Digital Forensic Investigation Process Research Articles

Artificial intelligence in mobile forensics: A survey of current status, a use case analysis and AI alignment objectives

As the capabilities and utility of Artificial Intelligence and Machine Learning systems continue to improve, they are expected to have an increasingly powerful influence in the digital forensic investigation process. The concurrent proliferation of mobile devices and rapid increase of forensic value of related artifacts creates the requirement for a comprehensive review of the current status of artificial intelligence software usage and usefulness in Mobile Forensics. In this context, we conducted a survey to evaluate the characteristics and properties of AI functions in mobile forensic software from the practitioners' perspective and enhance understanding to the work in the field. In this study, we evaluated the performance of image categorization software in digital forensics using a variety of evaluation metrics including accuracy, precision, recall, and F1-score, as well as the confusion matrix. In this research we also identify and integrate theoretical principles to conceptualize an AI Alignment framework pertaining to Mobile Forensics and Digital Forensics in general, in order to accurately determine specific AI strategy objectives and potential solutions to the current technical and administrative landscape. We emphasized the importance of interpretability and transparency in AI systems and the need for a comprehensive approach to understanding the reasoning behind the software's decisions. Additionally, we highlighted the importance of robustness in image categorization software, as well as the consideration of AI governance and standardized procedures concepts. Our results show that the accuracy and robustness of the image categorization software have a significant impact on the outcome of legal cases and that the software should be designed with interpretability, transparency, and robustness in mind. Through the examination of the survey responses, the evaluation of the image categorization software and research literature, we explore existing and potential approaches to aligned Artificial Intelligence and analyze their contribution to the forensic examination of cases.

Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems

With the continuously increasing number of security incidents targeting sensors, embedded devices, and other electronics appliances and systems that comprise the so-called Internet of things (IoT), the field of IoT forensics emerged as a branch of digital forensics focusing on the investigation of attacks in the IoT ecosystem. Digital evidence authenticity, integrity, confidentiality, and privacy are among the factors affecting the investigation process in IoT forensics, which can be addressed by employing the blockchain as the means not only for the preservation of digital evidence, but also for other steps of a digital forensics investigation process. The high-level goal of the paper is three-fold: to establish a holistic IoT forensics process as a reference point against which blockchain integration patterns and best practices will be identified in order to yield a robust, widely accepted and scalable architecture of the blockchain-enabled solution; to integrate the blockchain with the proposed IoT forensics process for addressing the above challenges; and to evaluate the overall solution highlighting improvements and potential performance bottlenecks. The proposed blockchain-enabled platform leverages multi-access edge computing and has been implemented with Hyperledger Fabric on an extensive virtualized testbed providing a realistic smart home environment. A thorough evaluation was conducted with real cyber-attacks generating digital evidence at high rates for testing the platform’s behavior at high load. The experimental results showed that the proposed platform achieved high throughput, excessively low latency, and zero error rate in the operation of the blockchain network.

Digital Forensic Framework for Protecting Data Privacy during Investigation

Rapid technological breakthroughs, a surge in the use of digital devices, and the enormous amount of data that these devices can store continuously put the state of digital forensic investigation to the test. The prevention of privacy breaches during a digital forensic investigation is a significant challenge even though data privacy protection is not a performance metric. This research offered solutions to the problems listed above that centre on the efficiency of the investigative process and the protection of data privacy. However, it’s still an open problem to find a way to shield data privacy without compromising the investigator's talents or the investigation's overall efficiency. This system proposes an efficient digital forensic investigation process which enhances validation, resulting in more transparency in the inquiry process. Additionally, this suggested approach uses machine learning techniques to find the most pertinent sources of evidence while protecting the privacy of non-evidential private files.

Machine-Learning Forensics: State of the Art in the Use of Machine-Learning Techniques for Digital Forensic Investigations within Smart Environments

Recently, a world-wide trend has been observed that there is widespread adoption across all fields to embrace smart environments and automation. Smart environments include a wide variety of Internet-of-Things (IoT) devices, so many challenges face conventional digital forensic investigation (DFI) in such environments. These challenges include data heterogeneity, data distribution, and massive amounts of data, which exceed digital forensic (DF) investigators’ human capabilities to deal with all of these challenges within a short period of time. Furthermore, they significantly slow down or even incapacitate the conventional DFI process. With the increasing frequency of digital crimes, better and more sophisticated DFI procedures are desperately needed, particularly in such environments. Since machine-learning (ML) techniques might be a viable option in smart environments, this paper presents the integration of ML into DF, through reviewing the most recent papers concerned with the applications of ML in DF, specifically within smart environments. It also explores the potential further use of ML techniques in DF in smart environments to reduce the hard work of human beings, as well what to expect from future ML applications to the conventional DFI process.

Unboxing the digital forensic investigation process

As digital forensics continues to play an important role in criminal investigations, its investigative work must be underpinned with well-defined and robust methodologies. Over the last 20 years, a substantial body of research has been produced to define and codify the digital forensic investigation process and the stages/sub-processes involved. Whilst current digital forensic investigation process models provide a solid foundation, it is argued that existing attempts often only focus on those physical tasks, which a practitioner must carry out at any given stage of an examination, omitting to identify those core thought processes, decisions and behaviours that form part of effective investigative practices. This work presents the Digital Forensic Workflow Model (DFWM), a novel approach to the structuring and definition of the procedures and tasks involved in the digital forensic investigation process starting from the initial ‘Review of Client Requirements & Planning’ stage, right through to the ‘Evaluation of Deployed Workflow’ stage. The DFWM contributes to the digital forensic management toolbox, where it enables the identification and management of risk and supports error mitigation at each stage of the workflow. The paper demonstrates how the DFWM functions as a framework for unboxing the digital forensic investigation process based on the investigative strategy of the particular case, providing a detailed structure and depiction of the physical and investigative tasks and decisions. From a research perspective, DFWM is a descriptive starting point, and future empirical studies may expand and provide further detail to the various physical and cognitive tasks and associated risks during the DF workflow.

Detection of Crime Patterns in Digital Forensic Investigation to Trace the Adversaries

The use of the internet has increased significantly over the past couple of years. Access to the internet has become so common that a person without computer knowledge can also use this facility easily. This ease of availability has provided a lot of benefits to society but on the other hand misuse of the internet for personal or corporate benefits is also increasing. To prosecute cybercriminals and make some lawful checks on everyone's digital activities, digital forensic science comes into the light. In this context, we developed a new framework that improves the digital forensic investigation process. This research paper proposes a method in which we can identify the illegal activities and trace the adversaries. We capture the TCP (Transmission Control Protocol) packets from the servers and workstations. This data collected from the TCP log is stored in the database and preprocessed to eliminate redundant data. Furthermore, the database also contains past data. The proposed framework has three major processes collection of TCP packets, storing and preprocessing of collected data in a database, and mining of the pattern through a digital forensic anomaly collection algorithm. For the evaluation of our proposed framework, we have developed a java based application. The results are shown in the form of reports and tables.

Digital forensics supported by machine learning for the detection of online sexual predatory chats

Chat-logs are informative digital footprints available on Social Media Platforms (SMPs). With the rise of cybercrimes targeting children, chat-logs can be used to discover and flag harmful behaviour for the attention of law enforcement units. This can make an important contribution to the safety of minors on SMPs from being exploited by online predators. The problem is that digital forensic investigation is mostly manual. Thus, a daunting task for forensic investigators because of the sheer volume and variety of data. The solution that is proposed in this paper employs a Digital Forensic Process Model that is supported by Machine Learning (ML) methods to facilitate the automatic discovery of harmful conversations in chat-logs. ML has already been successfully applied in the domain of text analysis for the discovery of online sexual predatory chats. However, there is an absence of approaches that show how ML can contribute to a digital forensic investigation. Thus, the contribution of this paper is to indicate how the tasks in a digital forensic investigation process can be organised so to obtain useable ML results when investigating online predators.

Disposable Virtual Machines and Challenges to Digital Forensics Investigation

Digital forensics field faces new challenges with emerging technologies. Virtualization is one of the significant challenges in the field of digital forensics. Virtual Machines (VM) have many advantages either it be an optimum utilization of hardware resources or cost saving for organizations. Traditional forensics’ tools are not competent enough to analyze the virtual machines as they only support for physical machines, to overcome this challenge Virtual Machine Introspection technologies were developed to perform forensic investigation of virtual machines. Until now, we were dealing with persistent virtual machines; these are created once and used many times. We have extreme version of virtual machine and that is disposable virtual machine. However, the disposable virtual machine once created and are used one time, it vanish from the system without leaving behind any significant traces or artifacts for digital investigator. The purpose of this paper is to discuss various disposable virtualiza-tion technologies available and challenges posed by them on the digital forensics investigation process and provided some future directions to overcome these challenges.

Internet of Things (IoT) Characteristics, Applications, and Digital Forensics Investigation Process: A Review

Internet of Things (IoT) Characteristics, Applications, and Digital Forensics Investigation Process: A Review

A semi-automated forensic investigation model for online social networks

Investigating the online social network profiles of victims, suspects, and witnesses are now part of almost every legal investigation, either it involves a criminal offense, financial fraud, or domestic lawsuit. However, investigating online social networks (OSN) is a technically complicated process that becomes more challenging due to the legal issues of privacy and authentication. Completely manual investigative methods are not feasible for OSN investigations due to the immense size and heterogeneity of social networks. However, the existing models for digital forensic investigation are not supporting automated or semi-automated forensic investigation processes. Furthermore, they are not addressing the fundamental differences and specific requirements of online social networks. The model presented in this work incorporates the robust features of standard investigation models and proposes a digital forensic investigation process model that explicitly addresses the necessities of OSN investigations. This work is addressing the issues of automating the forensic collection and analysis processes, defining crime scene boundaries, and outlining reasonable iterative collection procedures in online social network forensic investigation. This work is evaluated using a case study and is compared with existing practices and standards.

Industrial Internet of Things (IIoT) of Forensic and Vulnerabilities

The Industrial Internet-of-Things (IIoT) have changed the present world and future technology-based Industry 4.0, however the understanding of Industrial Internet of things (IIoT) has turned out to be big challenge as far as security concern. The main purpose of adopting and going with new technologies will bring new challenges with cybersecurity and will have more expose uncertain vulnerabilities in terms of AI and BI applications and usage with forensic investigation and accuracy of information sharing between smart devices. This paper composed on the utilization of Artificial Intelligence in securing required evidence for forensic investigation process. The legal methods are different as per region and industry, but the back-frame work and case-based thinking are similar. This framework is made from Intelligence systems such as AI and BI too dependent on the digital information from cloud server. The information from Business Intelligence (BI) and Artificial Intelligence (AI) intersects with data on cloud-based server requires more secure network process and firewall to prevent cyber intruders. This paper has discovered a few gaps on security issues and vulnerabilities where as it will cater proper IIoT based procedure for the Digital Forensic Investigation process.

A comparative analysis of digital forensic readiness models using CFRaaS as a baseline

AbstractDigital forensic readiness (DFR) aims at maximizing the potential of conducting a digital forensic investigation while minimizing the cost of conducting postevent processes when a potential security incident is detected. Conducting digital forensic investigation (DFI) process and changing the functionality of software architectures and/or infrastructures while conducting these processes is a costly exercise; however, the availability of DFR processes can shorten and save the cost of these processes. A comparative analysis of the DFR process models is given that makes a strict comparison with the cloud forensic readiness as a service (CFRaaS) model. The main reason the CFRaaS model has been used as a basis for comparison is because it has been constructed by modifying the functionality of initially considered malicious botnets to allow the removal of potential digital evidence from the cloud without changing the architecture or the infrastructure of the cloud while conducting digital forensic processes. It is worth to note that the CFRaaS processes have been carefully developed based on the guidelines of ISO/IEC 27043:2015 international standards for information technology, security techniques, incident investigation principles and processes. Nevertheless, additional postevent response processes have also been incorporated in the CFRaaS like the reconstruction of the events and the Incident Response Procedures processes. The outcome of the comparison has shown promising results worth exploring.This article is categorized under: Digital and Multimedia Science > Cloud Forensics Digital and Multimedia Science > Cyber Threat Intelligence MoDigital and Multimedia Science > Forensic Visualization

Digital Forensic Investigation of Social Media, Acquisition and Analysis of Digital Evidence

Various social networking sites (SNSs), widely referred to as social media, provide services such as email, blogging, instant messaging and photo sharing for social and commercial interactions. SNSs are facilitating new forms of social interaction, dialogue, exchange and collaboration. They allow millions of users and organisations worldwide to exchange ideas, post updates and comments or participate in activities and events, while sharing their wider interests. At the same time, such a phenomenon has led to an upsurge in significant criminal activities by perpetrators who are becoming increasingly sophisticated in their attempts to deploy technology to circumvent detection. Digital forensic Examiners (DFEs) often face serious challenges in relation to data acquisition. Therefore, this article aims to analyse the significance of SNSs in DFIs and challenges that DFEs often encounter when acquiring evidence from SNSs. Furthermore, this article describes the steps of the digital forensic investigation process that must be taken to acquire digital evidence that is both authentic and forensically sound.

Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes

The state-of-the-art and practice show an increased recognition, but limited adoption, of Behavioural Evidence Analysis (BEA) within the Digital Forensics (DF) investigation process. Yet, there is currently no BEA-driven process model and guidelines for DF investigators to follow in order to take advantage of such an approach. This paper proposes the Behavioural Digital Forensics Model to fill this gap. It takes a multidisciplinary approach which incorporates BEA into in-lab investigation of seized devices related to interpersonal cases (i.e., digital crimes involving human interactions between offender(s) and victim(s)). The model was designed based on the application of traditional BEA phases to 35 real cases, and evaluated using 5 real digital crime cases - all from Dubai Police archive. This paper, however, provides details of only one case from this evaluation pool. Compared to the outcome of these cases using a traditional DF investigation process, the new model showed a number of benefits. It allowed a more effective focusing of the investigation, and provided logical directions for identifying the location of further relevant evidence. It also enabled a better understanding and interpretation of victim/offender behaviours (e.g., probable offenders' motivations and modus operandi), which facilitated a more in depth understanding of the dynamics of the specific crime. Finally, in some cases, it enabled the identification of suspect's collaborators, something which was not identified via the traditional investigative process.

Adoption of Chain of Custody Improves Digital Forensic Investigation Process

Chain of custody plays an important role in determine integrity of digital evidence, because the chain of custody works on a proof that evidence has not been altered or changed through all phases, and must include documentation on how evidence is gathered, transported, analyzed and presented.
 The aims of this work is first to find out how the chain of custody has been applied to a wide range of models of the digital forensic investigation process for more than ten years. Second, a review of the methods on digitally signing an evidence that achieves the successful implementation of chain of custody through answering a few questions "who, when, where, why, what and how", and thus providing digital evidence to be accepted by the court. Based on the defined aims an experimental environment is being setup to outline practically an acceptable method in chain of custody procedure. Therefore, we have adopted SHA512 for hashing and regarding encryption RSA and GnuGP is applied where according to the defined requirement a combination of this algorithms could be adopted as a practical method.

Case Based Interpretation of Windows 10 Registry Forensics

With the advancement in computer technologies, cybercrimes advanced too. As in today’s world, the technology knowledge to attack a computer is less than ever, with the help of advanced tools that does most of the work. Digital forensic investigations are crucial in solving this type of crimes, and it must be done professionally. Computer registries play a big part in the digital forensic investigation, it can help find artifacts that are left by the cybercrimes, dates of the crimes on the computer system and the user at the time of the crime. In this research, interpretation of these artifacts is the main focus, committees and jurors are the focus of the interpretations of the registries. Two types of cases are subject to investigation in this research. BitTorrent clients’ use for downloading illegal o copyrighted content, and three clients are chosen for this digital forensic investigation uTorrent, Vuze and BitComet. Theft using USB storage devices is the second type of case, where there are three types of USB devices Mass Storage Class, Picture Transfer Protocol and Media Transfer Protocol, each type of USB devices leaves different artifacts behind during insertion and removal. A web based dashboard will be developed to help with the process of interpretation the artifacts found in the registry of the computer system. A categorization process of each cybercrime case will be conduct to evaluate the severity of the case depending on the artifacts found in the digital forensics investigation process. The research methodology will consist of three phases. The first phase will be information gathering including literature review, requirements gathering and dataset gathering for the research. Performing digital forensics analysis will be the second phase and it includes planning, identification and reconnaissance. Last phase will include result analysis and discussion.

Adding Digital Forensic Readiness as a Security Component to the IoT Domain

The unique identities of remote sensing, monitoring, self-actuating, self–adapting and self-configuring “things” in Internet of Things (IoT) has come out as fundamental building blocks for the development of “smart environments”. This experience has begun to be felt across different IoT-based domains like healthcare, surveillance, energy systems, home appliances, industrial machines, smart grids and smart cities. These developments have, however, brought about a more complex and heterogeneous environment which is slowly becoming a home to cyber attackers. Digital Forensic Readiness (DFR) though can be employed as a mechanism for maximizing the potential use of digital evidence while minimizing the cost of conducting a digital forensic investigation process in IoT environments in case of an incidence. The problem addressed in this paper, therefore, is that at the time of writing this paper, there still exist no IoT architectures that have a DFR capability that is able to attain incident preparedness across IoT environments as a mechanism of preparing for post-event response process. It is on this premise, that the authors are proposing an architecture for incorporating DFR to IoT domain for proper planning and preparing in the case of security incidents. It is paramount to note that the DFR mechanism in IoT discussed in this paper complies with ISO/IEC 27043: 2015, 27030:2012 and 27017: 2015 international standards. It is the authors’ opinion that the architecture is holistic and very significant in IoT forensics.

A multidisciplinary digital forensic investigation process model

Worldwide usage of mobile smart devices has increased dramatically over the past two decades. The popularity of these devices has grown as a result of their increased processing power, storage capacity, and memory; they can now hold enormous amounts of both personal and private business data. In addition to the consideration of mobile devices, the scope of any forensic investigation has also grown to include cloud environments. Previously, we proposed a working model that can improve the effectiveness and efficiency of an investigation in a multidisciplinary environment. The study presented herein, however, evaluates a straw man model derived from current practice models to identify the required improvements. The study also proposes a new improved process model known as a multidisciplinary digital forensic investigation process model.

Review and Assessment of the Existing Digital Forensic Investigation Process Models

Review and Assessment of the Existing Digital Forensic Investigation Process Models

A Proactive Approach in Network Forensic Investigation Process

Information Assurance and Security (IAS) is a crucial component in the corporate environment to ensure that the secrecy of sensitive data is protected, the integrity of important data is not violated, and the availability of critical systems is guaranteed. The advancement of Information communication and technology into a new era and domain such as mobility and Internet of Things, its ever growing user’s base and sophisticated cyber-attacks forces the organizations to deploy automated and robust defense mechanism to manage resultant digital security incidences in real time. Digital forensic is a scientific process that facilitates detection of illegal activities and in-appropriate behaviors using scientific tools, techniques and investigation frameworks. This research aims at identifying processes that facilitate and improves digital forensic investigation process. Existing digital forensic framework will be reviewed and the analysis will be compiled toderive a network forensic investigation framework that include evidence collection, preservation and analysis at a sensor level and in real time. It is aimed to discover complete relationship with optimal performance among known and unseen/new alerts generated by multiple network sensors in order to improve the quality of alert and recognize attack strategy