Digital Forensic Techniques Research Articles

Analisis Keamanan Data Pribadi pada Shopee Paylater Menggunakan Metode Hybrid

The low level of awareness and understanding of Shopee online shopping application users regarding the security of user data causes the level of digital crime to increase, as evidenced by the many crime cases that occur, namely the misuse of users' personal data by utilizing OTP codes as a verification process. This can be a loophole for digital crimes that are certainly very detrimental to users. Perform personal data security analysis on Shopee PayLater using the Hybrid method. The method used is the hybrid method, which is a method of combining basic digital forensic techniques with re-engineering techniques. This method can be used to analyze applications that involve user personal data, tools used such as MobSF, Virustotal to view application activity, and apk-deguard for apk reengineering. Personal data security research on Shopee PayLater was carried out using the help of Virustotal and MobSF tools found vulnerabilities caused by users. The results of the personal data security analysis carried out on the Android-based Shopee application show that there are several vulnerabilities in the user's personal data vulnerability, namely in the application licensing section.

A generalized approach to automotive forensics

In the past years, software became an essential topic in modern vehicles, e.g., with the rise of more and more complex driver assistance systems. The advent of automated driving will drive this trend even further. Today, accident investigation, as well as warranty claim analysis, need to take into consideration an analysis of the rapidly increasing proportion of software and security based implementations as part of modern vehicles, the so-called digital forensics. This paper evaluates the general feasibility of digital forensics on a state-of-the-art vehicle. To do so, we analyzed current digital forensics techniques on a state-of-the-art vehicle to constitute gaps in the automotive forensics process used on in-vehicle systems. We present a general process for automotive forensics to close existing gaps and implemented it on a state-of-the-art vehicle in an in-vehicle device manipulation scenario. The implementation uses the on-board diagnostics interface, the diagnostics over internet protocol, as well as the unified diagnostic services for communication. Our implementation requires automotive Ethernet at the diagnostic interface.Our research shows future directions for efficient automotive forensic as well as the exemplary feasibility of automotive forensic analysis on state-of-the-art vehicles without the need for additional in-vehicle components such as intrusion detection systems or event data recorders.

Digital Forensics Subdomains: The State of the Art and Future Directions

For reliable digital evidence to be admitted in a court of law, it is important to apply scientifically proven digital forensic investigation techniques to corroborate a suspected security incident. Mainly, traditional digital forensics techniques focus on computer desktops and servers. However, recent advances in digital media and platforms have seen an increased need for the application of digital forensic investigation techniques to other subdomains. This includes mobile devices, databases, networks, cloud-based platforms, and the Internet of Things (IoT) at large. To assist forensic investigators to conduct investigations within these subdomains, academic researchers have attempted to develop several investigative processes. However, many of these processes are domain-specific or describe domain-specific investigative tools. Hence, in this paper, we hypothesize that the literature is saturated with ambiguities. To further synthesize this hypothesis, a digital forensic model-orientated Systematic Literature Review (SLR) within the digital forensic subdomains has been undertaken. The purpose of this SLR is to identify the different and heterogeneous practices that have emerged within the specific digital forensics subdomains. A key finding from this review is that there are process redundancies and a high degree of ambiguity among investigative processes in the various subdomains. As a way forward, this study proposes a high-level abstract metamodel, which combines the common investigation processes, activities, techniques, and tasks for digital forensics subdomains. Using the proposed solution, an investigator can effectively organize the knowledge process for digital investigation.

Detection and localization of inter-frame forgeries in videos based on macroblock variation and motion vector analysis

Surveillance videos and footages are the primary sources of evidence for any event or crime in the court of law. However, with the rapid advent of low-cost, computationally cheap video manipulating software and tools, video manipulation has become a no-brainer task today. This introduces a major challenge in authenticating the sanctity/originality of videos before they can be produced in the court, or used in other sensitive application domains. In this paper, we propose a digital forensic technique to detect inter-frame forgeries in surveillance videos. The proposed technique utilizes compressed domain video footprints i.e, prediction footprint variation and variation of motion vectors in videos, for the purpose of video forgery detection and localization. Through this work, we identify the type of forgery that has taken place in a video. We have performed experiment over 43 authentic and 720 inter-frame forged videos. Our experimental results indicate that the proposed technique performs consistently efficiently, irrespective of the group of pictures length and degree of compression in videos.

RETRACTED ARTICLE: A novel privacy preserving digital forensic readiness provable data possession technique for health care data in cloud

The scorching challenge calls for an importunate solution in the form of a secure, privacy preserved, economical cloud storage that can weather the turbulence of the rapidly evolving digital storage technologies. This calls for an avid solution, in the form of a public auditing protocol which stands as a testament to establish connection even with an unfamiliar person who must be trusted for sharing of health care data stored in a hermit cloud. The solution should be a technique which aids an external auditor to audit user’s outsourced data in the cloud deprived of the wisdom on the data content. The contributions in this paper are (1) A comprehensive analysis of the contemporary privacy preserving PDP data integrity schemes, (2) a novel technique, which, contemporaneously supports the vital functions like Unbounded number of audits, Public auditing, Blockless verification, Stateless verification, data integrity, confidentiality. (3) A framework to direct the data to be safely stored, (4) embed digital forensic readiness into the technique in order to be digitally forensic ready, monitor, plan and formulate proactively before the occurrence of any potential security incidents, (5) implementation of the enhanced PDP technique to validate the auditing performance by existing experimental comparisons with the state of the art techniques. The results validate that the novel integrity technique can competently accomplish secure auditing and outclass the erstwhile ones. Last but not the least, this paper also gives a bird’s eye view on the recent research status, and future directions of privacy preserving data integrity.

How Valid are the Reported Cases of People Infected with Covid-19 in the World?

The goal of this paper is to analyze the registered cases of people who have been infected with Covid-19 registered from throughout the world, using a digital forensic analysis technique that is based on Benford's Law. Twenty-three countries were randomly chosen for this analysis: China, India, Germany, Brazil, Venezuela, Netherlands, Italy, Colombia, Russia, Norway, South Africa, Portugal, Singapore, United Kingdom, Chile, Ecuador, Egypt, Denmark, Ireland, France, Belgium, Australia and Croatia.. We calculate on the p-values based on Pearson χ2 and Mantissa Arc Test according to the results obtained with the first digit. If any country fails these two tests, a third proof will be carried out based on the Freedman-Watson test. The results indicated that results from Italy, Portugal, Netherlands, United Kingdom, Denmark, Belgium and Chile are suspicions of data manipulation because the numbers fail the Benford’s Law according to the results obtained until April 30, 2020. However, it is necessary to carry out further studies in these countries in order to ensure that they countries manipulate or altered the information.

Modern Methods of Investigating Digital Currency Related Crimes

Abstract: In this article are examined various ways and methods of collecting the evidence pertaining to the digital currency related crimes. And in particular is investigated the role of cryptocurrency in the total number of financial crimes. Authors study modern digital forensics techniques which are used in the crime investigation.

Chip and Board Level Digital Forensics of Cummins Heavy Vehicle Event Data Recorders

<div class="section abstract"><div class="htmlview paragraph">Crashes involving Cummins powered heavy vehicles can damage the electronic control module (ECM) containing heavy vehicle event data recorder (HVEDR) records. When ECMs are broken and data cannot be extracted using vehicle diagnostics tools, more invasive and low-level techniques are needed to forensically preserve and decode HVEDR data. A technique for extracting non-volatile memory contents using non-destructive board level techniques through the available in-circuit debugging port is presented. Additional chip level data extraction techniques can also provide access to the HVEDR data. Once the data is obtained and preserved in a forensically sound manner, the binary record is decoded to reveal typical HVDER data like engine speed, vehicle speed, accelerator pedal position, and other status data. The memory contents from the ECM can be written to a surrogate and decoded with traditional maintenance and diagnostic software. The research also shows the diagnostic trouble codes from the ECM are preserved. In other words, the digital forensic technique of extracting memory contents through the in-circuit debugging port does not introduce any new fault codes. Cryptographic hashing of the forensic binary data provides a mechanism to verify the original digital forensic record. Finally, the decoding for the HVEDR binary record is presented so investigators can decode the forensic record without the need for a surrogate ECM. The techniques in this paper provide a new method for extracting data from heavy vehicle ECMs.</div></div>

Advanced Digital Forensic IoT Based Secure Communication

With the explosive growth of the Internet-of-Things (IoT) due to its widespread applicability, it is imperative that IoT designers and architects must incorporate ensuring security of communication in IoT as a key requirement. This emerging field of study, communication in IoT, is concerned with ensuring secure collaboration between smart sensors, actuators and devices and the external environment that constitute the overarching arena of IoT. The field poses new challenges to security and privacy in communication. Most of the cloud service providers such as Amazon, IBM, Microsoft, and Google facilitate various cloud services at reduced cost. The architecture of IoT must be designed to have many features such as scalability, efficiency, accessibility, availability, and flexibility so that applications can be built that can benefit both public and commercial entities. Key factors in driving the success of the IoT will be an accurate specification of security parameters with various security measures that must be enforced. This paper gives an overview of security and privacy aspects in IoT communications using an advanced digital forensic approach for security enhancement. The researchers face various challenges in the investigation of security breaches in IoT. The challenges get magnified multiple folds as cloud service providers utilize many advanced techniques such as virtualization and a multi-tenant usage model to allocate its resources to users securely. These models and architectures make it difficult for investigators who try identify sources that launched various malicious activities and attacks on cloud services. The investigators resort to advanced digital forensic investigation to analyze such attacks. There exist various digital forensic techniques and tools which are not necessarily applied in the context of security breach in IoT. When any security breach occurs, investigators face challenges in collecting evidence as they cannot physically access the evidence buried in devices connected to a local host. The advanced digital forensic approach consists of identifying the evidence related to the source of the crime, and examining and reporting the results and conclusions. The proposed methodology, which employs an advanced digital forensic approach, describes an improved, efficient, and reliable method to identify the source of the crime and collect evidence responsible for security breach during communication.

Using Digital Forensic Techniques to Identify Contract Cheating: A Case Study

Contract cheating is a major problem in Higher Education because it is very difficult to detect using traditional plagiarism detection tools. Digital forensics techniques are already used in law to determine ownership of documents, and also in criminal cases, where it is not uncommon to hide information and images within an ordinary looking document using steganography techniques. These digital forensic techniques were used to investigate a known case of contract cheating where the contract author has notified the university and the student subsequently confirmed that they had contracted the work out. Microsoft Word documents use a format known as Office Open XML Format, and as such, it is possible to review the editing process of a document. A student submission known to have been contracted out was analysed using the revision identifiers within the document, and a tool was developed to review these identifiers. Using visualisation techniques it is possible to see a pattern of editing that is inconsistent with the pattern seen in an authentic document.

Image Forgery: Detection of Manipulated Images Using Neural Network

The emergence of new technology has resulted in mass usage of web applications which lets anyone crowd source anything. In the digitized world, using a wide range of online available tools, anyone can modify and edit images. So, it is necessary to ensure the authenticity of the images. Digital forensic techniques are needed to detect tampering and manipulation of images for illegal purposes [8]. This paper proposes a noble image manipulation detection system using neural networks. There are two techniques for identifying manipulated images in this project, the first one is metadata analysis and the second one is using Convolutional Neural Network. The metadata analysis checks the information contained within the image file and looks for tags that relate to faking. Error Level Analysis is used to detect the compression ratio of foreign content in a fake image.

A Study on the Digital Forensic Investigation Method of Clever Malware in IoT Devices

As IoT devices are always connected to mobile devices or other computing devices via the Internet, clever malwares targeting IoT devices or other computing devices connected to IoT devices are emerging. Therefore, effective IoT security research is needed to respond to hacking attacks by these kinds of malware. This paper studied the method of identifying and analyzing malware combined with social engineering from the perspective of digital forensics. The paper classified and analyzed intelligent malware characteristics and proposed a method of quickly identifying and analyzing the malware that secretly intruded into the devices installed with Android, Linux OS, using digital forensics techniques. Moreover, this paper proved its effectiveness by applying this investigation method to two actual malware cases. The research outcomes will be useful in responding to increasingly clever malware attacking IoT devices.

Not all areas are equal: analysis of citations in information security research

The understanding of the inner workings of a research community is essential to evaluate the impact of an author as well as to decide where and how to publish results. One of the key metrics is the number of citations that a publication receives. In parallel, information security is now a key and strategic area, partially fueled by the advent of the Internet of Things (IoT) and the need of pursuing cybercriminals by using digital forensics techniques. Therefore, this paper analyzes several factors influencing the number of citations in the domain of information security, such as differences between journal and conference publications, or the impact of the number of pages and the length of the abstract. To obtain quantitative results, we investigated papers of six sub-disciplines, i.e., anonymity and privacy, cryptography, information hiding, IoT and Cyber-Physical System security, digital forensics and incident response, and network security. For each sub-domain, we used metadata of 5000 publications collected from IEEE-Xplore. Results indicate some clear behaviors, for instance, papers tend to receive more citations when their abstract is longer and the number of references positively influences the performance of the work.

Forensic originality identification of iPhone’s voice memos

In this paper, we focus on the meta-data analysis methods and digital forensics techniques to solve the problem of forensic originality identification of audio recordings recorded by the Voice Memos App in the iPhone. The Voice Memos App is the built-in application for voice recording and editing in the iPhone. We first introduce the features of the Voice Memos App. Then, the experimental study is carried out to collect and analyze the original and the non-original audio recordings from different iPhones and iOS versions. The file structure pattern, time related file attribute information pattern, application database data pattern of the original audio recordings are analyzed and concluded in this paper, which can be valuable for forensic identification of original audio recordings.

Live Forensics Analysis of Line App on Proprietary Operating System

The development of computer technology is increasing rapidly. This has positive and negative effects. One of the negative effects that occurred was the use of Line applications to conduct online shop fraud. Line is one of the instant messenger applications that can be used on computers, especially on Windows 8.1 operating system computers. Applications that run on the computer leave traces of data on Random Access Memory (RAM). Data left in RAM can be obtained using digital forensic techniques, namely live forensics which is used when the computer is running and connected to the internet. This study aims to find digital evidence regarding cases of online shop fraud using the National Institute of Standards and Technology (NIST) method. Digital evidence can be obtained using forensic tools, namely RamCapturer, FTK Imager and Winhex. RamCapturer is used to acquire data in RAM, FTK Imager is used for imaging and Winhex is used to analyze data that has been taken. The results obtained in this study were conversational recordings consisting of conversation time, conversation content and conversation status which could be digital evidence in uncovering the online shop fraud crime that occurred.

Enterprise Cybersecurity: Investigating and Detecting Ransomware Infections Using Digital Forensic Techniques

As the world continues to grow and embrace technology ransomware is growing problem. When ransomware encrypts storage sytems, systems shutdown, productivity grinds to a halt, and serious long-term damage takes place. As this is a known problem many firms have developed functionality to address ransomware issues in key security technologies such as intrusion protection systems. Many firms, especially smaller ones, may not have access to these technologies or perhaps the integration of these technologies might not yet be possible due ot varying circumstances. Regardless, ransomware must still be addressed as cyber miscreants actually target weak and unprotected environment. Even without tools that automate and aggregrate security capability, systems administrators can use systems utilities, applications, and digital forensic techniques to detect ransomware and defend their environemnts. This paper explores the literature regarding ransomware attacks, discusses current issues on how ransomware might be addressed, and presents recommendations to detect and investigate ransomware infection.

RPAS Forensic Validation Analysis Towards a Technical Investigation Process: A Case Study of Yuneec Typhoon H

The rapid pace of invention in technology and the evolution of network communication has produced a new lifestyle with variety of opportunities and challenges. Remotely Piloted Aerial Systems (RPAS) technology, which includes drones, is one example of a recently invented technology that requires the collection of a solid body of defensible and admissible evidence to help eliminate potential real-world threats posed by their use. With the advent of smartphones, there has been an increase in digital forensic investigation processes developed to assist specialized digital forensic investigators in presenting forensically sound evidence in the courts of law. Therefore, it is necessary to apply digital forensic techniques and procedures to different types of RPASs in order to create a line of defense against new challenges, such as aerial-related incidents, introduced by the use of these technologies. Drone operations by bad actors are rapidly increasing and these actors are constantly developing new approaches. These criminal operations include invasion of privacy, drug smuggling, and terrorist activities. Additionally, drone crashes and incidents raise significant concerns. In this paper, we propose a technical forensic process consisting of ten technical phases for the analysis of RPAS forensic artifacts, which can reduce the complexity of the identification and investigation of drones. Using the proposed technical process, we analyze drone images using the Computer Forensics Reference Datasets (CFReDS) and present results for the Typhoon H aerial vehicle manufactured by Yuneec, Inc. Furthermore, this paper explores the availability and value of digital evidence that would allow a more practical digital investigation to be able to build an evidence-based experience. Therefore, we particularly focus on developing a technical drone investigation process that can be applied to various types of drones.

Finding a Needle in a Haystack: The Traffic Analysis Version

Abstract Traffic analysis is the process of extracting useful/sensitive information from observed network traffic. Typical use cases include malware detection and website fingerprinting attacks. High accuracy traffic analysis techniques use machine learning algorithms (e.g. SVM, kNN) and require to split the traffic into correctly separated blocks. Inspired by digital forensics techniques, we propose a new network traffic analysis approach based on similarity digest. The approach features several advantages compared to existing techniques, namely, fast signature generation, compact signature representation using Bloom filters, efficient similarity detection between packet traces of arbitrary sizes, and in particular dropping the traffic splitting requirement altogether. Experimental results show very promising results on VPN and malware traffic, but low results on Tor traffic due mainly to the single-size cells feature.

Forensic Analysis using Text Clustering in the Age of Large Volume Data: A Review

Exploring digital devices in order to generate digital evidence related to an incident being investigated is essential in modern digital investigation. The emergence of text clustering methods plays an important role in developing effective digital forensics techniques. However, the issue of increasing the number of text sources and the volume of digital devices seized for analysis has been raised significantly over the years. Many studies indicated that this issue should be resolved urgently. In this paper, a comprehensive review of digital forensic analysis using text-clustering methods is presented, investigating the challenges of large volume data on digital forensic techniques. Moreover, a meaningful classification and comparison of the text clustering methods that have been frequently used for forensic analysis are provided. The major challenges with solutions and future research directions are also highlighted to open the door for researchers in the area of digital forensics in the age of large volume data.

Blind Image Source Device Identification

This article describes how digital forensic techniques for source investigation and identification enable forensic analysts to map an image under question to its source device, in a completely blind way, with no a-priori information about the storage and processing. Such techniques operate based on blind image fingerprinting or machine learning based modelling using appropriate image features. Although researchers till date have succeeded to achieve extremely high accuracy, more than 99% with 10-12 candidate cameras, as far as source device prediction is concerned, the practical application of the existing techniques is still doubtful. This is due to the existence of some critical open challenges in this domain, such as exact device linking, open-set challenge, classifier overfitting and counter forensics. In this article, the authors identify those open challenges, with an insight into possible solution strategies.