussed in this paper looks simple, but in fact this activity requires the precision and patience of the investigator. Keywords : Human Interface Device, BadUSB, ATMEGA32U4, and Registry.

Supporting Law Enforcement Personnel Working with Distressing Material Online.

This study aimed to expand on previous research by gathering international data on key stressors impacting on computer forensic investigators who are exposed to child exploitation material (CEM) as part of their role. Semistructured interviews were conducted with five members of law enforcement (LE) working in this area, from five independent and internationally separated organizations. The results of these interviews were explored using thematic analysis. The three key themes identified were "stressors related to work investigating CEM online," "strategies for mediating stress related to investigating CEM online," and "training to investigate CEM online." Investigators of CEM online may experience stress from several sources, including but not limited to stress from exposure to the material. Other factors such as poor management, high workloads, and limited resources may also result in stress, and these stressors may be mediated to an extent. Recommendations for training, resources, psychological support, and management practices emerged from the research. Such strategies may reduce stress experienced by investigators in this role. This study furthers understanding by conducting an international examination of multiple centers. Identification of common themes and stressors identified by LE personnel in multiple countries can help in the development of international standards and guidelines in training and stress management.

Testing closed source software: computer forensic tool case study

Computer forensic techniques are important for the prevention, detection, and investigation of electronic crime. Computer forensic investigators need computer forensic tools to produce reliable results that meet legal requirements and are acceptable in the courts. Most of these tools are closed-source, making the software a black-box for testing purposes. This paper illustrates a different black box testing method for experimenting computer forensic tools based on functional scenarios.

Penerapan Composite Logic dalam Mengkolaborasikan Framework Terkait Multimedia Forensik

Like the digital forensics in general, multimedia forensics requires an integrated and flexible framework that can guide the process of proof is procedurally in order to maintain the validity of a digital evidence so that it can be justified in court. But this time, the digital forensics investigation framework that develops more emphasis on computer forensic investigations in general and did not give a specific stage of multimedia forensics. Often in investigating multimedia forensics investigator uses a framework that vary depending on the type of multimedia content to be analyzed, of course it becomes inflexible and inefficient, whereas multimedia content share characteristics that allow it to be integrated into a single unit. This study develops a forensic multimedia framework by implementing the Composite Logic to collaborate on several multimedia framework and related documents. Logic Composite method is a method of modeling the distribution of structured logical modularization techniques with explicit interface in which a model consists of a set of components that are interconnected with the principle of decomposition. In other words, the application of this method will allow researchers to extract and merge several frameworks into a single unit does not eliminate the function and the basic structure of the frameworks.

WEB BROWSER FORENSICS: GOOGLE CHROME

Internet users use the web browser to perform various activities on the internet such as browsing internet, email, internet banking, social media applications, download files- videos etc. As web browser is the only way to access the internet and cybercrime criminal uses or target the web browser to commit the crime related to internet. It is very important for the digital forensic examiner to collect and analysis artifacts related to web browser usage of the suspect. There are various browsers available in the market such as Google Chrome, Internet Explorer, Firefox Mozilla, Safari and Opera etc, among which Google Chrome is very popular among the internet user community. Our literature survey shows that most of the researches used prefetch file and live memory analysis as source of information to extract artifacts. In this research paper, we analyzed default artifacts location, history, cookies, login data, topsides, shortcuts, user profile, prefetch file and RAM dump to collect artifacts related to internet activities on windows installed Google Chrome. The outcome of this research will serve to be a significant resource for law enforcement, computer forensic investigators, and the digital forensics research community.

Cybercrime investigation in Finland

Nordic police cooperation concerning cybercrimes has been developed during the last few years, e.g. through the Nordic Computer Forensics Investigators (NCFI) and Nordplus training programmes. More empirical research is needed in order to enhance cybercrime investigation and address the training needs of police officers. There is a knowledge gap concerning organizational models for the police’s cybercrime investigation: How the function is organized, what the professional characteristics of the staff are and how to combine computer forensics with crime investigation? The purpose of this paper was to study the organization of cybercrime investigation in Finland. Data were collected by a questionnaire from all 11 local police districts and the National Bureau of Investigation in July–August 2014. In addition, six thematic interviews of cybercrime investigators were conducted in 2014. Three investigation models of computer integrity crimes were found: (1) Computer forensic investigators conduct the entire pre-trial examination, (2) Computer forensic investigators conduct only the computer forensics, and tactical investigation is done by an occasional investigator, (3) Computer forensic investigators conduct only the computer forensics and tactical investigation is centralized to designated investigators. The recognition of various organizational models and educational backgrounds of investigators will help to develop cybercrime investigation training.

REVERSE ENGINEERING AND VULNERABILITY ANALYSIS IN CYBER SECURITY

Most of the incidents response environment and computer forensics investigations cannot be successful accurately or thoroughly without understanding the runtime nature of a binary. Hackers increasingly use customized Trojans that are not detected by any antivirus which can only be analyzed and traced back to the original attacker via reverse engineering. Sometime, many executable programs contain vulnerabilities, such as use of very weak cryptographic algorithms and the buffer overflows. The most useful way to discover these extreme critical vulnerabilities for binary closed-source programs is to reverse engineer them. Reverse engineering is required in order to understand and define complex binary obfuscation schemes used by copy protection vendors, as well as obfuscation put in place by commercial software vendors. In some different cases Vulnerability Analysis may be the ambition of the test to validate mitigation is in place and the vulnerability is not accessible; while in other mode the ambition maybe to test every applicable variable with authenticated access in an effort to discover all applicable vulnerabilities. Testing may be to find all the vulnerabilities on a hosting system; while in other factors we may need to find all the vulnerabilities on hosts within a given boundary or inventory. Vulnerability analysis performs according to the threat level of a system detected by the penetration testing.