Digital Forensic Practitioners Research Articles

Hypervisor-based data synthesis: On its potential to tackle the curse of client-side agent remnants in forensic image generation

In the field of digital forensics, the number and heterogeneity of devices typically involved in an investigation is increasing. In order to train digital forensics practitioners and make faster progress in the development and validation of forensic tools, the demand for up-to-date data sets is high. However, manually creating data sets is a complex, tedious, and time-consuming task increasing the need for automated solutions. Existing data generation frameworks typically use components that run directly on the simulated client (e.g., a client-side agent controlled via SSH). On the one hand, this facilitates simulation by providing direct feedback from the client and the ability to use client-side libraries to access software. On the other hand, however, this approach creates unintended traces in the generated data sets that quickly reveal their synthetic origin and affect their realism and thus their relevance. To avoid such traces, this paper presents a hypervisor-based solution to eliminate such a client-side software component in a recent digital forensic data set generator, while compensating for its absence only through host-side means. To demonstrate the practicability of the proposed approach as well as the indistinguishability of the generated traces, a multi-participant scenario is performed as a proof of concept to replicate a realistic attack scenario on a Linux system from a Kali attacker machine. During the evaluation, the generated data set is compared in terms of unintended traces and realism to a data set generated by the same framework using an agent component. In this way, we demonstrate the benefits and overall usefulness of an agent-less data synthesis approach.

Mobile Forensic Readiness: A Comprehensive Survey of the Best Practices, Current Methods and Available Data

Our way of life has been completely transformed by mobile phones. Nowadays, a cell phone is seen as a necessary item. Which means we use it for the majority of our tasks as well as communication. Communication is portable allowing us to send texts and make calls from anywhere on the planet. In addition, people can utilize the camera to record significant moments in their life and store them for later reference. People used to send these photos to their loved ones from their phone allows them to share their moments with others. Moreover, through mobile applications, they may interact with individuals from all over the world and create new acquaintances on a mobile phone, Last but not least, they can use smartphone applications for finding their way about acquiring maps. For nefarious purposes, some people, on the other hand, want to wipe all of their data, including phone records, text messages, images, videos, and location information. Therefore, using mobile forensic technologies, a mobile forensic expert can recover all of the erased data, including call logs, text messages, photographs, videos, and location data. This survey paper intends to investigate and assess the state of mobile phone forensic preparation, including a thorough overview of current methodologies and industry best practices. This research intends to help forensic investigators, law enforcement organizations, and digital forensic practitioners create strong and efficient mobile phone forensic preparation strategies by examining various methodology, tools and procedures.

Post-mortem digital forensic analysis of the Garmin Connect application for Android

The Garmin Vivosmart 4 smartband can monitor various health metrics, including heart rate, oxygen saturation, body composition, and stress levels. It is a quite popular fitness tracking device, as its Android companion application – Garmin Connect – has been downloaded more than 10 million times and can provide critical forensic artifacts such as timestamped GPS-based locations. In this work, we analyze the Garmin Connect application to identify i) relevant digital forensic artifacts, and ii) assess methods to retrieve cloud-based data relevant to a digital forensic examination. For this purpose, we first establish a test scenario where the paired device/application collects data in regular real-world situations using a rooted smartphone running Android 11. The smartphone is then examined to gain insights into the data stored by the application and identify meaningful digital artifacts.To ease and automate the task of digital forensic practitioners, we have developed the Garmin Connect for Android Analyzer (GC4AA) set of Python 3 modules tailored for the digital forensic framework Android Logs Events And Protobuf Parser (ALEAPP). These open-source modules parse dumps of a Vivosmart 4 data directory and create reports displaying several digital artifacts, such as health metrics, GPS data and routes, and phone notifications. They automate the information-gathering process and produce a report specially tailored for Garmin Connect data, highlighting the most relevant artifacts. Our results show that the analysis of paired Garmin Collect/Vivosmart 4 with GC4AA can yield more digital forensic artifacts than existing open-source tools, including the following new artifacts: i) Daily Summary data; ii) GPS data; iii) Response Cache data; iv) Network Logs; v) Facebook API tokens; vi) Device Synchronization cache; vii) SpO2 reading charts. Our contributions include a graphical presentation of the collected data, greatly improving its readability and analysis.

Computer Forensics Education: The Applications of Forensic Tools in Modern Education System

Cybercrime and computer-related incidents are becoming more prevalent and common, resulting in billions of dollars in damages. To address these crimes and scams, there is an urgent need to build digital forensics training programme, that will equip relevant professionals to investigate computer crime and events efficiently. There is presently no standard that governs the development of an academic program’s digital forensics curriculum. This study extensively investigates prior work on curriculum design in digital forensics as well as existing computer forensics course offered at the first is the Community College in Buraidah, and the second is the Community College in Unaizah namely, “Cyber Security Diploma” The Cyber Security Diploma is offered in both colleges, the Community College in Buraidah and Unaizah, and the diploma is at the third level of the course “Computer Forensic Analysis,” which is the focus of the research topic. Interviews were conducted with both digital forensic trainers and practitioners, and the findings were examined in order to identify and assess the skills and knowledge required by the industry and law enforcement agencies for their digital forensic examiners. Hands-on training may be delivered by constructing and managing a student laboratory specifically designed for digital forensic examination instruction. A laboratory can be outfitted with a wide range of software solutions, ranging from commercial investigation suites to free command line tools. Similarly, the forensic workstations that execute the software might be supplied by the vendor as stand-alone devices or assembled from separate components in-house. Building and administering a student lab successfully can be a daunting task, but it can also be done on a little budget as long as the focus stays on student achievement.

Live Memory Forensic for Windows

This work describes a functional, generic, broad-scoped investigative methodology for Windows memory analysis. The methodology applies equally to functional and damaged, or corrupted memory images and relies on Volatility. It is based on the author’s various memory analysis case studies. Summing it up succinctly, the methodology aids the forensic practitioner in squeezing the maximum amount of possible evidence from a memory image. The proposed methodology is suitable for analysts at all levels of investigative capability. It provides guidance in extracting maximum evidence using simple, commonplace tools and techniques familiar to digital forensic practitioners. As with all methodologies, nothing is written in stone; the forensic practitioner must be flexible and agile in responding to ever-changing investigative requirements. To assess the performance of various tools for gaining, analysing, and improving criminal evidence from volatile memory. A comparison of several tools is offered in order to provide a better understanding of the tools used.

That tool is rubbish!…or is it?

Digital forensic practitioners often utilise a range of tools throughout their casework in order to access, identify and analyse relevant data, making them a vital part of conducting thorough, efficient and accurate digital examinations of device content and datasets. Whilst their importance cannot be understated, there is also no guarantee that their functionality is free from error, where similarly, no practitioner can 100% assure that their performance is flawless. Should an error occur during an investigation, assuming that it has been identified, then determining the cause of it is important for the purposes of ensuring quality control in both the immediate investigation and for longer-term practice improvements. Perhaps anecdotally, a starting position in any postmortem review of an error may be to suspect that any tools used may be at fault, where recent narratives and initiatives have enforced the need to evaluate all tools prior to them being used in any live investigation. Yet, in addition, an error may occur as a result of a practitioner’s investigative conduct. This work discusses the concept of ‘fault-attribution’, focusing on the roles of the forensic tool and practitioner, and proposes a series of principles for determining responsibility for an investigative error.

Crowdsourcing forensics: Creating a curated catalog of digital forensic artifacts.

The increasing volume, variety, velocity, distribution, structural intricacy, and complexity of use of digital evidence can make it difficult for practitioners to find and understand the most forensically useful information (Casey E. Digital evidence and computer crime: Forensic science, computers, and the Internet. Academic Press; 2011. p. 31; Pollitt M. The hermeneutics of the hard drive: Using narratology, natural language processing, and knowledge management to improve the effectiveness of the digital forensic process [PhD dissertation]. University of Central Florida; 2011). Digital forensic practitioners currently search for information and solutions in an ad hoc manner, leading to results that are unstructured, unverified, and sometimes incomplete. As a result, certain digital evidence is being missed or misinterpreted. To mitigate risks of knowledge gaps, there is a pressing need for a systematic mechanism that practitioners can use to codify and combine their collective knowledge. This work presents the design and development of a solution that catalogs crowdsourced knowledge of digital forensic artifacts in a well‐structured, easily searchable form to support efficient and automated extraction of pertinent information, improving availability and reliability of interpretation of artifacts (general acceptance). Technical implementation and artifact curation are discussed with illustrative examples and recommendations for future work.

Strategies for safeguarding examiner objectivity and evidence reliability during digital forensic investigations

The paper investigates how digital forensic (DF) practitioners approach examiner objectivity and evidence reliability during DF investigations. Fifty-three DF practitioners responded to a questionnaire concerning these issues after first receiving a scenario, contextual information, and a task description and then examining an evidence file. The survey showed that hypotheses played an important role in how the DF practitioners handled contextual information before the analysis and safeguarding objectivity during the analysis. Dual tool verification was the most frequently referred measure for controlling evidence reliability. The analysis of responses revealed three significant causes of concern. First, 45% started the analysis without an innocence hypothesis in mind. Second, 34% applied no techniques to maintain their objectivity during the analysis. Third, 38% did not use any techniques to examine or control evidence reliability. The paper provides insights into how DF investigations are carried out in practice. These insights are essential for the DF community to guide the development of procedures that safeguard fair investigations and effective error mitigation strategies.

A CRITICAL COMPARISON OF BRAVE BROWSER AND GOOGLE CHROME FORENSIC ARTEFACTS

Digital forensic practitioners are tasked with the identification, recovery and analysis of Internet browser artefacts which may have been used in the pursuit of committing a civil or criminal offence. This research paper critically compares the most downloaded browser, Google Chrome, against an increasingly popular Chromium browser known as Brave, said to offer privacy-by-default. With increasing forensic caseloads, data complexity, and requirements for method validation to satisfy ISO 17025 accreditation, recognising the similarities and differences between the browsers, developed on the same underlying technology is essential. The paper describes a series of conducted experiments and subsequent analysis to identify artefacts created as part of normal user browsing activity. Analysis of the artefacts found that Brave and Chrome share almost identical data structures, with on-disk artefact recovery successful, even for deleted data. The outcome of this research, based upon the results, serves to enrich understanding and provide best practice for practitioners and software developers, respectively responsible with the examination of Chromium artefacts for use in evidence production, and development of new forensic tools and techniques.

“Scaffolding” responses to digital forensic inquiries

AbstractAs part of their role, digital forensic practitioners are often faced with case‐specific investigative inquiries which they must attempt to address and provide an appropriate answer to their client. Such investigative questions can take many forms wherein every instance, any response they offer must be reliable. To be reliable, any response to an inquiry must be derived from justifiable and robust processes and information, coined here as the underpinning “scaffolding.” This work offers a discussion of response scaffolding, what it is and why it is required in digital forensics with the three ways that this can be achieved outlined—via “past experience,” “targeted testing” or through reference to appropriate “existing bodies of knowledge.” Each one is examined in turn and their use is demonstrated via an overarching hypothetical example which is deployed and utilized throughout the analysis narrative for illustrative purposes.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation

The different types of reports produced in digital forensic investigations

The importance of ensuring the results of any digital forensic (DF) examination are effectively communicated cannot be understated. In most cases, this communication will be done via written report, yet despite this there is arguably limited best practice guidance available which is specific for this field in regards to report construction. Poor reporting practices in DF are likely to undermine the reliability of evidence provided across this field, where there is a need for formalised guidance regarding the requirements for effective DF report construction; this should not be a task left solely to each individual practitioner to determine without instruction. For this, the field of DF should look to the wider forensic community and the existing work in this area for support. In line with many other ‘traditional’ forensic science types, a DF practitioner can be commissioned to report in one of three ways - ‘technical’, ‘investigative’ or ‘evaluative’, where each reporting type maintains a specific purpose and interpretative-context, determined by the examination workflow undertaken by a practitioner following client instruction. This work draws upon guidance set out in fundamental forensic science reporting literature in order to describe each reporting type in turn, outlining their scope, content and construction requirements in an attempt to provide support for the DF field.

A Survey on Digital Forensic Investigation Practitioners Approach and Challenges

Digital crimes are taking place over the entire world. For any digital crime which commit at any part of world, computer or any electronic devices are used. The devices which are used to commit the crime are useful evidences which must be identified and protected for further use. The crimes involving electronic devices are called as cyber-crime. To investigate such crimes, a scientific procedures needs to be followed. The data collection, analysis, preservation and presentation of digital evidence is must in order investigate the cybercrime. This paper highlights the practices that are used worldwide in the investigation process of cyber-crime. Keywords: Digital Forensics, Analysis, Investigation, models of investigation.

Identifikasi Bukti Forensik Jaringan Virtual Router Menggunakan Metode NIST

The evolution information technology has led to the growth of virtualization technology. Router OS is the operating system of the Mikrotik Router, which supports virtualization. Router Os virtualization technique which is easy to run is a metarouter. Metarouter provides benefits such as, building virtual servers, virtual machines, network topology and savings cost. As an object of research, Metarouter introduces challenges to digital forensic investigations, both practitioners and academics. Investigators need to use methodology and tools in order to prove the perpetrators of crimes. This study uses the Windump forensic tool as a means of recording network traffic activity. Network Miner and Wireshark as an analytical tool for identifying digital evidence. The use of the National Institute of Standard and Technology (NIST) method which collection, examination, analysis and reporting, can be repeated and maintained with the same data. Based on experiments with virtual router network traffic testing, the system built has succeeded in obtaining digital evidence, either by direct or indirectly. The system scenario that has been planned succeeded recording 220494 packages, but by the Windump, it is automatically divided into 9 (nine) parts of the package which are Buktidigital0 to Buktidigital8. The inspection stage produces evidence that has been verified by Wireshark and Network Miner. The analysis stage proves that there were attacks carried out by addresses 192.168.10.10 and 192.168.234.10. Based on the results of forensic testing, the use of the NIST method on a forensic system that has been built with a virtual router object can be used by investigators to identify evidence of cyber-attacks.

A Forensic Analysis Visualization Tool for Mobile Instant Messaging Apps

In this study, we demonstrate the role of visualization to facilitate forensic analysis goal in interpreting metadata of evidence of interest to answer who, what, why, when, where, and how an incident occurred. Two mobile Instant Messaging (IM) applications (i.e. WhatsApp and Line) were deployed as a case study. Subsequently, a tool – W*W Visualizer – was designed and developed with the aims to analyze and visualize the connection of evidence metadata, text frequency and word count, and display report of analysis activities. The tool is developed by adopting Object-Oriented Software Development Model with Visual Studio platform and C# language were used to develop the system. Our findings show that W*W Visualizer could transform the data of the chat database into a visual form, for example graph, chart and word cloud. The tool also allows the user to perform search feature such as searching based on keyword and timestamp from the IM chat history. It is expected that outcomes from this study would significantly influence digital forensics practitioners in analyzing and interpreting evidence data, and judicial authorities in understanding the presentation of evidence.

Inter-regional digital forensic knowledge management: needs, challenges, and solutions.

Increasing demand for digital evidence in criminal investigations is driving decentralization of forensic capabilities closer to the crime scene. Law enforcement agencies are struggling to keep pace with technological developments, cybercrime growth, and scientific advances. In federated environments, digital forensic knowledge and practices vary widely across regions. To reduce delays, wasted resources, missed opportunities, mistakes, and misinterpretations, there is a pressing need to balance the democratization of digital forensic capabilities with knowledge management and sharing between decentralized regions. There are multiple forms of knowledge to be managed, including procedural, technical, investigative, scientific, behavioral, crime analysis, and forensic intelligence. In addition, there are multiple knowledge producers and consumers, including police investigators, digital forensic practitioners, criminal intelligence analysts, attorneys, and judges. Knowledge management becomes even more challenging when multiple interdependent regions are involved, speaking different languages. Taking all of these factors into consideration, this work presents an inter-regional knowledge management solution for improving the quality, consistency, reliability, efficiency, cost-effectiveness, and return on investment of digital forensic capabilities. The basis of this work is a community-driven initiative of Swiss regional police authorities. Interviews were conducted with 15 digital forensic units to determine their current knowledge management practices and needs. The results were then generalized into a prioritized set of requirements for inter-regional digital forensic knowledge management that may be applicable in other countries. These requirements were used to evaluate knowledge management platforms, and one was selected. Implementation, operations, and maintenance challenges of an inter-regional digital forensic knowledge management platform are discussed.

Forensic Exchange Analysis of Contact Artifacts on Data Hiding Timestamps

When computer systems are increasingly important for our daily activities, cybercrime has created challenges for the criminal justice system. Data can be hidden in ADS (Alternate Data Stream) without hindering performance. This feature has been exploited by malware authors, criminals, terrorists, and intelligence agents to erase, tamper, or conceal secrets. However, ADS problems are much ignored in digital forensics. Rare researches illustrated the contact artifacts of ADS timestamps. This paper performs a sequence of experiments from an inherited variety and provides an in-depth overview of timestamp transfer on data hiding operations. It utilizes files or folders as original media and uses the timestamp rules as an investigative approach for the forensic exchange analysis of file sets. This paper also explores timestamp rules using case examples, which allow practical applications of crime scene reconstruction to real-world contexts. The experiment results demonstrate the effectiveness of temporal attributes, help digital forensic practitioners to uncover hidden relations, and trace the contact artifacts among crime scenes, victims, and suspects/criminals.

Chronological independently verifiable electronic chain of custody ledger using blockchain technology

As evidence in digital form becomes more prevalent in all kinds of investigations, there is a pressing need for a trustworthy and transparent way to maintain electronic chain of custody (e-CoC) and integrity information that is independently verifiable. Generally, a hash value of digital evidence is calculated and documented with the acquired data to prove that it has not been altered. However, the hash value alone does not prove that digital evidence is the same as when it was obtained, only that the contents has not been modified since the time when the hash was calculated. This work responds to the need for a chronological independently verifiable e-CoC ledger using blockchain technology. Employing this approach, each e-CoC record is stored in a block, each block being connected to the previous one with the hash value of the block. This e-CoC ledger, the blockchain, can be hosted by a trusted entity and accessed by any party to verify e-CoC details. For privacy reasons, sensitive information is not stored inside the e-CoC record in the blockchain. Moreover, to prove that the e-CoC ledger itself has not been modified, information is periodically sent to a public blockchain, where the integrity is guaranteed by its decentralization and the structure of such a secure ledger. Not all of the blocks are sent into a public blockchain which allows different levels of verification. Proof-of-work examples are provided using AFF4 and dc3dd to demonstrate how this e-CoC ledger can be used by different parties in a legal context, including digital forensic practitioners, attorneys and judges.

Towards Sound Forensic Arguments: Structured Argumentation Applied to Digital Forensics Practice

Digital forensic practitioners are increasingly facing examinations which are both complex in nature and structure. Throughout this process, during the examination and analysis phases, the practitioner is constantly drawing logical inferences which will be reflected in the reporting of results. Therefore, it is important to expose how all the elements of an investigation fit together to allow review and scrutiny, and to support associated parties to understand the components within it. This paper proposes the use of ‘Structured Argumentation’ as a valuable and flexible ingredient of the practitioners' thinking toolbox. It explores this approach using three case examples which allow discussion of the benefits and application of structured argumentation to real world contexts. We argue that, despite requiring a short learning curve, structured argumentation is a practical method which promotes accessibility of findings facilitating communication between technical and legal parties, peer review, logical reconstruction, jury interpretation, and error detection.

Structuring the Evaluation of Location-Related Mobile Device Evidence

Location-related mobile device evidence is increasingly used to address forensic questions in criminal investigations. Evaluating this form of evidence, and expressing evaluative conclusions in this forensic discipline, are challenging because of the broad range of technological subtleties that can interact with circumstantial features of cases in complex ways. These challenges make this type of digital evidence prone to misinterpretations by both forensic practitioners and legal decision-makers. To mitigate the risk of misleading digital forensic findings, it is crucial to follow a structured approach to evaluation of location-related mobile device evidence. This work presents an evaluation framework widely used in forensic science that employs scientific reasoning within a logical Bayesian framework to clearly distinguish between, on the one hand, what has been observed (i.e., what data are available) and, on the other hand, how those data shed light on uncertain target propositions. This paper provides case examples to illustrate the advantages and difficulties of applying this approach to location-based mobile device evidence. This work helps digital forensic practitioners follow the principles of balanced evaluation and convey location-related mobile device evidence in a way that allows decision-makers to properly understand the relative strength of, and limitations in, digital forensic results.

Standardization of forming and expressing preliminary evaluative opinions on digital evidence

The growing number of cases involving overlooked or misinterpreted digital evidence is raising concerns among factfinders and decision-makers about the reliability of digital forensic conclusions. To reduce the risk of mistakes and misinterpretations of forensic observations, including but not limited to digital evidence, there is a pressing need to standardize how evaluative opinions are formed and expressed. Responding to this need, the international community is drafting ISO-21043 and the UK Forensic Science Regulator is drafting an evaluative interpretation standard that promote a likelihood ratio approach. This approach is suitable for fully evaluative opinions in many forensic disciplines, but until more refined methods for evaluating digital evidence are developed, digital forensic practitioners require an interim solution to address immediate needs. More broadly, digital evidence is used in many non-judicial contexts that do not require fully evaluative opinions expressed as a likelihood ratio. This work proposes a standardized approach to formulating and expressing preliminary evaluative opinions in terms of strength of evidence in a manner that employs scientific reasoning within a logical Bayesian framework and can be understood by non-specialist factfinders. Illustrative case examples are presented that involve digital evidence tampering. In addition, this work presents a proof-of-concept database of cases involving tampering of digital evidence that could support assignment of strength of evidence in similar cases.