Digital Forensic Examiners Research Articles

THE ROLE OF DIGITAL FORENSIC IN REVEALING CRIMINAL ACTS OF ONLINE PROSTITUTION AT KEPOLISIAN DAERAH JAWA TIMUR

This thesis talks about the role of digital forensic in revealing criminal acts of online prostitution. Digital forensic itself is not specifically regulated in the Indonesian Criminal Code Act, but digital forensic is very important in its role in the process of analyzing an item of evidence obtained from a criminal offence. The subject matter that the author discusses is, how the digital forensic role in exposing the criminal acts of online prostitution and whether the barriers in the application of digital forensic in exposing the criminal acts of online prostitution. The research methods that the author uses are juridical empirical. The author also conducted an analysis on the role of digital forensic in exposing the criminal acts of online prostitution associated with the Information and Electronic Transaction Law which is then presented by the author's thought. The results of this study can be seen through several digital forensic roles at the level of investigation, prosecution and also the courts, in addition, there are also some obstacles that faced by the experts of Digital Forensic Examiner and the efforts that can be done in overcoming those obstacles.
 
 Keyword : Digital Forensic, Online Prostitution, Information and Electronic Transaction Law

Rationing bytes: managing demand for digital forensic examinations

ABSTRACT With the growing sophistication and prevalence of digital devices such as mobile phones, computers, tablets, sat-navs, and domestic appliances, the extraction, analysis and interpretation of digital data has become increasingly central to intelligence gathering and criminal proceedings. However, the very extent of data available today challenges the ability of police agencies to turn seized devices into useful evidence. To date, most social science scholarship about forensics has concentrated on DNA profiling and its societal and ethical issues. In contrast, other forensic fields, including digital forensics, have had little analytical scrutiny. Based on unprecedented access to a forensic collaboration in England, this study addresses the question: In conditions of constrained resources, how do police agencies manage the insatiable demand for digital examinations? In doing so, we bring rationing classification schemes from healthcare studies into the field of criminology in order to characterise the techniques for reconciling demand with capacity. As detailed, formal attempts to ration demand are confounded by informal practices and procedures that can impact on the capacity of the workforce and the speed with which cases are processed. In addition, the rationing of digital devices has significant consequences for the definition and distribution of skills and expertise across criminal justice agencies.

Analysis of Digital Forensic Tools

This paper aims to analyze different tools for Forensic Data Analysis comes under the branch of Digital Forensics. Forensic data analysis is done with digital techniques. Digital forensics becomes more important in law enforcement, due to the large use of computers and mobile devices. The pattern recognition system most appropriately fits into the Analysis Phase of the Digital Forensics. Pattern Recognition involves two processes. One Process is an analysis and the second process is recognition. The result of the analysis is taken out of the attributes from the patterns to be recognized i.e., a pattern of different faces and fingerprints. These attributes are then utilized for the further process in the analysis phase which provides attention on various techniques of pattern recognition that are applied to digital forensic examinations and is proposed to develop different forensic tools to collect evidence that would be helpful to solve specific types of crimes. This evidence further helps the examiner in the analysis phase of the digital forensic process by identifying the applicable data.

Ontology‐driven perspective of CFRaaS

AbstractA Cloud Forensic Readiness as a Service (CFRaaS) model allows an environment to preemptively accumulate relevant potential digital evidence (PDE) which may be needed during a post‐event response process. The benefit of applying a CFRaaS model in a cloud environment, is that, it is designed to prevent the modification/tampering of the cloud architectures or the infrastructure during the reactive process, which if it could, may end up having far‐reaching implications. The authors of this article present the reactive process as a very costly exercise when the infrastructure must be reprogrammed every time the process is conducted. This may hamper successful investigation from the forensic experts and law enforcement agencies perspectives. The CFRaaS model, in its current state, has not been presented in a way that can help to classify or visualize the different types of potential evidence in all the cloud deployable models, and this may limit the expectations of what or how the required PDE may be collected. To address this problem, the article presents the CFRaaS from a holistic ontology‐driven perspective, which allows the forensic experts to be able to apply the CFRaaS based on its simplicity of the concepts, relationship or semantics between different form of potential evidence, as well as how the security of a digital environment being investigated could be upheld. The CFRaaS in this context follows a fundamental ontology engineering approach that is based on the classical Resource Description Framework. The proposed ontology‐driven approach to CFRaaS is, therefore, a knowledge‐base that uses layer‐dependencies, which could be an essential toolkit for digital forensic examiners and other stakeholders in cloud‐security. The implementation of this approach could further provide a platform to develop other knowledge base components for cloud forensics and security.This article is categorized under: Digital and Multimedia Science > Cloud Forensics Digital and Multimedia Science > Cyber Threat Intelligence Digital and Multimedia Science > Multimedia Forensics

Effective resource management in digital forensics

PurposeBuilding on the findings of a British Academy-funded project on the development of digital forensics (DF) in England and Wales, the purpose of this paper is to explore how triage, a process that helps prioritise digital devices for in-depth forensic analysis, is experienced by DF examiners and police officers in four English police forces. It is argued that while as a strategy triage can address the increasing demand in the examination of digital exhibits, careful consideration needs to be paid to the ways in which its set-up, undertaking and outcomes impact on the ability of law enforcement agencies to solve cases.Design/methodology/approachThe methodological approach adopted here builds on the ethnographic turn in criminology. The analysis draws on 120 h of ethnographic observations and 43 semi-structured interviews. Observational data of the working DF environment at each location and a systematic evaluation of internal documents, organisational settings and police priorities helped refine emergent analysis threads, which were analytically compared between sites and against the testimonies of members of different occupational groups to identify similarities and differences between accounts.FindingsThe findings emphasise the challenges in the triage of digital exhibits as they are encountered in everyday practice. The discussion focusses on the tensions between the delivery of timely and accurate investigation results and current gaps in the infrastructural arrangements. It also emphasises the need to provide police officers with a baseline understanding of the role of DF and the importance of clearly defined strategies in the examination of digital devices.Originality/valueThis paper aims to bridge policy and practice through an analysis of the ways in which DF practitioners and police officers in four English constabularies reflect on the uses of triage in DF to address backlogs and investigative demands. Highlighting the importance of digital awareness beyond the technical remit of DF units, it offers new insights into the ways in which police forces seek to improve the evidential trail with limited resources.

Automated ambient recognition method based on dynamic center mirror local binary pattern: DCMLBP

Voice recognition and sound classification is a hot-topic research area in the literature and many methods have been presented. Ambient recognition is very important problem by using voices or acoustic. Especially, digital forensics examiners need an automated ambient recognition system by using acoustical voices. In this study, a novel automatic ambient recognition method is presented by using acoustic. Firstly, an acoustical voice dataset is acquired. These voices are categorized in the 8 classes and these classes are kinder garden, ferryboat, airport, café, subway, bus, traffic and walking. Then, a sequential learning method is presented for ambient recognition using acoustical voices. The proposed method consists of dynamic center mirror local binary pattern (DCMLBP) and discrete wavelet transform (DWT), neighborhood component analysis (NCA) based feature selection and classification phases. By using DWT, a sequential learning method is proposed and the proposed feature extraction method has nine levels. Experiments clearly show that the proposed DCMLBP based method has high classification accuracy, precision, geometric mean, F-score for ambient recognition. According to results, the best accuracy rate was calculated as 99.97% ± 0.07% by using support vector machine and 128 features.

Let the robots do it! – Taking a look at Robotic Process Automation and its potential application in digital forensics

The challenges of tackling increasing caseloads, large volumes of digital data and maintaining examination efficiency in order to adhere to tight criminal justice system deadlines persist. As the field looks towards techniques for improving efficiency, forms of automation are both simultaneously touted as a potential solution, whilst also attracting criticism. The potential for techniques which mechanise parts of the digital forensic examination process, and do it reliably, is great, however developing the capability to do this remains a challenge. This work provides an introductory discussion to Robotic Process Automation, a form of service task automation. Its potential application is debated and two case studies are offered demonstrating potential areas of applicability. An objective evaluation is offered, debating whether technology has a place in improving efficiency in this field.

A proactive malicious software identification approach for digital forensic examiners

Digital investigators often get involved with cases, which seemingly point the responsibility to the person to which the computer belongs, but after a thorough examination malware is proven to be the cause, causing loss of precious time. Whilst Anti-Virus (AV) software can assist the investigator in identifying the presence of malware, with the increase in zero-day attacks and errors that exist in AV tools, this is something that cannot be relied upon. The aim of this paper is to investigate the behaviour of malware upon various Windows operating system versions in order to determine and correlate the relationship between malicious software and OS artifacts. This will enable an investigator to be more efficient in identifying the presence of new malware and provide a starting point for further investigation.The study analysed several versions of the Windows operating systems (Windows 7, 8.1 and 10) and monitored the interaction of 90 samples of malware (across three categories of the most prevalent (Trojan, Worm, and Bot) and 90 benign samples through the Windows Registry. Analysis of the interactions has provided a rich source of knowledge about how various forms of malware interact with key areas of the Registry. Using this knowledge, the study sought to develop an approach to predict the presence and type of malware present through an analysis of the Registry. To this end, different classifiers such as Neural Network, Random forest, Decision tree, Boosted tree and Logistic regression were tested. It was observed that Boosted tree was resulting in a correct classification of over 72% – providing the investigator with a simple approach to determining which type of malware might be present independent and faster than an Antivirus. The modelling of these findings and their integration in an application or forensic analysis within an existing tool would be useful for digital forensic investigators.

Digital Forensic Investigation of Social Media, Acquisition and Analysis of Digital Evidence

Various social networking sites (SNSs), widely referred to as social media, provide services such as email, blogging, instant messaging and photo sharing for social and commercial interactions. SNSs are facilitating new forms of social interaction, dialogue, exchange and collaboration. They allow millions of users and organisations worldwide to exchange ideas, post updates and comments or participate in activities and events, while sharing their wider interests. At the same time, such a phenomenon has led to an upsurge in significant criminal activities by perpetrators who are becoming increasingly sophisticated in their attempts to deploy technology to circumvent detection. Digital forensic Examiners (DFEs) often face serious challenges in relation to data acquisition. Therefore, this article aims to analyse the significance of SNSs in DFIs and challenges that DFEs often encounter when acquiring evidence from SNSs. Furthermore, this article describes the steps of the digital forensic investigation process that must be taken to acquire digital evidence that is both authentic and forensically sound.

A Framework for Large-Scale Analysis of Video \"in the Wild\" to Assist Digital Forensic Examination

The European Union-funded project LASIE, aims to assist forensics investigators through innovative tools for image and video analysis, object detection and tracking, and event detection. These tools exploit the latest advances in machine learning to handle the challenges in processing content from real-world data sources.

Improving the Role of Experts under Indonesian Criminal Procedure Law: Lessons Learned From the Dutch Legal System

This article attempts to scrutinize the role of expert under KUHAP and examine how Indonesian courts have interpreted and applied relevant rules and principles of the expert in selected cybercrime cases. It finds that the main role of expert in such cases is providing the courts with opinions on the legal and technical meanings of the legal provisions at stake and their contextualization in the cases. This raises a question whether law enforcement agencies comprehend the execution of the provisions. It also shows that law enforcement agencies are not always interested in getting digital forensic examination from which electronic evidence may be produced. It emphasizes that role of expert under KUHAP is equivocal and views the need to improve the role and principles. In order to improve the role of experts under Indonesian criminal law, the article describes and explains the salient features of expert evidence under Dutch law. The article concludes by making a series of recommendations.

The reliability of clocks as digital evidence under low voltage conditions

Battery powered electronic devices like mobile phones are abundant in the world today, and such devices are often subject to digital forensic examinations. In this paper, we show that the assumptions that clocks are close to correct can be misleading under some circumstances, especially with failing batteries. One of four tested devices showed the clock jumped 8 and 12 years into the future when the battery connector voltage was held at 2.030 V and 2.100 V for about 9 s. Other devices showed a more expected behavior, where the clocks were slowly lagging until it was reset. In addition to this, we tested the precision of some methods of documenting the clock settings, and found most timestamps to be within reasonable precision for forensic use. Finally, we describe a model for the variability of the timestamps examined.

A comparative forensic analysis of privacy enhanced web browsers and private browsing modes of common web browsers

Growing concerns regarding internet privacy has led to the development of enhanced privacy web browsers. The authors conducted a digital forensic examination, to determine the recoverable artefacts of three enhanced privacy web browsers (Dooble, Comodo Dragon and Epic) and three commonly used web browsers in anonymous browsing mode (Chrome, Edge and Firefox). In addition, the authors compared two digital forensic tools (FTK and Autopsy) commonly used by law enforcement to determine differences in recoverable browser artefacts. Results indicated the enhanced privacy browsers performed about the same as the common browsers in anonymous browsing mode. In addition, FTK was the better tool for recovering and viewing browser artefacts for both browser groups. Overall, this study did not produce sufficient evidence to conclude enhanced privacy browsers do indeed provide better privacy.

Assessing the Psychological Well-being and Coping Mechanisms of Law Enforcement Investigators vs. Digital Forensic Examiners of Child Pornography Investigations

Previous research indicates law enforcement investigators and digital forensic examiners working child exploitation cases are at an increased risk for experiencing psychological distress; however, the roles of digital forensic examiners and investigators often overlap substantially when working child pornography cases. Thus, the current study was the first to compare the psychological well-being, job satisfaction, coping mechanisms, and attitudes toward mental health services for individuals working as either digital forensic examiners and/or investigators of child pornography cases. Law enforcement officers were solicited from the Internet Crimes Against Children task force listserv, and based on their current self-reported duties, 20 were classified as digital forensic examiners-only, 71 as investigators-only, and 38 as both digital forensic examiners and investigators of cases involving Internet child pornography. Results showed significant differences between groups; individuals performing both duties scored significantly higher on secondary traumatic stress, higher on feelings of worthlessness, and lower on concentration compared to digital forensic examiners-only. Individuals performing both duties also reported significantly lower scores on job satisfaction compared to investigators-only. Finally, individuals working both duties were significantly more likely to know someone who sought counseling as a result of work-related stress. The study’s mental health implications and future research suggestions are discussed.

A framework for large-scale analysis of video "in the Wild" to assist digital forensic examination

A framework for large-scale analysis of video "in the Wild" to assist digital forensic examination

The Hazards of Investigating Internet Crimes Against Children: Digital Evidence Handlers’ Experiences with Vicarious Trauma and Coping Behaviors

Over the last two decades there has been a substantive increase in the number of cybercrime and digital forensic units in local and state police agencies across the US. There is, however, little research on the occupational responses of individuals serving in specialized roles within criminal justice agencies. Individuals tasked to these units are likely to encounter psychologically harmful materials on a regular basis due to the number of child pornography and sexual exploitation cases they are assigned. As a result, this study examined the experiences of vicarious trauma and coping behaviors of digital forensic examiners in a sample culled from across the country. The findings suggest that exposure to content involving crimes against children directly and indirectly increases the likelihood of trauma and incidence of coping strategies employed.

WEB BROWSER FORENSICS: GOOGLE CHROME

Internet users use the web browser to perform various activities on the internet such as browsing internet, email, internet banking, social media applications, download files- videos etc. As web browser is the only way to access the internet and cybercrime criminal uses or target the web browser to commit the crime related to internet. It is very important for the digital forensic examiner to collect and analysis artifacts related to web browser usage of the suspect. There are various browsers available in the market such as Google Chrome, Internet Explorer, Firefox Mozilla, Safari and Opera etc, among which Google Chrome is very popular among the internet user community. Our literature survey shows that most of the researches used prefetch file and live memory analysis as source of information to extract artifacts. In this research paper, we analyzed default artifacts location, history, cookies, login data, topsides, shortcuts, user profile, prefetch file and RAM dump to collect artifacts related to internet activities on windows installed Google Chrome. The outcome of this research will serve to be a significant resource for law enforcement, computer forensic investigators, and the digital forensics research community.

Digital Fingerprint and Forensic Examination as a Technology for Cybercrime Detection and Prevention in Nigeria

Digital Fingerprint and Forensic Examination as a Technology for Cybercrime Detection and Prevention in Nigeria

Mobile Forensic Images and Videos Signature Pattern Matching using M-Aho-Corasick

Mobile forensics is an exciting new field of research. An increasing number of Open source and commercial digital forensics tools are focusing on less time during digital forensic examination. There is a major issue affecting some mobile forensic tools that allow the tools to spend much time during the forensic examination. It is caused by implementation of poor file searching algorithms by some forensic tool developers. This research is focusing on reducing the time taken to search for a file by proposing a novel, multi-pattern signature matching algorithm called M-Aho-Corasick which is adapted from the original Aho-Corasick algorithm. Experiments are conducted on five different datasets which one of the data sets is obtained from Digital Forensic Research Workshop (DFRWS 2010). Comparisons are made between M-Aho-Corasick using M_Triage with Dec0de, Lifter, XRY, and Xaver. The result shows that M-Aho-Corasick using M_Triage has reduced the searching time by 75% as compared to Dec0de, 36% as compared to Lifter, 28% as compared to XRY, and 71% as compared to Xaver. Thus, M-Aho-Corasick using M_Triage tool is more efficient than Dec0de, Lifter, XRY, and Xaver in avoiding the extraction of high number of false positive results.

English

English