Digital Forensic Analysis Research Articles

A digital forensic analysis of an electrocardiogram medical device: A first look

AbstractThe increased frequency and severity of cybersecurity incidents impacting healthcare organizations has prompted the publication of suggested best practices for these organizations, when attempting to respond to incidents in their respective settings. While these best practices provide a wealth of information on how to respond to a cybersecurity incident impacting medical devices, minimal information is provided related to the forensics investigation of the devices themselves. A growing appetite for digital evidence from medical devices, coupled with limited practical guidance from industry best practices prompts an investigation into identifying tools and techniques to assist digital forensic investigators with device disassembly, data acquisition, and preservation of evidence in medical devices. This paper presents the results of a detailed exploratory case study involving the digital forensic investigation of a General Electric MAC 800 electrocardiogram medical device. The contributions of this research are threefold. First, it provides an empirical demonstration of practical techniques for acquiring and examining residual data from the electrocardiogram medical device. Second, the research documents the artifacts that can be recovered from the medical device, which could be used as potential evidence. Third, it provides the foundation for future investigations regarding the tools and processes suitable for examining additional medical devices.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation Digital and Multimedia Science > IoT Forensics

“Cutie, click on the link”: A forensic analysis of URLs

This article presents an examination of the technological components of the online sexual grooming abuse process. While much of the existing literature on online grooming and child exploitation focuses on the broader behavioral patterns of offenders, our study examines the specific affordances of Information and Communication Technologies (ICT) that enable and exacerbate these behaviors. Through a multidisciplinary lens, we conducted a digital forensic analysis of 371 URL links obtained from two studies with active online groomers. The analysis reveals that online groomers use URLs to engage in social engineering, distribute malware, solicit Child Sexual Abuse Material (CSAM), and share images. These findings suggests that previous models and stage descriptions of the online grooming process overlook how different ICT tools can be adopted and adapted to facilitate the online grooming and abuse process. We draw on the technology acceptance model to explain that the perceived affordances of a platform, particularly those that facilitate covert or malicious activities, are likely to influence offenders' choices in using these ICTs. The implications of these findings extend to theoretical, methodological, and policy considerations.

In the time loop: Data remanence in main memory of virtual machines

Data remanence in the physical memory of computers, i.e., the fact that data remains temporarily in memory even after power is cut, is a well-known issue which can be exploited for recovering cryptographic keys and other data in forensic investigations. Since virtual machines in many aspects mimic their physical counterparts, we investigate whether data remanence is also observable in virtual machines. Using KVM as an example of virtualization technology, we experimentally show that it is common for a substantial amount of volatile data to remain in the memory of virtual machines after a reboot. In digital forensic analysis scenarios such as malware analysis using virtual machines, our observations imply high risks of evidence contamination if no precautions are taken. So while the symptoms of data remanence in virtual machines are similar to physical machines, the implications for digital forensic analysis appear very different.

Comparison Study of NIST SP 800-86 and ISO/IEC 27037 Standards as A Framework for Digital Forensic Evidence Analysis

Comparison Study of NIST SP 800-86 and ISO/IEC 27037 Standards as A Framework for Digital Forensic Evidence Analysis

A holistic digital forensic analysis of Discord - Storage, memory, and network perspectives.

In the last decade, the market share and user base of social media applications have witnessed significant growth. However, this surge in popularity has inadvertently drawn the attention of criminals aiming to exploit these platforms for illicit activities. The forensic examination of these applications emerges as a pivotal avenue for uncovering valuable insights into criminal behavior and identifying suspects. Discord, a social media platform, has become a significant focal point for such illicit activities. In this paper, we examine the remnants of Discord on both Windows and Linux operating systems, employing storage, memory, and network analysis techniques to review the remnants of Discord. Our investigation reveals a range of crucial artifacts that have been successfully recovered across all three areas of analysis, including login and payment details, chat history, account information, and much more. Collectively, these artifacts constitute a valuable resource for forensic investigations, allowing the reconstruction of most of the user's activity.

Unveiling Digital Document Manipulation: A Case Study in Forensic Examination

The ease of creating digital documents due to today’s technological advancements has led to a surge in white- collar crimes involving forgery and manipulation. Detecting these digital document alterations presents a unique set of challenges to forensic investigators. The present study aims to uncover a forgery in a digitally manipulated document and demonstrate the successful detection of digital document alterations. This study examines a real- life case to explore the methods utilized by forensic experts in detecting and evaluating document forgery. It highlights the crucial role of digital forensic analysis in contemporary investigative procedures. This research emphasises the significance of understanding document forgery and the need for robust forensic techniques in detecting digital manipulation. Ensuring the integrity of digital documents is crucial in maintaining trust and reliability in today’s information-driven era.

Experiences of Burnout, Post-Traumatic Growth, and Organisational Support in Police Officers Working in Specialised Units: An Interpretative Phenomenological Analysis

Repeated exposure to traumatogenic material is a part of every working day for police officers in specialist units, such as forensic scene investigation and digital forensic analysis, with recent years marking an increase in its volume and intensity (Office for National Statistics (2018). While this may be considered a price paid for choosing to pursue careers in these areas, it is likely to have a significant impact on a professional and personal level, with psychological and physical effects extending beyond the individual’s working hours (Burns et al. in Traumatology 14:20–31, 2008). On the other hand, this important work may contribute to elements of growth and self-development, recognised in existing literature as post-traumatic growth (Tedschi and Calhoun in SAGE Publications, Inc, 1995). The present study adopted a qualitative approach to understanding the lived experiences of seven digital forensic analysts and two forensic scene investigators. Semi-structured interviews explored the impact of their work, as well as their coping strategies and perceived organisational support. Using interpretative phenomenological analysis (IPA), the study yielded rich personal accounts and identified three superordinate themes: “The effects are inevitable”, “Creating a safe environment”, and “Sense of responsibility and personal growth”. Participants described the inevitable effects of their work, along with their coping strategies developed in response to these. Furthermore, participants considered the safety of their work environment and relationships with their colleagues, while also reflecting on their experience of personal growth through their exposure to adversity. Findings are discussed in relation to theoretical and practical implications, as well as directions for future research.

An abstract model for digital forensic analysis tools - A foundation for systematic error mitigation analysis

As automation within digital forensic tools becomes more advanced there is a need for a systematic approach to ensure the validity, reliability, and standardization of digital forensic results. This paper argues for intermediate output in a standardized format within digital forensic tools to allow a methodical approach to tool validation that targets errors at each stage of processing. To achieve this, a detailed process model of digital forensic analysis tools is created, extrapolating the details of the internal processes performed by monolithic forensic tools. The research deconstructs the process flow within tools and presents an ‘abstract digital forensic tool’, revisiting earlier abstraction layer ideas. This not only identifies the interconnected processes within tools but allows discussion of the potential error that could be introduced at each stage, and how it could potentially propagate within a tool. A demonstration, with a dataset, is also included, structurally annotated using Cyber-investigation Analysis Standard Expression (CASE).

ANALISIS BUKTI DIGITAL PADA APLIKASI DISCORD DESKTOP DENGAN MENGGUNAKAN FRAMEWORK DFRWS

A Currently, various communication platforms are available, and one of them is Discord. Discord is utilized by users to interact and share various types of content. However, Discord is often implicated in the distribution of inappropriate content that goes against Discord regulations. This can lead to cybercrime cases such as Child Sexual Abuse Material (CSAM). The main challenge faced is the recovery of digitally deleted data through these communication platforms. The objective of this research is to analyze digital evidence in the form of deleted text messages, images, and documents in the chat rooms of the desktop-based Discord application. The research method employed is the Live Forensic Technique, applying the DFRWS (Digital Forensics Research Workshop) method. The digital forensic analysis process is conducted using the digital forensic tool Magnet Axiom. The research results indicate that the accuracy of digital evidence analysis using Magnet Axiom reaches 94.11%. A total of 16 digital evidence items were successfully recovered out of the total 17 items available

Digital forensic analysis of attack detection and identification in private cloud environments for databases

Digital forensic analysis of attack detection and identification in private cloud environments for databases

Natural Language Processing Applied to Forensics Information Extraction With Transformers and Graph Visualization

Digital forensics analysis is a slow process mainly due to the large amount and variety of data. Some forensic tools help categorize files by type and allow automatization of tasks, like named entity recognition (NER). NER is a key component in many natural language processing (NLP) applications, such as relation extraction (RE) and information retrieval. The introduction of neural networks and transformer architectures in the last few years made it possible to develop more accurate models in different languages. This work proposes a reproducible setup to build a forensic pipeline for information extraction using NLP of texts. Our results show that it is possible to develop both NER and RE models in any language and tune its hyper-parameters to achieve state-of-art performance and build comprehensive knowledge graphs, decreasing the amount of time required for human supervision and review. We also find that solving this task in phases can further improve the performance, not only for digital investigation applications, but also for general-purpose information extraction and analysis.

A Digital Forensics Model for the Examination of QR Code and Android App to Investigate Aadhaar Card Identity Fraud

There are various new-age crime rackets reported with the help of digital technology and such cases are routinely investigated by the police and digital forensics analysts. In the course of investigation of different rackets such as Aadhaar card, ATM card, PAN card, ration card, voter identity card, passport, fake Indian currency note, various electronic gadgets such as mobile phones, laptops, desktops, biometric scanners, GPS devices, SIM cards, portable skimmers and hi-tech printers are usually taken from the fraudsters for digital forensics analysis. In one case, some Aadhaar cards, mobile phones, laptops, SIM cards and memory card were seized from some suspected airline passengers by the law enforcement agency. All the key probe elements were received for digital forensics examination. In this paper, we propose a digital forensics model for decoding a distorted QR code and specialized Android app used in the creation of fake Aadhaar cards. This model comprised a new algorithm to decode QR codes and recovery of background data including resources associated with the QR code. The proposed model was tested with a QR code retrieved from a suspect’s laptop and Aadhaar card document. The Android app used for preparation of fake Aadhaar card was analyzed in our model and also checked in a mobile phone to verify data generated through the app. The result of the analysis detects fake Aadhaar cards. Further, examination of mobile phones and laptops revealed various technical data, supporting link evidence for preparing disputed fake Aadhaar cards for ID proof.

To have or have not: Limiting the data available for subsequent use by the police

In search of evidence in criminal investigation police often collect data in bulk, and the question addressed concerns whether the bulk data as a whole or only in part may be deemed available for subsequent use. The article suggests that only data exposed to the police in the digital forensic analysis performed as part of the investigation, should be deemed available for subsequent use. Such data are termed digital assessed information and are contrasted to data whose content is not known to the police. The latter should be deleted or made inaccessible for further use once the original case is finalised. The position is anchored in the criminal procedural principles of purpose limitation and purpose orientation, recognised in case-law related to Article 8 European Convention of Human Rights (ECHR), further validated in considerations of fairness and coherence with the rules for use of excess information in intercepted communications.

Virtual reality forensics: Forensic analysis of Meta Quest 2

The Meta Quest 2 is one of the most popular Virtual Reality (VR) entertainment headsets to date. The headset, developed by Meta Platforms Inc., immerses the user in a completely simulated environment. Some VR environments can be shared over the Internet to allow users to communicate and interact with one another and share their experiences. Unfortunately, the safety of these VR environments cannot always be guaranteed, generating a risk that users may be exposed to illicit online behaviour in the form of online harassment, grooming, and cyberbullying. Therefore, forensic examiners must be able to conduct sound forensic analysis of VR headsets to investigate these criminal investigations. In this study, we conduct digital forensic acquisition and analysis of the Meta Quest 2 VR headset. Analysis of the forensic image exemplified that there were several digital artefacts relating to user activities, device information and stored digital artefacts that can be extracted in a forensically sound manner. The main contributions of this study include a detailed description of the forensic acquisition process, identification of internal file storage locations, and recovery and analysis of digital artefacts that can be used to aid VR forensic investigations.

Post-mortem digital forensic analysis of the Garmin Connect application for Android

The Garmin Vivosmart 4 smartband can monitor various health metrics, including heart rate, oxygen saturation, body composition, and stress levels. It is a quite popular fitness tracking device, as its Android companion application – Garmin Connect – has been downloaded more than 10 million times and can provide critical forensic artifacts such as timestamped GPS-based locations. In this work, we analyze the Garmin Connect application to identify i) relevant digital forensic artifacts, and ii) assess methods to retrieve cloud-based data relevant to a digital forensic examination. For this purpose, we first establish a test scenario where the paired device/application collects data in regular real-world situations using a rooted smartphone running Android 11. The smartphone is then examined to gain insights into the data stored by the application and identify meaningful digital artifacts.To ease and automate the task of digital forensic practitioners, we have developed the Garmin Connect for Android Analyzer (GC4AA) set of Python 3 modules tailored for the digital forensic framework Android Logs Events And Protobuf Parser (ALEAPP). These open-source modules parse dumps of a Vivosmart 4 data directory and create reports displaying several digital artifacts, such as health metrics, GPS data and routes, and phone notifications. They automate the information-gathering process and produce a report specially tailored for Garmin Connect data, highlighting the most relevant artifacts. Our results show that the analysis of paired Garmin Collect/Vivosmart 4 with GC4AA can yield more digital forensic artifacts than existing open-source tools, including the following new artifacts: i) Daily Summary data; ii) GPS data; iii) Response Cache data; iv) Network Logs; v) Facebook API tokens; vi) Device Synchronization cache; vii) SpO2 reading charts. Our contributions include a graphical presentation of the collected data, greatly improving its readability and analysis.

Ontology-based case study management towards bridging training and actual investigation gaps in digital forensics

The training programs in digital forensics have contributed many case study models to guide digital forensic analyses. However, they only account for a small number of real cases and they are usually too abstract while actual cybercrime investigations are more diverse and complex. This gap leads to difficulties in giving immediate and straightforward actions for law enforcement during cybercrime investigations. In this paper, we propose an ontology-based knowledge map model, which is a foundation model for building a case study management system for Digital Forensic Intelligence (DFINT) and Open Source Intelligence (OSINT) in digital forensics. The main idea of this proposed model is to encode specific training cases of cybercrime into knowledge map representations, then the system uses the knowledge from the ontology to provide more information on the context and enrich them to match actual cybercrime scenes. Therefore, this approach can be used to bridge the gap between training case studies and the actual investigation environment. To illustrate our approach, we build a DFOSINT ontology for DFINT and OSINT domain; develop a prototype of the case study management system, and evaluate it in two aspects, ontology validation and case study validation with existing case studies of digital investigations.

Digital Forensic Analysis of Vehicular Video Sensors: Dashcams as a Case.

Dashcams are considered video sensors, and the number of dashcams installed in vehicles is increasing. Native dashcam video players can be used to view evidence during investigations, but these players are not accepted in court and cannot be used to extract metadata. Digital forensic tools, such as FTK, Autopsy and Encase, are specifically designed for functions and scripts and do not perform well in extracting metadata. Therefore, this paper proposes a dashcam forensics framework for extracting evidential text including time, date, speed, GPS coordinates and speed units using accurate optical character recognition methods. The framework also transcribes evidential speech related to lane departure and collision warning for enabling automatic analysis. The proposed framework associates the spatial and temporal evidential data with a map, enabling investigators to review the evidence along the vehicle's trip. The framework was evaluated using real-life videos, and different optical character recognition (OCR) methods and speech-to-text conversion methods were tested. This paper identifies that Tesseract is the most accurate OCR method that can be used to extract text from dashcam videos. Also, the Google speech-to-text API is the most accurate, while Mozilla's DeepSpeech is more acceptable because it works offline. The framework was compared with other digital forensic tools, such as Belkasoft, and the framework was found to be more effective as it allows automatic analysis of dashcam evidence and generates digital forensic reports associated with a map displaying the evidence along the trip.

Digital forensic analysis of the private mode of browsers on Android

The smartphone has become an essential electronic device in our daily lives. We carry our most precious and important data on it, from family videos of the last few years to credit card information so that we can pay with our phones. In addition, in recent years, mobile devices have become the preferred device for surfing the web, already representing more than 50% of Internet traffic. As one of the devices we spend the most time with throughout the day, it is not surprising that we are increasingly demanding a higher level of privacy. One of the measures introduced to help us protect our data by isolating certain activities on the Internet is the private mode integrated in most modern browsers. Of course, this feature is not new, and has been available on desktop platforms for more than a decade. Reviewing the literature, one can find several studies that test the correct functioning of the private mode on the desktop. However, the number of studies conducted on mobile devices is incredibly small. And not only is it small, but also most of them perform the tests using various emulators or virtual machines running obsolete versions of Android. Therefore, in this paper we apply the methodology we presented in a previous work to Google Chrome, Brave, Mozilla Firefox, and Tor Browser running on a tablet with Android 13 and on two virtual devices created with Android Emulator. The results confirm that these browsers do not store information about the browsing performed in private mode in the file system. However, the analysis of the volatile memory made it possible to recover the username and password used to log in to a website or the keywords typed in a search engine, even after the devices had been rebooted.

IoT forensics: Exploiting unexplored log records from the HIKVISION file system.

CCTV surveillance systems are IoT products that can be found almost everywhere. Their digital forensic analysis often plays a key role in solving crimes. However, it is common for these devices to use proprietary file systems, which frequently hinders a complete examination. HIKVISION is a well-known manufacturer of such devices that typically ships its products with its proprietary file system. The HIKVISION file system has been analyzed before but that research has focused on the recovery of video footage. In this paper, the HIKVISION file system is being revisited regarding the log records it stores. More specifically, these log records are thoroughly examined to uncover both their structure and meaning. These unexplored pieces of evidence remain unexploited by major commercial forensic software, yet they can contain critical information for an investigation. To further assist digital forensic examiners with their analysis, a Python utility, namely the Hikvision Log Analyzer, was developed as part of this study that can automate part of the process.

Enhancing Microsoft 365 Security: Integrating Digital Forensics Analysis to Detect and Mitigate Adversarial Behavior Patterns

This research article investigates the effectiveness of digital forensics analysis (DFA) techniques in identifying patterns and trends in malicious failed login attempts linked to public data breaches or compromised email addresses in Microsoft 365 (M365) environments. Pattern recognition techniques are employed to analyze security logs, revealing insights into negative behavior patterns. The findings contribute to the literature on digital forensics, opposing behavior patterns, and cloud-based cybersecurity. Practical implications include the development of targeted defense strategies and the prioritization of prevalent threats. Future research should expand the scope to other cloud services and platforms, capture evolving trends through more prolonged and extended analysis periods, and assess the effectiveness of specific mitigation strategies for identified tactics, techniques, and procedures (TTPs).