Digital Forensic Analysis Research Articles

The role of Artificial Intelligence in Cyber Security and Incident Response

The escalating number and intricacy of cyber attacks have underscored the urgent requirement for innovative solutions to bolster the security of digital infrastructure. Among these solutions, Artificial Intelligence (AI) emerges as a promising technology with the potential to significantly enhance cyber security and incident response. It has the aptitude to improve the speed and accuracy of threat detection, response and mitigation while also reducing the workload on security professionals. This research paper focuses on the role of AI in key areas of cyber security and incident response, specifically vulnerability assessment, intrusion detection and prevention, and digital forensics analysis. It elucidates how AI, with its innate capabilities, can be a game-changer by empowering organizations to detect, respond to, and mitigate threats more effectively. However, AI is not a silver bullet for Cyber Security. Like any technology, it possesses its limitations and potential vulnerabilities. Consequently, this paper also addresses the need for ongoing development in the field of AI to overcome these limitations and challenges. By recognizing the need for continuous advancements, the research paper emphasizes the importance of future research and development efforts to maximize the potential benefits of AI in the realm of cyber security.

Digital forensics challenges and readiness for 6G Internet of Things (IoT) networks

AbstractThe development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

Digital forensics analysis based on cybercrime and the study of the rule of law in space governance

Abstract With the rapid development of social informatization, the Internet has become an important channel for global information dissemination. The wireless network space and the real space are intertwined and have a significant impact on the political, economic, and cultural aspects of international society. For example, it can effectively solve the problem of information exchange between cities, regions, and countries. Wireless network crime and wireless network space security issues involve the development of information technology in various countries and, more importantly, involve all aspects of national security. In the age of science and technology, the current situation of cybercrime can be expressed by data as follows: the online crime rate is high. According to relevant statistics, nearly 5 million Internet users are involved in various cases every year due to the use of the Internet. This article starts with the digital forensics of wireless network crime and wireless network security management systems and discusses the composition, characteristics, existing problems, and future development directions of the current wireless network security management system. By comparing the wireless network security laws of China and the United States, using the latent Dirichlet allocation (LDA)-Gibbs model and the k-means algorithm to analyze the data, this article provides guidance for future research on wireless network space governance. The combination of digital forensics analysis based on cybercrime and space governance can improve the level of public security work. At present, the world has made some progress in cyberspace, but it still faces severe challenges. In the face of new situations and new measures, it is necessary to strengthen legislation, improve relevant systems, and strengthen supervision capacity. At the same time, it is necessary to establish perfect technical means and safeguards to ensure that this goal can be achieved.

The Role of Digital Forensic Experts in Cybercrime Investigations in Indonesia Based on The Scopus Research Index

The development of information technology, besides having a positive impact, has negative impacts, such as an increase in cybercrime. Several parties are involved in handling cybercrimes in Indonesia, including expert witnesses in digital forensics. It is hoped that cybercrimes can be uncovered through a digital forensic approach. Research related to cybercrime and Digital Forensics in Indonesia is experiencing increasing growth from 2010 to 2021. A very rapid increase was shown in 2017. Through bibliometric analysis, you can analyze expert witnesses in the field of digital forensics by region in Indonesia, such as Sumatera, Western Java, Central Java, and Eastern Java. An expert witness in digital forensics must have technical skills in operating digital forensic tools and analysis and academic skills in uncovering crimes. The results of this study are very useful for law enforcement officers or lawyers in determining expert witnesses in the field of digital forensics. List of digital forensic experts in Indonesia who have been tested from their scientific studies by conducting various paper publications. So, law enforcement can synergize with digital forensic experts to solve cybercrime. One of the roles of a digital forensic expert is as an expert witness in court. Through research, it is hoped that there will be an increase in awareness of digital forensic experts to conduct scientific publications so that it is easier to be recognized by law enforcement and academics for updating methods and techniques of cybercrime investigation

Digital Forensic on Secure Digital High Capacity using DFRWS Method

As evidenced in the trial, between 2015 and the second quarter of 2022, there were 54 cases involving secure digital high capacity (SDHC) storage hardware as evidenced in trials. In 2021 there will be an increase in cases involving SDHC. The three cases with the highest number are corruption cases, special crimes, and ITE. SDHC is an advanced technology development of Secure Digital (SD) card hardware which functions as storage. SD Card only has a capacity of up to 2 gigabytes, while the largest SDHC capacity is 32 gigabytes. As a storage device that is small, thin, and has a fairly large capacity. this research needs to be done because of the increasingly widespread increase in cases involving SDHC. This study aims to perform digital forensic analysis on SDHC evidence using forensic applications that run on Linux, namely foremost and DC3DD. This study uses the DFRWS method to retrieve valid evidence in court. Based on the research conducted, it was found that the number of files that can be restored at the examination stage using foremost is 77%, and the accuracy of recovered files is 50% with string file hash validation. From this research, it can be concluded that the processing results of DC3DD and Foremost can be used as valid evidence.

Digital Forensic Analysis of Ransomwares for Identification and Binary Extraction of Cryptographic Keys

This article aims to show the use of digital forensic to recover the cryptographic key of files encrypted by ransomwares through identification, extraction and binary analysis of memory dumps

Managing Policing Demand for Digital Forensics through Risk Assessment and Prioritization in England and Wales

Abstract Digital forensic helps to unlock the evidential opportunities presented by digital devices. Ninety per cent of all cases in England and Wales carry a digital element and identifying the devices with the most evidential value is central to dealing effectively and efficiently with the demand for digital forensic (DF) analysis. This article offers an ethnographically informed, empirical analysis of how police requests for in-house DF examinations are organized in 35 forces in England and Wales, and the mechanisms, contexts, and challenges of managing-related internal demand, which have been rarely examined systematically in both policing and DF practitioner literature. The analysis illustrates how an updated understanding of risk and prioritization is needed to address the growing demand for DF analysis. The findings call for updated, systematic approaches that encourage the forecasting of internal policing demand collaboratively and bridge between the operational and the technical sides of investigations.

Digital forensic analysis of discord on google chrome

Over the past decade, social media applications have significantly increased their market share and garnered a wide user base. However, these applications have also attracted the attention of criminals desiring to exploit the apps to support illicit operations due to the low barrier to entry and ease of usage. A digital forensic investigation of these applications can reveal valuable information about criminal activity and the suspect. Discord is a Voice over Internet Protocol (VoIP) service that enables text, image, video, and audio chats. It has grown in popularity, and as a result, it is subject to increased use by cybercriminals. In this paper, we examine the remnants of the increasingly popular social media application ‘‘Discord” when used on the Google Chrome web browser. We recovered various artifacts such as payment information, sent messages, account settings, conversations, uploaded attachments, and much more, all of which could be utilized in a forensic investigation.

Digital Forensic Analysis on Mobile-based MiChat Services using National Institute of Standard Technology Method

Digital Forensic Analysis on Mobile-based MiChat Services using National Institute of Standard Technology Method

Review on effectiveness of deep learning approach in digital forensics

<p><span>Cyber forensics is use of scientific methods for definite description of cybercrime activities. It deals with collecting, processing and interpreting digital evidence for cybercrime analysis. Cyber forensic analysis plays very important role in criminal investigations. Although lot of research has been done in cyber forensics, it is still expected to face new challenges in near future. Analysis of digital media specifically photographic images, audio and video recordings are very crucial in forensics This paper specifically focus on digital forensics. There are several methods for digital forensic analysis. Currently deep learning (DL), mainly convolutional neural network (CNN) has proved very promising in classification of digital images and sound analysis techniques. This paper presents a compendious study of recent research and methods in forensic areas based on CNN, with a view to guide the researchers working in this area. We first, defined and explained preliminary models of DL. In the next section, out of several DL models we have focused on CNN and its usage in areas of digital forensic. Finally, conclusion and future work are discussed. The review shows that CNN has proved good in most of the forensic domains and still promise to be better.</span></p>

Investigating Wearable Fitness Applications: Data Privacy and Digital Forensics Analysis on Android

Wearable devices are becoming more and more prevalent in our daily lives as people become more curious about how well they are doing in monitoring, improving, or maintaining their health and fitness. Fitness trackers and smartwatches have become almost ubiquitous, so these devices have begun to play a critical role in forensic investigations. In this paper, the authors conducted a forensic analysis of the controlling applications for three popular fitness bands and smartwatches (i.e., Amazon Halo, Garmin Connect, and Mobvoi) on an Android smartphone device to (1) provide forensic investigators with a road-map of forensically relevant data that are stored within these applications and (2) highlight any privacy concerns that the stored data within these applications may present to the applications’ users. Our findings indicate that the three fitness applications store a wealth of user data. In particular, the Amazon Halo app stores daily, weekly, and monthly activity-related data for at least the last 13 days. The user’s Tone Analysis results were also recovered. The Garmin Connect application also records detailed user activity information, as it was possible to recover the last 15 days worth of user activity data. The Garmin Connect user’s general location was also determined via the application’s weather notification feature. Lastly, the Mobvoi application records all data points from the time the device is first used until the last time the device is used. These data points may include heart rates taken every 5 min and step counts. Our findings highlight the possibility of collecting personally identifiable information about users of these devices and apps, including their profile information, habits, location, and state of mind. These findings would be pertinent to forensic investigators in the event that these or similar applications are part of an investigation.

Digital Forensic Analysis on Mobile-based Facebook Messenger services using National institute of Standard Technology Method

Digital Forensic Analysis on Mobile-based Facebook Messenger services using National institute of Standard Technology Method

Foundations of cybercriminalistics: From general process models to case-specific concretizations in cybercrime investigations

Despite spectacular stories of successful cyber operations by law enforcement agencies, we continue to be extremely inefficient in fighting cybercrime. The research community has contributed many abstract models to guide digital forensic analyses, but these are usually too abstract to be helpful in concrete cybercrime investigations since they do not give an immediate and straightforward translation of a confronted (digital) crime scene into viable yet promising criminalistic actions. We propose a method to systematically bridge the gap between high-level process models and the demands of actual investigations. The idea is to encode phenomenon-specific knowledge of cybercrime into node-link representations, thereby literally mapping the digital crime scene in well-founded visual representations – so-called cognitive maps. These can be used to derive a prioritized plan of action for targeted acquisition and analysis of case-relevant artifacts. To illustrate our approach, we present a cognitive map for the category of botnet crime and evaluate it with the help of domain experts and by applying it to two real-world cases.

DiagAnalyzer: User behavior analysis and visualization using Windows Diagnostics logs

Windows Diagnostics, which is used by default in Windows 10 and Windows 11, records basic device information as well as various detailed user activities of those who use Windows. Previously, there have been several preceding studies that attempted to apply diagnostics information to digital forensics analysis, but there have been no practical methods or publicly available tools to analyze data in relation to user behavior. Therefore, this paper analyzed how three representative activities (attaching and detaching USB storage devices, web browser activities, and wireless network activities) are recorded in Window Diagnostics. Furthermore, based on the analysis results, we developed DiagAnalyzer, which automatically analyzes the diagnostics event log and visualizes the user's behavior. Through the methodology and tool of this paper, the application of Windows Diagnostics deserves further attention as an important artifact in digital forensics investigation for Windows in the future.

Forensic investigation of Google Meet for memory and browser artifacts

Web applications have experienced a widespread adaptation owing to the agile Service Oriented Architecture (SOA) reflecting the ever-changing software needs of users. Google Meet is one of the top video conferencing applications, especially in the post-COVID19 era. Security and privacy concerns are therefore critical. This paper presents an extensive digital forensic analysis of Google Meet running on multiple browsers and software platforms including Google Chrome, Mozilla Firefox, and Microsoft Edge browsers in Windows 10 and Linux. Artifacts, traces of potential evidence, are extracted from different locations on a client's desktop, including the memory and browser. These include meeting records, communication records, email addresses, profile pictures, history, downloads, bookmarks, cache, cookies, etc. We explore how different Random Access Memory (RAM) sizes of client devices impact the persistence and format of extracted memory artifacts. A memory artifact extraction tool is developed to automate the extraction of artifacts identified via unstructured string analysis. Google Meet forensic artifacts are critical in that they are potential digital evidence in relevant criminal investigations. Additionally, they highlight that user data can be extracted despite implementing multiple privacy and security mechanisms.

Digital forensic analysis of mobile automotive maintenance applications

Mobile applications regarding automotive maintenance have gained popularity among many automobile users. These applications may store digital forensics artifacts about the mechanics and movements of the vehicles such as GPS coordinates, vehicle health reports, or speed values which can be valuable for investigating a broad category of cases such as traffic incidents, insurance disputes, or criminal offenses. This study presents the forensics artifacts that can be identified in three automobile maintenance apps and provides guidance about the required technical procedures for the extraction and analysis of these artifacts. On the other hand, although increased utilization of mobile and IoT technologies creates additional opportunities for collecting more artifacts as evidenced in this study, they will cause more burden on the backlogs of forensic labs. This study also proposes a guideline about how to align manual and logical extraction procedures with the digital forensics life-cycle that includes the triage and other follow-up steps.

Forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications.

Digital forensic analysis of videoconferencing applications has received considerable attention recently, owing to the wider adoption and diffusion of such applications following the recent COVID-19 pandemic. In this contribution, we present a detailed forensic analysis of Cisco WebEx which is among the top three videoconferencing applications available today. More precisely, we present the results of the forensic investigation of Cisco WebEx desktop client, web, and Android smartphone applications. We focus on three digital forensic areas, namely memory, disk space, and network forensics. From the extracted artifacts, it is evident that valuable user data can be retrieved from different data localities. These include user credentials, emails, user IDs, profile photos, chat messages, shared media, meeting information including meeting passwords, contacts, Advanced Encryption Standard (AES) keys, keyword searches, timestamps, and call logs. We develop a memory parsing tool for Cisco WebEx based on the extracted artifacts. Additionally, we identify anti-forensic artifacts such as deleted chat messages. Although network communications are encrypted, we successfully retrieve useful artifacts such as IPs of server domains and host devices along with message/event timestamps.

Forensic Analysis of Electronic Mail Messages

E-mail has revolutionized business, academic, and personal communication. The advantages of e-mail include speedy delivery, ease of communication, cost effectiveness, geographical independence, and the portability of mailboxes. The last two are the biggest advantages over snail mail. However, with e-mail comes the threat of a genuine user being compromised through key loggers, social engineering, shoulder surfing, password guessing and other similar, though less technical, methods. This passive espionage can have a direct impact on the genuine user in terms of denial of information, loss of money, loss of time, mental harassment and an attack of personal privacy. To enable digital forensic analysis of e-mails, we propose behavioral biometric based authentication, which is analogous to a signature in paper documents. Keyword: E-mail, forensics, threats, digital analysis, security cyber crimes

Digital forensic analysis of intelligent and smart IoT devices

Digital forensic analysis of intelligent and smart IoT devices

Explainable digital forensics AI: Towards mitigating distrust in AI-based digital forensics analysis using interpretable models

The present level of skepticism expressed by courts, legal practitioners, and the general public over Artificial Intelligence (AI) based digital evidence extraction techniques has been observed, and understandably so. Concerns have been raised about closed-box AI models’ transparency and their suitability for use in digital evidence mining. While AI models are firmly rooted in mathematical, statistical, and computational theories, the argument has centered on their explainability and understandability, particularly in terms of how they arrive at certain conclusions. This paper examines the issues with closed-box models; the goals; and methods of explainability/interpretability. Most importantly, recommendations for interpretable AI-based digital forensics (DF) investigation are proposed.