Digital Forensic Investigation Research Articles

Forensic Analysis of wxSQLite3-Encrypted Databases and Its Application

This study focuses on digital forensic investigations of the databases used in an instant messenger application. Instant messengers store and manage user data in databases, which can be encrypted for privacy protection. We proposed a method to identify and decrypt an SQLite version 3.40.0 database encrypted using wxSQLite3 version 4.9.1, and then we examined the LINE instant messenger application to validate the proposed method. As a result, we successfully acquired the wxSQLite3 passphrase, which was used to decrypt the database of the LINE messenger application. We also performed artifact analysis to enumerate the data from a digital forensics perspective. To the best of our knowledge, this study is the first to propose a method to identify and decrypt of wxSQLite3-encrypted database and its applications.

AI-Enhanced Digital Forensics: Automated Techniques for Efficient Investigation and Evidence Collection

The abstract summarizes AI-enhanced digital forensics topics. It highlights the importance of AI in digital forensic investigations and outlines its major features, historical perspectives, and methodological evolution. The abstract describes how automated methods can streamline evidence collection and investigation. The historical perspective highlights digital forensic procedures from rudimentary file system investigations to AI-driven methods. This progression reflects digital crime's dynamic character and forensic method developments. The AI-enhanced digital forensics methodology includes establishing an effective component model, identifying datasets, gathering data, arranging studies, and considering ethical considerations. Representative datasets and ethical considerations are stressed in the abstract to ensure ethical and responsible AI application in forensic investigations. AI-based systems are evaluated using accuracy, false positive/negative rates, speed and efficiency, scalability, and durability. A straightforward comparison of these parameters across AI algorithms using bar graphs and grouped bar charts helps forensic investigators chooses strategies. In conclusion, AI-enhanced digital forensics is well understood, and performance evaluations, methodological concerns, historical evolution, and ethics are important. AI is being used in digital forensics as technology advances, giving investigators a strong tool to navigate the digital world accurately and efficiently. To use AI responsibly and effectively for justice, technique and ethics must be constantly improved

Artificial intelligence in mobile forensics: A survey of current status, a use case analysis and AI alignment objectives

As the capabilities and utility of Artificial Intelligence and Machine Learning systems continue to improve, they are expected to have an increasingly powerful influence in the digital forensic investigation process. The concurrent proliferation of mobile devices and rapid increase of forensic value of related artifacts creates the requirement for a comprehensive review of the current status of artificial intelligence software usage and usefulness in Mobile Forensics. In this context, we conducted a survey to evaluate the characteristics and properties of AI functions in mobile forensic software from the practitioners' perspective and enhance understanding to the work in the field. In this study, we evaluated the performance of image categorization software in digital forensics using a variety of evaluation metrics including accuracy, precision, recall, and F1-score, as well as the confusion matrix. In this research we also identify and integrate theoretical principles to conceptualize an AI Alignment framework pertaining to Mobile Forensics and Digital Forensics in general, in order to accurately determine specific AI strategy objectives and potential solutions to the current technical and administrative landscape. We emphasized the importance of interpretability and transparency in AI systems and the need for a comprehensive approach to understanding the reasoning behind the software's decisions. Additionally, we highlighted the importance of robustness in image categorization software, as well as the consideration of AI governance and standardized procedures concepts. Our results show that the accuracy and robustness of the image categorization software have a significant impact on the outcome of legal cases and that the software should be designed with interpretability, transparency, and robustness in mind. Through the examination of the survey responses, the evaluation of the image categorization software and research literature, we explore existing and potential approaches to aligned Artificial Intelligence and analyze their contribution to the forensic examination of cases.

Chain of Custody and Evidence Integrity Verification Using Blockchain Technology

The validity and integrity of digital evidence and the chain of custody are crucial to all digital forensic investigations. All new evidence and access logs of the original evidence should be logged in a document called the ‘chain of custody’. This document shows the timeline of any piece of evidence from the time it was recorded until the end of the investigation. In a traditional digital investigation, trusted parties, such as an investigator, are allowed access to the digital evidence and follow a strict process when dealing with data. These trusted parties have the capability to alter the data making the evidence inadmissible in a court of law. Alternatively, these trusted parties may also alter the data accidentally or with malicious intent, due to a lack of transparency and non-repudiation. Blockchain technology can solve this issue, however, existing research shows that adopting blockchain does not provide adequate transparent access control mechanisms. Consequently, this makes blockchain difficult to adopt due to the one-to-one mapping and the inability to easily validate the chain of custody and evidence admissibility.  Current methodologies rely on an external off-chain access control mechanism, which, regrettably, remains susceptible to potential breaches that could compromise its integrity and validity. This paper proposes an enhanced model to provide access control through smart contracts, ensuring immutability, flexibility, transparency, and non-repudiation of both the access control mechanisms and the digital evidence itself. This is achieved by moving the access control mechanism to the blockchain. This tracks any changes made through the access control mechanism, further ensuring transparency and integrity. This smart contract-based access control builds off role-based access control, allowing for more complex hierarchies to be used. This model aims to allow for both modularity, making adoption easier for existing digital forensic tools, and encouraging digital investigation and litigation to become more streamlined.  Existing tools can easily integrate with the proposed model adding an extra layer of non-repudiation, transparency, and integrity.

A Privacy-Compliant Process for Digital Forensics Readiness

This research paper examines the issue of privacy compliance in digital forensics readiness, specifically in relation to the breach of confidentiality during analysis of collected data on users. This is a problem because the collection and analysis of digital evidence during these investigations can have a potential impact on individuals’ privacy rights. The study’s methodology involves a literature review of relevant research, an analysis of privacy regulations, and a case study of a real-world digital forensics investigation. The main findings of the study indicate that organizations need to develop and implement robust privacy measures and data protection policies to ensure that their digital forensics readiness efforts are privacy compliant and do not compromise user privacy. Some examples of why this is necessary are provided in the research to address these privacy compliance issues, this study proposes a measure, this measure implements technical safeguards to protect user data and maintains its confidentiality. By implementing the proposed measures, organizations can maintain their digital forensics readiness while also protecting user privacy.

Proof of Concept of a Digital Forensic Readiness Cybercrime Language as a Service

Welcome to the 21st century, where more devices are connected to the Internet than people on this earth. Each device will be or has been a target of cybercrime. The popularity of text-based cybercrimes has become prevalent with the advancement of the Internet. The number of cybercrimes increases yearly, unlike the reports of such crimes. The major problem is the lack of awareness and protection from cybercrimes. These issues cascade into greater consequences, such as a shortfall of reports, deficiency of cybercrime data, etc. The DFClaaS system is proposed as a solution; it allows users to report text-based cybercrimes anonymously. Next, several NLP techniques are applied to such reports to comprehend text-based cybercrimes as a language, and once the usage of the language is detected, an investigation proceeds. Subscribed users are individuals or businesses that are in some regard connected to the Internet. The DFClaaS system aims to protect its users from text-based cybercrimes and provide digital forensic investigators resources to conduct a successful investigation, enriching digital forensics research. The system is a feature-rich digital forensics readiness tool that will track the aggressive advancements of text-based cybercrimes, thus serving and protecting its users.

An AI Model for Digital Forensic Readiness in the Cloud using Secure Access Service Edge

Computing infrastructure has evolved and has brought about changes to the ways that work and business are carried out. Cloud computing has redefined these workspaces by providing connectivity and tools to enable productivity, collaboration, and flexibility.   As work moves outside the centralised office and goes remote, users are accessing the cloud directly, leaving the protection of the corporate network and leaving the users’ computing platforms open to threats. In the pre-cloud era, the data centre for organisations was the single location where digital assets would be housed and non-complicated security parameters implemented. The firewall would be the main security perimeter implemented to secure the network in this pre-cloud era. The advent of cloud computing has brought potential areas and gaps in securing the organisational data, information and communication connectivity to the cloud-based resources. As such, there is need to rethink and redesign the models which can be implemented to secure the cloud computing services. The cloud should be in a state of digital forensics readiness in order to facilitate digital forensics investigation. The study focuses on the development of an artificial intelligence model for digital forensic readiness for the cloud using secure access service edge. This integrated approach might assist in the provisioning of cloud security.

Designing an automated, privacy preserving, and efficient Digital Forensic Framework

<p class="MDPI18keywords">The digital forensic investigation field faces continual challenges due to rapid technological advancements, the widespread use of digital devices, and the exponential growth in stored data. Protecting data privacy has emerged as a critical concern, particularly as traditional forensic techniques grant investigators unrestricted access to potentially sensitive data. While existing research addresses either investigative effectiveness or data privacy, a comprehensive solution that balances both aspects remains elusive. This study introduces a novel digital forensic framework that employs case information, case profiles, and expert knowledge to automate analysis. Machine learning techniques are utilized to identify relevant evidence while prioritizing data privacy. The framework also enhances validation procedures, fostering transparency, and incorporates secure logging mechanisms for increased accountability.</p>

Intelligent Systems for Cloud SAAS Forensic

The rapid growth of Software-as-a-Service (SaaS) applications in cloud environments has introduced new challenges for digital forensics investigators. Traditional forensic methods are often insufficient to collect, preserve, and analyze digital evidence from cloud-based environments. To address these challenges, this scope will propose the development of an Intelligent System for Cloud SaaS Forensic (ISC-SF) for OpenStack environment. The ISC-SF will integrate machine learning algorithms with the SaaS model and will present the algorithms to design for attribute selection, machine learning model training, attack detection, evidence extraction, collection, and analysis. This paper provides an overview of OpenStack architecture, OpenStack services, and log locations. The ISC-SF aims to revolutionize the field of cloud SaaS forensic investigation by leveraging intelligent algorithms in a controlled cloud environment.

Grand theft API: A forensic analysis of vehicle cloud data

Modern vehicles such as cars, trucks and motorcycles contain an increasing number of embedded computers that continuously exchange telemetry data like current mileage, tire pressure, expected range and geolocation to the manufacturer's cloud. Vehicle owners can access this data via Vehicle Assistant Apps (VAA). Naturally, this data is of increasing interest to law enforcement in criminal investigations. While manufacturers must comply with local laws requiring them to hand over the data of suspects upon the issuance of a warrant, this process can be time-consuming and cause an additional delay in a case. Making use of novel API-based access methods in cloud forensic investigations, we present a method to get permanent access to a vehicle's cloud data by directly accessing cloud servers given suspects' credentials. We analysed a set of 23 different VAAs and pointed out the potentially accessible data categories. With our proof of concept tool gta.py in combination with six provided vehicles from BMW, Dacia, Ford, Hyundai, Mercedes and Tesla, we verified the accessibility of the data categories. Our findings demonstrate that the API-based forensic acquisition and analysis of vehicle cloud data provides important insights to be considered in future digital forensic investigations of vehicles.

ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models

Generative AIs, especially Large Language Models (LLMs) such as ChatGPT or Llama, have advanced significantly, positioning them as valuable tools for digital forensics. While initial studies have explored the potential of ChatGPT in the context of investigations, the question of to what extent LLMs can assist the forensic report writing process remains unresolved. To answer the question, this article first examines forensic reports with the goal of generalization (e.g., finding the ‘average structure’ of a report). We then evaluate the strengths and limitations of LLMs for generating the different parts of the forensic report using a case study. This work thus provides valuable insights into the automation of report writing, a critical facet of digital forensics investigations. We conclude that combined with thorough proofreading and corrections, LLMs may assist practitioners during the report writing process but at this point cannot replace them.

The Design and Development of Hands-on Activities for Digital Forensics Education

It has been widely admitted by researchers and educators that hands-on activities are a core component in digital forensics education to help students gain practical skills that are needed in real-world forensic investigations. However, it is not clear in existing works about what kinds of hands-on activities are recommended to be integrated into a digital forensics course and how to design and develop them. In our teaching practice, hands-on activities for a digital forensics course are designed in three categories: 1) activities that assist students in learning how to use common digital forensics tools; 2) activities that help students gain in-depth understanding of the basic concepts and fundamental knowledge that are presented in class lectures; 3) activities that promote students the development of mindsets and data analytical skills that are needed for a digital forensic investigator. Various formats are employed to develop these hands-on exercises in different categories. The educational objectives and student learning outcomes map well to the CAE-CD (Centers of Academic Excellence - Cyber Defense) outcomes by completing their forensic knowledge units. In this paper, we share our idea and experience to design and implement such hands-on assignments in each category for meeting specific educational objectives. Sample exercises are briefly described to explain our idea in each category. Open source tools and data sets are introduced for references. Experiences, lessons, and sample feedback from students are discussed. Our results will provide a point of reference for those who teach digital forensics courses at a college or university, or are developing a digital forensic curriculum.

Drone Forensics: An Innovative Approach to the Forensic Investigation of Drone Accidents Based on Digital Twin Technology

In recent years, drones have become increasingly popular tools in criminal investigations, either as means of committing crimes or as tools to assist in investigations due to their capability to gather evidence and conduct surveillance, which has been effective. However, the increasing use of drones has also brought about new difficulties in the field of digital forensic investigation. This paper aims to contribute to the growing body of research on digital forensic investigations of drone accidents by proposing an innovative approach based on the use of digital twin technology to investigate drone accidents. The simulation is implemented as part of the digital twin solution using Robot Operating System (ROS version 2) and simulated environments such as Gazebo and Rviz, demonstrating the potential of this technology to improve investigation accuracy and efficiency. This research work can contribute to the development of new and innovative investigation techniques.

The Application of AI Techniques for Firearm detection in Digital Forensic Investigation

The Application of AI Techniques for Firearm detection in Digital Forensic Investigation

Effectiveness of digital forensic investigation through excavation methods of various Linux based tools

Effectiveness of digital forensic investigation through excavation methods of various Linux based tools

Effectiveness of Digital Forensic Investigation through Excavation Methods of Various Linux Based Tools

Effectiveness of Digital Forensic Investigation through Excavation Methods of Various Linux Based Tools

Leveraging Deep Learning for Identification of Illicit Images in Digital Forensic Investigations

Leveraging Deep Learning for Identification of Illicit Images in Digital Forensic Investigations

Digital Forensics Challenges in Cyberspace: Overcoming Legitimacy and Privacy Issues Through Modularisation

The significance of the cloud environment is growing in the current digital world. It provides several advantages, such as reduced expenses, the ability to adjust to different needs, adaptability and enhanced cooperation. The field of digital forensic investigations has encountered substantial difficulties in reconciling the requirement for efficient data analysis with the increasing apprehensions regarding privacy in recent times. As investigators analyse digital evidence to unearth crucial information, they must also traverse an intricate network of privacy rules and regulations. Given the increasing prevalence of remote work and the necessity for businesses to be adaptable and quick to react to shifting market circumstances, the cloud infrastructure has become a crucial asset for organisations of various scales. Although the cloud offers benefits such as scalability, flexibility and enhanced collaboration, it presents difficulties in digital forensic investigations regarding data protection, ownership and jurisdictional boundaries. These concerns are becoming increasingly significant as more data is kept in the cloud. In this paper, we present three major challenges that are faced during cloud-based forensics investigation. We analyse the extent to which different data formats increase complexity in forensics investigations in cyberspace. This paper analyses three core challenges facing digital forensics in the cloud environment: legitimacy, complexity and an increase in data volume, looking at the implications these have on data liable for legal issues in court. These challenges contribute to the backlog in digital forensics investigations due to a lack of modularisation of the procedures. To address these concerns, modularisation model is proposed to offer a way to integrate traditional processing functions while ensuring strict adherence to privacy protocols. To overcome these challenges, we propose modularisation as a strategy for improving the future of digital forensic research's operational efficiency, overcoming the identified challenges faced during cloud-based investigations and demonstrating how organisations can mitigate potential risks associated with storing sensitive information in the cloud.

A study on vulnerability of the Wickr login system in windows from a live forensics perspective

Secure instant messengers employ various techniques to ensure secure communication for users, such as eavesdropping denial, data leakage prevention, and privacy protection. While robust data protection techniques are generally considered beneficial, they may interfere with evidence collection during digital forensics investigations. As this is a known fact, secure instant messengers are often used by criminals to conduct clandestine communications. Therefore, identifying potential ways to collect data from secure instant messengers is crucial for digital forensic investigations. We analyzed Wickr, a secure instant messenger, to determine possible data collection methods. We considered various cases that might be encountered during digital forensics investigations and listed the main data that can be collected for each case, much of which was encrypted, or the data for encrypting the data. We analyzed the collected data and the log-in process of Wickr in detail, through which we succeeded in logging in without knowing the password of the account used on the target computer, because the password was verified on the client, not the server, after the first login. Based on our analysis results, we showed that it is possible to log in to Wickr without password even from devices that have never been logged in, when certain conditions are met. It was performed through reverse engineering. Our results indicate that there may be various data collection methods for secure instant messengers from a digital forensics investigation perspective, and that more study is needed.

Techniques and methods for obtaining access to data protected by linux-based encryption – A reference guide for practitioners

This research presents an overview of the typical disc and folder-level encryption that a digital forensic investigator may encounter when investigating a Linux operating system. Based on prior first-hand experience and significant follow-up testing and research, this work examines the operation of such encryption from the user's perspective, discusses how the encryption operates “under the hood”; and explores methods and techniques that can be used to access and retrieve data from such encrypted devices, both during at-scene/live forensic investigation and also post-scene. Worked examples are presented, to aid the reader's understanding. This research also presents considerations, approaches and steps that can be used by an investigator, in order to maximise the potential for data acquisition, and most crucially discusses lessons learnt to facilitate getting the best evidence in such cases. A breakdown of the binary structure of the key files associated with fscrypt is also presented, for reference. Current limitations and gaps in knowledge are also discussed.