Digital Evidence Research Articles

Evaluasi Protokol Pengumpulan Bukti Forensik Dalam Kasus Pemerkosaan: Meningkatkan Kualitas Bukti dan Akurasi Identifikasi Pelaku

Handling rape cases requires effective forensic evidence collection to ensure justice for victims and truth disclosure in court. This study aims to evaluate protocols for collecting forensic evidence in rape cases, focusing on enhancing evidence quality and perpetrator identification accuracy. The evaluation method involves analyzing the implementation of existing protocols, including procedures for collecting and analyzing relevant physical, biological, and digital evidence in the context of sexual crimes. The study's findings indicate that increasing training and awareness of updated protocols can significantly improve the quality of collected evidence and the accuracy of perpetrator identification. These findings highlight the importance of collaboration among investigators, forensic experts, and other authorities in improving and implementing effective protocols for handling rape cases. This research provides a foundation for ongoing improvements in forensic procedures to enhance justice for victims of sexual crimes and overall community safety.

Finding the criminal within: the use and meaning of digital evidence at trial

Finding the criminal within: the use and meaning of digital evidence at trial

Certain aspects of criminal evidence and digital evidence

Certain aspects of criminal evidence and digital evidence

Criminal law and procedural characteristics of war crimes in Ukraine (after the full-scale invasion of the russian federation into Ukraine)

Criminal law and procedural characteristics of war crimes in Ukraine (after the full-scale invasion of the russian federation into Ukraine)

Development of Xiaomi Product Mobile Forensic Acquisition Framework on Second Space Features Based on SNI/ISO 27037:2014

Abstract — In conducting digital forensic activities, it must follow the rules of SOP procedures or frameworks as a reference. One of the acquisition frameworks used in digital forensics practice is ISO 27037:2014, which contains specific guidelines related to digital forensic investigation activities. On the other hand, mobile cellular is one of the branches of digital forensics that is always developing, but with the large variety of mobile devices today, ISO 27037: 2014 has not provided specific standards in the digital forensics process on mobile devices that have special features that are different from ordinary mobile devices. One of the special features provided by Xiaomi vendor developers that gives users access to cloning and creating new space in one mobile phone is called second space or second space. With this, it will be a problem for investigators when conducting forensic processes because the data acquisition process will produce 2 extraction results from one mobile device, but the SNI ISO 27037: 2014 standard has not regulated the validity of digital evidence obtained from these special features. This research will develop a framework in conducting the investigation process on Xiaomi mobile devices, because currently only Xiaomi mobile devices have a second room feature. By paying attention to the existing problems, this research will develop a framework in carrying out the acquisition process on xiaomi mobile devices on the special features of the second room based on SNI ISO 27037: 2014. It is hoped that this research can help investigators, especially DEFR (Digital Evidence First Responder) and can be a reference that can be used in the process of searching for electronic evidence that is in accordance with SNI ISO 27037: 2014 and can be accounted for in court.

Cybercrime Intention Recognition: A Systematic Literature Review

Cybercrime Intention Recognition: A Systematic Literature Review

Automotive digital forensics through data and log analysis of vehicle diagnosis Android apps

Modern vehicles including smart cars have been equipped with many electronic devices such as electronic control units (ECUs), on-board diagnostics (OBD) systems, telematics and infotainment systems, gateways, sensors, etc. Because these devices create, transmit, and store a lot of digital data, modern vehicles are becoming key source of digital evidence in vehicular forensics. In addition, some dedicated mobile apps can capture driving and diagnostic data from a vehicle via a Bluetooth-enabled OBD-II scanner. In this paper, we propose a new process for effective automotive forensics. It collects and analyzes three different types of data left on an Android phone which has been connected to the OBD-II port of a vehicle via Bluetooth communication. The three types of data are OBD-II Android apps' data, Bluetooth HCI snoop log, and the main log buffer of the Android logging system. By analyzing them individually and integratedly, we find Bluetooth connection time, vehicle information, MAC address of the OBD-II scanner, vehicle velocity, sharp speeding event, sudden braking event, refueling event, and so on. We also construct a timeline of Bluetooth traffic and driving events through the timeline analysis, which can be used to determine the driver's behaviors in terms of vehicle forensics.

Blockchain-based Pipeline Custody System (BPCS) for Preserving Critical Video Evidence

<p>The explosive development of network technology has driven the evolution of civilization, leading to the higher crime rate. Hence, CCTV cameras have been widely deployed to monitor criminal behaviors. The video of CCTV is considered as significant digital evidence. Due to the property of digital data, it is easily to copy and modify without electronic footprint, unlike the physical records. In case, the law enforcement starts to employ the blockchain technique due to its advantages, decentralization, transparency, and traceability, which can improve the legal effect. Unfortunately, blockchain network produces the tremendous overhead when it processes the data preservation based on the distributed communication. Thus, the gap and burden of data synchronization are the derivative issues. In order to solve the above problems, we aim to realize a blockchain-based pipeline custody system, so-called BPCS. The critical frame determination (CFD) technique is designed to catch the potential evidence image from the monitor, which is able to mitigate the storage cost of blockchain. Especially, the pipeline and directional ring strategy is proposed to aggregate the potential evidence in a batch file. This can reduce the burden on the chain of custody and shorten the time gap. The experimental results have demonstrated that BPCS can firmly possess the features of credibility and efficient through the comparisons and storage simulation.</p> <p> </p>

Towards Digital Forensic Readiness: A Framework for Financial Service Providers

Digital Forensic Readiness has widely been referred to as an organization’s ability to proactively capture digital evidence and as a result, incur minimum costs of investigation in the event of incidents. However, several organizations still underestimate the usefulness of setting up their environments to be forensically ready until an incident occurs, and this often results in huge losses and costly investigations. Global trends show that financial institutions are amongst the worst-hit companies by cybercriminals, and this is attributed to one of the key motivations for cybercrime, which is financial gain. Kenya’s cybercrime statistics over the past five years also show that financial services remain amongst the top hit sectors by cybercriminals. The aim of this study was to develop a Digital Forensic Readiness framework for Financial Services Providers. To achieve this, the study assessed the relevant existing frameworks to explore their strengths and gaps. Additionally, the study explored the current state of forensic readiness in Kenyan financial institutions by reviewing secondary data and analysing primary data collected from respondents in the financial services sector. The study adopted a descriptive research design with the main data collection tool being questionnaires, which were administered to respondents through an online survey. The collected data was analysed using the SPSS software 28.0.1 and a multiple regression analysis was performed to determine the influence of organizational factors, legal factors, technology, and policies on Digital Forensic Readiness. The outcome of the analysis indicated that these factors indeed had a significant effect on forensic readiness, with organizational factors and policies having more impact on the framework. The study recommended that organizations not only focus on complying with laws and implementing technological controls, but also prioritize improving forensic readiness awareness and culture, supporting forensic readiness activities, setting up training, and enforcing policies to ensure personnel compliance

Forensic Investigation of Digital Evidence on Flash Disk with Forensic Process Method Based on NIST

Flash disk merupakan barang yang tidak lepas dari kehidupan sehari-hari. Dengan Flash disk pengguna dapat menyimpan beberapa daya penting baik bagi pribadi maupun perusahaan. Selain itu, tidak dapat disangkal bahwa banyak kasus-kasus hukum di Indonesia yang menjadikan Flash disk sebagai barang bukti. UU ITE (Undang-undang Informasi dan Transaksi Elektronik) mengatur tentang bagaimana ketentuan bagaimana barang bukti digital menjadi barang bukti yang kuat di persidangan. Penelitian ini melakukan studi investigasi forensik terhadap bukti digital pada Flashdisk dengan empat skenario percobaan. Pengolahan forensik digital menggunakan metode forensic process berdasarkan panduan NIST (National Institute of Standards and Technology). Penelitian ini menghasilkan analisis dimana barang bukti yang diolah dengan skenario 1 dan 4 merupakan barang bukti digital yang valid dan sah untuk diajukan ke persidangan sedangkan barang bukti 2 dan 3 merupakan barang bukti yang tidak sah.

A hybrid artificial intelligence framework for enhancing digital forensic investigations of infotainment systems

Infotainment systems in vehicles have become important sources of digital evidence in forensic investigations. Analyzing data from these systems can provide valuable insights into a suspect's activities and interactions. In this paper, we propose a hybrid artificial intelligence (AI) framework that combines unsupervised learning using K-means clustering and language model analysis to enhance the forensic analysis process. The proposed methodology was applied to two distinct datasets from Hyundai and Mitsubishi infotainment systems. In the Hyundai dataset, the recall for contact names and phone numbers improved by 18% and 3% respectively when compared to clustering alone. Similarly, in the Mitsubishi dataset, the recall of song names improved by 2%. In addition, this hybrid approach enabled the discovery of more forms of forensically-relevant data stored in the infotainment systems, such as geographical locations and connected devices, that would have been infeasible to find with either manual analysis or clustering alone. Despite the presence of some hallucinations, the combination of these techniques resulted in improved ease of analysis and increased recall, demonstrating the potential of this hybrid approach in forensic investigations.

CYBERCRIMES, LAW, AND CYBER FORENSICS: COMPARATIVE STUDY OF INDIAN, BRITISH, AND AMERICAN CONTEXTS

New forms of crime have emerged with the rising prevalence of computer misuse. Some of them include the use of cutting-edge tools and methods for criminal conspiracy. From spreading fraud through email to stealing and reselling intellectual property, cybercrime covers a lot of ground. The domain of computer science known as "cyber forensics" is considered to be among the most essential subfields. It is concerned with the investigation of cybercrime. The concept of cyber forensics is broken down into its parts by the author in this paper. This paper focuses on the significance of the topic as well as some of the methods and instruments that are used by cyber forensic investigators. The objective of cyber forensics is to conduct an examination of electronic content in a manner that is forensically sound with the goals of preserving, recovering, analyzing, identifying, and presenting facts and views about digital information. Cyber forensics evidence undergoes the same processes as other digital evidence and serves as supporting evidence in judicial proceedings. Cyber forensics is often linked to the investigation of cybercrime, but it may also be utilized in legal actions involving private parties. This paper demonstrates the necessity for further investigation into how cyber forensics might be used to enhance the identification of cybercrime. This research will help fill in some of the gaps in our knowledge of how cyber forensics investigations are conducted in India and explore cyber security policy in the United Kingdom, the United States, and India to identify both similarities and differences. Keywords: Cybercrime, Cyber Forensics, Policy

SAFEGUARDING FORENSIC EVIDENCE USING BLOCKCHAIN TECHNOLOGY

Digital evidence is important when investigating cybercrime because it can be used to link criminal s to victims. As digital evidence passes through various stages of the chain of custody during a criminal investigation, ensuring its integrity, authenticity and investigation is crucial. A security certificate is required to ensure that the data containing the evidence remains secure during and after processing. The system called Digital Threat Investigator developed in this project is built on Hyperledger Fabric, a permissioned network that requires the permission of all users. Access control, channel authorization and participant configuration are very important in order to effectively solve the privacy and confidentiality problem. Blockchain can also be used to store and distribute valuable information. The raw forensic data is fragmented, stored in the cloud and linked to the blockchain in Digit al Threat Investigator, and the usage history of the raw data is also stored in the blockchain. These t wo processes are integrated to ensure scalability and traceability of data entry. Programming is done using WordPress, HTML, CSS and PHP. The results of the experiment show that latency continously decreases as the number of nodes in the blockchain decreases. The results show that the time increases from 150ms to 353ms as the number of nodes increases from 1 to 8. The system has proven to be a useful tool to assist digital forensics and ensure the security of forensic evidence. Key Words: Blockchain, Cyber Crime, Information Security, proof of concept, blockchain technology; Ethereum.

Mobile Forensics in Financial Fraud Analysis

Mobile forensics, a critical component of digital forensics, is essential for investigating and analyzing digital evidence pertinent to financial fraud security. This guide delineates key steps and methodologies, with a focus on device identification, secure data extraction, password decryption, cloud and deleted data analysis, timeline reconstruction, network and geolocation analysis, app and social media investigations, and comprehensive reporting. The operational process involves acquiring mobile devices, analyzing file systems for financial data, extracting and decoding relevant information, verifying findings, collaborating with network forensics for broader insights, and presenting conclusive results. Mobile forensics plays a pivotal role in uncovering evidence for financial crimes, ranging from fraudulent transactions to data breaches, where mobile devices serve as critical tools. Specialized techniques in mobile forensics contribute significantly to meticulous and successful investigations aimed at mitigating financial fraud risks. Keywords- Mobile Forensics, Data, Analysis, Extraction, Evidence, Financial fraud

Crime Analysis and Prediction

Data Mining in Crime analysis is a systematic approach to identifying and analyzing patterns and trends in crime. With the increasing adoption of computerized systems, Data Mining in Crime analysis can assist law enforcement in predicting crime. This technique plays a key role in cyber forensics. Cyber forensics involves the collection and analysis of digital evidence to detect and document a cybercrime or security breach. Data mining techniques can help investigators extract valuable insights from the large volume of data typically collected during a cyber forensics investigation. Keywords: Data mining, crime, pattern, analysis, cyber, Forensics, detect, document, breach, security.

Forensic Analysis of File Exfiltrations Using AnyDesk, TeamViewer and Chrome Remote Desktop

The use of remote desktop applications has increased greatly in recent years, mainly because of the generalization of telecommuting due to the COVID-19 pandemic. This process has been carried out in a very controlled manner in some companies, but in other organizations it has been introduced in a more anarchic way. The direct use of on-premises company computers and resources from the internet without the necessary protection mechanisms, including VPNs, has increased the risk of data exfiltration. Apart from other types of data exfiltration, there are cases in which employees transfer files using encrypted communications, consciously or unconsciously, producing a leak of information undetected by data loss prevention systems. In this paper we analyse the question of whether a forensic investigation may answer questions about data exfiltrations; questions such as those regarding the when, what and who (or to whom) and the use of application logs and other available tools. The answers to these questions may form the basis of solid digital evidence for legal purposes, though they may only deliver a partial response to said questions. Other complementary sources are necessary to build a complete answer and accurate digital evidence. Nevertheless, we have identified and analysed several use cases that may help to raise an early alarm that can offer warning about certain behaviours in encrypted traffic that may be detected via network monitoring.

Application Of Electronic Evidence As Extension Of Legal Civil Evidence Divorce Cases In Indonesia

Electronic evidence serves as a crucial component in civil trials, such as divorce cases, offering comprehensive proof to sway judges and ensure justice and legal certainty for involved parties. Nonetheless, disagreement persists regarding its classification, whether as supplementary or primary evidence, posing significant questions within formal and material law. This study employs normative juridical legal research, which scrutinizes theories, concepts, legal principles, and statutory regulations pertinent to the subject. Under Article 5(1) of the ITE Law, electronic evidence, including electronic information, documents, and their printouts, is recognized as valid legal evidence, extending the scope of admissible evidence in Indonesia. Formal requirements for electronic evidence, or digital evidence, need not be in written form; printouts are considered presumptive or preliminary evidence. However, material requirements stipulate that digital evidence must guarantee authenticity, integrity, and availability, often necessitating testimony from digital forensic experts. This dual nature of electronic evidence highlights its importance and complexity in contemporary legal proceedings, demanding a nuanced understanding and application within the framework of Indonesian law.

Comparative analysis of software used in anonymised search and seizure cases: acquisition, examination and analysis

It is discussed that within the production of digital evidence, the use of forensic software to support the acquisition, examination and analysis of evidence in a correct manner plays a role of great importance, mainly to maintain the credibility of evidence and its acceptance in the judiciary. The objective is to evaluate a sample of real judicial search and seizure cases that occurred between 2014 and 2023, presenting the forensic software used in each stage of each evaluated case. A random selection of one case will be made for each year, with anonymised data, to carry out a continuity analysis of the software used. The article seeks to identify whether these software remain in force or whether it has been discontinued, rendered obsolete or replaced over the selected sampling period, The research is structured in operational stages, starting with the selection of cases until the analysis of software continuity, revealing a predominance of software with valid status and indicating a tendency to update technological solutions in the field of digital forensics. The results also highlight the need for periodic reviews of the solutions that exist in the market. Based on the sample analyzed, the software evaluated shows, in their majority, continuity, with 87.5% of the solutions considered current when adding the software in force and replaced. This study contributes to the understanding of the evolution of forensic software by offering details on the status of continuity of such software for the digital evidence production process and the respective credibility of the acceptance of evidence in the judicial environment.

Sentiment analysis of tweet content on Hurricane Dorian: Sensemaking in digital journalistic inquiry ecology

Twitter is a powerful digital journalistic instrument and evidence shows journalists were transferring authority to Twitter. With journalistic information ecology becoming imbalanced, it is valuable to research how journalists may use Twitter to discover accurate and reliable information and maintain a vast overview of news events without shifting the power as the fourth estate. The purpose of this study is to provide a possible digital journalistic inquiry model to identify trending topics, distinguish reliable journalistic information while maintaining the balance of journalistic information ecology. Utilizing a large-scale dataset – 1.2 million tweets collected from Twitter API – this study executed cutting-edge network analysis and sentiment analysis to fill in the knowledge gap through a case study on Hurricane Dorian. The study found that the impact of traditional opinion leaders on information diffusion is declining. On the contrary, top in-degree centrality users play more important roles in information diffusion on Twitter. Moreover, tweets with negative polarity opinions were retweeted more. In addition, non-opinion leaders’ negatively polarized tweets were retweeted more than positively polarized ones, although it is not the same case with opinion leaders. With the change of journalistic ecology, identifying top in-degree centrality users and examining their tweets will provide useful resources for journalists to identify keywords, trending themes and predict how likely a topic may interest audience based on degree of polarity and number of retweets on Twitter. The results provide useful patterns for journalists to follow in sensemaking tasks in digital journalistic inquiry.

Trends, Challenges and Opportunities of Engaging Digital Forensics for Cybercrime Investigations

The use of digital forensic tools and techniques has continued to evolve as the security community makes efforts to stay ahead and mitigate cyber crimes. These tools and techniques are assisting cybersecurity experts and law enforcement in identifying fraudsters and protecting data by utilizing techniques such as digital traces left by data processing and storage. This paper identifies the peculiarities of digital forensics as a field of study, explores trends, challenges and opportunities presented by digital forensic tools in investigating cyber crimes. We carried out a systematic literature review of applicable tools and techniques. Our research identified challenges affecting the use of digital forensics in investigating cybercrime, and capture comprehensively the pulse of the domain. Recommendations were made that digital forensics lack a unified formal representation of standardized procedures and knowledge for analyzing and gathering digital artifacts. This inevitably causes incompatibility and conflict within various digital forensics tools. This leads to errors in the interpretation and analysis of digital artifacts due to lack of standardized or formalized procedure for analyzing, preserving, and collecting digital evidence is absent. Keywords: Cybercrimes, Police, Cyber Security, Challenges, Techniques CISDI Journal Reference Format Adams Terrence Addey (2024): Trends, Challenges and Opportunities of Engaging Digital Forensics for Cybercrime Investigations – A Review. Computing, Information Systems, Development Informatics & Allied Research Journal. Vol 15 No 1, Pp 1-.8. dx.doi.org/10.22624/AIMS/CISDI/V15N1P1x. Available online at www.isteams.net/cisdijournal