Digital Evidence Collection Research Articles

Innovative strategies and forward thinking on China’s digital maritime law enforcement

In the digital era, the limitations of traditional maritime law enforcement models have become apparent. China actively promotes digital maritime law enforcement and has conducted thorough exploration across policy, technology, and legal domains. The primary legal foundation is the Coast Guard Law, bolstered by policy initiatives like the “21st Century Maritime Silk Road”, the “Maritime Community with a Shared Future” strategy, and the “Technology Empowers the Marine” plan. By coupling law and technology, China’s digital maritime law enforcement has innovatively established a three-dimensional enforcement model of “online + offline” at sea. It utilizes artificial intelligence to assist in maritime law enforcement decision-making, employs big data sharing for collaborative maritime law enforcement, and advances maritime compliance enforcement by digital technology. Through case analysis and effectiveness assessment, China’s digital maritime law enforcement has yielded significant results. Nonetheless, it also encounters various challenges, including data privacy infringement, cybersecurity attacks, the legitimacy of digital evidence collection, and data sharing barriers. Therefore, at the institutional level, standardizing digital maritime law enforcement procedures and establishing both horizontal and vertical coordination mechanisms are imperative. At the technical level, introducing privacy protection technologies and increasing investment in network security technologies are necessary. At the conceptual level, China should adhere to data ethics principles and strengthen awareness of open data sharing. The future of the oceans is digital, and China should advance the modernization of national maritime governance through digital maritime law enforcement.

Crime Analysis and Prediction

Data Mining in Crime analysis is a systematic approach to identifying and analyzing patterns and trends in crime. With the increasing adoption of computerized systems, Data Mining in Crime analysis can assist law enforcement in predicting crime. This technique plays a key role in cyber forensics. Cyber forensics involves the collection and analysis of digital evidence to detect and document a cybercrime or security breach. Data mining techniques can help investigators extract valuable insights from the large volume of data typically collected during a cyber forensics investigation. Keywords: Data mining, crime, pattern, analysis, cyber, Forensics, detect, document, breach, security.

A Privacy-Compliant Process for Digital Forensics Readiness

This research paper examines the issue of privacy compliance in digital forensics readiness, specifically in relation to the breach of confidentiality during analysis of collected data on users. This is a problem because the collection and analysis of digital evidence during these investigations can have a potential impact on individuals’ privacy rights. The study’s methodology involves a literature review of relevant research, an analysis of privacy regulations, and a case study of a real-world digital forensics investigation. The main findings of the study indicate that organizations need to develop and implement robust privacy measures and data protection policies to ensure that their digital forensics readiness efforts are privacy compliant and do not compromise user privacy. Some examples of why this is necessary are provided in the research to address these privacy compliance issues, this study proposes a measure, this measure implements technical safeguards to protect user data and maintains its confidentiality. By implementing the proposed measures, organizations can maintain their digital forensics readiness while also protecting user privacy.

Cybercrime and the Law: Addressing the Challenges of Digital Forensics in Criminal Investigations

A lack of standards and regulations for handling digital evidence is impeding its admissibility in court proceedings. This article addresses the challenges of digital forensics in criminal investigations due to the rise of cybercrime. The literature existing studies on digital forensics, legal frameworks, and cybercrime is reviewed in order to find possible solutions. The results demonstrate the importance of collaboration between the legal and technological sectors in developing standardized norms and processes for digital evidence collection and processing. The findings also highlight the importance of digital forensics in criminal investigations and the need for a robust legal framework to combat cybercrime effectively. This note emphasizes the vital significance of digital forensics in criminal investigations and the need to develop standardized rules and procedures for the management of digital evidence. The recommendations presented in this article may assist policymakers and law enforcement authorities in designing legal framework capable of effectively confronting cybercrime.

A novel blockchain-based digital forensics framework for preserving evidence and enabling investigation in industrial Internet of Things

To address challenges in digital evidence collection and responsibility determination for industrial safety accidents involving industrial Internet of Things (IIoT) device nodes, this paper proposes a blockchain-based digital forensic scheme within the IIoT communication architecture. The scheme utilizes a decentralized blockchain storage mechanism to enable remote storage of digital forensic data. Additionally, it leverages smart contract mechanisms to facilitate efficient retrieval and tracing of related evidence chains. To enhance data security of IIoT device nodes, a token mechanism is implemented for access control. Moreover, to meet real-time evidence acquisition requirements in IIoT, an efficient batch consensus mechanism is proposed. Experimental simulations demonstrate the superiority of the novel consensus algorithm compared to the traditional Delegated Proof-of-Stake (DPOS) consensus in the proposed scheme for the IIoT environment. It meets speed requirements for evidence collection, ensuring tamper-proof, non-repudiable, and permanent storage of digital forensic data. Consequently, the application of blockchain technology for judicial access and evidence storage has made significant contributions to digital forensics within the IIoT context.

A Complete Handbook for Digital Forensics Investigator

Abstract: This handbook provides a comprehensive guide to digital forensics, covering topics such as its definition and scope, importance in investigations, and legal and ethical considerations. It emphasizes the collection, analysis, and presentation of digital evidence while adhering to legal guidelines and ethical standards. Key topics include cybercrime investigations, incident response, privacy protection, chain of custody, and professional conduct. The handbook also covers tools, file systems, network forensics, malware analysis, mobile device forensics, and emerging challenges in the field

Digital Forensics in the Era of Cybercrime: Emerging Trends and Challenges for Forensic Accountants in Nigeria

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

Digital forensics challenges and readiness for 6G Internet of Things (IoT) networks

AbstractThe development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

Cyber bullying Detection on Social Media Using Machine Learning

Cyber bullying has become a growing concern in today's society, with more and more people turning to the internet to harass and intimidate others. Digital forensics is an essential tool for investigating cyber bullying activities, as it allows for the collection and analysis of digital evidence. However, traditional digital forensics techniques can be time-consuming and require a significant amount of human effort. In this paper, we propose the use of machine learning algorithms to aid in the investigation of cyber bullying activities. By training these algorithms on a dataset of known cyber bullying incidents, we can create a predictive model that can automatically classify new instances of cyber bullying. This can significantly reduce the time and effort required for investigations, allowing for a more efficient response to cyber bullying incidents. The challenges associated with using machine learning for cyber bullying detection, including the need for high-quality training data and the potential for bias in the algorithms. We also explore the various types of digital evidence that can be used in cyber bullying investigations, such as social media posts, emails, and instant messages. We present a case study in which we apply our proposed approach to a real-world cyber bullying incident. Our results show that the machine learning algorithm was able to accurately identify the cyber bullying activity with a high level of precision, demonstrating the potential of this approach for improving the efficiency and effectiveness of cyber bullying investigations.

Електронні докази - дієві інструменти доказування у кримінальному провадженні

The process of proving is carried out by competent participants of criminal trial in order to establish the truth in criminal proceedings and is an important component of the proceeding. Proving is carried out in compliance with the statutory procedure for criminal proceedings in general, the order of the execution of certain procedural actions and the adoption of procedural decisions, that is within the limits of the criminal procedural form. The modern concept of criminal proceedings is aimed at establishing additional guarantees of observance of the participants’ rights at each stage. The process of proving should be clearly regulated by criminal procedure legislation to ensure the rights of a person in criminal proceedings. The rapid development of the latest information technologies and a significant increase in the number of legal relations in the plane of the information space objectively affected the features of the criminal process. In particular, this applies to such an important category as sources of evidence. In modern conditions of widespread use of information technologies, electronic media are an important and informative source of evidence in criminal proceedings. From theoretical and practical perspectives an important task for scholars is to regulate at the legislative level the methods and procedural proceedings for the legal collection of digital information relevant to criminal proceedings and its further use in compliance with the principles of relevance, admissibility, reliability and sufficiency. The peculiarities of collecting, processing and recording digital evidence are analyzed in the article. It is emphasized that the collection of evidence contained on electronic media can be done by removing the media or information system and by copying the information stored on the corresponding electronic media. The advantages and disadvantages of using digital evidence collection methods are analyzed. Emphasis is placed on the importance of observing the procedural and technical aspects of obtaining information stored on electronic media in order to ensure the possibility of using such information as evidence during criminal proceedings.

INVESTIGATING THE ROLE OF BLOCKCHAIN TECHNOLOGY IN CYBERSECURITY INCIDENCE RESPONSE AND DIGITAL FORENSIC INVESTIGATION

In the modern interconnected society, large, medium, and small organizations, including governmental and non-governmental organizations, are vulnerable to cyberattacks. When an attack, such as a phishing or ransomware attack, occurs, each of these enterprises must have a dependable or rather established and accurate reference database and platform for appropriate analysis and storage of digital evidence to facilitate a quick and effective response to the attack. Establishing a secure platform for cyber incident response is essential for organizations to minimize the impact of an attack, prevent further damage, and identify and track the source of the attack. This paper critically examines the role of blockchain technology in facilitating safe and secure collection, storage, and analysis of digital evidence in the modern cyber incidence response and digital forensic investigation industry. This paper employs observation, experimentation, and case study methods to investigate how crucial the technology is in different stages of incidence responses and modern forensic investigation. It explores critical aspects such as evidence preservation, the chain of custody, gathering threat intelligence, analyzing computer viruses, and tracking compromised data and funds flow. Its findings imply that the technology is far more efficient than other technologies of the same calibre. By adopting this tool, organizations can improve their incidence response capabilities and increase their chances of successfully identifying and prosecuting cyber attackers. The paper concludes by discussing the potential limitations and challenges of using blockchain technology, offering recommendations for future research on the technology to continue improving the cyber incidence response field. Keywords: Blockchain Technology, Digital Forensics, Forensic Investigation, Incidence Response, Digital Evidence DOI： https://doi.org/10.35741/issn.0258-2724.58.3.59

Advanced Intuitive Model for Digital Forensics Collection Methods in the Context of Cloud Computing and IoT

Abstract: With the wide scale adoption of cloud computing paradigms and Internet of Things implementations, the arena of service delivery has changed significantly for the world of technology-oriented services. While these new modes of service delivery have provided innovations that were not fathomable earlier, they not only create new non-traditional pathways for evidence generation, nevertheless, they have also been seen to carry a potential of creating and exposing a whole new set of security vulnerabilities that malicious actors can exploit. Traditional forensic investigation process falls short in many ways including the way it aims to identify and link crucial pieces of evidence in these scenarios due to a myriad of internal and external factors. Challenges and inadequacies have been identified in the community in relation to these specific sets of advancing technologies that hinder the efficient identification, extraction and processing of evidence generated in crimes involving them. In this paper we wish to surmise the current forensic collection methods, how they pose challenges when put together with the latest cloud and IoT technologies and then attempt to propose an advanced, more intuitive, and theoretically validated digital forensic collection process guided by zero trust principle and enforced with artificial intelligence and machine learning methodologies with the aim to fill the gaps and provide a more reliable, robust and intuitive model to perform digital evidence collection in the given context.

A hybrid deep learning technique based integrated multi-model data fusion for forensic investigation

Digital evidence is an integral part of any trial. Data is critical facts, encrypted information that requires explanation in order to gain meaning and knowledge. The current process of digital forensic research cannot effectively address the various aspects of a complex infrastructure. Therefore, digital forensics requires the optimal processing of a complex infrastructure that differs from the current process and structure. For a long time, digital forensic research has been utilized to discuss these issues. In this research, we offer a forensic investigation hybrid deep learning approach based on integrated multi-model data fusion (HDL-DFI). First, we concentrate on digital evidence collection and management systems, which can be achieved by an integrated data fusion model with the help of an improved brain storm optimization (IBSO) algorithm. Here, we consider several multimedia data’s for evidence purposes, i.e. text, image, speech, physiological signals, and video. Then, we introduce a recurrent multiplicative neuron with a deep neural network (RM-DNN) for data de-duplication in evidence collection, which avoids repeated and redundant data. After that, we design a multistage dynamic neural network (MDNN) for sentimental analysis to decide what type of crime has transpired and classify the action on it. Finally, the accuracy, precision, recall, F1-score, G-mean, and area under the curve of our proposed HDL-DFI model implemented with the standard benchmark database and its fallouts are compared to current state-of-the-art replicas (AUC). The results of our experiments show that the computation time of the proposed model HDL-DFI is 20% and 25% lower than the previous model’s for uploading familiar and unfamiliar files, 22% and 29% lower for authentication generation, 23% and 31% lower for the index service test scenario, and 24.097% and 32.02% lower for familiarity checking.

SoK: cross-border criminal investigations and digital evidence

Abstract Digital evidence underpin the majority of crimes as their analysis is an integral part of almost every criminal investigation. Even if we temporarily disregard the numerous challenges in the collection and analysis of digital evidence, the exchange of the evidence among the different stakeholders has many thorny issues. Of specific interest are cross-border criminal investigations as the complexity is significantly high due to the heterogeneity of legal frameworks, which beyond time bottlenecks can also become prohibiting. The aim of this article is to analyse the current state of practice of cross-border investigations considering the efficacy of current collaboration protocols along with the challenges and drawbacks to be overcome. Further to performing a legally oriented research treatise, we recall all the challenges raised in the literature and discuss them from a more practical yet global perspective. Thus, this article paves the way to enabling practitioners and stakeholders to leverage horizontal strategies to fill in the identified gaps timely and accurately.

The survey on cross-border collection of digital evidence by representatives from Polish prosecutors’ offices and judicial authorities

The survey on cross-border collection of digital evidence by representatives from Polish prosecutors’ offices and judicial authorities

Collecting Evidence in Forensic Events and Comparison of the Digital Evidence Practices of Kosovo and Turkey

Evidence is an important concept in order to reveal whether a crime really exists or not and integrate it with all its elements. There are numerous methods of crime scene investigation in forensic cases. During the judgment phase, the most important factor that will help understand and decide the manner in which the incident took place is the evidence that will provide proof with regard to the incident. Therefore, evidence helps prosecutors and judges correctly understand and establish the relationship between the crime and the criminals and prove the committed crime and ensure correct, fair and rapid execution of the trial with the aim of reaching the material truth. Evidence obtained in the crime scene provides information with regard to the manner in which the crime was committed, the time of the crime, thebehaviour of the perpetrator, the suspect, the victim and the crime scene ensuring the establishment of the relationship between them. On the other hand, with the digital systems gaining more placein the life of the society, the crime scene has shifted from a physical environment to a digital one. Consequently, new types of crimes are committed digitally and as a result, the concept of digital evidence has arisen. There are no specific laws on the collection of digital evidence under Kosovo's legislation. On the other hand, there are legal regulations regarding digital evidence in exemplary countries such as Turkey. This study will comprise of the methods of gathering evidence in forensic cases and the comparison of the legal legislation on digital evidence in Kosovo and Turkey. Received: 5 June 2021 / Accepted: 15 July 2021 / Published: 5 September 2021

Digital Integrity

Abstract Researchers working with digital evidence must be aware of its vulnerabilities if they hope to maximize its value for justice and accountability. In this paper, we highlight two important vulnerabilities: the impermanent nature of digital evidence, and its susceptibility to attack from online dis/misinformation campaigns. We argue that to overcome the challenge that the impermanent nature of digital evidence presents, researchers can implement rapid response archiving techniques that, while not as rigorous as protocols set out for the collection of evidence in legal cases, could leave them with digital breadcrumbs to aid with the recovery of deleted digital evidence. We further propose that researchers consider implementing a stance of radical transparency in the collection, synthesis, and presentation of digital evidence with the goal of fortifying it against dis/misinformation campaigns.

Comparative Study and Analysis on Integrity of Data Files Using Different Tools and Techniques

Digital forensic investigation is the scientific process of collection, preservation, examination, analysis, documentation and presentation of digital evidence from digital devices, so that the evidence is in compliance with legal terms and acceptable in a court of law. Integrity of the digital evidence is an indispensable part of the investigation process and should be preserved to maintain the chain of custody. This is done through hashing technique using standardized forensic tools. However, while handling the evidences , lack of knowledge might lead to unintentional alteration of computed hash. This violates the chain of custody and makes the evidence inadmissible in a court of law. In this paper, our objective is to determine the different conditions under which the original hash value of a digital evidence changes. For this, we create different scenarios using sample data files and compute their hash values. A comparative study and analysis are done to determine in which scenario the original hash value of the data file changes. The results of the research will prove useful and essential for Criminal Justice Functionaries in gaining knowledge about various conditions leading to the change in hash value of digital evidence and therefore, avoid its accidental alteration during forensic investigation/examination.

An Appraisal of Digital Documents as Evidence in Islamic Law

Major shifts in the science and technology landscape have made the collection and analysis of digital evidence an increasingly important tool for resolving of crimes as well as the preparation of court cases. Digital documents are known as electronic documents and it can be used as a means of proof in court. However, this kind of method is still need to be discussed in detail regarding its admissibility in the Syariah court. This is because there is no specific provision on the use of it. Thus, this article focuses on the concept of digital documents as evidence in Syariah courts. It also explores the Islamic legal perspective on digital documents as a means of proof by considering the Quran, hadiths, legal maxims, and acts. This article also will focus on the admissibility of digital documents as evidence in Syariah courts. The methodology of this study is a qualitative approach. The data collected is divided into two types: primary sources, such as the Quran, hadiths, legal maxims, and acts; and secondary sources, such as journal articles, books, cases reported in law journals, and kitab fiqh. The data obtained is analyzed using document analysis methods. The results show that there is a high need to accept digital documents as evidence, especially in Syariah courts. This is because, the scientific and technological developments have led to this need to make use of digital documents. Studies show that the use of digital documents as evidence serves to reinforce other evidence presented in court.
 
 Received: 7 September 2020 / Accepted: 2 February 2021 / Published: 10 May 2021

The Application of Blockchain of Custody in Criminal Investigation Process

With the advancing technologies become tools for illicit activities and avoid detection, digital forensics is necessary for law enforcement in modern criminal investigations. In order to maintain the integrity and authenticity of the evidence, a chain of custody is essential for the successful prosecution of criminals in court. However, it is a great challenge to manage the preservation and collection of digital evidence because of its fragile and volatile in nature. Blockchain has been proposed as a promising and reliable technology to provide immutability and traceability of digital content, however, the applications of blockchain to the law enforcement agencies (LEAs) requires special attention to the security issue. In this research, we proposed a blockchain of custody framework to facilitate the security and transparency of digital evidence in criminal investigation process. The framework is implement on Ethereum smart contract to support authenticity and integrity of digital evidence in preliminary investigation, case management and court phases. We also propose the role of investigator to leverage access control in evidence creation, transferring and modification. The corresponding actions with judicial process is simulated using private ethereum blockchain. The experimental results indicate that the proposed framework can prevent digital evidence been tampered or contaminated and assure its legal defensibility with rigorous privilege management. Moreover, by successfully synchronizing digital evidence transactions to multiple nodes ensures the accountability of evidence data for every involved law enforcement agency.