Digital Evidence Research Articles

Development of Digital Forensic Framework for Anti-Forensic and Profiling Using Open Source Intelligence in Cyber Crime Investigation

Abstract. Cybercrime is a crime that increases every year. The development of cyber crime occurs by utilizing mobile devices such as smartphones. So it is necessary to have a scientific discipline that studies and handles cybercrime activities. Digital forensics is one of the disciplines that can be utilized in dealing with cyber crimes. One branch of digital forensic science is mobile forensics which studies forensic processes on mobile devices. However, in its development, cybercriminals also apply various techniques used to thwart the forensic investigation process. The technique used is called anti-forensics. Purpose: It is necessary to have a process or framework that can be used as a reference in handling cybercrime cases in the forensic process. This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. Methods/Study design/approach: This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. By testing the scenario data, the results are obtained in the form of processing additional information from the files obtained and information related to user names. Result/Findings: The result is a digital forensic phase which concern on anti-forensic identification on media files and utilizing OSINT to perform crime suspect profiling based on the evidence collected in digital forensic investigation phase. Novelty/Originality/Value: Found 3 new types of findings in the form of string data, one of which is a link, and 7 new types in the form of usernames which were not found in the use of digital forensic tools. From a total of 408 initial data and new findings with a total of 10 findings, the percentage of findings increased by 2.45%.

Legislative tasks for the realization of the rule of law In the search and seizure process of digital evidence

Legislative tasks for the realization of the rule of law In the search and seizure process of digital evidence

Forensic Analysis of the WhatsApp Application Using the National Institute of Justice Framework

The advancement of communication media has rapidly evolved with the emergence of various communication applications on smartphones, which have now surpassed mere communication functions to become complex social media platforms. This change has transformed the way we interact, not only through messages and voice but also through the exchange of videos and images. However, along with these developments, there has been a surge in digital crimes such as defamation, fraud, and drug trafficking. This investigation aims to compare the performance of forensic tools in obtaining digital evidence by utilizing applications like Mobiledit, Belkasoft, Mobile Forensic SPF, and Magnet Axiom, and by applying the National Institute of Justice framework, which consists of five stages: identification, collection, examination, analysis, and reporting. The output of the investigation is presented through reports and evidence, resulting in text chat files, contacts, images, audio, and view-once images. Forensic tools have a 100% success rate in finding pieces of evidence. The comparison of the four tools showed different percentages: Mobiledit Forensic 40%, Magnet Axiom 80%, Belkasoft 60%, and Mobile Forensic SPF 60% in obtaining evidence. Digital evidence can be used as strong support in court proceedings.

A digital forensic analysis of an electrocardiogram medical device: A first look

AbstractThe increased frequency and severity of cybersecurity incidents impacting healthcare organizations has prompted the publication of suggested best practices for these organizations, when attempting to respond to incidents in their respective settings. While these best practices provide a wealth of information on how to respond to a cybersecurity incident impacting medical devices, minimal information is provided related to the forensics investigation of the devices themselves. A growing appetite for digital evidence from medical devices, coupled with limited practical guidance from industry best practices prompts an investigation into identifying tools and techniques to assist digital forensic investigators with device disassembly, data acquisition, and preservation of evidence in medical devices. This paper presents the results of a detailed exploratory case study involving the digital forensic investigation of a General Electric MAC 800 electrocardiogram medical device. The contributions of this research are threefold. First, it provides an empirical demonstration of practical techniques for acquiring and examining residual data from the electrocardiogram medical device. Second, the research documents the artifacts that can be recovered from the medical device, which could be used as potential evidence. Third, it provides the foundation for future investigations regarding the tools and processes suitable for examining additional medical devices.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation Digital and Multimedia Science > IoT Forensics

Forensically analyzing IoT smart camera using MAoIDFF-IoT framework

IoT devices spread over a wide range of applications these days, and their vast amount of data generated becomes a target for intruders. IoT digital forensics, which involves extracting the digital evidence from the IoT device itself and/or its network traffic using a framework is important and challenging. The challenges include the diversity of types of IoT devices, resource constraints, and users’ privacy. In this article, we focus on network forensics investigations of smart camera traffic as a case study. The investigation process followed the MAoIDFF-IoT framework, a comprehensive and effective framework for IoT devices, and focusing on the locations of potential Artifacts of Interest (AoI). In addition, a few scenarios in using the camera are investigated to obtain a valuable artifact. The results show that it is possible to extract a few artifacts from the network captured traffic even though the traffic is encrypted. Moreover, this research offers guidelines for digital investigators to conduct network forensics on smart camera devices, with detailed results provided.

Using Blockchain Evidence in China’s Digital Copyright Legislation to Enhance the Sustainability of Legal Systems

To achieve sustainable development of social systems, it is necessary to modernize the legal system, which is the foundation of any society, to increase the efficiency of resources and simultaneously optimize the performance of the environment and society. The immutable and timestamped features of blockchain offer a robust solution for tracking and authenticating digital copyright evidence, thereby enhancing the integrity and transparency of judicial systems. This ensures that the integration of blockchain into legal systems not only advances technological efficiency but also promotes environmental consciousness. Through comprehensive analyses that integrate questionnaires, interviews, case studies and legislative assessments, this research reveals that there are still problems in the application of blockchain evidence in China’s judicial practice, such as insufficient and stable credibility, inadequate database storage, deficient original rights mechanisms, and the imperfect application of rules of evidence. These problems can be solved by enhancing correspondence legal systems, such as establishing an officially trusted copyright certificate blockchain, creating a blockchain copyright certificate technology supervision system and formulating specific laws and regulations on the application and identification of blockchain evidence. As such, our study contributes to aligning blockchain with judicial records, supporting the sustainable development goals of social systems, fostering institutional justice and social progress.

The Role of Digital Forensics in Criminal Investigations: An Analysis of Electronic Evidence in the Indonesian Legal System

Research on the use of digital forensic evidence in the process of investigating criminal acts, especially those carried out by the Police with their legal structure capabilities, aims to find out and analyze the extent to which evidence produced through digital forensics plays an important role in the process of proving criminal acts, the results of which become electronic evidence that has the strength of evidence in the applicable criminal procedural law. The type of research is normative (doctrinal), namely research that views law as building a system of norms. Digital forensics is an important instrument that helps investigators carry out research and investigation tasks, and it is an absolute requirement that must be met so that electronic documents can be used as evidence from the start of investigations, inquiries, prosecutions, and trials. The role of digital forensics in uncovering a criminal case starts from the preliminary stage, where investigators begin to collect evidence and electronic evidence assisted by one or more digital forensic experts. Digital forensics from the investigation stage is used to find material truth in every process of proving a criminal act.

Navigating the legal and technical challenges of Admitting Electronic records as Evidence: An analytical study

On the internet, nothing is immune. There is usually some element of surprise in cybercrime. Every person who uses the internet leaves traces of their online activity behind. The user can be located using these footprints. All of these might be gathered and utilized as digital evidence. Electronic evidence is a topic that is frequently discussed in India. However, Indian courts have always made an effort to make the legal situation clear, including the gathering procedure, admissibility, veracity, and relevance of electronic evidence. Few parts were still unclear, though. The purpose of this study is to describe the import of electronic evidence's admissibility and veracity from an Indian legal standpoint. Additionally, to examine the legislative actions made by the Indian Parliament and the rulings issued about electronic evidence by the Hon'ble Supreme Court of India. This essay examines the issue of when an electronic evidence certificate is necessary, what information should be included in such a certificate, which is qualified to provide such a certificate, and at what point it is needed. This study also tries to determine whether or not spoken testimony regarding the content of electronic evidence can be provided.

Advancing Justice Through Technology: A Comparative Analysis of Data-Driven Approaches to The Burden of Proof in Criminal Cases in The USA and Pakistan

In this paper, the burden of proof in criminal justice is examined concerning technological innovations: The United States and Pakistan A Comparative Analysis. This paper looks at how digital evidence, much like forensic technologies and AI have impacted the legal proceedings, especially on aspects of discovery up come to scrap for proof. The research uses a mixed methods approach through case analysis and interviews with legal professionals to illustrate some of the benefits and barriers on deploying technical solutions in criminal justice. The study concludes that these innovations improve the reliability and efficiency of legal processes while posing significant challenges for developing legals frameworks, reliable evidencing practice or regulations, as well as clear ethical standards. The findings illustrate the divide between digitally rich and poor law systems, highlighting that effective legal reforms must be accompanied by sustained training for justice sector officials with a nuanced approach buttressing core human rights such as data privacy or presumption of innocence. This research adds to the rich literature on technology in justice and provides important lessons for policy makers, legal professionals, academics who wish to transform the criminal justice system of the future by leveraging digital technologies.

Regarding the question of usage of open-source evidence in criminal proceedings

The article is devoted to the study of the issue of using open-source evidence in criminal proceedings. Attention is drawn to the lack of a universally recognized definition of the term “open-source information”, a list of fundamental features of this type of information is provided, among which are: 1) accessibility of the information to the general public; 2) the author of the information may not be determined; 3) access to information can be provided both on a paid and free basis. The lack of an adequate volume of legislation aimed at regulating the procedure for usage of open-source evidence is emphasized. A study of the Berkeley Protocol, which was created jointly by the University of California, Berkeley School of Law and representatives of the United Nations, was carried out. In particular, the following is outlined: a list of the principles enshrined in the Berkeley Protocol, divided into professional, methodological and ethical, their content; the investigation process put forward in the Berkeley Protocol, that consists of the following stages: 1) online inquiries; 2) preliminary assessment; 3) collection of information; 4) preservation of information; 5) verification of information; 6) investigative analysis. Problems that may arise in the process of using open-source evidence are emphasized. The requirements of propriety, admissibility and reliability of open-source evidence are studied. The state of legal regulation of the issue of the usage of open-source evidence in national legislation is considered. The specific features of electronic (digital) evidence are singled out, which distinguish them from other types of evidence and determine the need to separate them in the criminal procedural legislation as a different type of evidence. The practice of national and international judicial institutions related to the use of open-source evidence is considered. The special role of this type of evidence for establishing the corpus delicti or circumstances of crimes against the foundations of national security, especially since the beginning of full-scale Russian aggression against Ukraine, is emphasized.

Legal Provisions and Practical Effects of Burden of Proof in Online Copyright Infringement Cases Under China’s Copyright Law

This paper explores the legal provisions and practical effects of the burden of proof in online copyright infringement cases under China’s Copyright Law. With the rapid growth of digital technology and the increasing prevalence of online platforms, copyright infringement has become a significant challenge in China. The paper examines the specific rules set forth in the Copyright Law, particularly those that allow for a shift in the burden of proof upon the presentation of preliminary evidence by the copyright holder. It analyzes the impact of these provisions on both plaintiffs and defendants, highlighting the benefits of empowering copyright holders and the challenges associated with procedural fairness, evidentiary standards, and judicial consistency. The paper also discusses the evolving use of digital evidence, such as blockchain technology, and the need for clearer guidelines to balance the rights of all parties. Ultimately, it argues for continued refinement of the legal framework to ensure effective and equitable copyright enforcement in the digital age.

Forensic analysis and data decryption of tencent meeting in windows environment

Video conferencing applications have become ubiquitous in the post-COVID-19 era. Remote meetings, briefing sessions, and lectures are gradually becoming part of our culture. Thus, the amount of user data that video conferencing applications collect and manage has increased, and such data can be used as digital evidence. In this study, we analyzed Tencent Meeting, the most widely used video conferencing application in China, to identify the data stored on the user's disk by the application. Tencent Meeting stores user information and the chat history during a video conference on local storage. We found that Tencent Meeting suffers from a vulnerability in the process of encrypting and storing the user data, which can be exploited by anyone who can access and decrypt the user's data. We expect that our findings to help digital forensics investigators conduct efficient investigations when applications are used for malicious purposes.

Innovative strategies and forward thinking on China’s digital maritime law enforcement

In the digital era, the limitations of traditional maritime law enforcement models have become apparent. China actively promotes digital maritime law enforcement and has conducted thorough exploration across policy, technology, and legal domains. The primary legal foundation is the Coast Guard Law, bolstered by policy initiatives like the “21st Century Maritime Silk Road”, the “Maritime Community with a Shared Future” strategy, and the “Technology Empowers the Marine” plan. By coupling law and technology, China’s digital maritime law enforcement has innovatively established a three-dimensional enforcement model of “online + offline” at sea. It utilizes artificial intelligence to assist in maritime law enforcement decision-making, employs big data sharing for collaborative maritime law enforcement, and advances maritime compliance enforcement by digital technology. Through case analysis and effectiveness assessment, China’s digital maritime law enforcement has yielded significant results. Nonetheless, it also encounters various challenges, including data privacy infringement, cybersecurity attacks, the legitimacy of digital evidence collection, and data sharing barriers. Therefore, at the institutional level, standardizing digital maritime law enforcement procedures and establishing both horizontal and vertical coordination mechanisms are imperative. At the technical level, introducing privacy protection technologies and increasing investment in network security technologies are necessary. At the conceptual level, China should adhere to data ethics principles and strengthen awareness of open data sharing. The future of the oceans is digital, and China should advance the modernization of national maritime governance through digital maritime law enforcement.

The Landscape of Sexual Harm in the Video Game, Streaming, and Esports Community.

While sexual harm has been studied across a range of contexts, it has not yet been considered within the video game, streaming, and esports community. This study aimed to explore the landscape of sexual harm in this community, specifically, where it has been committed by esports professionals and video game live streamers. Fifty-five victim statements were extracted from online sources (such as Twitter/X and Reddit) and coded into variables relating to offender and victim demographics, offense characteristics, the offense process, and platform(s) used. Descriptive statistics were generated for each variable and Fisher's exact tests were conducted to examine the differences between adult-on-adult and adult-on-child cases. The findings reveal diverse offense outcomes across the sample, ranging from rape to sexual communication with a child. Some offense patterns can be seen in wider sexual offending literature, such as pre-offense alcohol consumption, offending against incapacitated victims (e.g., sleeping), and offending within an established romantic relationship. However, several offense process characteristics unique to the video gaming community were identified. These included offenders using their position of fame within the community to access victims and bypass the need for other coercive behaviors. Online offenses were more common with children and offenders demonstrated a preference for "live" methods, such as voice chat and video calling, rather than instant messaging or sharing images of themselves. This limits the digital evidence left behind and indicates the offenders' greater technological literacy. The study's findings shed light on the sexual harm that exists within this previously unexplored context and highlight areas where esports organizations, live-streaming platforms, and educational providers can do more to safeguard players, fans, and viewers in this community.

Reading class: Digital evidence about fiction and social class

Recent years have seen the return of social class to popular fiction with the success of international authors like Édouard Louis, Annie Ernaux, Sally Rooney and Douglas Stuart. In Scandinavia, working-class authors have topped bestseller lists since 2022 and have drawn attention in mass media. This study looks at readers of “class fiction” by analyzing data from the digital book platform eReolen. Using data for loan time and geographic municipality, I argue that the popularity of class fiction has been fueled by media attention and gain many of its readers from relatively prosperous areas in Denmark – as opposed to the people represented in the books.

Methods of Extracting and Analyzing Metadata for Evidentiary Purposes

This paper examines methods for extracting and analyzing metadata for evidentiary purposes in civil proceedings. Through a comprehensive review of current literature, legal cases, and forensic techniques, it explores the diverse approaches to metadata analysis across various digital domains, including file systems, emails, documents, web browsers, mobile devices, cloud storage, social media, and emerging technologies. The study highlights the critical role of metadata in establishing the authenticity, reliability, and chronology of digital evidence. It also addresses the challenges posed by encrypted data, large-scale analysis, and the need for robust quality assurance processes. The findings underscore the importance of adapting forensic methodologies to evolving digital landscapes while maintaining legal and ethical standards. This research contributes to the ongoing development of best practices in digital forensics and their application in civil litigation.

CRIMINAL LAW REFORMS IN RECENT TIMES: ISSUES AND CHALLENGES

Criminal law is basically a fundamental part of the judiciary system, which protects society and upholds justice. The main purpose of this law is to maintain social order and rehabilitate offenders. Ensures to protection of the rights of individuals and maintains rules regarding illegal and legal behaviour. In India criminal law protects citizens and improves overall justice delivery. The new criminal laws especially emphasize the human rights of the citizens and provide effective outcomes for victims. The modification and introduction directly contribute towards reducing the crime rate and ensuring India's justice system becomes more robust and simple. The importance of reforms and changes in the proper legislation process highlighted the fact that the existing laws are specially backdated. A certain colonial Era is directly reflected in the Justice system. Several old laws in the section have become irrelevant and undoubtedly delay the overall justice system. However, there is a certain concern which can reflect the criminal law reforms in India. Misuse of power by certain authorities and inappropriate implementation can cause severe consequences. The criminal law has been amended many times which enables a legal framework to maintain societal changes and emerging challenges along with technology advancement. When the criminal justice system came to deliver justice by mitigating delay and compliance it created a fair justice system for communities and people. The idea of reform of criminal law mainly emphasizes victim empowerment, modernized evidence rule and many more. Also, certain areas needed to be addressed such as accountability, transfer, privacy, freedom of speech, the potential for abuse and interpretation and implementation challenges. Recent significant criminal law reforms in India here will be discussed and challenges or issues will be identified properly. Bharatiya Nyaya Sanhita (BNS) replaced the Indian penal code (IPC) and mostly aimed to influence the severity of punishment and criminal offences. Bharatiya Nagarik Suraksha Sanhita (BNSS) is a modified version of the Code of Criminal Procedure (CrPC) which focuses on victim protection and streamlining investigations. The Latest version of the Indian Evidence Act is Bharatiya Sakshya Adhiniyam (BSA) which incorporates forensic advancements and digital evidence. Those laws have been implemented with several challenges and issues but they also foster the judiciary system of India. These new laws effectively prioritize victims' rights and developed Updater support mechanisms for them also simplify the legal processes by reducing delays.

حجية الدليل الإلكتروني أمام القضاء الإداري: دراسة مقارنة

This research comes as part and introduction to a master’s thesis in public law at King Abdulaziz University entitled “The Validity of Electronic Evidence before the Administrative Judiciary a Comparative Study by researcher Saeed Alghamdi and supervised by Associate Professor of Administrative Law, Dr. Alaa El Din Mohammed. There is no doubt that modern means of proof, especially those that are done via the Internet, are important in our contemporary society, what is called digital evidence, and due to the importance of digital evidence in proof, the research addressed the answer to the problem: To what extent is electronic evidence authoritative before the administrative judiciary? Many questions arise from it that do not go beyond this problem in their content. The researcher followed the comparative approach to answer the research question, as a comparison will be made between the Egyptian, Emirati and Saudi laws, and the researcher reached a number of results, the most important of which is that electronic evidence is considered independent evidence and has strong authoritativeness before the judiciary because the Saudi evidence system included electronic evidence as independent evidence and became like other evidence that is independent and it is valid to base the ruling on it and its provisions apply before the administrative judiciary by virtue of what is stipulated in the litigation system before the Saudi Board of Grievances. In light of the previous results, we recommend that the Saudi regulator add a paragraph in Article Nine of the Enforcement System stating that an electronic document authenticated electronically is considered an executive document.

The invisible evidence: Digital forensics as key to solving crimes in the digital age

Digital transformation rapidly changes how we live our lives in the post pandemic world. Unfortunately, digital technology is not limited to law abiding organisations and citizens. Criminal organisations and individuals are quick to identify new opportunities with new technologies, and digital transformation is dramatically changing the character of crimes, terror, and other threats. The fast emergence of new crimes is facilitated by possibilities brought by disruptive technologies such as AI, Internet of Things, drones, and cryptocurrencies that can be disastrous tools in the hands of criminals. Consequently, our society needs far better capacity to prevent and investigate criminal acts to protect organisations and citizens. This brings an urgent need to proactively reform digital forensics to significantly increase our capability to meet the strain on society brought by crimes evolving in the digital transformation era. The future of forensic science is already here, characterized by a mix of opportunities and challenges. It is essential to make it harder to effectively use digital technologies for criminal activities, while leveraging the possibilities of digital technologies by those affected, law enforcement agencies, business and organisations. As digital technologies continue to evolve, we need to stay up to date with the latest developments to effectively investigate and prosecute crimes in the digital age. There is an increased reliance on digital evidence, and the amount of heterogeneous digital evidence in criminal cases keep increasing. The forensic science techniques thus become more sophisticated and play an increasingly important role. However, the scientific area is extremely broad, and beyond the capability of most forensic science labs to keep up with the technology forefront development speed. Besides an urgent need to bring up the subject to the political arena, examples of how we can meet the challenges are discussed such as by extending our cooperation, encourage and facilitate cooperation for training and education to handle the extremely broad and rapid development, working out methods for explaining and visualising evidence for the treatment and legal values of digital evidence in prosecution, and cooperation between product developers and crime investigators for swift innovation of digital forensics tools and methodologies for quickly emerging threats. This paper will highlight specific examples where modern digital techniques are used to solve crimes in the physical world as well as crimes committed in the digital domain and discuss how “good AI” can be used to fight “evil AI” and finally touch on the sensitive balance between the increased power of the new digital forensic tools and private integrity.

An Object Based Decision Support Protocol for Multi- Constraint Agile Digital Forensics Investigation

The recent scenarios expressing live digital forensics and its applications in security domain with multiple constraint-based analysis. Many digital forensic tools available in the market helps to make a good analysis of various digital forensic situations but the awareness of the situation-based decision making is still an unsolvable issue in many critical forensic cases. As the digital forensic domain increases its scope to various business and computer related industries, leading market investors and the employees are much aware about the digital crimes and its prevention. Here in this article, we proposed a new protocol which can help the decision making of sensitive digital forensic cases by the involvement of various constraint-based evaluation. A multi constraint operational system proposed here for live digital forensic and the decision support system takes an object parameter while the decision-making procedure is implemented. Thus, the protocol introduced here may carry a set of rules where the object formation and decision support constraints bind together and it may reply on the digital forensic tool integration. The characteristics of this protocol is mainly distributed for situation awareness criterion evaluation and modelled to limit the amount of data retrieval and its acquisition. categorical acquisition of digital evidences through time, duration, devices involved, wings of affect, cause of the target, hacker/attacker/affected user, kind of attack are the constraints to be solved through this prototype. The focus of this prototype is for dynamic digital forensics instead classic forensics conducted on switched off devices. This protocol supports the standard organizational formats to follow the forensic procedures in which a detailed recommendations and documentation from various organizations. The standardized formats of National Institute of Standards and Technology (NIST), International Standards Organization (ISO), Global Professional Information Community (AIIM) and American Society for Testing and Materials (now ASTM International) into considered while developing this protocol.