Digital Forensic Framework Research Articles

A Survey on Blockchain Based Digital Forensics Framework

Abstract: Blockchain is the best suited technology that well satisfies the purpose and needs of security and integrity of evidences or proof collected by the police department as digital forensics across the country. This paper potray a blockchain based digital forensics framework as the proposed system, enabling privacy preservation and proof of existence. The proposed system is achieved by using SHA algorithm, AES encryption technique (Rijndael) and blockchain methodology. SHA algorithm mainly consists of SHA functions which are a group of hashing algorithms used for hashing the input of variable size. The AES encryption technique makes the uploaded forensic data to be encrypted and the data storage very secure. This project comes out as the best application that the defence department can use. The nature of the blockchain being decentralized, establishes privacy and tamper-proof. It also easily detects any wrong happenings or modifications and alerts the concerned authority. The forensic investigation framework establishes authenticity, security, traceability, privacy, immutability and becomes a trustworthy system for the defence department.

Detection and extraction of digital footprints from the iDrive cloud storage using web browser forensics analysis

STorage as a <span>service (STaaS) allows its subscribers the ability to access their stored data with the use of internet enabled digital devices at anywhere, anyplace and anytime. The easy accessibility of cloud storage with digital devices is one of the major benefits of cloud computing but this benefit can also be exploited by cybercriminals to perform various forms of malicious usages. During forensic investigation, forensic examiners are expected to provided evidence in relation to the malicious usages but the physical inaccessibility to the digital artifacts on the cloud servers, the difficulty in retrieving evidential artifacts from various cloud storage services and the difficulty in obtaining forensic logs from the concerned cloud service providers among other factors make it difficult to perform forensic investigations. This paper provided step by step experimental guidelines to extract digital artifacts from Google Chrome and Internet Explorer from Windows 10 personal computer using iDrive cloud storage as a case study. The study used Nirsoft forensic tool to locate the relevant forensic artifacts and an integrated conceptual digital forensic framework was adopted to carry out the investigation. This study increases the knowledge of client forensics using web browser analysis during cloud storage forensic investigation.</span>

IoT Forensic Frameworks (DFIF, IoTDOTS, FSAIoT): A Comprehensive Study

Abstract In the Internet of Things, millions of electronic items, including automobiles, smoke alarms, watches, eyeglasses, webcams, and other devices, are now connected to the Internet (IoT). Aside from the luxury and comfort that the individual obtains in the field of IoT, as well as its ability to communicate and obtain information easily and quickly, the other concerning aspect is the achievement of privacy and security in this connection, especially given the rapid increase in the number of existing and new IoT devices. Concerns, threats, and assaults related to IoT security have been regarded as a potential and problematic area of research. This necessitates the quick development or creation of suitable technologies with the nature of crimes in the IoT environment. On the other hand, criminal investigation specialists encounter difficulties and hurdles due to various locations, data types, instruments used, and device recognition. This paper provides an in-depth explanation of the criminal content of the Internet of Things. It compares its stages to the detailed stages of traditional digital forensics in terms of similarities and differences, the frameworks used in dealing with electronic crimes, and the techniques used in both types. This paper presents previous discussions of researchers in the field of digital forensics. For the IoT, which brings us to the most important parts of this paper, which is a comprehensive study of the IoT criminal frameworks that are used to protect communication in the field of IoT, such as Digital Forensic Investigation Framework (DFIF), Digital Forensic Framework for Smart Environments (IoTDOTS), Forensic State Acquisition from the Internet of Things (FSAIoT), and discusses the challenges in their general frameworks and provides solutions and strategies. Keywords: digital forensic, FSAIoT, IoT, IoT Challenges, IoT Forensic, IoT Framework, IOTDOTS.

Vision: An empirical framework for examiners to accessing password-protected resources for on-the-scene digital investigations

It is increasingly becoming difficult to acquire meaningful information in the field of digital forensics through the traditional approach owing to advances in information security and anti-forensics techniques. To counteract anonymous services such as data in remote areas without authentication information, data encryption, device locks, and cryptocurrencies, it is important to acquire key information through live forensics at search and seizure sites. Thus, it is necessary to establish a response system that explores and processes credential information on site and extracts meaningful information based on the processed information. To this end, this study proposes a new digital forensics framework for application at search and seizure sites. The proposed framework is designed to allow expansion in the form of additional functions on account of a module type development for the system even when new services and digital devices appear in the future. We then explain its applicability through case studies of actual digital investigations.

Implementation of ACPO Framework for Digital Evidence Acquisition in Smartphones

A forensic investigator or analyst should implement an appropriate digital forensic framework to acquire valid digital evidence to be presented at court. Choosing an unsuitable digital forensic framework with the investigation process may lead to failure at acquiring or maintaining complete digital evidence. Missing a step or turning a certain step into another irrelevant step may lead to unclear results and invalid conclusions. Digital evidence extracted from risky electronic evidence cannot be accepted by the court. Accordingly, a forensic investigator or forensic analyst should refer to a structuralized standard structure to perform well.Several internal digital forensic frameworks are available, one of which is the Good Practice Guide for Computer-based Electronic Evidence [1], an English issuance by ACPO (Association of Chief Police Officers) in cooperation with 7Safe. The digital forensic framework is commonly called the digital forensic framework from ACPO or the ACPO Framework. This research brings into focus the analysis of the percentage of success rate for using the ACPO digital forensic framework or the ACPO Framework in comparison with another digital forensic framework, i.e., NIST Framework. This research is also aimed at examining the performance of a mobile forensic tool, i.e., Cellebrite’s UFED Touch2 in comparison with another mobile forensic tool for digital evidence acquisition in smartphones.The research objects were smartphones containing deleted WhatsApp messages. This research successfully implemented the ACPO Framework for digital evidence acquisition in smartphones using Cellebrite’s UFED Touch2 as the mobile forensic tool.

Identification of forensic artifacts from the registry of windows 10 device in relation to idrive cloud storage usage

The accessibility of cloud storage over the internet as a result of cloud computing technology provides the opportunity to store, share and upload data online with the use of digital devices which can be accessed anytime and anywhere. These benefits can also be exploited by the cybercriminals to perform various criminal activities including storing and exchanging of illegal materials on cloud storage platforms. The logs of malicious usages can be obtained from the cloud service providers for forensic investigations but the privacy issue among other factors make it difficult for such logs to be shared. Therefore, there is a need to perform client-side forensics to be able to carry out forensic investigation on digital devices as related to the activities on cloud storage. This study identifies relevant artifacts that can be forensically extracted from the registry of a window 10 device that accessed iDrive cloud storage. The study explores different experimental setups for the forensic analysis and adopted an integrated conceptual digital forensic framework in the investigation process to detect relevant forensic artifacts from the registry of a windows 10 device. This study increases the knowledge of cloud storage forensics and the significance of registry analysis during digital investigations.

Mobile Digital Forensics Framework to Increase Security Level of for Smartphone User

Mobile Digital Forensics Framework to Increase Security Level of for Smartphone User

Email Analysis in Fraud Investigation: Digital Forensic and Network Analysis Approach

Email is an imperative method of communication that is changing the way people share their data and information. It provides effective and efficient communication, especially in business, convenience, and easy access and replication. Those electronic data should be considered by a fraud investigator to comprehend the investigation. Email can be divided into two parts: the head of the email and the email body. The head of the email is metadata that consists of unstructured data, and the body and its attachment consist of semi-structured data. The email data usually comes in large volumes and ranges of types. Therefore, a manual investigation of an email should be avoided. This paper uses the Design Science Research Methodology to discover the most profound framework in an email fraud investigation. Using email metadata and email body, this research performs a digital forensic framework: preparation, gathering, processing, and presentation, combines with social network analysis to be applicable in the investigation. The result shows that digital forensics process, network analysis, data visualization provides a more valuable and comprehensive insight into email analysis.

P2DF

The extensive use of digital devices by individuals generates a significant amount of private data which creates challenges for investigation agencies to protect suspects' privacy. Existing digital forensics models illustrate the steps and actions to be followed during an investigation, but most of them are inadequate to investigate a crime with all the processes in an integrated manner and do not protect suspect's privacy. In this paper, we propose the development of a privacy-preserving digital forensics (P2DF) framework, which facilitates investigation through maintaining confidentiality of the suspects through various privacy standards and policies. It includes an access control mechanism which allows only authorized investigators to access private data and identified digital evidences. It is also equipped with a digital evidence preservation mechanism which could be helpful for the court of law to ensure the authenticity, confidentiality, and reliability of the evidences, and to verify whether privacy of the suspect was preserved during the investigation process.

Forensic analysis for AI speaker with display Echo Show [formula omitted] generation as a case study

As the Internet of Things (IoT) era arrives, many Internet-connected devices are being released, and their use is increasing. One of these, the AI speaker, is designed to augment user convenience by using voice recognition. The best-known products are the Amazon Echo family, including Echo and Echo Dot and more recently, Echo Show with display. An AI speaker with display provides diverse functions such as surfing the Internet, taking pictures, making voice or video calls, and controlling smart home devices. To do this, Alexa cloud servers store a variety of configuration values and historical logs, and users can manage their own cloud-native data through interfaces (e.g., Web sites or mobile apps). For this reason, AI speakers with smart display are similar to PCs or smartphones, which can be very profitable from a digital forensic perspective. This paper focuses on detailed research on the second generation of Echo Show. The first step was to collect forensic artifacts stored inside the product by teardown, identifying eMMC flash memory chips and performing chip-off on Echo Show. Alexa app-related artifacts used on smartphones and how to automatically acquire data from the Alexa cloud were also investigated. From three sources including Echo Show, a companion client (smartphone), and the Alexa cloud, it was possible to acquire user credentials, traces of photos, records of watching videos, log files, and Internet histories with timestamp. The second step was to identify the possibility of inferring new information by correlating artifacts collected from different sources. Integrative analysis enables investigators to track suspect activity across digital devices. Third, this paper introduces an updated version of Cloud-based IoT Forensic Toolkit (CIFT) to support digital investigation of Echo Show. Based on the technical findings, this study proposes a digital forensic framework for a smart speaker with a display that can play an important role as a digital witness at a crime scene. Until now, there has been no multilevel approach to acquisition and analysis of Echo Show data in the field of digital forensics. Therefore, this study makes a contribution to the digital forensic community.

Development of conceptual framework for cyber fraud investigation

The increase in the number of internet users in Indonesia as much as 175.4 million as recorded in the Datareportal.com report and 4.83 billion globally, impact the increase in the number of cyber fraud cases. Data states that 96% of fraud cases are not resolved due to fraud methods carried out online and make it difficult for legal officers to obtain evidence. Previous fraud investigation research mainly focused on fraud detection, so this research focuses on submitting a framework for investigating cyber fraud cases. The cyber fraud case requires a new framework for investigation because in this fraud case, there is digital evidence that is very prone to be damaged, lost, or modified, which makes this case unsolved. This research aims to develop a framework that is expected to help auditors to uncover cases of cyber fraud so that resolved cyber fraud cases can increase. The method used in making this framework uses Jabareen's conceptual framework development method, which consists of 6 stages, namely, Mapping the selected data source, extensive reading and categorizing of the chosen data, Identifying and naming objects, Deconstructing and categorizing the concept, Integrating concept, Synthesis, resynthesis. And make it all sense. The framework for cyber fraud investigation uses 22 digital forensic frameworks and eight frameworks for fraud audit investigations. The results of developing a framework using the Jabareen method resulted in 8 stages, integrating various concepts selected from digital forensics and fraud audits. Evaluation of framework development was carried out by giving limited questionnaires to practitioners and academics, which produced 89% for the feasibility value and needs of the framework and 67% there is no need for changes to the framework being developed.

Internet-of-Forensic (IoF): A blockchain based digital forensics framework for IoT applications

Digital forensic in Internet-of-Thing (IoT) paradigm is critical due to its heterogeneity and lack of transparency of evidence processing. Moreover, cross-border legalization makes a hindrance in such process pertaining to the cloud forensic issues. This urges a forensic framework for IoT which provides distributed computing, decentralization, and transparency of forensic investigation of digital evidences in cross-border perspectives. To this end, we propose a framework for IoT forensics that addresses the above mentioned issues. The proposed solution called Internet-of-Forensics (IoF) considers a blockchain tailored IoT framework for digital forensics. It provides a transparent view of the investigation process that involves all the stakeholders (e.g., heterogeneous devices, and cloud service providers) in a single framework. It uses blockchain-based case chain to deal with the investigation process including chain-of-custody and evidence chain. Consensus is used for consortium to solve the problems of cross-border legalization. This is also beneficial for a transparent and ease of forensic reference. The programmable lattice-based cryptographic primitives produce reduced complexities. It shows benefits for power-aware devices and puts an add-on to the novelty of the presented idea. IoF is generic; hence, it can be used by autonomous security operation centers, cyber-forensic investigators and manually initiated evidences under chain-of-custody for man-made crimes. Security services are assured as required by the framework. IoF is experimented and compared with the other state-of-the-art frameworks. The outcomes and analysis prove the efficiency of IoF concerning complexity, time consumption, memory and CPU utilization, gas consumption, and energy analysis.

A design science approach to developing an integrated mobile app forensic framework

As our society becomes increasingly interconnected and reliant on technologies, the need for digital forensics is no longer restricted to cybercriminal investigations. For example, when a private organization’s system is compromised due to unauthorized access or espionage, digital forensic investigations can help to reveal the ‘what, why, how, who, when, and where’ relating to the incident, and the findings can inform decision-making and mitigation strategy formulation. Taking an interdisciplinary lens, this paper uses the design science approach to guide the development of an integrated digital forensic framework. It is then demonstrated how the framework can be used by a forensic investigator to examine Android applications, using a series of case studies (also referred to as “instantiations” of the method artifact in the design science literature).

Identifying Digital Forensic Frameworks Based on Processes Models

Digital forensic is part of forensic science that implicitly covers crime related to computer and other digital devices. It‟s being for a while that academic studies are interested in digital forensics. The researchers aim to find out a discipline based on scientific structures that defines a model reflecting their observations. This paper suggests a model to improve the whole investigation process and obtaining an accurate and complete evidence and adopts securing the digital evidence by cryptography algorithms presenting a reliable evidence in a court of law. This paper presents the main and basic concepts of the frameworks and models used in digital forensics investigation.

Efficient and reliable forensics using intelligent edge computing

Due to the increasing awareness and use of cloud and edge computing, society and industries are beginning to understand the benefits they can provide. Cloud and Edge are the future of information management, and they have transformed the Internet into an innovative and interactive computing platform. The ultimate goal of edge/cloud computing is to reduce the use of computing resources in the network, as well as support information sharing and intercommunication efforts within the network. Secure edge computing methodologies are applied in both open and heterogeneous network systems to protect them from many potential security threats. However, these approaches only provide passive protection for normal edge computing operations, and fail to address the security measures of several applications, particularly forensics in industrial settings. Forensics applications running on edge computing must be capable of support taking legal action against invaders for malicious damage or information theft. This paper proposes an efficient and reliable forensics framework (ERFF) to address industrial intelligent edge computing critical for the industry 4.0 implementation plan. The proposed ERFF consists of a detective module and validation model, with the detective module responsible for detecting the interaction between the client terminal and the edge resource, which means the investigator is capable of gathering the evidence securely. The security-validation model integrated with ERFF is far safer than sharing common key-based cryptographic approaches. The proposed conceptual framework is tested with Live Digital Forensic Framework for a Cloud (LDF2C), and results are compared with other existing industrial frameworks that fulfill fundamental ISO/IEC 17025 accreditation requirements, including Legal Reliable Forensic Framework (LRFF), Source Identification Network Forensics Framework (SINFF) and Logging Framework for Cloud Computing Forensic (LFCCF)). These frameworks were designed to support the digital forensic requirements of industry and academia, and experimental results validate the effectiveness of the proposed framework from reliability and efficiency perspectives as well as realistic scenarios

Instagram Mobile Application Digital Forensics

In this research, we developed a plugin for our automated digital forensics framework to extract and preserve the evidence from the Android and the IOS-based mobile phone application, Instagram. This plugin extracts personal details from Instagram users, e.g., name, user name, mobile number, ID, direct text or audio, video, and picture messages exchanged between different Instagram users. While developing the plugin, we identified resources available in both Android and IOS-based devices holding key forensics artifacts. We highlighted the poor privacy scheme employed by Instagram. This work, has shown how the sensitive data posted in the Instagram mobile application can easily be reconstructed, and how the traces, as well as the URL links of visual messages, can be used to access the privacy of any Instagram user without any critical credential verification. We also employed the anti-forensics method on the Instagram Android’s application and were able to restore the application from the altered or corrupted database file, which any criminal mind can use to set up or trap someone else. The outcome of this research is a plugin for our digital forensics ready framework software which could be used by law enforcement and regulatory agencies to reconstruct the digital evidence available in the Instagram mobile application directories on both Android and IOS-based mobile phones.

A novel principle to validate digital forensic models

Digital forensic models (DFMs) form the base for any digital investigation because they guide the investigators with necessary steps and procedures to be taken during the investigation. State-of-the-art DFMs assume that it is safe to proceed from one stage of the investigation to the next without taking into account the anti-forensic techniques that could be used to defeat the investigation process. However, the findings in the literature shows that common phases in the digital forensic process such as acquisition, examination, analysis, and reporting are affected by various anti-forensic (AF) methods. To fill this gap, we propose an abstract digital forensic framework and validate DFMs by factoring in AF techniques affecting various phases in a digital forensic process. This validation principle can be used to enhance state-of-the-art DFMs to enable principled detection and countering of AF techniques before being applied to a real-time investigation case.

Intelligence-led response: turning theory into law enforcement practice in cyber security incidents

As the internet grows drastically in scale and density, the number of cyber security incidents investigated by law enforcement agencies (LEAs) is skyrocketing. Criminals may deny committing a crime, but LEAs are hindered in proving it by the limited processing capabilities of human analysis. While initial crime scene investigation emphasises finding actionable intelligence as quickly as possible, lab forensics focuses on reconstructing the case and cross-referencing the evidence to find the truth. Both are critical parts of the investigative response to cyber security incidents. This paper presents a practical digital forensic framework based on ISO/IEC 27043: 2015 activities, intended to handle digital evidence at the crime scene and lessen the caseload burden at the lab. By advocating an intelligence-led response to crime scene investigation and lab forensics, we aim to turn theory into practice for LEAs, supporting the resolution of cyber security incidents and the understanding of what happened. By working through the different processes and activities in practical exercises, we aim to enable LEAs to implement a response strategy for combating cyber crime.

Intelligence-led response: turning theory into law enforcement practice in cyber security incidents

As the internet grows drastically in scale and density, the number of cyber security incidents investigated by law enforcement agencies (LEAs) is skyrocketing. Criminals may deny committing a crime, but LEAs are hindered in proving it by the limited processing capabilities of human analysis. While initial crime scene investigation emphasises finding actionable intelligence as quickly as possible, lab forensics focuses on reconstructing the case and cross-referencing the evidence to find the truth. Both are critical parts of the investigative response to cyber security incidents. This paper presents a practical digital forensic framework based on ISO/IEC 27043: 2015 activities, intended to handle digital evidence at the crime scene and lessen the caseload burden at the lab. By advocating an intelligence-led response to crime scene investigation and lab forensics, we aim to turn theory into practice for LEAs, supporting the resolution of cyber security incidents and the understanding of what happened. By working through the different processes and activities in practical exercises, we aim to enable LEAs to implement a response strategy for combating cyber crime.

D4I - Digital forensics framework for reviewing and investigating cyber attacks.

Many companies have cited lack of cyber-security as the main barrier to Industrie 4.0 or digitalization. Security functions include protection, detection, response and investigation. Cyber-attack investigation is important as it can support the mitigation of damages and maturing future prevention approaches. Nowadays, the investigation of cyber-attacks has evolved more than ever leveraging combinations of intelligent tools and digital forensics processes. Intelligent tools (e.g., YARA rules and Indicators of Compromise) are effective only when there is prior knowledge about software and mechanisms used in the cyber-attack, i.e., they are not attack-agnostic. Therefore, the effectiveness of these intelligent tools is inversely proportional to the number of the never-seen-before software and mechanisms utilized. Digital forensic processes, while not suffering from such issue, lack the ability to provide in-depth support to a cyber-attack investigation mainly due to insufficient detailed instructions in the examination and analysis phases. This paper proposes a digital forensics framework for reviewing and investigating cyber-attacks, called D4I, which focuses on enhancing the examination and analysis phases. First, the framework proposes a digital artifacts categorization and mapping to the Cyber-Kill-Chain steps of attacks. Second, it provides detailed instructing steps for the examination and analysis phases. The applicability of D4I is demonstrated with an application example that concerns a typical case of a spear phishing attack.