Digital Forensic Research Workshop Research Articles

ANALISIS BUKTI DIGITAL PADA APLIKASI DISCORD DESKTOP DENGAN MENGGUNAKAN FRAMEWORK DFRWS

A Currently, various communication platforms are available, and one of them is Discord. Discord is utilized by users to interact and share various types of content. However, Discord is often implicated in the distribution of inappropriate content that goes against Discord regulations. This can lead to cybercrime cases such as Child Sexual Abuse Material (CSAM). The main challenge faced is the recovery of digitally deleted data through these communication platforms. The objective of this research is to analyze digital evidence in the form of deleted text messages, images, and documents in the chat rooms of the desktop-based Discord application. The research method employed is the Live Forensic Technique, applying the DFRWS (Digital Forensics Research Workshop) method. The digital forensic analysis process is conducted using the digital forensic tool Magnet Axiom. The research results indicate that the accuracy of digital evidence analysis using Magnet Axiom reaches 94.11%. A total of 16 digital evidence items were successfully recovered out of the total 17 items available

Comparison of Forensic Tools on Social Media Services Using the Digital Forensic Research Workshop Method (DFRWS)

Social media applications currently play a role and become part of various human activities, on the other hand social media is also very vulnerable to various crimes. Some crimes on social media can be in the form of hate speech, defamation, fraud, gambling, pornography, and other harmful actions. This research applies the Digital Forensic Research Workshop (DFRWS) method to search for all data on twitter social media services running on the Android operating system using MOBILedit Forensic Express and Belkasoft Evidence Center tools. Twitter social media services in this research are used for activities by utilizing all the features in it. Activities carried out by twitter users become evidence that will be acquired using MOBILedit Forensic Express and Belkasoft Evidence Center tools. From the two tools used, a comparison was obtained that MOBILedit Forensic Express found more data on twitter social media than Belkasoft Evidence Center, the findings in these two tools made several contributions to social media investigations that run on the android operating system

Mobile Forensic Analysis of Signal Messenger Application on Android using Digital Forensic Research Workshop (DFRWS) Framework

Cybercrime is a crime committed using equipment connected to the internet. One of the cybercrimes that occured during the COVID-19 pandemic was the spread hoaxes about the COVID-19 vaccine which caused panic in society. Signal Messenger is one of the social media that has become a trending topic since the number of personal data security issues and the emergence of end-to-end encryption features. This research aims to find digital evidence on Signal Messenger application installed on the perpetrator's Android smartphone. This research uses Belkasoft, Magnet AXIOM, and MOBILedit Forensic Express tools and implements the Digital Forensics Research Workshop (DFRWS) framework in each stage of the research experiment. The research was carried out according to the case scenario with 11 predetermined parameters. Digital evidence is found from the Signal Messenger application: application information, account information, chat, pictures, videos, contacts, and stickers. The results of this research indicate that Belkasoft Evidence Center forensic tool is better, with an accuracy rate of 78.69%, while Magnet AXIOM is 26.23% and MOBILedit Forensic Express is 9.84%. The results of this research can be used as a reference for other forensic researchers/experts in handling similar crime cases on the Signal Messenger application to get better results.

Mobile Forensic of Vaccine Hoaxes on Signal Messenger using DFRWS Framework

The COVID-19 pandemic is one of the factors that has increased the use of social media. One of the negative impacts of using social media is the occurrence of cybercrime. The possibility of cybercrime can also happen on one of the social media platforms, such as the Signal Messenger application. In the investigation process, law enforcement needs mobile forensic methods and appropriate forensic tools so that the digital evidence found on the perpetrator's smartphone can be accepted by the court. This research aims to get digital evidence from cases of spreading the COVID-19 vaccine hoaxes. The method used in this research is a mobile forensics method based on the Digital Forensic Research Workshop (DFRWS) framework. The DFRWS framework consists of identification, preservation, collection, examination, analysis, and preservation. The results showed that the MOBILedit tool could reveal digital evidence in the form of application information and contact information with a performance value of 22.22%. Meanwhile, Magnet AXIOM cannot reveal digital evidence at all. The research results were obtained following the expected research objectives.

Mobile Forensic Investigation of Fake News Cases on Instagram Applications with Digital Forensics Research Workshop Framework

The number of digital crimes or cybercrimes today continues to increase every year, and lately a lot of it happens on social media like Instagram. The social behavior of today's people who communicate more through social media encourages the perpetrators of these digital crimes. Instagram is a social media that is often found content that contains elements of pornography, hoax news, hate speech, etc. This research is aimed at processing digital evidence of cases of the spread of hoax news on the Instagram application. This research follows the framework of the Digital Forensics Research Workshop (DFRWS) with six stages, namely identification, preservation, collection, examination, analysis, and presentation. The process of obtaining digital evidence is assisted by the application of Axiom Magnet and Cellebrite UFED. Digital evidence sought from the smartphone device of the suspected hoax news disseminator seized following the case scenario consists of 8 variables in the form of accounts, emails, images, videos, URLs, times, IP address, and location. The results of this research with the help of the application of Magnet Axiom digital proof obtained 87.5% and the Cellebrite UFED application of 68.75%. The results of this study show that Magnet Axiom has better performance than MOBILedit Forensics.

Analisis Forensik Aplikasi Michat Menggunakan Metode Digital Forensics Research Workshop

The development of information technology has had various positive and negative effects. The positive impact that information technology can have is to make it easier for people to communicate with others in the world, and the negative impact is that society is out of control when using its applications. It is an attitude that causes various crimes in the world caused by cyberspace (cybercrime) One of the most widely used instant messaging applications is Michat. The MiChat app causes cybercrime, pornography, online gambling, fraud, cyberbullying and drug trafficking. Evidence research is conducted using one of the frameworks of the digital forensic research workshop. In this framework, forensic identification, preservation, collection, investigation, analysis, and presentation phases are designed to find evidence of digital crime. The forensic tools used to collect evidence are mobility forensic express pro, a DB browser for SQLite, and oxygen forensic detective. Results are presented in the form of reports and evidence, and text chat files, contacts, images, audio, video, and web caches are generated. Forensic tools have a 100% success rate in finding evidence. Comparing the functions of the three forensic tools, the mobility forensic express pro has a processing rate of 66.7%, DB browser for SQLite has 33.3%, and oxygen forensic detective has 83.3%. Digital evidence can be used as corroborating evidence in a trial

The Comparison National Institute of Standards and Technology and Digital Forensics Research Workshop Method in Instant Messenger Services

The Comparison National Institute of Standards and Technology and Digital Forensics Research Workshop Method in Instant Messenger Services

Forensik WhatsApp Menggunakan Metode Digital Forensic Research Workshop (DFRWS)

Smartphone technology makes cybercrime crimes increase from year to year, one of the smartphone applications used to commit crimes is WhatsApp. The WhatsApp application is one of the most widely used social media, especially in Indonesia. Criminal acts such as hate speech, fraud, and defamation often occur on WhatsApp social media. This research was conducted to find forensic evidence on the WhatsApp social media application using the Digital Forensics Research Workshop (DFRWS) method. The stages of digital forensics include identification, preservation, collection, examination, analysis and presentation in finding digital evidence of cybercrime using the MOBILedit Forensic Express and HashMyFiles software applications. The digital evidence sought on smartphones can be found using case scenarios with 13 parameters that have been created. The results of this study indicate that the digital forensic software MOBILedit Forensic Express can detect types of digital evidence with an accuracy rate of 84.6%, while Hashmyfiles can detect the authenticity of digital evidence by 100%.

Audio Forensics on Smartphone with Digital Forensics Research Workshop (DFRWS) Method

Audio is one of the digital items that can reveal a happened case. However, audio evidence can also be manipulated and changed to hide information. Forensics audio is a technique to identify the sound’s owner from the audio using pitch, formant, and spectrogram parameters. The conducted research examines the similarity of the original sound with the manipulated voice to determine the owner of the sound. It analyzes the level of similarity or identical sound using spectrogram analysis with the Digital Forensics Research Workshop (DFRWS) Method. The research objects are original and manipulated files. Both files are in mp3 format, which is encoded to WAV format. Then, the live forensics method is used by picking up the data on a smartphone. Several applications are also used. The results show that the research successfully gets digital evidence on a smartphone with the Oxygen Forensic application. It extracts digital evidence in the form of two audio files and two video files. Then, by the hashing process, the four obtained files are proven to be authentic. Around 90% of the data are identical to the original voice recording. Only 10% of the data are not identical.

Comparative analysis of Forensic Tools on Twitter applications using the DFRWS method

Current crime is increasing, one of which is the crime of using social media, although no crime does not leave digital evidence. Twitter application is a social media that is widely used by its users. Acts of crime such as fraud, insults, hate speech, and other crimes lately use many social media applications, especially Twitter. This research was conducted to find forensic evidence on the social media Twitter application that is accessed using a smartphone application using the Digital Forensics Research Workshop (DFRWS) method. These digital forensic stages include identification, preservation, collection, examination, analysis, and presentation in finding digital evidence of crime using the MOBILedit Forensic Express software and Belkasoft Evidence Center. Digital evidence sought on smartphones can be found using case scenarios and 16 variables that have been created so that digital proof in the form of smartphone specifications, Twitter accounts, application versions, conversations in the way of messages and status. This study's results indicate that MOBILedit Forensic Express digital forensic software is better with an accuracy rate of 85.75% while Belkasoft Evidence Center is 43.75%.

Investigating Cyberbullying on WhatsApp Using Digital Forensics Research Workshop

Cyberbullying in group conversations in one of the instant messaging applications is one of the conflicts that occur due to social media, specifically WhatsApp. This study conducted digital forensics to find evidence of cyberbullying by obtaining work in the Digital Forensic Research Workshop (DFRWS). The evidence was investigated using the MOBILedit Forensic Express tool as an application for evidence submission and the Cosine Similarity method to approve the purchase of cyberbullying cases. This research has been able to conduct procurement to reveal digital evidence on the agreement in the Group's features using text using MOBILedit. Identification using the Cosine method. Similarities have supported actions that lead to cyberbullying with different levels Improved Sqrt-Cosine (ISC) value, the largest 0.05 and the lowest 0.02 based on conversations against requests.

Application of Static Forensics Method for Extracting Steganographic Files on Digital Evidence Using the DFRWS Framework

Steganography is one of the anti-forensic techniques that allow criminals to hide information in other messages so that during the investigation, the investigator will experience problems and difficulty in getting evidence of original information on the crime. Therefore an investigator is required to have the ability to be able to find and extract (decoding) using the right tools when opening messages that have been inserted by steganography techniques. The purpose of this study is to analyze digital evidence using the static forensics method by applying the six stages to the Digital Forensics Research Workshop (DFRWS) framework and extracting steganography on files that have been compromised based on case scenarios involving digital crime. The tools used are FTK Imager, Autopsy, WinHex, Hiderman, and StegSpy. The results of extraction of 9 out of 10 files that were scanned by steganography files had 90% success and 10% of steganography files were not found, so it can be concluded that the extraction files in steganographic messages can be used as legal digital proofs according to law.

Introducing the Temporal Dimension to Memory Forensics

Kickstarted by the Digital Forensic Research Workshop (DFRWS) conference in 2005, modern memory analysis is now one of most active areas of computer forensics and it mostly focuses on techniques to locate key operating system data structures and extract high-level information. These techniques work on the assumption that the information inside a memory dump is consistent and the copy of the physical memory was obtained in an atomic operation. Unfortunately, this is seldom the case in real investigations, where software acquisition tools record information while the rest of the system is running. Thus, since the content of the memory is changing very rapidly, the resulting memory dump may contain inconsistent data. While this problem is known, its consequences are unclear and often overlooked. Unfortunately, errors can be very subtle and can affect the results of an analysis in ways that are difficult to detect. In this article, we argue that memory forensics should also consider the time in which each piece of data was acquired. This new temporal dimension provides a preliminary way to assess the reliability of a given result and opens the door to new research directions that can minimize the effect of the acquisition time or detect inconsistencies. To support our hypothesis, we conducted several experiments to show that inconsistencies are very frequent and can negatively impact an analysis. We then discuss modifications we made to popular memory forensic tools to make the temporal dimension explicit during the analysis and to minimize its effect by resorting to a locality-based acquisition.

RX_myKarve carving framework for reassembling complex fragmentations of JPEG images

Digital forensic aims to provide an assistance for making decisions about a crime by looking at a file content which usually involves image files such as GIF, BMP, JPEG and etc. JPEG is a very popular image file format. It has less structured contents than other images which makes its recovery possible in the absence of some file system metadata. However, an essential problem of which is fragmented JPEG file intertwined with non-JPEG files and/or Bifragmented in the scan area. This paper proposes RX_myKarve as a new file carving framework for solving a number of forensic recovery problems including fragmentation. The RX_myKarve basic design includes a structure-based and content-based carving approaches. It adopts machine learning and evolutionary algorithms in its main components of identification validation and reassembling. The identification and validation techniques encompass an Extreme Learning Machine (ELM) for identifying and filtering the image data in the scan area. The reassembling technique encompasses a genetic algorithm to reconstruct the data from fragmented pieces to a complete image. The main contribution of the paper lies on the reassembling of fragmented image file clusters in the scan area. The RX_myKarve is tested and evaluated by using the Digital Forensic Research Workshop (DFRWS) 2006 and 2007 forensic challenge datasets. The results show that the RX_myKarve is able to carve and fully recover all the giving cases of the DFRWS-2006 dataset, which are 19 images, and all the relevant cases of the DFRWS-2007 dataset, which are 18 images. This improvement in file carving is mostly attributed to the novel identification and reassembling techniques.

Mobile Forensic Images and Videos Signature Pattern Matching using M-Aho-Corasick

Mobile forensics is an exciting new field of research. An increasing number of Open source and commercial digital forensics tools are focusing on less time during digital forensic examination. There is a major issue affecting some mobile forensic tools that allow the tools to spend much time during the forensic examination. It is caused by implementation of poor file searching algorithms by some forensic tool developers. This research is focusing on reducing the time taken to search for a file by proposing a novel, multi-pattern signature matching algorithm called M-Aho-Corasick which is adapted from the original Aho-Corasick algorithm. Experiments are conducted on five different datasets which one of the data sets is obtained from Digital Forensic Research Workshop (DFRWS 2010). Comparisons are made between M-Aho-Corasick using M_Triage with Dec0de, Lifter, XRY, and Xaver. The result shows that M-Aho-Corasick using M_Triage has reduced the searching time by 75% as compared to Dec0de, 36% as compared to Lifter, 28% as compared to XRY, and 71% as compared to Xaver. Thus, M-Aho-Corasick using M_Triage tool is more efficient than Dec0de, Lifter, XRY, and Xaver in avoiding the extraction of high number of false positive results.

Dealing with forensic software vulnerabilities: is anti-forensics a real danger?

The idea that malicious hackers could theoretically 'fatally compromise' forensic software and evidence with a few exploits has been on practitioners' minds since the beginning of the millennium. Conferences such as the Digital Forensics Research Workshop have generated serious discussion of the technical and legal implications of such theories. According to a paper published by the Stanford Law School (2007), ''to the extent there are insufficient 'external' sources of authenticity, a proponent of forensic evidence will need to demonstrate the accuracy of the forensic software itself.''^1 Federal Rule of Evidence 901 provides that evidence may be authenticated by ''describing a process or system used to produce a result and showing that the process or system produces an accurate result.''^2

Advanced carving techniques

Carving is the term most often used to indicate the act of recovering a file from unstructured digital forensic images. The term unstructured indicates that the original digital image does not contain useful filesystem information which may be used to assist in this recovery. Typically, forensic analysts resort to carving techniques as an avenue of last resort due to the difficulty of current techniques. Most current techniques rely on manual inspection of the file to be recovered and manually reconstructing this file using trial and error. Manual processing is typically impractical for modern disk images which might contain hundreds of thousands of files. At the same time the traditional process of recovering deleted files using filesystem information is becoming less practical because most modern filesystems purge critical information for deleted files. As such the need for automated carving techniques is quickly arising even when a filesystem does exist on the forensic image. This paper explores the theory of carving in a formal way. We then proceed to apply this formal analysis to the carving of PDF and ZIP files based on the internal structure inherent within the file formats themselves. Specifically this paper deals with carving from the Digital Forensic Research Work-Shop's (DFRWS) 2007 carving challenge.

FORZA – Digital forensics investigation framework that incorporate legal issues

What is Digital Forensics? Mark Pollitt highlighted in DFRWS 2004 [Politt MM. Six blind men from Indostan. Digital forensics research workshop (DFRWS); 2004] that digital forensics is not an elephant, it is a process and not just one process, but a group of tasks and processes in investigation. In fact, many digital forensics investigation processes and tasks were defined on technical implementation details Investigation procedures developed by traditional forensics scientist focused on the procedures in handling the evidence, while those developed by the technologist focused on the technical details in capturing evidence. As a result, many digital forensics practitioners simply followed technical procedures and forget about the actual purpose and core concept of digital forensics investigation. With all these technical details and complicated procedures, legal practitioners may have difficulties in applying or even understanding their processes and tasks in digital forensics investigations. In order to break the technical barrier between information technologists, legal practitioners and investigators, and their corresponding tasks together, a technical-independent framework would be required. In this paper, we first highlighted the fundamental principle of digital forensics investigations (Reconnaissance, Reliability and Relevancy). Based on this principle, we re-visit the investigation tasks and outlined eight different roles and their responsibilities in a digital forensics investigation. For each role, we defined the sets of six key questions. They are the What (the data attributes), Why (the motivation), How (the procedures), Who (the people), Where (the location) and When (the time) questions. In fact, among all the investigation processes, there are six main questions that each practitioner would always ask. By incorporating these sets of six questions into the Zachman's framework, a digital forensics investigation framework – FORZA is composed. We will further explain how this new framework can incorporate legal advisors and prosecutors into a bigger picture of digital forensics investigation framework. Usability of this framework will be illustrated in a web hacking example. Finally, the road map that interconnects the framework to automatically zero-knowledge data acquisition tools will be briefly described.

Completing the Post Mortem Investigation

Over the past two months we have got a good start on our digital post mortem. The techniques we are using follow the End-to-End Digital Investigation (EEDI) process and are consistent with the Digital Forensics Research Work Shop (DFRWS) 1 framework for digital investigations.