Digital Evidence Research Articles

MOBİL KİBER KRİMİNALİSTİKAYA HAZIRLIQ METODOLOGİYALARININ TӘDQİQİ

Mobile cyber forensics serves to recover potential digital evidence from mobile devices using digital forensics. The development and spread of mobile technologies, the need for mobile-based services and new requirements have led to the development and transformation of mobile cyber forensics into an important field. In this article, a component model is proposed to assess the readiness potential of the relevant organizations in the field of mobile cyber forensics for the detection of cybercrimes, collection of evidence, and investigation of criminal cases.

Forensic challenges regarding the Internet of Things

The Internet of Things brings many benefits to our society, but its advantages come with a price, namely with a huge opportunity for those who want to commit cybercrime. To fight against this kind of criminality, investigators must use appropriate methods. The Forensics of the Internet of Things (IoT) has evolved from “traditional” Digital Forensics, and includes, among other activities, the identification of the devices related to a certain crime, collecting the digital evidence in a form which can be used in front of the judicial bodies, the analysis, and the extraction of all possible information from the collected data, and the preservation of the evidence. The Forensics of IoT must face specific issues, mainly generated by the extraordinary large number of IoT devices and by the great diversity of these devices. An important problem is that data analysis is very difficult to perform, because of different data formats used by the components of IoT. In the forensic investigations related to the IoT, an important concern refers to privacy protection. Overall, IoT Forensics is a challenging field, but we must search for suitable solutions, because ensuring security for IoT is a very important aim.

Problems of evaluation of digital evidence based on blockchain technologies

Problems of evaluation of digital evidence based on blockchain technologies

Legal Professionals' Perspectives on the Challenges of Cybercrime Legislation Enforcement

This study aims to explore the perspectives of legal professionals on the enforcement challenges of cybercrime legislation. It seeks to identify the key challenges within the legal framework, operational enforcement, and strategic policy-making that hinder the effective combat of cybercrime. Employing a qualitative research design, the study conducted semi-structured interviews with 30 legal professionals, including prosecutors, defense attorneys, judges, and legal scholars. The participant selection was based on purposive sampling to cover a broad range of insights into the enforcement of cybercrime legislation. Data collection adhered to the principle of theoretical saturation, ensuring a comprehensive exploration of the subject matter. Thematic analysis was utilized to identify patterns and themes within the data. Three main themes emerged from the analysis: Legal Framework Challenges, Operational Enforcement Challenges, and Strategic and Policy Challenges. Within these themes, several categories were identified, including the ambiguity of laws, jurisdictional issues, technological evolution, resource constraints, digital evidence management, cybercrime reporting and detection, interagency cooperation, prevention and awareness, legal professionals’ preparedness, policy development and implementation, stakeholder engagement, and future-proofing legislation. Each category was further broken down into specific concepts highlighting the multifaceted challenges in cybercrime legislation enforcement. The study reveals that legal professionals face significant hurdles in the enforcement of cybercrime legislation, stemming from legal ambiguities, operational limitations, and strategic gaps in policy-making. Effective enforcement requires addressing these challenges through clearer legal definitions, enhanced interagency cooperation, increased resources for digital evidence management, and forward-looking policy development. By addressing these issues, there is potential to significantly improve the effectiveness of cybercrime legislation enforcement.

ВСТАНОВЛЕННЯ ДОСТОВІРНОСТІ ЦИФРОВИХ ДОКАЗІВ МІЖНАРОДНИМ КРИМІНАЛЬНИМ СУДОМ...: ОКРЕМІ ПРОБЛЕМНІ ПИТАННЯ ТА ШЛЯХИ ЇХ ВИРІШЕННЯ

The article is devoted to the study of some problematic issues of authentication of digital evidence in the course of consideration of cases by the International Criminal Court. The authors note that in the digital era, new technologies and the development of computing power have changed the nature of potentially relevant evidence which is assessed in international criminal law. The International Criminal Court is currently insufficiently prepared to address the issues of authentication of digital evidence, i.e., to determine the reliability of this type of evidence. The purpose of the article is to: (1) outline the challenges and dangers of the ICC’s current approach to establishing the reliability of digital evidence; (2) study scientific approaches to the authentication of digital evidence in criminal proceedings; and (3) establish the need to establish the most pragmatic approach to determining the reliability of digital evidence in the future. The article outlines the challenges and dangers of the ICC’s current approach to authentication and verification of digital evidence, examines the discussions among scholars on the issues outlined, and identifies recommendations for improving the Court’s work and its ability to verify the reliability of digital evidence. The general approach of the ICC to the admissibility of evidence is defined, which provides for a consistent three-part test in which each of the following criteria must be met: 1) relevance: According to Articles 64(9)(a) and 69(4) of the Rome Statute, as well as the Rules of Procedure and Admission of Evidence, evidence is considered relevant if “the evidence produced makes the existence of the fact in question more or less probable”. In other words, evidence may be considered relevant if it is “prima facie” (“at first glance”) relevant to the case; 2) sufficiency: Evidentiary value is generally understood to mean whether the evidence is sufficiently useful to prove an important part of the trial. In essence, probative value measures the extent to which the proposed evidence may affect the determination of a fact or issue. The court must balance the probative value of the item against its prejudicial effect on the accused; 3) weighing probative value and prejudicial effect: According to Rules 69(4) and 63(2), the evidence provided must be “sufficiently relevant and probative to outweigh any prejudicial impact or effect that its admission may have”. In other words, the weight given to the evidence must fully respect the rights of all parties and not be manifestly unfair to the prosecution or defense, nor prejudicial to the overall fairness of the trial. The author concludes that the ICC should seriously consider the following recommendations: (1) appoint an eCourt User Group to lead efforts to improve algorithms and continuously develop authentication issues; (2) expand the technological advisory role of the Scientific Advisory Board; (3) establish regular trainings and seminars to enhance the technical competence of judges; and (4) increase the transparency of the Scientific Advisory Board and the eCourt User Group.

Genesis of digital evidence as mean of proof in civil process of Ukraine

Genesis of digital evidence as mean of proof in civil process of Ukraine

Admissibility of Digital Evidence for Cyber Crime Investigation

Admissibility of Digital Evidence for Cyber Crime Investigation

Electronic document as a type of digital evidence

Electronic document as a type of digital evidence

Digital Evidence and its Admissibility under Pakistani Law

Digital evidence is much important in current modern world due to its diversity, accuracy and complexity. The world is agreed upon the point of admissibility of digital evidence, as enlightened from the domestic and international legislations, from one hand, the laws are presuming the digital evidence as admissible piece of evidence, on the other hand they directed every authority, not to negate the admissibility of digital evidence, merely on the ground that it is not in the form that is substantive and tangible in nature. In this context, this paper analyses the admissibility of digital evidence from the perspective of Pakistani law. It discusses the historical background, legislation on the subject and its presentation before the Court at the national level. The research methodology used in this paper is analytical. Relevant laws on digital evidence are analyzed.

디지털 증거 선별압수를 위한 인공지능 활용에 대한 고찰

Our society is already experiencing the Fourth Industrial Revolution. Therefore, most of our lives are influenced by the technology of the Fourth Industrial Revolution. One of the core values of the 4th Industrial Revolution is to rebuild the real space in the virtual space by transferring information in the real space to the virtual space. As a result, all objects, movements, and attributes in the real space are digitized and stored. Amid these changes, the importance of digital evidence is already beyond analog evidence. However, investigations and trials of crimes are still conducted only in analog spaces. Therefore, a technical device that connects the digital world and the analog world is required. The problem is that digital evidence and related legal regulations are not sufficient in the current Criminal Procedure Act. Therefore, investigative agencies have a difficult task to collect digital evidence and prove guilt in accordance with precedents and internal regulations.
 Article 106 of the Criminal Procedure Act stipulates a method of confiscating digital evidence. The problem is that among the suspect’s numerous information, it is not easy to collect only information related to criminal charges without violating the suspect’s basic rights. Therefore, as a way to overcome such difficulties, a method of performing seizure using a technical method such as artificial intelligence is being considered. Therefore, as a countermeasure against it, first of all, ground rules for legal procedures must be prepared. In addition, the reliability of artificial intelligence application technology should be recognized from a trusted institution, and users should be able to control the artificial intelligence technology used for screening and seizure. As technology develops in the future, similar problems may continue to occur. Therefore, comprehensive research related to the digital evidence legal system and technology system is needed.

Mobile Forensic Analysis of Signal Messenger Application on Android using Digital Forensic Research Workshop (DFRWS) Framework

Cybercrime is a crime committed using equipment connected to the internet. One of the cybercrimes that occured during the COVID-19 pandemic was the spread hoaxes about the COVID-19 vaccine which caused panic in society. Signal Messenger is one of the social media that has become a trending topic since the number of personal data security issues and the emergence of end-to-end encryption features. This research aims to find digital evidence on Signal Messenger application installed on the perpetrator's Android smartphone. This research uses Belkasoft, Magnet AXIOM, and MOBILedit Forensic Express tools and implements the Digital Forensics Research Workshop (DFRWS) framework in each stage of the research experiment. The research was carried out according to the case scenario with 11 predetermined parameters. Digital evidence is found from the Signal Messenger application: application information, account information, chat, pictures, videos, contacts, and stickers. The results of this research indicate that Belkasoft Evidence Center forensic tool is better, with an accuracy rate of 78.69%, while Magnet AXIOM is 26.23% and MOBILedit Forensic Express is 9.84%. The results of this research can be used as a reference for other forensic researchers/experts in handling similar crime cases on the Signal Messenger application to get better results.

An Appraisal on Digital Forensic and Computer Tools involved in Investigation process: The Case of Pakistan

Cybercrime is conducted by manipulating the digital devices, the negative use of digital devices harms an individual or society. As it is primarily cleared that the digital evidence or the evidence that is not available in substantive form, can only be collected by using the tools, techniques, knowledge and expertise, here a question may be arises that whether there is a settled principle to follow while conducting the digital investigation. In this context, this article discusses the concept of digital forensic and computer tools used in the investigation process. This research is limited to the case of Pakistan. An analytical method of the research is followed. This paper concludes that as the digital investigation unlike the formal investigation is totally different having different techniques, different mechanism and different skills, the process and steps involved in digital investigation are pretty much same in rest of the world, but the standards and the legal backings are different in the countries.

Advanced Intuitive Model for Digital Forensics Collection Methods in the Context of Cloud Computing and IoT

Abstract: With the wide scale adoption of cloud computing paradigms and Internet of Things implementations, the arena of service delivery has changed significantly for the world of technology-oriented services. While these new modes of service delivery have provided innovations that were not fathomable earlier, they not only create new non-traditional pathways for evidence generation, nevertheless, they have also been seen to carry a potential of creating and exposing a whole new set of security vulnerabilities that malicious actors can exploit. Traditional forensic investigation process falls short in many ways including the way it aims to identify and link crucial pieces of evidence in these scenarios due to a myriad of internal and external factors. Challenges and inadequacies have been identified in the community in relation to these specific sets of advancing technologies that hinder the efficient identification, extraction and processing of evidence generated in crimes involving them. In this paper we wish to surmise the current forensic collection methods, how they pose challenges when put together with the latest cloud and IoT technologies and then attempt to propose an advanced, more intuitive, and theoretically validated digital forensic collection process guided by zero trust principle and enforced with artificial intelligence and machine learning methodologies with the aim to fill the gaps and provide a more reliable, robust and intuitive model to perform digital evidence collection in the given context.

Network Forensic of Cryptocurency Miners

As reported by BSSN on August, 2022, Indonesia has traffic anomalies of 1.6 billion traffic, with 55.83% of anomaly findings containing malware and the remaining 14.99% information disclosure is another activity. Some of this data, when further analyzed based on the type of attack, falls into the categories of breaches, successes, attempts, and failures. Investigate crimes related to misuse of resources for illegal cryptocurrency mining activities. Therefore, this study should consider acquisitions from the network side as they apply to existing government agencies/institutions. This observation thereby provides information for later evidence, intruder detection, and prosecution of perpetrators who misuse resources for personal gain. As a result, the harvesting processs can obtain valuable data from routers as a digital evidence for investigating information about network attack activitiy and anomalies traffic.

Evincing Offence: How Digital Forensics Turns Big Data into Evidence for Policing Sexual Abuse

A reader can expect the abstract, paper and keywords to discuss descriptions of evidence, classification schema, seizure rules and more generally the data frictions, constraints and limitations associated with the processing of digital forensic evidence involving children in England.
 The widespread availability and use of digital devices both enables criminal acts and helps to detect them. The production and circulation of indecent images of children has been one area of crime that has transformed in recent years because of developments in modern communication technologies. Through in-depth ethnographic observations and qualitative interviews with four police forces in England, this article examines the resources and labor required to turn digital footprints into evidence for the possession of indecent images. In doing so, our aim is twofold. One, we detail the formal and informal processes whereby large sets of data become discrete pieces of judicial evidence. A notable feature of these administrative and technical processes is that while criminal justice agencies often strive for linear investigations, such aspirations fail to acknowledge the messy interrelation of expertise and roles that underpin the transformation of digital devices into evidence. As a second aim, we seek to identify similarities and differences in the practices whereby evidence is constructed between digital and other areas of forensics. In particular, this analysis raises questions around the descriptive and normative adequacies of prevalent theories of objectivity for digital forensics.

APPlied stalking: What the next generation of stalking victims consider to be ‘stalking’ and why victims report their experiences to the police

Research suggests that offenders are finding new ways to exploit the conveniences of commonplace technologies for malicious purposes. What is less clear is whether targets of the malicious conduct consider emerging forms of technology-facilitated (TF) abuse as ‘stalking’ and whether such tactics influence decisions to involve the police. Using a national sample of emerging adults (ages 18–24) meeting legal criteria for stalking (N = 194), the current study investigated whether victim decision-making was related to pursuit type (physical only, TF-tactics only, both), the number of different tactics, and/or the frequency of specific pursuit behaviors. Net of victim and situational considerations, stalking acknowledgement was solely related to the frequency of being followed. Victims who were frequently followed were more likely to identify their experience as stalking while relentless threats and harassment via Snapchat produced a 12% decrease in the odds of acknowledgement. The findings suggest the need for adapting stalking prevention initiatives to discuss technology-facilitated pursuit tactics while increasing the capacity of first responders to identify and collect digital evidence.

Steganography and Computer Forensics - the art of hiding information: a systematic review

This paper focuses on the study of steganoprahy as an anti-forensic method. The purpose of steganography techniques is to hide information from individuals unrelated to its content. Through a systematic review, the objectives of this article are: (I) explore and investigate the importance of steganography in computer forensics; (II) understand and analyze the methodology used to hide information in a file and (III) understand and analyze the methodology used to extract the information. The results summarize the previous research on this topics and we conclude the article with a warning to develpop more studies regarding this thematic as well as and make the security forces aware of this type of digital evidence and, in the same way that the methodology is being developed, the stegananalysis must also seek, at least, to reach the same technological level

THE PRUDENCE OF ADMINISTRATIVE JUDGES IN THE DIGITAL EVIDENCE IN THE ERA OF APPLYING E-GOVERNMENT INFORMATION TECHNOLOGY

In this research, the use of digital evidence in courts is studied. State administrators, including the executive and the legislative, must use information technology (e-government), especially the judiciary. Digital evidence is also frequently utilised to resolve administrative disputes between states. Judges should be able to look over and evaluate cases that involve digital evidence in order to do this. The Supreme Court has issued PERMA Number 1 of 2019 concerning the Electronic Administration of Cases and Trials in Courts in order to get ready to adapt to changes in the digitalization of electronic services (e-government). This time, the Supreme Court is taking reforming the justice system’s information technology field seriously as seen by the E-Court. Administrative Court Judges can make an effort, but in the digital age, Administrative Judges must pay attention to the entire e-government system. For instance, licencing now involves an integrated online system that includes components of the regional government, the provincial government, and the government centre. These factors make it possible for administrative judges to consult with web professionals. Because it is virtually difficult for an administrative judge to have good and accurate understanding of digital forensics, digital web forensic experts are required when proving matters at the Administrative Court. Web-based experts will provide insight into a case, assisting State Administrative judges in making judgements. The Supreme Court should hold education and training regarding online licensing, online registration, and online validation carried out by the executive. Administrative judges should not hesitate to present web expert witnesses to explain an administrative case.

Golden Eye

File systems are important sources of intelligence information and digital evidence. They have long attracted the interest of researchers in recovering files that are deleted from a hard disk. Existing file recovery studies rely heavily on an operating system (OS). However, it is often encountered that OS services are not available, making existing file recovery approaches unusable. To address this issue, the authors design and implement an OS-independent file recovery algorithm named Golden Eye (GE) by targeting the EXT4 file system. Fed the raw image obtained from a (sanitized) hard disk, GE can automatically recover any designated file or even the whole EXT4 file system. GE is based on the understanding of the file disk layout of EXT4 and does not need any support from additional hardware or software. Experimental results prove the feasibility and correctness of GE. This work not only solves the OS dependency problem that most existing file recovery work suffers from but also reveals the fact that even sanitized hard disks are still at risk of leaking sensitive data.

An improved IoT forensic model to identify interconnectivity between things

The Internet of Things (IoT) is permeating our daily lives, blurring the boundaries between the cyber world and the physical world. With an increased number of identified sources, obtaining potential digital evidence has become a significant aspect of investigations and incident responses. However, multi-level interconnections are bringing new challenges to identifying connected things in IoT ecosystems. This study focuses on IoT services that can connect or be connected to various things to reveal their connected relationship by examining forensic artifacts under six interconnected scenarios. We found that not all services retain traces of interconnection. Based on our findings from scenario-based experiments and existing IoT forensic frameworks, we propose an improved IoT forensic model to identify interconnectivity between things. This framework suggests additional phases for identifying the interconnectivity of things. The proposed framework is designed to investigate IoT-related cases by identifying all the connected things, ensuring relevant data collection, narrowing down areas of investigation, and integrating the data. Our proposed model discovers pieces of connected things, which helps reveal the whole interconnected IoT ecosystems where users are involved in. This approach can also be applied for a thorough understanding of events relating to things and services around a suspect in cybercrime response.