Digital Evidence Research Articles

Digital Evidence in Foreign Jurisdiction and Quality of Justice

In an increasingly interconnected digital world, the concept of the right and access to digital evidence from a foreign jurisdiction has emerged as a fundamental human rights issue in the globe. This right asserts that individuals and/or States should have the right to access information stored beyond their national borders, reflecting the globalized nature of data storage and its profound implications for ensuring justice in true sense universally. This article explores the legal framework and associated challenges of the right to online evidence under international law. International human rights instruments, including the Universal Declaration of Human Rights and the International Covenant on Civil and Political Rights, provide a foundationfor its recognition. However, the extraterritorial nature of online information storage and States’ reluctance question the quality of justice globally resulting in a complex landscape. On top of that the challenges associated with this right include conflicts of jurisdictions, issues of state sovereignty, and the extraterritorial application of domestic laws. Case studies involving cross-border data access also illustrate the complexities involved. Furthermore, the paper discusses the potential discriminatory consequences of this asymmetry, as jurisdictions with greater access to online evidence may enjoy a distinct advantage in legal proceedings involving foreign parties. This raises questions about the fairness and impartiality of the global legal system and underscores the need for international cooperation and equitable frameworks for evidence sharing.

The Challenges of Collecting Digital Evidence Across Borders

In the modern world, the use of ICT communication technologies has become an integral part of life. ICT infrastructure is the bearer of digital traces of both legal and illegal activities performed through it. However, for something to become digital evidence, it must be obtained by law and by a person authorised by law. Namely, the virtual infrastructure, especially the Internet and the new challenges brought to us by cloud architectue due to its physical positioning outside national borders, calls into question the legality of searching and collecting digital evidence outside national borders. This paper analyses the legal basis for collecting digital evidence in cyberspace internationally, such as the Council of Europe Convention on Cybercrime, the US Cloud Act, the Australian Decryption Act and the European GDPR. Although the Court of Justice of the European Union declared invalid the decision of the European Commission (EU) 2016/1250 on the adequacy of data protection provided through the EU-US Privacy Shield, experts must not stop looking for a solution to the apparent problem. The paper intends to support decision-makers in taking clear national positions regarding the above controversial legal norms and their mutual conflict. The paper compares the legal consequences of such collection, and the acceptability of such digital evidence, and such collection may also be associated with a breach of the privacy of a legal and private entity.

Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems

With the continuously increasing number of security incidents targeting sensors, embedded devices, and other electronics appliances and systems that comprise the so-called Internet of things (IoT), the field of IoT forensics emerged as a branch of digital forensics focusing on the investigation of attacks in the IoT ecosystem. Digital evidence authenticity, integrity, confidentiality, and privacy are among the factors affecting the investigation process in IoT forensics, which can be addressed by employing the blockchain as the means not only for the preservation of digital evidence, but also for other steps of a digital forensics investigation process. The high-level goal of the paper is three-fold: to establish a holistic IoT forensics process as a reference point against which blockchain integration patterns and best practices will be identified in order to yield a robust, widely accepted and scalable architecture of the blockchain-enabled solution; to integrate the blockchain with the proposed IoT forensics process for addressing the above challenges; and to evaluate the overall solution highlighting improvements and potential performance bottlenecks. The proposed blockchain-enabled platform leverages multi-access edge computing and has been implemented with Hyperledger Fabric on an extensive virtualized testbed providing a realistic smart home environment. A thorough evaluation was conducted with real cyber-attacks generating digital evidence at high rates for testing the platform’s behavior at high load. The experimental results showed that the proposed platform achieved high throughput, excessively low latency, and zero error rate in the operation of the blockchain network.

Data Integrity Testing of Digital Evidence Data Capture Results on Private Cloud Computing Services

Private Cloud has better advantages than other cloud services because private cloud is managed and run by the company itself so that cloud needs can be tailored to the company's needs, but allows abuse from within the company itself, as in the case study simulation of a Gojek startup company. This case occurred because of a security weakness in the system so that internal people took advantage of these weaknesses for their own benefit by leaking confidential data, acquisitions were carried out to prove and find evidence of crime, acquisitions used live acquisition techniques, namely acquisitions on an ongoing system, namely monitoring network traffic using Wireshark tools , the method in this case uses the Digital Forensics Investigating Framework (DFIF), data integrity must be properly maintained when acquiring digital evidence because to maintain the authenticity of the digital evidence obtained, then data integrity is tested on the digital evidence obtained, testing is carried out on digital evidence before and after the acquisition to see if there is a change in data integrity, the research results show that there is no change in data integrity.

A Review on Software Quality Forensics: Techniques, Challenges, and Limitations

Software quality forensics plays a vibrant role related to software quality, security, and integrity. The paper aims to derive a software quality forensics model through existing software quality models and their factors. The papers explore quality models, factors, approaches, tools, techniques, and standards regarding software quality investigation and confine the research area for software quality integrity breach forensics. The explore the deviations of quality attributes, standards, factors, and artifacts, it leads to further investigation of root-cause followed by digital evidence procedure for alleged software quality issues. Therefore, there is a need for a software quality forensics model and dedicated standards to fulfill the digital evidence procedure validation, satisfiable, and prosecution in the court of law in the context of alleged or illegal activity investigation quality of software. The paper has derived the techniques, challenges, and limitations of software quality forensics based on the review of research questions.

Quality Assurance in Digital Forensic Investigations: Optimal Strategies and Emerging Innovations

Digital forensic investigations are critical in modern law enforcement, cybersecurity, and legal proceedings. Ensuring digital evidence’s accuracy, integrity, and reliability is paramount in these contexts. This review article explores the challenges and best practices associated with quality control in digital forensic investigations and the emerging technologies that are reshaping the field. The article begins by discussing the foundational concepts of quality control in digital forensics, emphasizing the need for standardized procedures, documentation, and validation techniques. It delves into the potential sources of errors and bias that can arise during the acquisition, preservation, analysis, and presentation of digital evidence. It highlights the importance of continuous monitoring and review to mitigate these risks. The review article further examines the evolving landscape of digital forensic tools and technologies advancing quality control efforts. It covers advancements in data acquisition methods, including live forensics and memory analysis, and discusses the role of artificial intelligence and machine learning in automating quality control processes. The integration of Blockchain and cryptographic techniques for ensuring the integrity of digital evidence is also explored. In addition, the article addresses the challenges and opportunities presented by cloud computing, IoT devices, and the proliferation of digital data sources. It emphasizes adaptability and agility in quality control approaches to accommodate the changing digital landscape. Through a comprehensive analysis of established practices and emerging technologies, this review article offers practitioners, researchers, and policymakers’ insights into enhancing the reliability and trustworthiness of digital forensic investigations. By adopting robust quality control measures and embracing innovative technologies, the digital forensics community can ensure its findings hold up to scrutiny in the courtroom and beyond.

From data to decisions: Empowering brownfield redevelopment with a novel decision support system

This research evaluates a novel decision support system (DSS) for planning brownfield redevelopment. The DSS is implemented within a web-based geographical information system that contains the spatial data informing three modules comprising land use suitability, economic viability, and ground risk. Using multi-criteria decision analysis, an evaluation was conducted on 31,942 ha of post-industrial land and around Liverpool, UK. The representativeness and credibility of the DSS outputs were evaluated through user trials with fifteen land-use planning and development stakeholders from the Liverpool City Region Comined Authority. The DSS was used to explore land use planning scenarios and it could be used to support decision making. Our research reveals that the DSS has the potential to positively inform the identification of brownfield redevelopment opportunities by offering a reliable, carefully curated, and user-driven digital evidence base. This expedites the traditionally manual process of conducting assessments of land suitability and viability. This research has important implications for assessing the impact of current and future planning policy and the potential for the use of digital tools for land use planning and sustainability in the UK and globally.

Electronic evidence in criminal proceedings: problematic issues of theory and practice

The article summarises the scientific developments regarding the concept and essence of electronic evidence and provides the author’s own definition to the concept of “electronic (digital) evidence” in criminal proceedings; examines the regulatory framework for the use of electronic (digital) evidence in criminal proceedings; analyses the investigative and judicial practice and the practice of the Supreme Court regarding the admissibility of such evidence in criminal proceedings.
 It has been admitted that today the problem of regulating electronic (digital) evidence is relevant. The analysis of the Criminal Procedure Code of Ukraine makes it possible to understand that electronic (digital) evidence has almost no legal regulation, which negatively affects the quality and effectiveness of criminal proceedings. As a result, a number of legislative contradictions arise. Unlike other procedural laws (commercial, civil and administrative), criminal procedural legislation does not contain any provisions on electronic (digital) evidence. At the same time, there are positive trends at the legislative level to recognise the need to regulate electronic (digital) evidence in criminal proceedings.
 It has been determined that today there is no unified approach among scholars to understanding the concept, features and place of electronic evidence in the system of sources of evidence in criminal proceedings. It is proposed to use the term “electronic (digital) evidence” at the legislative level. This is substantiated by the fact that “electronic” indicates the type of device with which the evidence was created and stored, and “digital” refers to the type of recording the formation on the relevant device. 
 The analysis of investigative and judicial practice has highlighted the ambiguity in the understanding of law enforcement officers regarding the collection of electronic evidence. This issue was the subject for consideration by the judges of the Criminal Court of Cassation of the Supreme Court (in particular, the procedure for assessing electronic evidence and its admissibility was explained in the decision of the Joint Chamber of the Criminal Court of Cassation of the Supreme Court dated 29 March 2021 in case No. 554/5090/16-к).
 Taking into account international experience in collecting electronic (digital) evidence allows the use of the Berkeley Protocol in criminal proceedings in Ukraine, as it is actively used by the international community and is relevant in the context of russia’s armed aggression against Ukraine.

DEAD FORENSIC ANALYSIS OF QUTEBROWSER AND LIBREWOLF BROWSERS USING THE NIST 800-86 METHOD

A browser is software used to access web pages to obtain clear and readable information. Information resources are identified by a Uniform Resource Identifier (URI) and can be web pages, images, videos, or other content. When a browser user engages in online activities, they usually leave traces on the device such as history, cookies, cache files, and even emails and passwords. Such traces can usually help users access a website or input something, such as emails and passwords. The purpose of this research is to obtain digital evidence in the form of a cache on the hard disk in the Librewolf and Qutebrowser browsers. In this study, researchers used the National Institute of Standards and Technology (NIST) 800-86 method which consists of four stages, namely collection, examination, analysis, and reporting. which focuses on the Qutebrowser and LibreWolf browsers. The results obtained from this study were found to be 21 caches, 2 Sessions, 6 Cookies, 8 Network Persistent State, 9 QuotaManager, 11 IndexedDB, 24 LevelDB, 48 Cache Storage, 14 Favicons, 3 History, 6 Database, 3 StartupCache, 4 Alternate Services, 6 Content-Pref, Notification amounted to 1, Permission amounted to 7, Service Worker amounted to 6, SiteSecuristyServiceState amounted to 7, Webappstore amounted to 8, Sessionstore-Backups amounted to 5, Storage amounted to 47 NIST 800-86 method can be properly used in the acquisition of digital evidence and the most crucial data obtained in the Librewolf browser on the telegram and whatsapp sites.

Comparative Study of Cloud Forensic Investigation Using ADAM And NIST 800-86 Methods in Private Cloud Computing

As information technology advances, associated risks also increase, particularly in the field of private cloud computing services. These services are subject to potential internal abuse risks, either due to system vulnerabilities or other factors. However, the investigation of these incidents in private cloud computing varies greatly due to the different frameworks and unique characteristics of each cloud service. The lack of a standardized approach to analyzing and assessing investigative processes in cloud computing services has been a persistent problem. This lack of consensus affects the accuracy, efficiency, and data acquisition process when dealing with digital evidence in each method, causing concern among researchers. To overcome this, a comparative study was carried out with a focus on the ADAM (The Advanced Data Acquisition Model) method and the NIST (National Institute of Standards and Technology) method. The goal is to identify the most effective investigative process to deal with cyber attack incidents on both the server and client side of cloud computing services. By testing these methods in a network that is built on private cloud computing services, then the results from this research include the weaknesses and strengths of the ADAM and NIST methods are found when applied to cloud computing case studies and these have not been identified in previous research, then produce recommendations for investigators when conducting investigations on case studies on cloud computing, and in this study managed to find a bug in the ownCloud application version 10.9.1. Then this study also aims to provide researchers with valuable references to carry out analysis and assessment in the investigative process, where standardization is still an unresolved issue.

Identification of data wiping tools based on deletion patterns in ReFS $Logfile

Data wiping tools permanently delete files by repeatedly overwriting data on a digital device, making file recovery impossible. Unlike the conventional deletion methods, which merely remove the file system pointer to the data, these tools are designed to entirely and irretrievably erase the data. This method can be exploited to obliterate evidence of a crime. Given the growing prevalence of such tools, a comprehensive analysis of permanent deletion behavior is essential, especially concerning the Resilient File System (ReFS). In this study, we propose a method for detecting user behavior concerning data wiping tools and algorithms in ReFS 3.7. Our approach relies on the fact that file modifications are logged in the redo record of the $Logfile, and that the opcode value of the redo record varies depending on the data wiping tool used. Since opcodes were only analyzed up to version 3.4, we analyzed the newly updated opcodes. Initially, we selected the 12 most commonly used data wiping tools for our research. In the pattern analysis phase, we applied the algorithms supported by each tool, generating a distinct deletion pattern for each one. This was accomplished by utilizing consecutive opcodes to formulate the patterns and monitor transitions in file and directory names. The patterns discerned in the $Logfile allowed us to determine which data wiping tool was deployed. The proposed methodology simplifies the identification of not only which data wiping tool has been used, but also the specific deletion behavior exhibited. We developed a tool incorporating the proposed method. Our subsequent verification confirmed the effectiveness of our methodology and tools in accurately detecting the use of comprehensive deletion tools. These findings contribute valuable insights to the acquisition of digital evidence of user deletion behavior in ReFS. Our proposed methodology will help digital forensic examiners in the detection and identification of data wiping tools' behavior.

“Must the Police Refuse to Look?”

Courts in Canada are dealing more frequently with an old problem in a new guise: civilians bringing police digital evidence that engages a suspect’s privacy interest (text messages, email). Do police carry out a seizure when they receive it or a search when they proceed to review it, even briefly? Should police ‘refuse to look’ before obtaining a warrant or other authorization? If so, why? What measure of protection would calling this a search or seizure under section 8 of the Charter afford Canadians? The Supreme Court of Canada has yet to decide these issues directly, and trial, appeal courts, and commentators have offered widely diverging responses to the questions they raise. In doing so, courts and commentators alike have lost sight of the Supreme Court’s principled approach to what constitutes a search or seizure and when it will be reasonable. Applying this approach in R v Marakah, McLachlin CJ in obiter held that receiving a text exchange from a third party would require police to obtain a warrant before reading it, but she provided no rationale. This article articulates the Court’s principled approach and shows why diverging approaches among recent courts and commentators are not compelling. More crucially, given how central digital communication has become to all of us, the article sets out a rationale for insisting on a warrant before police review texts or photos, and what is at stake in failing to provide this vital safeguard.

A Formal Treatment of Expressiveness and Relevanceof Digital Evidence

Digital investigations are largely concerned with reconstructing past events based on traces in digital systems. Given their importance, many concepts have been established to describe their quality—most of them concerned with procedural aspects, i.e., authenticity and integrity, for example. Besides that, there exist principal concepts that have been overlooked in the past: Two of those criteria are relevance and expressiveness of digital evidence. Unlike others, those are directly concerned with reaching the investigative goal. Therefore, we approach these two overlooked concepts of digital evidence by giving formal definitions. To illustrate the usefulness, we present two applications: First, we demonstrate that the notions of expressiveness and completeness can be used to guide investigations by presenting the Facet-oriented Criminalistic Cycle as a thinking model, which extends the well-established criminalistic cycle. Second, we put the concepts into practice by calculating the expressiveness of facets from a state machine representation of a digital system utilizing temporal logic and a model checker. Furthermore, we sketch out the implications of this improved way of defining relevance and expressiveness. Accordingly, this article aims to improve the understanding of these critical aspects of the overall investigative process.

Social Media Metadata Forensic Ontology Model

The escalating use of compact electronic gadgets like smartphones and smartwatches, along with social media platforms, has led to a new dimension of criminal activities. Advancements in digital forensics, which investigates digital evidence, have become noteworthy. Researchers David Christopher Harrill and Richard P. Mislan devised Small-Scale Digital Device Forensics (SSDDF) for examining miniature digital devices used in criminal undertakings. Edlira Kalemi and Sule Yildirim-Yayilgan demonstrated the application of ontology in social media forensics, deciphering Android system frameworks related to social media data extraction. However, their investigations mainly focused on social media, overlooking the role of gadgets used by criminals and victims. Extracting digital data from these devices remains pivotal for securing relevant evidence from social media. Notwithstanding, incorporating SSDDF and understanding Android system structures have significantly contributed to digital forensic methodologies. These enhancements can bolster the investigation process, capturing and analyzing critical digital evidence from compact electronic appliances and social media platforms. The advent of SSDDF and elucidating Android system structures have offered invaluable inputs to digital forensics, enhancing efficacy in amassing significant evidence from small electronic devices and social media platforms.

Forensic Digital Analysis of Telegram Applications Using the National Institute Of Justice and Naïve Bayes Methods

Currently, Telegram is an instant messaging application that is often used by the Indonesian people as a means of long-distance communication with other users. Telegram also has good security features to protect all data from its users. However, Telegram has a positive impact on its users. This security feature can be used by several people to protect against digital crimes, especially cases of sexual harassment. To overcome the existing crimes, analysis, and forensic methods are needed to help solve crimes. This research is guided by the investigation process using the National Institute Of Justice (NIJ) method and the Naïve Bayes method to classify the conversations found. It can be concluded that MOBILedit Forensic Express has a poor performance in finding digital evidence in the Telegram application and FTK Imager is very good at finding digital evidence in the Telegram application. In this research, the classification process using the Naïve Bayes method has been able to classify conversations that contain sexual harassment or not. Evaluation of the classification method uses a confusion matrix to determine the best classification model.

LAVA: Log Authentication and Verification Algorithm

Log files provide essential information regarding the actions of processes in critical computer systems. If an attacker modifies log entries, then critical digital evidence is lost. Therefore, many algorithms for secure logging have been devised, each achieving different security goals under different assumptions. We analyze these algorithms and identify their essential security features. Within a common system and attacker model, we integrate these algorithms into a single (parameterizable) “meta” algorithm called LAVA that possesses the union of the security features and can be parameterized to yield the security features of former algorithms. We present a security and efficiency analysis and provide a Python module that can be used to provide secure logging for forensics and incident response.

A Critical Look at the Jurisprudence of the Suspect’s Right to Participate in a Seizure of Digital Evidence

A Critical Look at the Jurisprudence of the Suspect’s Right to Participate in a Seizure of Digital Evidence

Propuesta metodológica para la generación de soportes que apoyen la recolección de evidencia digital, en entidades del sector financiero

With the development of this article, a methodology is proposed that supports commercial and business processes for companies in the financial sector, as an alternative to face the high rates of cybercrime reported in recent years, ensuring orderly and articulated execution, among the different dependencies, to mitigate the impacts of an attack, in addition to facilitating the identification and collection of digital evidence for forensic investigation processes in cases in which it is demonstrated that an incident has occurred that violates cybersecurity mechanisms, this is a Currently a dominant need, because due to the social changes resulting from the pandemic, more and more people find themselves in need of resorting to digital infrastructures to access financial services and electronic commerce platforms. Based on the analysis and in accordance with the financial context, a review of documents recovered from digital repositories is carried out to identify the main computer infringements related to the materialization of financial crimes. By way of the scientific impact achieved through this research work, a starting point is established through which it is possible to reinforce the computer security of management systems in companies in the financial sector, complementing it with the generation of supports that can be used as digital evidence in an eventual forensic investigation process, it is also evidenced the need to implement a holistic vision in the processes, which allows an efficient response to IT security needs.

A bibliometrics analysis of multimedia forensics and deep learning research based on Scopus index

Forensics of digital data are concerned with identifying, acquiring, processing, analysing, and reporting on electronic data. Multimedia forensics focuses on investigating computer crimes using forensic methods. The analysis of multimedia evidence is the role of multimedia forensics, on the other hand. In the analysis, digital evidence is evaluated scientifically to maintain its integrity, to find its source, and to authenticate it. There are several methods in multimedia forensics, such as the implementation of deep learning. The purpose of this research is to conduct bibliometric analysis in multimedia forensics and deep learning by using the data gathered from Scopus index on the keyword “multimedia forensics and deep learning”. The result is 68 relevant papers were found in the range of 2017-2022. The results of this research can be used by researchers as a reference when conducting research and determining the research themes to be pursued.

Algorithmic futures: the intersection of algorithms and evidentiary work

ABSTRACT The role of algorithms in decision-making is now so consequential that we agree that algorithmic systems must be designed, implemented, and managed in ways that are understandable to interested parties. Anchored in a tradition of capturing, contextualizing, and preserving evidence of analog and digital technologies, this article draws out the roles adopted or tried on by the recordkeeping professions to account for algorithmic systems as they communicate and represent meaning in the world. We begin by delineating a promising role for recordkeeping professions as algorithmic conceptualizers. We show how expertise in evaluating recorded information provides a method to conceive or model algorithms from an accountability and transparency perspective. Then we delineate a breakthrough role for recordkeeping professionals as algorithmic historicizers, revealing how the professions’ curation of records of human actions extends to the capture and preservation of algorithms for purposes of critical review. Finally, we delineate an emerging role for recordkeeping professionals as algorithmic sponsors involved in harnessing algorithmic tools to manage and make accessible other forms of digital evidence at scale. In articulating such roles, our goal is to examine the opportunities inherent in harnessing the relationships that form at the intersection of algorithmic activity and evidentiary work.