Digital Evidence Research Articles

LIMITES DA PRIVACIDADE DIGITAL: IMPLICAÇÕES JURÍDICAS NO DIREITO PENAL

This article deals with the limits of digital privacy and its legal implications in Criminal Law. Given the complexity evident in the digital era, this study aimed to analyze the legal implications in Criminal Law regarding the protection of personal data. Methodologically, bibliographical research was used through research in articles, jurisprudence and books to support the study. It analyzes the tension between the protection of individual rights and the need to combat cybercrime, emphasizing the importance of adequate legislation to guarantee digital security without compromising the privacy of citizens. The research uses a qualitative and bibliographical approach, exploring challenges such as collecting digital evidence and the legal implications of online surveillance. In the end, there was great progress in legislation in the fight against cybercrime, strengthening the protection of personal data. However, the difficulty of identifying offenders of crimes like these is still a challenge, and, to be combatted, requires improvements in supervision and improvement of digital investigation mechanisms, in addition to more effective cooperation between national and international authorities. This includes the development of advanced technologies and the creation of specific legal protocols that help identify and hold perpetrators accountable without compromising the rights of individual citizens.

Scalable Technology for Adolescents and Youth to Reduce Stress in the Treatment of Common Mental Disorders in Jordan: Protocol for a Randomized Controlled Trial.

Young people in low- and middle-income countries encounter significant barriers to accessing mental health support due to various factors, including a substantial treatment gap and limited health care budgets allocated to mental health. Using innovative strategies, such as scalable digital self-help psychological interventions, offers a potential solution for improving access to mental health support. However, digital mental health interventions come with their own set of challenges, including issues related to low user engagement. Chatbots, with their interactive and engaging nature, may present a promising avenue for the delivery of these interventions. This study aims to explore the effectiveness of a newly developed World Health Organization (WHO) digital mental health intervention, titled Scalable Technology for Adolescents and Youth to Reduce Stress (STARS). A single-blind, 2-arm randomized controlled trial will be conducted nationally across Jordan. Participants will include 344 young adults, aged 18-21 years, currently residing in Jordan. Inclusion criteria are heightened levels of psychological distress as determined through the 10-item Kessler Psychological Distress Scale (≥20). Assessment measures will be conducted at baseline, 1-week post intervention, and 3-month follow-up. Following baseline assessments, eligible participants will be randomized to receive STARS or enhanced usual care. The primary outcomes are the reduction of symptoms of depression and anxiety (Hopkins Symptom Checklist, 25 subscales) at 3-month follow-up. Secondary outcomes include general functioning (WHO Disability Assessment Schedule 2.0), well-being (WHO-5 Well-Being Index), personal problems (Psychological Outcomes Profile), and agency (State Hope Scale subscale). The study was funded in January 2020 by the Research for Health in Humanitarian Crises Programme (Elhra) and recruitment for the trial started on July 16, 2023. As of November 15, 2023, we randomized 228 participants. This trial intends to contribute to the growing digital mental health evidence base by exploring technological solutions to address global public health challenges. Given the widespread use of technology globally, even in resource-constrained settings, and the high adoption rates among adolescents and young individuals, digital initiatives such as STARS present promising opportunities for the future of mental health care in low- and middle-income countries. ISRCTN Registry ISRCTN10152961; https://www.isrctn.com/ISRCTN10152961. DERR1-10.2196/54585.

The role of cyber intelligence in policing cybercrime in South Africa: Insights from law enforcement officers

ABSTRACT The rapid increase of technology and the sophistication in which it is used to obtain and manipulate information presents fertile ground for cybercriminals. Thus, the consequent increase of cybercrime in South Africa poses a threat to individuals, government, businesses, and security agencies; ultimately causing extensive financial losses to the economy. The huge preventive cost incurred by putting in place stringent preventative measures, affect the financial status of individuals and threatens the sustainability of many companies. This study aimed to examine the policing of cybercrime in South Africa by analysing the experiences of police officers who are involved in the policing of this crime. It focussed on the use of cyber intelligence and cybersecurity measures for monitoring, preventing, and combating cybercrime. An empirical study was conducted in five selected provinces of South Africa, and Tesch’s data analysis method was used. The findings indicate the challenges that investigators encounter in obtaining credible digital evidence such as the frequent expiry of digital forensic licences. These challenges are compounded by victims’ unwillingness to testify due to the fear of losing their clients, and the need to protect the reputation of their companies.

Digital Footprints and Evidence: The Need for a Theoretical and Normative Definition in the Context of Digitalization

Introduction: the paper analyzes the scientific positions of understanding footprints and evidence processed exclusively in digital form, their nature, and their relationship with generally accepted categories. The current discussion allows for developing a unified approach to understanding the nature of digital footprints and their interpretation in the science of criminalistics, criminal procedure, and other branches of legal science. The study aims to examine the most influential scientific perspectives on comprehending the fundamental nature of digital footprints and evidence, with the goal of subsequently incorporating these understandings into the criminal law sciences and legislation. The author analyzes the controversial issues of the nature of digital footprints and evidence, clarifies some judgments, and identifies potential solutions. Methods: the dialectical, systemic, and logical methods (general scientific) were used in the course of the study. Among the specific scientific research methods, the formal legal and generalization methods prevailed. Results: based on the results of the conducted research, the most general theoretical positions on understanding the essence of trace and evidentiary information in the digital (electronic) environment are highlighted. The information on the main approaches to understanding this category is summarized, and some additions to the domestic legislation are proposed in order to eliminate existing contradictions. Conclusions: the use of data created and processed in electronic form as orienting and evidentiary information is an objective necessity. The available scientific views on the problem under consideration have studied its essence quite comprehensively, operate in various terms, and, in the author’s opinion, require the development of a conceptual construct, including those enshrined in the legislation to optimize criminal proceedings.

GAMEPLANS: A template for robust digital evidence strategy development.

Law enforcement officers should now expect to encounter forms of digital evidence at most of their inquiries, and as a result ensure they are prepared to effectively deal with it. This should involve the production of a digital evidence strategy (DES) which describes those actions required of any investigative team to effectively identify, collect, examine, and evaluate any digital devices/data, while also defining the circumstances for when it is appropriate to conduct such tasks. To help officers to produce robust DESs this work provides a DES template which utilizes the "GAMEPLANS" acrostic to identify nine fundamental components that are required of all DESs-"G"-Grounds for investigation; "A"-Authorization; "M"-Method of investigation; "E"-Evaluation of the meaning of any findings; "P"-Proportionality; "L"-Logic; "A"-Agreement; "N"-Necessity; "S"-Scrutiny. Each of these components are described including the sub-tasks that are contained within each, which any officer constructing a robust and effective DES must address (and provide evidence of having addressed). To support this, a DES template file is also provided, which can be utilized by officers.

Understanding Digital Forensic Tools: Their Features, Applicability and Key Short Comings. A Compendium

The Paper provides a comprehensive overview of various digital forensic investigation tools. The paper outlines the significance of digital forensics in collecting and preserving evidence for computer crimes and cybersecurity incidents. It discusses several prominent tools, including Encase Professional, Magnet Axiom, Passware Kit Forensic, Falcon Neo, Tableau USB Write Blocker, FTK Imager, and Autopsy, detailing their features, applications, and shortcomings. Key features highlighted include data acquisition methods, advanced file analysis capabilities, and reporting functionalities. The paper also addresses the potential limitations of these tools, such as issues with user authentication, performance under load, and chain of custody concerns. By examining these tools' strengths and weaknesses, the document aims to provide insights into their applicability in various investigative contexts and emphasize the importance of selecting appropriate tools for effective digital evidence management.

Methods of Extracting and Analyzing Metadata for Evidentiary Purposes

This paper examines methods for extracting and analyzing metadata for evidentiary purposes in civil proceedings. Through a comprehensive review of current literature, legal cases, and forensic techniques, it explores the diverse approaches to metadata analysis across various digital domains, including file systems, emails, documents, web browsers, mobile devices, cloud storage, social media, and emerging technologies. The study highlights the critical role of metadata in establishing the authenticity, reliability, and chronology of digital evidence. It also addresses the challenges posed by encrypted data, large-scale analysis, and the need for robust quality assurance processes. The findings underscore the importance of adapting forensic methodologies to evolving digital landscapes while maintaining legal and ethical standards. This research contributes to the ongoing development of best practices in digital forensics and their application in civil litigation.

A obtenção das provas digitais no processo penal demanda uma disciplina jurídica própria? Uma análise do conceito, das características e das peculiaridades das provas digitais

This article analyzes the theme of digital evidence, and aims to answer the question: does obtaining digital evidence in Brazilian criminal proceedings require its own legal discipline? Through bibliographic and legislative study, the article seeks to answer the question by analyzing, in particular, the distinctive characteristics of digital evidence, the fundamental rights affected by measures to obtain this evidence, and two ways of obtaining specific digital data, namely, the search and seizure of computer devices and hidden and remote access through government hacking and malware. In the end, it is concluded that the legislation must provide minimum requirements for obtaining digital evidence, to guide judicial decisions that authorize the means of obtaining this evidence, that is, the question is answered positively: digital evidence does require a legal discipline of its own in Brazilian criminal proceedings.

Direito da pessoa imputada ao anonimato digital

Based on the need to expand, in the virtual age, the list of fundamental rights available to the accused person in the same proportion that procedural practices that use technological resources are extended to their disadvantage, the article proposes to answer the following question: would the accused person have the right to digital anonymity? Without disregarding the need for state intervention when used in the practice of criminal offences, the paper methodologically proposes an interdisciplinary bibliographical review to conceptualize anti-forensic techniques as important tools for protecting the right of the accused person not to produce digital evidence against them, highlighting anonymity as one of its most effective tools and defending the relevance of its legal protection in the cyber age.

Appraising the Test of Admissibility of Electronic Records under Cameroonian Criminal Trials

By examining the test for admitting electronic records in trials, this research critically examines the procedural and legal nuances unique to digital records. The study investigates ambiguities in authority, privacy concerns, and procedural conflicts. It seeks to propose recommendations for improving the handling of electronic records in criminal trials, aiming to ensure that justice is served without compromising individual rights. This analysis provides a comprehensive approach to navigating the complexities of digital evidence while maintaining the integrity of the judicial process and upholding fundamental human rights.

A survey of intelligent multimedia forensics for internet of things communications: Approaches, strategies, perspectives, and challenges for a sustainable future

Digital forensics is a proven method for collecting, preserving, reporting, analyzing, identifying, and presenting digital evidence from the original data, and it helps find evidence of cybercrimes. Intelligent multimedia forensics is a type of digital forensics and is essential because it is used to identify fake multimedia, including images, videos, audio, and text. This paper conducted a comprehensive survey for intelligent multimedia forensics, categorized into 3 classes: deep learning forensics, multimedia forensics, and network and Internet of Things forensics. In the first class, we provided a survey of the multiple attacks breaking the DL models, such as attacks in the training step, and the testing step, and crafted. In the craft attacks, we survey the three attacks: white box, gray box, and black box. We also provided some defense methods against DL attacks, training step attacks, and testing step attacks. In the second class, we offered a survey of multimedia forensics, including passive and active manipulation. In the third class, we provide a survey of network/IoT forensics, including the attacks in five layers: physical, data link, transport, application, and network. We also provided network/IoT attack detection in the third class using deep learning models. We applied AI models in various datasets and obtained higher accuracy and performance on the datasets from various used models. Finally, we offered the challenges and future direction for the researcher in this scope.

Shortcomings of the Bharatiya Sakshya Adhiniyam, 2023: Challenges for Courts, Prisons, and Police

The Bharatiya Sakshya Adhiniyam, 2023 (BSA) replacing the Indian Evidence Act, 1872 (IEA) introduces several new provisions that create challenges for courts, prisons, and police, impacting their operational efficiency. The increased focus on electronic evidence in judicial proceedings raises worries about the authenticity of digital records and the dependability of electronic testimony, which can easily be subject to manipulation and tampering. Moreover, the law's unclear provisions regarding the admissibility of electronic evidence add to the complexity of its application. Courts, Prisons and Police Units need infrastructural enhancements to support remote monitoring, which necessitates substantial financial investments in video conferencing technology and cyber security measures. For law enforcement agencies, the BSA calls for improved digital forensics capabilities and stricter protocols for evidence gathering in course of investigation, leading to additional administrative and logistical burdens. These deficiencies highlight the urgent need for secure authentication methods, ongoing updates to the legal framework, and increased technological investment to safeguard the integrity of digital evidence. Failing to address these issues could compromise the effectiveness and credibility of the justice system.

Integration of legal databases in the context of EU accession aspirations

It is determined that the process of cooperation within the framework of the European Union has increased the need for identification and exchange of legal information coming from regional and national authorities at the European level. This need is partially met by digitally accessible legal information and the widespread use of the Internet. However, the exchange of legal information is largely limited by the differences that exist in different national legal systems, as well as the differences in their technical systems used to store and display the law on their respective websites. This hinders interaction between the information systems of national and European institutions, despite the increase in the availability of documents in electronic format. At the same time, the interconnection of national and international legal information from various sources and their presentation in the form of linked data of legal knowledge will undoubtedly improve the process of searching for legal information, expanding the possibilities of inquiries that are not currently possible. Moreover, in an increasingly digital society, where the number of cross-border civil and criminal proceedings is rapidly increasing, and given the complex diversity of different legal systems in the EU Member States, the simplification and facilitation of cross-border judicial cooperation is essential to ensure effective access of citizens and businesses to justice. At the same time, the system of identification and metadata should be well known to citizens and specialists in the field of law. In addition, to increase the chances of finding case law that is supported by an identifier and metadata, these court decisions should be searchable - by identifier and a minimal set of metadata - through a common interface. The exchange of digital evidence in the EU is also an important aspect. Currently, countries cooperate using private international law in cross-border criminal cases and exchange digital evidence based on these tools. The choice of tool depends on the countries involved and the type of information required.

Creating Solvability With Real-Time Crime Centers (RTCCs): Impacts on Homicide and Shooting Investigations

Amidst recent increases in homicides and shootings in the United States, clearances rates for homicides have declined and nonfatal shooting cases remain notoriously difficult to solve. Considerable research indicates that the outcomes of homicide and shooting investigations are likely influenced by a range of factors, including inherited case characteristics, investigative actions, forensic testing, and agency resources. Recent advancements in technologies available to law enforcement may help fill persistent gaps in solvability, but research remains limited on their effectiveness. RTCCs integrate a variety of technological innovations and software programs to rapidly receive and distribute information to support police operations, and they harness the strong potential to powerfully impact investigative outcomes and offer an additional pathway through which police agencies can increase case clearance. The current study explores the impact of strategic efforts in the Hartford Police Department (HPD) to increase investigative effectiveness through RTCC processes and technologies. Our findings indicate that RTCC activities significantly increase the likelihood that a case is solved, and this effect is primarily due to RTCC analysts’ ability to locate and analyze video associated with the case. When associated video was located, cases were 442% more likely to be solved when controlling for other covariates. The HPD’s RTCC operations, institutionalized technology, and organizational culture also play a crucial role, with a commitment to technology and information-sharing enhancing investigative capabilities. This study emphasizes the effectiveness of real-time crime centers in locating digital evidence, facilitating rapid information dissemination, and fostering agencywide collaboration, ultimately improving investigative outcomes.

“What you say in the lab, stays in the lab”: A reflexive thematic analysis of current challenges and future directions of digital forensic investigations in the UK

Despite digital evidence nowadays playing a major role in criminal investigations and being intrinsic to almost every criminal trial, research in digital forensics (DF) and national approaches to digital evidence in relation to investigating officers and court personnel remain almost non-existent. This research seeks to remedy this issue by qualitatively examining the accounts and experiences of 16 digital forensic investigators (DFIs) in England and Wales who took part in semi-structured interviews. We analyzed the data using a reflexive thematic analysis and identified four overarching themes: (i) Navigating tensions with investigating officers (that has a subtheme of ‘Tensions with legal professionals and challenges navigating court theatrics’) (ii) The psychological, emotional, and existential challenges confronted by DFIs; (iii) Identifying the potential and pitfalls of automation and AI in DF and (iv) The centrality of academia in the advancement of DF (that has a subtheme of ‘Validation of tools as a crucial step in digital forensics’). These new findings reveal that DFIs encounter significant demands to perform well and are continuously overburdened while juggling many roles. This research serves as a pivotal starting point for broader discussions.

A Survey on Mobile Digital Forensic: Taxonomy, Tools, and Challenges

ABSTRACTModern time largely rely on mobile gadgets as a means of communication, and entertainment. These gadgets now plays a vital role in forensic analysis and criminal investigations as it store a plethora of private and sensitive data. Investigating feasible digital incidents and preserving mobile device security became crucial as the proliferation of mobile devices continues to influence modern society. In this survey; mobile threats, investigative process models for mobile forensics, evidence sources, forensics tools, and field problems are all covered in‐depth. Further, a comprehensive analysis examining the capabilities, features, and efficiency of available distinct mobile forensic tools namely Belkasoft, MOBILedit, and Magnet AXIOM for retrieving, analyzing, and presenting digital evidence is being presented. The objective of the study is to assist forensic investigators in choosing the best tool for specific investigations. The findings of our study reveals the complexity of mobile operating systems, investigative process supported with sources of evidence, and forensic tools which makes it clear that the area of mobile forensics is dynamic and require modern skill adaptation along and innovative development in future. Finally, the study presents current challenges encountered during mobile forensic investigations as researchers can enhance their procedures and tactics for mobile device examination and evidence extraction by fostering a greater knowledge of the difficulties involved in mobile forensics.

A New Right to Procedural Accuracy: A Governance Model for Digital Evidence in Criminal Proceedings

This paper motivates and studies the feasibility of a new digital right to procedural accuracy (RPA) for digital evidence processing in criminal investigations. The need to guarantee a new principle of procedural accuracy under Art. 6 of the European Convention on Human Rights (ECHR) is based on the concern that digital forensic science and AI technology have a significant impact on individuals’ rights in criminal proceedings, which are neither coherently nor comprehensively addressed. The personal and material scope of RPA are examined and include: (i) protection against unreliable digital evidence processing; (ii) right to access the chain of evidence, explanation, and forensic assistance; and (iii) the right to participate in the determinative stages of the digital evidence processing. Limitations of the RPA are also discussed.

Decoding digital interactions: An extensive study of TeamViewer's Forensic Artifacts across Windows and android platforms

The pervasive influence of digital technology has ushered in a new era of connectivity, reshaping the landscape of forensic science and challenging investigators to adapt to evolving methods of digital interaction. Remote access applications (RAAs) like TeamViewer have become integral tools for facilitating remote collaboration and support across various platforms. However, the widespread adoption of such applications has also led to an increase in cybercrimes, underscoring the critical need for meticulous forensic analysis. This study presents a comprehensive examination of TeamViewer's forensic artifacts across Windows and Android platforms, employing advanced forensic techniques such as registry analysis, disk forensics, memory forensics, and Android forensics. By meticulously dissecting digital evidence and uncovering valuable insights into user interactions, configuration settings, and session dynamics, this research aims to enhance understanding of remote access activities and empower forensic investigators with the tools needed to combat cybercrimes effectively. The findings highlight the forensic significance of each investigative approach and underscore the importance of continuous innovation in the field of digital forensics.

Revisiting logical image formats for future digital forensics: A comprehensive analysis on L01 and AFF4-L

As the capacity of storage devices continues to increase significantly and cloud environments emerge, there is a need to perform logical imaging to selectively collect specific data relevant to a case. However, there is currently insufficient research addressing the appropriateness and usability of logical image file formats, which could potentially raise issues in terms of the originality and integrity of digital evidence. This study performs a comprehensive analysis of the internal structures and metadata of existing proprietary and open-source logical image file formats, with a particular focus on the L01 and AFF4-L. Furthermore, this study reveals several limitations of each file format and the supporting tools through practical experiments including metadata manipulation and stress tests. More specifically, the potential for loss of originality and metadata manipulation during and after logical imaging underscores the necessity for the development and standardization of more advanced logical image file formats to systematically manage different types of digital evidence from different sources. The findings of this research also demonstrate the necessity of collective efforts from the community for the continuous improvement of logical image file formats.

TAENet: Two-branch Autoencoder Network for Interpretable Deepfake Detection

Deepfake detection attracts increasingly attention due to serious security issues caused by facial manipulation techniques. Recently, deep learning-based detectors have achieved promising performance. However, these detectors suffer severe untrustworthy due to the lack of interpretability. Thus, it is essential to work on the interpretibility of deepfake detectors to improve the reliability and traceability of digital evidence. In this work, we propose a two-branch autoencoder network named TAENet for interpretable deepfake detection. TAENet is composed of Content Feature Disentanglement (CFD), Content Map Generation (CMG), and Classification. CFD extracts latent features of real and forged content with dual encoder and feature discriminator. CMG employs a Pixel-level Content Map Generation Loss (PCMGL) to guide the dual decoder in visualizing the latent representations of real and forged contents as real-map and fake-map. In classification module, the Auxiliary Classifier (AC) serves as map amplifier to improve the accuracy of real-map image extraction. Finally, the learned model decouples the input image into two maps that have the same size as the input, providing visualized evidence for deepfake detection. Extensive experiments demonstrate that TAENet can offer interpretability in deepfake detection without compromising accuracy.