Digital Forensic Investigation Research Articles

Invisible boundaries: Balancing Image metadata privacy with forensic Imperatives

Metadata provides a wealth of information that is invaluable for digital forensic investigations, but it also poses significant privacy risks. The varying degrees of metadata retention across social media platforms have significant implications for digital forensic investigations. Metadata plays a crucial role in constructing timelines, verifying data authenticity, and providing evidence of interactions. In this research, we investigate the handling of EXIF metadata by various social media platforms and assess the implications for user privacy and digital forensic investigations. Our findings underscore the critical need for specialized software to manage and remove metadata from images uploaded to social media, preserving user privacy while retaining necessary data for legal and forensic purposes. To address these concerns, we implement a framework for encrypting and decrypting metadata, ensuring that sensitive information can be protected before images are uploaded to social media platforms. This research aims to encapsulate the findings and emphasize the need for balanced solutions that respect user privacy while supporting forensic investigations.

A SYSTEMATIC LITERATURE REVIEW ON ROLE OF PROJECT MANAGEMENT IN DIGITAL FORENSICS INVESTIGATION

The landscape of digital forensics has evolved significantly with the advent of sophisticated cybercrimes and the proliferation of digital devices. Digital forensics is a rapidly evolving discipline, characterized by unique challenges such as rapidly changing technology, large volumes of data, and stringent legal requirements. Effective project management in this context is crucial to ensure that investigations are conducted efficiently, accurately, and in compliance with legal standards. This systematic literature review aims to comprehensively analyze the role of project management practices in optimizing digital forensics investigations. Using established search protocols and selection criteria, we identified and analyzed relevant studies published between 2016 until 2023 that explored the application of project management methodologies, challenges, and best practices within the context of digital investigations. By applying effective project management strategies, investigators can ensure efficient, accurate, and legally sound digital investigations, ultimately contributing to successful criminal prosecutions and civil litigation outcomes.

How engaged are you? A forensic analysis of the Oura Ring Gen 3 application across iOS, Android, and Cloud platforms

Wearable devices are becoming increasingly popular, diverse, and accessible. To put it in perspective, in 2022 alone, more than 490 million wearable devices were sold. The diversity of wearables is beneficial to users but poses challenges for mobile forensic investigators. These devices track, utilize, and collect a wide range of user information, generating a wealth of data that can potentially be used or presented in court as evidence. To keep up with these innovations, mobile forensic investigators must continuously monitor and update their knowledge. In particular, smart rings are gaining popularity, with the Oura Ring Gen 3 being one of the most anticipated within the community. This study provides an initial look at the Oura Ring Generation 3 application, known as Oura, from a mobile forensic perspective. The artifacts presented in this article are derived from three different platforms: Android, iOS, and Cloud. The study reveals the exact paths of the data points and their locations. The data uncovered in this study could be significant for digital forensics investigators in various scenarios and inform users about the personal information that is stored. Information such as heart rate, various activities performed, user ID, and other user details could prove valuable in multiple instances.

Understanding Digital Forensic Tools: Their Features, Applicability and Key Short Comings. A Compendium

The Paper provides a comprehensive overview of various digital forensic investigation tools. The paper outlines the significance of digital forensics in collecting and preserving evidence for computer crimes and cybersecurity incidents. It discusses several prominent tools, including Encase Professional, Magnet Axiom, Passware Kit Forensic, Falcon Neo, Tableau USB Write Blocker, FTK Imager, and Autopsy, detailing their features, applications, and shortcomings. Key features highlighted include data acquisition methods, advanced file analysis capabilities, and reporting functionalities. The paper also addresses the potential limitations of these tools, such as issues with user authentication, performance under load, and chain of custody concerns. By examining these tools' strengths and weaknesses, the document aims to provide insights into their applicability in various investigative contexts and emphasize the importance of selecting appropriate tools for effective digital evidence management.

“What you say in the lab, stays in the lab”: A reflexive thematic analysis of current challenges and future directions of digital forensic investigations in the UK

Despite digital evidence nowadays playing a major role in criminal investigations and being intrinsic to almost every criminal trial, research in digital forensics (DF) and national approaches to digital evidence in relation to investigating officers and court personnel remain almost non-existent. This research seeks to remedy this issue by qualitatively examining the accounts and experiences of 16 digital forensic investigators (DFIs) in England and Wales who took part in semi-structured interviews. We analyzed the data using a reflexive thematic analysis and identified four overarching themes: (i) Navigating tensions with investigating officers (that has a subtheme of ‘Tensions with legal professionals and challenges navigating court theatrics’) (ii) The psychological, emotional, and existential challenges confronted by DFIs; (iii) Identifying the potential and pitfalls of automation and AI in DF and (iv) The centrality of academia in the advancement of DF (that has a subtheme of ‘Validation of tools as a crucial step in digital forensics’). These new findings reveal that DFIs encounter significant demands to perform well and are continuously overburdened while juggling many roles. This research serves as a pivotal starting point for broader discussions.

Towards a unified XAI-based framework for digital forensic investigations

Explainable Artificial Intelligence (XAI) aims to alleviate the black-box AI conundrum in the field of Digital Forensics (DF) (and others) by providing layman-interpretable explanations to predictions made by AI models. It also handles the increasing volumes of forensic images that are impossible to investigate via manual methods; or even automated forensic tools. A holistic, generalized, yet exhaustive framework detailing the workflow of XAI for DF is proposed for standardization. A case study examining the implementation of the framework in a network forensics investigative scenario is presented for demonstration. In addition, the XAI-DF project lays the basis for a collaborative effort from the forensics community, aimed at creating an open-source forensic database that may be employed to train AI models for the digital forensics domain. As an onset contribution to the project, we create a memory forensics database of 27 memory dumps (Windows 7, 10, and 11) simulating malware activity and extracting relevant features (specific to processes, injected code, network connections, API hooks, and process privileges) that may be used for training, testing, and validating AI models in keeping with the XAI-DF framework.

Nintendo 3DS forensics: A secondhand case study

Computer and console-based video games are an important part of the entertainment industry. Such devices may be found in evidence lockers as part of investigations, or overlooked as their intrinsic value to an investigation may not be well-understood. Modern games consoles provide network connectivity and functionality that allows a significant degree of interaction via peer-to-peer connections and/or the Internet. These gaming consoles store settings, user preferences, user information, and can capture photos, audio and video, all of which potentially contain forensic artifacts about a person of interest. Games consoles have a fixed lifespan, eventually superseded by newer models with an expanded range of capabilities. As there are significant numbers of consoles available on the secondhand market, there is clear evidence that older consoles remain in circulation even after production has ceased. What is unclear, however, is the actual extent of forensic data available within these consoles. This paper shares the results of a digital forensic case-study undertaken to assess what artifacts are retrievable based on ‘real-world’ dataset, particularly the aging, but popular Nintendo 3DS series. A total of 47 Nintendo 3DS/2DS handheld systems were purchased secondhand. They were forensically imaged then examined to identify what artifacts are commonly found ‘in the wild’ on these often overlooked systems. Results presented in this paper provide guidance to digital forensic investigators of what may be realistically obtained from these non-traditional devices.

Development of Digital Forensic Framework for Anti-Forensic and Profiling Using Open Source Intelligence in Cyber Crime Investigation

Abstract. Cybercrime is a crime that increases every year. The development of cyber crime occurs by utilizing mobile devices such as smartphones. So it is necessary to have a scientific discipline that studies and handles cybercrime activities. Digital forensics is one of the disciplines that can be utilized in dealing with cyber crimes. One branch of digital forensic science is mobile forensics which studies forensic processes on mobile devices. However, in its development, cybercriminals also apply various techniques used to thwart the forensic investigation process. The technique used is called anti-forensics. Purpose: It is necessary to have a process or framework that can be used as a reference in handling cybercrime cases in the forensic process. This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. Methods/Study design/approach: This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. By testing the scenario data, the results are obtained in the form of processing additional information from the files obtained and information related to user names. Result/Findings: The result is a digital forensic phase which concern on anti-forensic identification on media files and utilizing OSINT to perform crime suspect profiling based on the evidence collected in digital forensic investigation phase. Novelty/Originality/Value: Found 3 new types of findings in the form of string data, one of which is a link, and 7 new types in the form of usernames which were not found in the use of digital forensic tools. From a total of 408 initial data and new findings with a total of 10 findings, the percentage of findings increased by 2.45%.

Open Source Tools for Digital Forensic Investigation: Capability, Reliability, Transparency and Legal Requirements

Open Source Tools for Digital Forensic Investigation: Capability, Reliability, Transparency and Legal Requirements

A digital forensic analysis of an electrocardiogram medical device: A first look

AbstractThe increased frequency and severity of cybersecurity incidents impacting healthcare organizations has prompted the publication of suggested best practices for these organizations, when attempting to respond to incidents in their respective settings. While these best practices provide a wealth of information on how to respond to a cybersecurity incident impacting medical devices, minimal information is provided related to the forensics investigation of the devices themselves. A growing appetite for digital evidence from medical devices, coupled with limited practical guidance from industry best practices prompts an investigation into identifying tools and techniques to assist digital forensic investigators with device disassembly, data acquisition, and preservation of evidence in medical devices. This paper presents the results of a detailed exploratory case study involving the digital forensic investigation of a General Electric MAC 800 electrocardiogram medical device. The contributions of this research are threefold. First, it provides an empirical demonstration of practical techniques for acquiring and examining residual data from the electrocardiogram medical device. Second, the research documents the artifacts that can be recovered from the medical device, which could be used as potential evidence. Third, it provides the foundation for future investigations regarding the tools and processes suitable for examining additional medical devices.This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation Digital and Multimedia Science > IoT Forensics

Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions

Blockchain technology has gained significant attention in recent years for its potential to revolutionize various sectors, including finance, supply chain management, and digital forensics. While blockchain’s decentralization enhances security, it complicates the identification and tracking of illegal activities, making it challenging to link blockchain addresses to real-world identities. Also, although immutability protects against tampering, it introduces challenges for forensic investigations as it prevents the modification or deletion of evidence, even if it is fraudulent. Hence, this paper provides a systematic literature review and examination of state-of-the-art studies in blockchain forensics to offer a comprehensive understanding of the topic. This paper provides a comprehensive investigation of the fundamental principles of blockchain forensics, exploring various techniques and applications for conducting digital forensic investigations in blockchain. Based on the selected search strategy, 46 articles (out of 672) were chosen for closer examination. The contributions of these articles were discussed and summarized, highlighting their strengths and limitations. This paper examines the selected papers to identify diverse digital forensic frameworks and methodologies used in blockchain forensics, as well as how blockchain-based forensic solutions have enhanced forensic investigations. In addition, this paper discusses the common applications of blockchain-based forensic frameworks and examines the associated legal and regulatory challenges encountered in conducting a forensic investigation within blockchain systems. Open issues and future research directions of blockchain forensics were also discussed. This paper provides significant value for researchers, digital forensic practitioners, and investigators by providing a comprehensive and up-to-date review of existing research and identifying key challenges and opportunities related to blockchain forensics.

Forensic analysis and data decryption of tencent meeting in windows environment

Video conferencing applications have become ubiquitous in the post-COVID-19 era. Remote meetings, briefing sessions, and lectures are gradually becoming part of our culture. Thus, the amount of user data that video conferencing applications collect and manage has increased, and such data can be used as digital evidence. In this study, we analyzed Tencent Meeting, the most widely used video conferencing application in China, to identify the data stored on the user's disk by the application. Tencent Meeting stores user information and the chat history during a video conference on local storage. We found that Tencent Meeting suffers from a vulnerability in the process of encrypting and storing the user data, which can be exploited by anyone who can access and decrypt the user's data. We expect that our findings to help digital forensics investigators conduct efficient investigations when applications are used for malicious purposes.

Enhancing Digital Forensics Readiness in Big Data Wireless Medical Networks: A Secure Decentralised Framework

Wireless medical networks are pivotal for chronic disease management, yet the sensitive Big Data they generate presents administration challenges and cyber vulnerability. This Big Data is valuable within both healthcare and legal contexts, serving as a resource for investigating medical malpractice, civil cases, criminal activities, and network-related incidents. However, the rapid evolution of network technologies and data creates complexities in digital forensics investigations and audits. To address these issues, this paper proposes a secure decentralised framework aimed at bolstering digital forensics readiness (DFR) in Big Data wireless medical networks by identifying security threats, complexities, and gaps in current research efforts. By improving the network's resilience to cyber threats and aiding in medical malpractice investigations, this framework significantly advances digital forensics, wireless networks, and healthcare. It enhances digital forensics readiness, incident response, and the management of medical malpractice incidents in Big Data wireless medical networks. A real-world scenario-based evaluation demonstrated the framework's effectiveness in improving forensic readiness and response capabilities, validating its practical applicability and impact. A comparison of the proposed framework with existing frameworks concluded that it is an advancement in framework design for DFR, especially in regard to Big Data processing, decentralised DFR storage and scalability.

Investigating Digital Forensic Artifacts Generated from 3D Printing Slicing Software: Windows and Linux Analysis

Although Three-dimensional (3D) printers have legitimate applications in various fields, they also present opportunities for misuse by criminals who can infringe upon intellectual property rights, manufacture counterfeit medical products, or create unregulated and untraceable firearms. The rise of affordable 3D printers for general consumers has exacerbated these concerns, making it increasingly vital for digital forensics investigators to identify and analyze vital artifacts associated with 3D printing. In our study, we focus on the identification and analysis of digital forensic artifacts related to 3D printing stored in both Linux and Windows operating systems. We create five distinct scenarios and gather data, including random-access memory (RAM), configuration data, generated files, residual data, and network data, to identify when 3D printing occurs on a device. Furthermore, we utilize the 3D printing slicing software Ultimaker Cura version 5.7 and RepetierHost version 2.3.2 to complete our experiments. Additionally, we anticipate that criminals commonly engage in anti-forensics and recover valuable evidence after uninstalling the software and deleting all other evidence. Our analysis reveals that each data type we collect provides vital evidence relating to 3D printing forensics.

Video and Audio Deepfake Datasets and Open Issues in Deepfake Technology: Being Ahead of the Curve

The revolutionary breakthroughs in Machine Learning (ML) and Artificial Intelligence (AI) are extensively being harnessed across a diverse range of domains, e.g., forensic science, healthcare, virtual assistants, cybersecurity, and robotics. On the flip side, they can also be exploited for negative purposes, like producing authentic-looking fake news that propagates misinformation and diminishes public trust. Deepfakes pertain to audio or visual multimedia contents that have been artificially synthesized or digitally modified through the application of deep neural networks. Deepfakes can be employed for benign purposes (e.g., refinement of face pictures for optimal magazine cover quality) or malicious intentions (e.g., superimposing faces onto explicit image/video to harm individuals producing fake audio recordings of public figures making inflammatory statements to damage their reputation). With mobile devices and user-friendly audio and visual editing tools at hand, even non-experts can effortlessly craft intricate deepfakes and digitally altered audio and facial features. This presents challenges to contemporary computer forensic tools and human examiners, including common individuals and digital forensic investigators. There is a perpetual battle between attackers armed with deepfake generators and defenders utilizing deepfake detectors. This paper first comprehensively reviews existing image, video, and audio deepfake databases with the aim of propelling next-generation deepfake detectors for enhanced accuracy, generalization, robustness, and explainability. Then, the paper delves deeply into open challenges and potential avenues for research in the audio and video deepfake generation and mitigation field. The aspiration for this article is to complement prior studies and assist newcomers, researchers, engineers, and practitioners in gaining a deeper understanding and in the development of innovative deepfake technologies.

Towards a practical usage for the Sleuth Kit supporting file system add-ons

Most modern digital devices with storage utilize a file system to manage files and directories. Consequently, when digital forensic investigators derive evidence from such devices, they collect and analyze data stored on them through file system analysis. However, there are numerous types of file systems, with new ones continually being developed. Each file system possesses a distinct metadata structure and file management system. Therefore, investigators must possess prior knowledge of the specific file system being examined. Nevertheless, it is challenging for practitioners to be knowledgeable about all existing file systems. To address this issue, forensic software such as The Sleuth Kit (TSK), an open-source forensic tool, is employed for investigations. However, even these tools may not offer complete support for relatively recent file systems.Hence, we propose a structure for integrating a new file system into the open-source forensic tool TSK. Additionally, to validate this proposed structure, we demonstrate that support for five file systems (Ext4, XFS, Btrfs, F2FS, and Hikvision) can be added following this framework. To achieve this, we conducted an analysis of the metadata and file management scheme for these five file systems. Furthermore, we examined the operational procedures of the TSK framework. Based on these analyses, investigation capabilities for the five file systems have been incorporated into TSK. Moreover, reliability verification experiments were conducted on the developed tools; and performance evaluation was carried out in comparison with other commercial digital forensic tools. The findings of this study can serve as a foundation for future forensic studies based on file systems. Additionally, the TSK developed based on the proposed structure can assist investigators in conducting digital forensics effectively.

Comparative Analysis of NIJ and NIST Methods for MicroSD Investigations: A Technopreneur Approach

This research aims to compare the performance of two forensic investigation methods, the National Institute of Justice (NIJ) and the National Institute of Standards and Technology (NIST), specifically for evidence analysis of MicroSD cards. MicroSD cards are frequently used as external storage in various digital devices, making them critical in digital forensic investigations. The study evaluates the effectiveness of these methods using tools such as Access Data FTK Imager and autopsy. The NIJ method enthis comparative passes detailed stages of preparation, collection, examination, analysis, and reporting, while the NIST method includes stages of collection, examination, analysis, and reporting. Results indicate that the NIJ method provides more comprehensive and detailed results, while the NIST method offers a faster investigation process. Additionally, tables and graphs illustrating performance metrics are included to substantiate the findings. This comparative analysis provides valuable insights for technopreneurs in optimizing digital forensic methods for better data integrity and efficiency, ultimately enhancing decision-making processes in technological entrepreneurship. Furthermore, this study aligns with the United Nations' Sustainable Development Goals (SDGs), particularly Goal 9: Industry, Innovation, and Infrastructure, by promoting innovative forensic methods that support the development of resilient infrastructure and foster innovation in the digital age. This study highlights the importance of effective forensic methods in supporting technopreneurial ventures.

Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction

Timestamps and their correct interpretation play a crucial role in digital forensic investigations, particularly when the objective is to establish a timeline of events a.k.a. event reconstruction. However, the way these timestamps are generated heavily depends on an internal clock, or ‘system time’, from which many are derived. Consequently, when this system time is skewed due to tampering, natural clock drift, or system malfunctions, recorded timestamps will not reflect the actual times the (real-world) events occurred. This raises the question of how to validate the correctness of the system clock when recording timestamps and, if found incorrect, how to determine system clock skew. To address this problem, this paper defines several important concepts such as time anchors, anchoring events, non-anchoring events and time anomalies which can be used to determine if the system time was correct. Using two examples - a Google search and a file creation - and comparing correct and skewed versions of the same set of performed actions, we illustrate the use and potential benefits of time anchors to demonstrate the correctness of the system clock for event reconstruction.

Beyond timestamps: Integrating implicit timing information into digital forensic timelines

Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical “flat” timeline is thereby extended into a “rich” partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.

Advancing Digital Forensic through Machine Learning: An Integrated Framework for Fraud Investigation

The rise of cybercrime and cyber-related crime encourages efficient digital forensic investigations more crucial than ever before. Traditional investigation methods can be time-consuming, costly, and resource-intensive, while machine learning algorithms have the potential to reduce the complexity by promoting automation and investigation capabilities. This study begins with an analysis of digital forensics framework using a document analysis methodology. Moreover, exploring current practice and potential implementation of machine learning in digital forensics for fraud investigation is demonstrated through the features of Autopsy 4.15.0, a widely known digital forensics tool. The findings suggest the implementation of a comprehensive digital forensic framework that prioritizes the interpretation phase, with the support of machine learning capabilities. At present, machine learning mainly supports the analysis phase, which happens to be the most time-intensive process of digital forensic investigations. Furthermore, as fraud investigation has a role of fraud detection and prevention, current digital forensics procedures do not support the fraud detection and prevention process, despite the potential for machine learning to support this through pattern recognition.These discoveries are particularly significant in the fight against fraudulent activities, such as tax fraud, data fraud, financial fraud, and asset misappropriation, in the digital age.