Digital Forensic Process Research Articles

Development of Xiaomi Product Mobile Forensic Acquisition Framework on Second Space Features Based on SNI/ISO 27037:2014

Abstract — In conducting digital forensic activities, it must follow the rules of SOP procedures or frameworks as a reference. One of the acquisition frameworks used in digital forensics practice is ISO 27037:2014, which contains specific guidelines related to digital forensic investigation activities. On the other hand, mobile cellular is one of the branches of digital forensics that is always developing, but with the large variety of mobile devices today, ISO 27037: 2014 has not provided specific standards in the digital forensics process on mobile devices that have special features that are different from ordinary mobile devices. One of the special features provided by Xiaomi vendor developers that gives users access to cloning and creating new space in one mobile phone is called second space or second space. With this, it will be a problem for investigators when conducting forensic processes because the data acquisition process will produce 2 extraction results from one mobile device, but the SNI ISO 27037: 2014 standard has not regulated the validity of digital evidence obtained from these special features. This research will develop a framework in conducting the investigation process on Xiaomi mobile devices, because currently only Xiaomi mobile devices have a second room feature. By paying attention to the existing problems, this research will develop a framework in carrying out the acquisition process on xiaomi mobile devices on the special features of the second room based on SNI ISO 27037: 2014. It is hoped that this research can help investigators, especially DEFR (Digital Evidence First Responder) and can be a reference that can be used in the process of searching for electronic evidence that is in accordance with SNI ISO 27037: 2014 and can be accounted for in court.

The role of Artificial Intelligence in digital forensics: Case studies and future directions

Key digested messageThe increase in digital evidence, especially in cases involving Indecent Images of Children (IIOC), presents a pressing challenge for law enforcement agencies. In this article, we discuss two of the most prominent types of Artificial Intelligence (AI) and how they can be used in digital forensic processes, providing examples, and highlighting potential challenges that are likely to be experienced in developing and adopting AI. The two main types are of Data-Driven Model (DDM) age classification and ModelBased Reasoning (MBR), and in this article, examples for both are provided and discussed in the contents of IIOC investigations.

Digital forensics in healthcare: An analysis of data associated with a CPAP machine

The need for digital forensic services across all sectors is not a new concept, nor is the increasing demand seen globally. However, the devices on which we perform digital forensics have changed and continue to evolve. For each device new approaches need to be developed or adapted to facilitate the secure preservation and analysis of the data it contains. The healthcare sector has seen particular adoption of a range of devices, from traditional through to cutting edge. The Covid-19 pandemic facilitated the need for a more boundary-agnostic level of care for patients, and medical devices are becoming increasingly more interconnected to facilitate remote care. This presents challenges in that devices are no longer “secured” in medical premises and will often be found in patient's homes, making them more exposed to attack, but also in a position to record significant amounts of personal data. The integration of information technology in medical environments has influenced the need for the development of a digital forensic process to perform analysis on medical devices. One such device is a continuous positive airway pressure (CPAP) machine, used by patients who suffer from Obstructive Sleep Apnea (OSA). It is estimated that 3-9% of the world's population suffer from this disorder, the normal medical treatment is the use of some form of CPAP machine. The research undertaken focuses on the ResMed AirSense 10 CPAP machine and a complete forensic postmortem analysis of the data contained and recorded by the device. The application of digital forensics to a traditional medical device, such as a CPAP machine, requires an adapted version of digital forensics, but in general the same tools and processes can be used. Through the analysis conducted, all patient data was located on a removable FAT32 formatted SD card, allowing the recovery of specific medical information about the device and personally identifiable information about the patient. The recovered data was then visualised using a variety of tools and systems. Information that can be derived from the visualisations include a sequence of events, to some extent how the device was operating, and the clinical information recorded on the device.

Digital Forensic Urgence in Analyzing Electronic Evidence for Evidence of Criminal Actions in Information and Electronic Transactions

This study aims to determine the position of digital examination results as electronic evidence for proving criminal acts of information and electronic transactions. This research was conducted using normative research methods. which is done by researching library materials and judges' decisions then analyzing the materials which are methods or methods used in a legal research to find answers which will later become a prescription for the legal problems faced. The results of this study indicate that digital evidence in the form of information and electronic documents and has passed the digital forensic process is legal evidence, as stated in Article 5 paragraphs (1) and (2) of Law Number 19 of 2016 concerning Electronic Information and Transactions. . So that the position of electronic evidence from the results of digital forensic examinations as evidence of expert testimony and documentary evidence at the stage of investigation and proof in the trial process.

Forensic detection of heterogeneous activity in data using deep learning methods

The abundance of digital images has been facilitated by smartphones and inexpensive storage. Digital forensic investigation requires the processing of tons of digital images collected on devices to either identify or validate the device's user or to ascertain whether the operator has any connections to the case that would be of interest. Examining and evaluating heterogeneous activity presents several difficulties, including variability, complex interaction across information, and volume. Digital forensics processes are said to need the inspection and analysis stages. This research presents a hybrid optimization of the Grey Wolf and artificial bee colony (GW-ABC) optimization with deep learning model Convolutional Neural Network (CNN) i.e., GW-ABC-CNN, and the developed framework is integrated as a module for Autopsy software. The main objective of this research is to detect the heterogeneous activity of humans from the Heterogeneous Human Activity Recognition (HHAR) database. The developed model is integrated into the data-source ingest module; in this module, pre-processing, feature extraction, and detection process is performed. Moreover, in the pre-processing stage, the Min-Max normalization method is used and the required frequency and time features are extracted using the GW-ABC method. In addition, CNN is used to detect heterogeneous activity; this detection process is performed by four layers. Finally, the effectiveness of the developed model is assessed, and the outcomes of using the GW-ABC-CNN paradigm were compared to those of other strategies to evaluate the model's effectiveness.

USING BLOCKCHAIN TECHNOLOGY FOR FORENSIC ENGINEERING OF DIGITAL ASSET BUSINESS IN THAILAND

This research article aims to study the use of blockchain technology for forensic engineering in Thai digital asset business. This research uses qualitative research methods based on in-depth interviews with experts related to blockchain technology. Digital asset business and engineering verification is a study based on the digital forensic process model. According to the international standard ISO/IEC 27037 , it consists of 4 components: 1) evidence identification 2) data collection 3) data acquisition 4) integrity of evidence. The study found that the use of blockchain technology increases the efficiency of the digital forensics process, solves problems in the original system andmakes the information and the evidence to be accurate and reliable. Blockchain technology also increases the security of information as Information security management system standards(ISMS) or ISO 27001 has completed all 3 elements: confidentiality, integrity and readiness for use.

Automated Planning to Prioritise Digital Forensics Investigation Cases Containing Indecent Images of Children

Law enforcement agencies (LEAs) globally are facing high demand to view, process, and analyse digital evidence. Arrests for Indecent Images of Children (IIOC) have risen by a factor of 25 over the previous decade. A case typically requires the use of computing resources for between 2-4 weeks. The lengthy time is due to the sequential ordering of acquiring a forensically sound copy of all data, systematically extracting all images, before finally analysing each to automatically identify instances of known IIOC images (second-generation) or manually identifying new images (first-generation). It is therefore normal practice that an understanding of the image content is only obtained right at the end of the investigative process. A reduction in processing time would have a transformative impact, by enabling timely identification of victims, swift intervention with perpetrators to prevent re-offending, and reducing the traumatic psychological effects of any ongoing investigation for the accused and their families. In this paper, a new approach to the digital forensic processes containing suspected IIOC content is presented, whereby in-process metrics are used to prioritise case handling, ensuring cases with a high probability of containing IIOC content are prioritised. The use of automated planning (AP) enables a systematic approach to case priorisation. In this paper, a planning approach is presented where AP is used to generate investigative actions in 60-minute segments, before re-planning to account for discoveries made during the execution of planned actions. A case study is provided consisting of 5 benchmark cases, demonstrating on average a reduction of 36% in processing time and a 26% reduction in time required to discover IIOC content.

Digital forensics on facebook messenger application in an android smartphone based on NIST SP 800-101 R1 to reveal digital crime cases

Android is the world's most popular system of operation. In the Android system, communication applications can be installed, for example, Facebook Messenger, which is one of the most popular communication applications with 988 million active users. As a medium for communication and data exchange, the Facebook Messenger application may be misused by unauthorized parties for cybercrime. This action is usually done to obtain a one-sided profit for unauthorized parties. After doing cybercrime, cybercriminals will delete all of the data to remove digital evidence. Digital forensics serves the challenge of uncovering evidence in investigations. Digital forensics on the Facebook Messenger application is needed to help the authorities organize digital evidence when the disclosure process is performed. The data revealed through the digital forensics process can reinforce existing evidence in a court. In this research, digital forensics on the Facebook Messenger application was conducted with data deletion scenarios and application uninstall scenarios. The results are digital evidence in the form of Facebook Messenger application information, photo, and video sent by the cybercriminal. The conversation and audio evidence could not be located because there was no rooting process, or the smartphone was in an untied state. When the uninstall process was carried out, the smartphone automatically deleted all the data including thumbnails. However, the digital forensics process in an unrooted state on the Facebook Messenger application can still produce digital evidence that can be used in the court.

Digital Forensics Techniques and Trends: A Review

The research work presented in this paper aims to review Digital Forensics (DF) techniques and trends. As computer technology advances day by day, the chances of data being misused and tampered with are also growing daily. The advancement in technology results in various cyber-attacks on computers and mobile devices. DF plays a vital role in the investigation and prevention of cyber-attacks. DF can be used to find the shreds of evidence and prevent attacks from happening in the future. Earlier presented reviews highlighted specific issues in DF only. This paper explores deeply DF issues by highlighting domain-specific issues and possible helpful areas for DF. This article highlights the investigation process framework and related approaches for the digital investigation process. The cognitive and human factors that affect the DF process are also presented to strengthen the investigation process. Nowadays, many DF tools are available in the industry that helps in DF investigation. A comparative analysis of the four DF tools is also presented. Finally DF performance is discussed. The submitted work may help the researchers go deeper into DF and apply the best tools and models according to their requirements

A forensic investigation framework for Internet of Things monitoring

With low-energy wireless sensing platforms enabling communications between the physical world and numerous Internet based digital devices, Internet connected physical objects have blurred the lines that traditionally separated a physical scene from the digital scene. Whilst sophisticated new Internet enabled physical objects are rapidly introduced for various IoT applications, the increasing variety and similarities of the connected Things to ordinary physical objects has significant implications for the digital forensic process of identification. The often-constrained Things, however, communicate utilizing new and improved technologies that provide for robust wireless communications where other traditional wireless technologies are less suitable. This brings the opportunity to gather valuable insights from the radio frequency signals of a physical environment. This research introduces a novel concept of harnessing radio frequency signals to discover, determine and locate the wireless sensing deployments of a digital scene. A model of the system for IoT monitoring combines the processes of collecting communications between connected Things, building the logical topologies and predicting the locations of disparate Things. The design of this solution is suited to benefit both forensic investigators and law enforcement agencies.

Analisis Forensik Aplikasi TikTok Pada Smartphone Android Menggunakan Framework Association of Chief Police Officers

TikTok is the most popular social media app that ranks sixth in the world in January 2022 according to We Are Media & Hootsuite. Along with the increasing number of uses of this application, the negative impacts it causes are also increasing, ranging from fraud, cyberbullying, to the spread of fake news (hoax). This study focuses on the negative impact of defamation. The purpose of the research is to plan and implement a digital forensics process using the Association of Chief Police Officers (ACPO) framework to raise evidence of defamation cases on the TikTok application. The forensic process is carried out in the form of static forensics on cases that are intentionally made in the form of simulating TikTok postings using an android smartphone. This research combines the ACPO forensics framework with the Magnet Axiom forensics tools. The combination of the two succeeded in raising 77% of evidence in the form of data messages, videos, and hashtags. Where these data have been previously defined as initial data posted in the simulation process

CONTAIN4n6: a systematic evaluation of container artifacts

A container provides an environment where applications are packaged and run with the supporting libraries and dependencies. Due to scalability and efficient software deployment, the popularity of container technology has increased and its services are also available on cloud platforms. The container environment is prone to a variety of threats and vulnerabilities that lead to security breaches and attacks. Investigation is required to analyze the attack and the digital forensics processes have also been implemented in the container environment. In this paper, we present a systematic evaluation of container artifacts. An interface named CONTAIN4n6 is developed to collect data from container environment that extracts the data using introspection libraries, container file systems, and is also capable to trace the system call of running container. The functionality of system calls traces is implemented in an open source containerization software, i.e, Moby project. Container’s artifacts are associated with environmental information, log files, directories, link files, repositories, etc. Data collected from multiple sources are stored in a database and created a hash values to maintain the integrity of collected data. A case study of privilege escalation attacks has been demonstrated which is used to validate the data collection tool, called, CONTAIN4n6. Research challenges associated with security and forensic investigations on containerized applications are also presented.

Mobile Device’s Digital Forensic Process Model

The primary goal is to compare various digital forensics process models, particularly mobile devices. One must conduct investigations forensically to prosecute digital offenders, with the resulting evidence acknowledged in a court of law. Digital forensic process models outline the necessary procedures that one must follow to ensure a successful enquiry. Keywords: Mobile Devices, Digital Devices, Digital Evidence and Smartphone BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free

SIFT Multi-Purpose Forensic Operating System For Digital Forensic Process.

The number of cyber incidents in which computer system or device is currently increasing every day. This requiring the opening up of forensic investigations in to multi-purpose forensic operating system for digital forensic process, a research that can shed light on what has occurred, In order to be able to provide investigators with proper solutions. for performing complete and efficient examinations in this new environment, operating systems platform and devices are being studied from a forensic perspective so that tools and procedures can be designed accordingly Keywords: Forensic Investigations, Cyber Forensic, Multi-Purpose Forensic Operating.

Crowdsourcing forensics: Creating a curated catalog of digital forensic artifacts.

The increasing volume, variety, velocity, distribution, structural intricacy, and complexity of use of digital evidence can make it difficult for practitioners to find and understand the most forensically useful information (Casey E. Digital evidence and computer crime: Forensic science, computers, and the Internet. Academic Press; 2011. p. 31; Pollitt M. The hermeneutics of the hard drive: Using narratology, natural language processing, and knowledge management to improve the effectiveness of the digital forensic process [PhD dissertation]. University of Central Florida; 2011). Digital forensic practitioners currently search for information and solutions in an ad hoc manner, leading to results that are unstructured, unverified, and sometimes incomplete. As a result, certain digital evidence is being missed or misinterpreted. To mitigate risks of knowledge gaps, there is a pressing need for a systematic mechanism that practitioners can use to codify and combine their collective knowledge. This work presents the design and development of a solution that catalogs crowdsourced knowledge of digital forensic artifacts in a well‐structured, easily searchable form to support efficient and automated extraction of pertinent information, improving availability and reliability of interpretation of artifacts (general acceptance). Technical implementation and artifact curation are discussed with illustrative examples and recommendations for future work.

Cyber Crime Forensics

Cyber crime is becoming more frequent in our daily life since computers are everywhere now and hence the term cyberspace is becoming our ordinary life. Digital forensics or computer forensics which the process of securing digital evidence against the crime is becoming inevitable. Digital evidence is the foundation for any digital forensic investigation that can be collected by several means using technologies and scientific crime scene investigation. Modifications with crime scene data may possibly change the evidences that may lead to different investigation results. Several models and frameworks to help investigating cybercrimes have been proposed. In this paper we are proposing a frame work that to suit the Sudanese judiciary system. The framework suggested studied several models and frameworks in the globe to come out with a suitable framework model that can help the Sudanese courts taking their decisions concerning cybercrime. The conventional chain of custody is our main platform to construct our framework. That is due to fact that computer crime is different from conventional crime in that it may have no definite place or space. Although The share of people in computer crime is more crucial than the technology itself, achieving evidence integrity is more challenging than normal crimes. This work aims to study and evaluate the applicability of existing digital forensic process models to the Sudanese environment, analyze each of these frameworks might and then construct a framework to Sudan courts.

Forensics chain for evidence preservation system: An evidence preservation forensics framework for internet of things‐based smart city security using blockchain

AbstractIn recent times, the new revolution of IoT facilitates communication and information sharing among people in different domains like a smart city. This revolution came with a risk of cyber‐attacks that target devices and shared data. The digital evidence resulting from the digital forensics process applied to IoT devices must be kept safe for later analysis. Preserving digital evidence on a centralized server raises the risk of a single point of failure. Evidence preserving on cloud servers raises the tampering risk with the evidence or even sharing them with malicious third parties. Therefore, this paper presents a novel framework called Forensics Chain for Evidence Preservation System for IoT‐based smart city security. The proposed framework aims to integrate blockchain with digital forensics to overcome the problems faced by forensic investigators; single point of failure and/or evidence modifications and enhance the security of preserving digital evidence via applying blockchain. Applying blockchain guarantees the immutability and data integrity of the preserved evidence. Furthermore, preserving the digital evidence among the forensic participant nodes eliminates the possibility of the single‐point failure of a centralized storage server. The results provided a Proof of Concept for forensic evidence preservation based on blockchain and evaluated its performance.

Digital forensic investigation methodology for Storage Space: Based on the NIST digital forensic process.

For forensic examiners, investigating the RAID systems of servers has been challenging, as the examiners must reconstruct multiple high-capacity disks to identify digital evidence. Software-based RAID systems' use has been released for personal use, so examiners should consider RAID systems even when they investigate personal computers. Although there is a high probability that the software-based RAID will become a target of crime, there has been little research into digital forensic methodology for software-based RAID, as exemplified by Storage Space. In this paper, we introduce details about the structure of Storage Space found through reverse engineering. Storage Space was analyzed by applying the digital forensic process of NIST. We explain how to reconstruct a virtual disk configured using Storage Space and develop an automated tool to do so. To evaluate our study and the tool developed, we created an experimental scenario and describe in detail the forensic procedure and technical methods for the analysis of Storage Space. Our research can be used as the basis of forensic investigations for Storage Space.

Email Analysis in Fraud Investigation: Digital Forensic and Network Analysis Approach

Email is an imperative method of communication that is changing the way people share their data and information. It provides effective and efficient communication, especially in business, convenience, and easy access and replication. Those electronic data should be considered by a fraud investigator to comprehend the investigation. Email can be divided into two parts: the head of the email and the email body. The head of the email is metadata that consists of unstructured data, and the body and its attachment consist of semi-structured data. The email data usually comes in large volumes and ranges of types. Therefore, a manual investigation of an email should be avoided. This paper uses the Design Science Research Methodology to discover the most profound framework in an email fraud investigation. Using email metadata and email body, this research performs a digital forensic framework: preparation, gathering, processing, and presentation, combines with social network analysis to be applicable in the investigation. The result shows that digital forensics process, network analysis, data visualization provides a more valuable and comprehensive insight into email analysis.

AKUISISI BUKTI DIGITAL PADA APLIKASI TAMTAM MESSENGER MENGGUNAKAN METODE NATIONAL INSTITUTE OF JUSTICE

Smartphones are one of the tools used in carrying out daily work activities, the number of active social media users in Indonesia in January 2019 reached 150 million, 130 million of whom accessed social media using smartphones. With the development of smartphones in social media, many are misused using instant messaging applications, one of which is cybercrime such as cyberbullying, human trafficking systems, fraud and so on. Cyberbullying is one of the negative impacts in cyber crime through the use of applications that are often used, namely the TamTam Messenger social media. The problem that will be discussed in this study is the digital forensic process, especially mobile forensics in order to find digital evidence that was deleted on the TamTam Messenger application using the MobileEdit forensic tools and the National Institute of Justice method. The results of this study show that using the MobileEdit forensic tools and the National Institute of Justice method succeeded in recovering digital evidence that had been deleted by the perpetrator on the TamTam Messenger application.