Digital Evidence Research Articles

Network Forensic Serangan DoS pada Jaringan Cloud berdasarkan Generic Framework for Network Forensics (GFNF)

The attacks on cloud-based networks have increased and could lead to various disadvantages such as the inaccessibility of services until the loss of user’s trust. Owncloud is one cloud implementation that runs on a network with more than 200 million users. The aims of these researches are to find digital evidence from DoS attacks. Some DoS attacks are SSH brute force, SYN flood, ping of death, and port scanning on the Owncloud network and then finding the digital evidence such as the attacker's IP, time occurred of the attack, types of the attack, also the resource usage of CPU and RAM. This research uses Wireshark and Snort tools to analyze the network and the method of Generic Framework for Network Forensic (GFNF) as a framework during the simulation process until performing the evidence. The simulation was carried out for 1 minute with 30 trials for each attack. The results of this study found the attacker’s IP, time of the attack occurred, types of attack, and also the increase of the resource usage on CPU and RAM when an attack occurred. The found of results digital evidence such as the attacker's IP, the time occurred of attack, and the types of attack were visualized as a table and presented on the ELK Stack dashboard.

Akuisisi Bukti Digital Pada Aplikasi Michat di Smartphone Menggunakan Metode National Institute of Standards and Technology (NIST)

The development of technology in the world of mobile devices is growing. However, these developments have a detrimental impact, one of which is cybercrime. Cybercrime is a crime that uses information technology. One of the smart phone technologies which includes cases of cybercrime that are often found in Indonesia include online prostitution of minors. This is done by utilizing social media, namely Michat as a medium of communication. The “chat with nearby users” feature by uploading a status that can be connected to the surrounding area within a certain radius and after being connected, the actor and his potential customer will negotiate and transact with each other until they finally meet. To eliminate digital evidence in the form of conversations in messages, usually perpetrators will delete the history of messages that produce data that can be used as evidence and perpetrators who can avoid legal traps, which are ultimately online. prostitution will be rampant. For online prostitution activities, it is necessary to carry out mobile forensics to find evidence which is then useful to be given to the authorities. This research uses the National Institute of Standards and Technology (NIST) method.

Deciphering emoji variation in courts: a social semiotic perspective

Emojis are increasingly being used as digital evidence in courts due to the miscommunication and misinterpretation arising from the high variability of their usage and interpretation. Emojis in courts have been extensively researched in extant studies, but relatively little attention has been paid to the emoji variation phenomena in Chinese courts. Through an empirical qualitative content analysis of the court judgments in China and the United States and some supplementary materials, this study posits that an emoji’s meaning in courts can be subject to the following six categories of variations: i. variation across platforms, including devices, operating systems, software programs and clients; ii. temporal variation; iii. variation in court cases under different rules of evidence; iv. variation in individual participants; v. variation across social groups; and vi. linguistic-cultural variation. From a social semiotic perspective, emojis as dynamic signs have great meaning potentials, making their meanings context-dependent and interpreter-dependent. For this reason, it is suggested that legal professionals untangle and weave historical, social, cultural and legal contexts into the interpretation of an emoji’s meaning. Moreover, a probe into the contextualized configuration of emojis can offer practical insights into the interpretation of emoji-bearing texts in judicial decision-making as well as the admissibility and investigation of digital evidence in courts.

THE CONCEPT OF HASH VALUE AND THE COLLISION OF HASH VALUE AS THE WAY TO PROVIDE UNASSAILABILITY OF DIGITAL EVIDENCE

The evidence used to prove the material fact which is subject to the criminal procedure should not be changed until it is brought before the court. It is relatively easy to ensure the accuracy of physical evidences by taking them into judicial custody. However, it is difficult to ensure the accuracy of the digital evidence since it is easy to copy and modify it. Digital evidences are used to provide the technological means to ensure accuracy. The hash value, which provides a one-way summarization value, can be applied to digital evidence such as a fingerprint and helps to ensure the accuracy of the numerical evidence. However, a collision of hash value, known as the hash value conflict, which occurs when two different digital data have the same hash value, is a problematic area in ensuring the accuracy of numerical evidence. In this study, the concept of summary value as a means of ensuring the accuracy of numerical evidence will be explained and the possible effects of the hash value collision will be discussed

Toward a unified and secure approach for extraction of forensic digital evidence from an IoT device

Toward a unified and secure approach for extraction of forensic digital evidence from an IoT device

A Comparative Analysis of Digital Forensic Investigation Tools on Facebook Messenger Applications

Technological developments make it easier for people to communicate and share information. Facebook Messenger is an instant messenger that contains multi-platform for sending text, image, sound, and video messages. Besides being used for positive purposes, this technology can also be used to carry out harmful activities. This study conducts a forensic investigation on a crime simulation in pornographic content distribution using Facebook Messenger as a communication medium on Android smartphones. Perpetrators communicate and send pornographic content in the shape of conversations, audio, and video, then delete them to eliminate traces. Every crime can leave evidence therefore after erasing the track, it can be revealed through digital forensic investigations on the smartphone devices that are used as objects to find digital evidence. The collection of evidence in this study is used four forensic tools with the research stages the National Institute of Justice (NIJ) framework. The study result can be used as evidence by investigators on handling criminal cases with the results obtained in the shape of application versions, accounts, emails, conversation, time of occurrence, pictures, audio, and video. MOBILedit Forensic Express has an accuracy of 84.85%, Wondershare Dr. Fone 36.36%, Magnet Axiom 75.76%, and Belkasoft Evidence Center 69.70%.

The Case for Validating ADDIE Model as a Digital Forensic Model for Peer-to-Peer Network Investigation

AbstractRapid technological advancement can substantially impact the processes of digital forensic investigation and present a myriad of challenges to the investigator. With these challenges, it is necessary to have a standard digital forensic framework as the foundation of any digital investigation. State-of-the-art digital forensic models assume that it is safe to move from one investigation stage to the next. It guides the investigators with the required steps and procedures. This brings a great stride to validate a non-specific framework to be used in most digital investigation procedures. This paper considers a new technique for detecting active peers that participate in a peer-to-peer (P2P) network. As part of our study, we crawled the µTorrent P2P client over ten days in different instances while logging all participating peers. We then employed digital forensic techniques to analyse the popular users and generate evidence within them with high accuracy. We evaluated our approach against the standard Analysis, Design, Development, Implementation, and Evaluation (ADDIE) model for the digital investigation to achieve the credible digital evidence presented in this paper. Finally, we presented a validation case for the ADDIE model using the United States Daubert Test and the United Kingdom’s Forensic Science Regulator Guidance – 218 (FSR-G-218) and Forensic Science Regulator Guidance – 201 (FSR-G-201) to formulate it as a standard digital forensic model.

EMERGENCE OF DIGITAL EVIDENCE IN BANGLADESHI COURTS FROM THE US BASED DIGITAL PLATFORMS: PROSPECTS AND CHALLENGES

Although a silent revolution of the digital court system has been marked in Bangladesh during the pandemic, the standard of the justice system in terms of digital evidencing is still far behind the same of the technologically developed countries. The socioeconomic progress through the ‘Digital Bangladesh’ movement has emerged as one of the biggest factors in the world of competition. However, existing studies demonstrate that the rising trend of the people’s reliance on online communication is also possibly responsible for many uncalculated judicial determinations due to the failure in proving or disproving the criminal communication. The United States-led online platforms like Facebook, Google, YouTube, WhatsApp and Instagram are the top digital platforms in Bangladesh and it is evident that Bangladesh has been regular in requesting the United States for particular private information for pending judicial proceedings. This article will explore to what extent the existing judicial proceedings of Bangladesh are affected by the unavailability of evidence that results in the benefit of doubt. The paper will assess the mutual interest, possible outcomes, and inherent challenges of a ‘Mutual Legal Assistance’ treaty between Bangladesh and the United States in guaranteeing rights to information (own evidence). A question regarding overall readiness of both the countries towards the deal will also be revolving around the existing evidence laws, role of the digital platforms and State responsibility for criminal application in cyberspaces. Finally, considering economic interests, national digital security and commitment to universally agreed principles of justice; this note will prescribe a framework for possible digital evidence sharing deal between the two States.

삼성 스마트폰의 음성 녹음 어플리케이션에 의해 녹음된 오디오 파일에 대한 위변조 여부 분석 방법

Audio recordings are used widely as crucial evidence due to the popularity of smartphones. However, the digital evidence submitted voluntarily may be questioned for its authentication. Since most smartphones provide the function of digital editing files, they could be exposed to crime as being edited maliciously. Primarily, it could be severe in the case of voluntary submission via information and communications networks. This paper proposed the forensic method for authentication of audio recordings generated by the Voice Recorder application from Samsung smartphones. First, we analyzed and compared the file structures and timestamps of audio recordings between the normal state without manipulation and the manipulated state. Then, we analyzed the spectrogram of audio recordings. Finally, by analyzing the timestamps of the media-log for audio recordings, we confirmed the authentication method for the audio recordings forensically.

Methods to acquisition digital evidence for computer forensics

Computer forensics is a key science and competency in meeting the growing risks of cybercrime, as well as for criminal investigation generally. In order to provide irrefutable evidence of a potential crime, a specialist in the incident response team (e.g. an IT forensics specialist) must secure the digital evidence in accordance with the correct procedure. There are no strict guidelines on how to do this. It is known that the authenticity and fidelity of data must be preserved. This article will collect good practices developed by specialists in the field of computer forensics. The process of securing the evidence material from a digital data sources for later analysis will be presented.

Mobile Cyber Forensic Investigations of Web3 Wallets on Android and iOS

Constant advancements in technology have a significant impact on our everyday lives and the ecosystem in which we live. The growing popularity of cryptocurrencies (e.g., Bitcoin and Ethereum), along with Non-Fungible Tokens (NFTs), which are founded on blockchain technology, has opened the way for these blockchain projects to be integrated into a wide range of other kinds of applications (apps). Today, cryptocurrencies are used as a popular method of payment online; however, their popularity on the dark Web is also increasing. For example, they can be used to buy and perform various illegal activities among criminals due to their anonymity. Web3 cryptocurrency wallets, used to store cryptocurrencies, have not been studied as thoroughly as many other apps from a digital forensic perspective on mobile devices, given the increasing number of these services and apps today for many platforms, including the leading mobile operating systems (i.e., iOS and Android). Therefore, the purpose of this research is to guide investigators to unlock the full potential of popular cryptocurrency Web3 wallets, Trust Wallet and Metamask, to understand what can be recovered, and to look at areas where there are knowledge gaps. We digitally analyzed and forensically examined two mobile wallets that do not require any personal identifiers to register and are widely used for Web3 cryptocurrencies on Android and iOS devices. We review the digital evidence we have collected and discuss the implications of the forensic tools we have used. Finally, we propose a proof of concept extension to the iOS Logs, Events, And Plists Parser (iLEAPP) tool to automatically recover artifacts.

ANALYSIS OF JUDGES' DECISIONS REGARDING DIVORCE CASES WITH DIGITAL EVIDENCE IN THE SAMARINDA RELIGIOUS COURT

<p><em>The legal force of digital evidence submitted by litigants in divorce hearings in religious courts is the background for this research. The method used in this study is normative legal research with a normative analytical juridical approach to judges' decisions in divorce cases as the object of research. So that researchers can answer problems by conducting literature research from relevant legal sources.The judge's consideration in deciding the case is in the law relating to Marriage, the stages of the trial procedure, the legal basis of the case, the legal basis for evidence, the legal basis for the reason or cause of divorce, and the legal basis for the authority of the judge. Meanwhile, the position of digital evidence itself as one of the evidence of confessions that is stamped and used by the judge as the main case for the cause of divorce.The judge did not use Law No. 11 of 2008 on electronic information on digital evidence but focused on Jurisprudence which gave birth to rules on the examination of divorce on the grounds of Article 19 letter (f) of Government Regulation No. 9 of 1975 jo Article 116 of the Compilation of Islamic Law, where the doctrine that must be applied in divorce cases is not "Matri Monial Guilt" but "Broken Marriage" or precisely the outbreak of the household "Az-Zawwaj Al-Maksuroh" so that the court does not focus on whose faults are the triggers for the dispute, but emphasizes the condition of the household itself.</em></p>

Digital Evidence in Civil Litigation

Digital Evidence in Civil Litigation

THE AUTHORITY OF THE CRIMINAL JUDGE TO ASSESS DIGITAL (ELECTRONIC) EVIDENCE IN JORDANIAN, EGYPTIAN, AND FRENCH LEGISLATION

The interest that the digital (electronic) evidence enjoys has become great compared to other evidence. In fact, this is due to the spread of the use of digital information technology which role has increased with the entry of the Internet and computers into various areas of life. So, the research issue lies in that this virtual medium has become a hotbed for a range of perpetrators called information criminals. Actually, the crimes they perpetrate are located in the virtual medium, or what can be called the digital or electronic world. In fact, several results and recommendations were reached in this research, the most important of which is that the digital (electronic) evidence is the best evidence to prove this type of crime because it is of the nature of the medium in which the crime was committed. Hence, from here, the interest in this type of evidence began, bearing in mind that the proof of the digital (electronic) crime is not limited to digital (electronic) evidence as it is possible to prove by traditional evidence such as testimony, confession, and others. Therefore, the issue of accepting digital evidence (electronic) is affected only by the extent of the criminal judge's conviction of it if such type of evidence can be subjected to the discretion of the judiciary.

The Urgency of Establishing Guidelines for Handling Cybercrime Cases in the Indonesian National Police Department

The Urgency of Establishing Guidelines for Handling Cybercrime Cases in the Indonesian National Police DepartmentTechnological development has a strong influence on the development of criminals. In the past, crimes were carried out in conventional ways and tools, but now crimes are carried out in modern ways. Cybercrime is a borderless crime and requires special treatment when collecting digital evidence. Evidence in cyber crime allows criminals to hide or remove their tracks. Until now, Indonesian National Police (POLRI) does not have any case management guidelines for storing digital evidence using digital forensic methods. This research aims to determine what steps investigators take in obtaining digital evidence, whether these steps have been effective in law enforcement, or whether they are still unclear. The method in this writing is normative legal research based on a statute approach and a conceptual approach. The author offers to establish guidelines for handling cyber crime cases in the Indonesian National Police by relying on digital forensic methods by strengthening and choosing the right tools for handling cases.
 Keywords: cybercrime, digital evidence, digital forensic

Sentiment analysis on Bangla conversation using machine learning approach

<span>Nowadays, online communication is more convenient and popular than face-to-face conversation. Therefore, people prefer online communication over face-to-face meetings. Enormous people use online chatting systems to speak with their loved ones at any given time throughout the world. People create massive quantities of conversation every second because of their online engagement. People's feelings during the conversation period can be gleaned as useful information from these conversations. Text analysis and conclusion of any material as summarization can be done using sentiment analysis by natural language processing. The use of communication for customer service portals in various e-commerce platforms and crime investigations based on digital evidence is increasing the need for sentiment analysis of a conversation. Other languages, such as English, have well-developed libraries and resources for natural language processing, yet there are few studies conducted on Bangla. It is more challenging to extract sentiments from Bangla conversational data due to the language's grammatical complexity. As a result, it opens vast study opportunities. So, support vector machine, multinomial naïve Bayes, k-nearest neighbors, logistic regression, decision tree, and random forest was used. From the dataset, extracted information was labeled as positive and negative.</span>

Digital Memory, Evidence, and Social Media. Lessons Learned from Syria

Digital Memory, Evidence, and Social Media. Lessons Learned from Syria

A comprehensive forensic preservation methodology for crypto wallets

Studies have shown that the existing methodology of digital forensics preservation, which is to acquire and hash the evidence, is insufficient for cryptocurrencies as it does not secure the value. To address this issue, investigators secure the cryptocurrency by transferring it to a crypto wallet controlled by the Law Enforcement Agencies(LEAs). This process will unavoidably modify some data. Despite the criticality of this issue, inadequate studies have been made in this area. In addition, current guidelines on securing the cryptocurrency lack a comprehensive description from the perspective of digital evidence preservation principles. Crucial data to be documented throughout the preservation process were also not properly listed. Therefore, this study aims to address the gap in preserving cryptocurrencies from crypto wallets. Three objectives were then laid out; (1) to develop a methodology that is mapped comprehensively with digital evidence preservation principle, (2) to describe and provide justification on the inevitably modified data, and (3) to list crucial data to be documented during preservation process. The methods to achieve the objectives were critical examinations on various types of crypto wallets and by using simulation. The result shows that the study is able to provide a comprehensive crypto wallets preservation methodology to forensic investigators. It is hoped that the outcome from this study will promote better understanding, ensure consistency of implementation, and to aid investigators in explaining and justifying their actions during search and seizure in court.

Review on effectiveness of deep learning approach in digital forensics

<p><span>Cyber forensics is use of scientific methods for definite description of cybercrime activities. It deals with collecting, processing and interpreting digital evidence for cybercrime analysis. Cyber forensic analysis plays very important role in criminal investigations. Although lot of research has been done in cyber forensics, it is still expected to face new challenges in near future. Analysis of digital media specifically photographic images, audio and video recordings are very crucial in forensics This paper specifically focus on digital forensics. There are several methods for digital forensic analysis. Currently deep learning (DL), mainly convolutional neural network (CNN) has proved very promising in classification of digital images and sound analysis techniques. This paper presents a compendious study of recent research and methods in forensic areas based on CNN, with a view to guide the researchers working in this area. We first, defined and explained preliminary models of DL. In the next section, out of several DL models we have focused on CNN and its usage in areas of digital forensic. Finally, conclusion and future work are discussed. The review shows that CNN has proved good in most of the forensic domains and still promise to be better.</span></p>

A systematic analysis on the readiness of Blockchain integration in IoT forensics

Internet of Things (IoT) devices are massively utilized in our daily lives which is exposing them to a wide range of attacks. The heterogeneity of evidence produced by IoT devices is complicating the process of evidence collection and processing. Consequently, it is imperative to maintain admissible evidence collection, preservation, and analysis to be presented in a court of law. The currently used digital forensic tools and methodologies are lagging behind the IoT's heterogeneity and distributive nature. The decentralized, distributed, and transparent nature of Blockchain has encouraged lots of research on utilizing Blockchain to store, process, and investigate digital evidence in IoT forensics across various jurisdictions. Therefore, this research work analyzes proposed frameworks in the literature to review their deployment of Blockchain technology to resolve the various presented challenges in IoT Forensics. It presents a systematic review to investigate the readiness of blockchain integration in IoT forensics. Many factors have been addressed to consider when integrating the Blockchain technology into IoT forensics such as data integrity, distributed storage, authentication, transparency, and security where the literature provides an adequate proof on the crucial need to consider them as essential IoT forensic readiness factors. The research findings highlight challenges and open research opportunities of blockchain utilization to facilitate sound and efficient IoT forensics.