Digital Investigation Process Research Articles

The effects of document's format, size, and storage media on memory forensics

Main memory or RAM contains volatile but critical data about the system's state and its recent activities. Often, RAM based artifacts are hard to be found elsewhere. Digital investigators can find in this volatile data an essential information about the recent usage of a system including the used documents. Nowadays, documents are often fetched from a variety of storage media, most of which are internet based. This can complicate the digital investigation process due to the remote nature of these storage media; most of these remote files cannot be traced on the local hard disk drive (HDD) of the captured machine. However, whenever the document's contents are successfully recovered from RAM images, it can ensure the actual usage of the document. This paper studies the effects of various storage media (local and remote) on the amount of volatile artifacts of different types of documents. Experiments are designed to evaluate the effects of local hard drives, removable media, and a set of cloud based platforms such as Dropbox, Google Drive, and OneDrive on the RAM based artifacts of a used document. Results show that the recovered contents are significantly affected by the used storage media. Moreover, the document's type has an effect too. Frequently, a good ratio of the document's contents are recovered from RAM even when the document is living on the cloud, the document is closed, and the connection is terminated.

ASMF: Ambient social media forensics chain of custody with an intelligent digital investigation process using federated learning

Ambient Intelligence is a concept that relates to a new paradigm of pervasive computing and has the objective of automating responses from the system to humans without any human intervention. In social media forensics, gathering, analyzing, storing, and validating relevant evidence for investigation in a heterogeneous environment is still questionable. There is no hierarchy for automation, even though standardization and secure processes from data collection to validation have not yet been discussed. This poses serious issues for the current investigation procedures and future evidence chain of custody management. This paper contributes threefold. First, it proposes a framework using a blockchain network with a dual chain of data transmission for privacy protection, such as on-chain and off-chain. Second, a protocol is designed to detect and separate local and global cyber threats and undermine multiple federated principles to personalize search space broadly. Third, this study manages personalized updates by means of optimizing backtracking parameters and automating replacements, which directly affects the reduction of negative influence on the social networking environment in terms of imbalanced and distributed data issues. This proposed framework enhances stability in digital investigation. In addition, the simulation uses an extensive social media dataset in different cyberspaces with a variety of cyber threats to investigate. The proposed work outperformed as compared to traditional single-level personalized search and other state-of-the-art schemes.

Electronic Evidence: A Framework for Applying Digital Forensics to Data Base

ABSTRACT Accounting data bases contain much information reflecting a company’s financial performance, clients, suppliers, and other relevant information about the company’s activities. Thus, attracting criminal activity is empowered by a wide range of new and evolving digital technologies. More interestingly, all of these electronic media create digital traces, providing useful information for the digital investigation process. As digital crime targeting millions of pieces of sensitive information from data bases is rising, specific expertise and an informed approach in data base forensics are required. This study suggests an enhanced meta-framework, named data base evidence finding investigation (DEFI), to investigate an accounting data base to detect tampering. DEFI offers more targeted and streamlined guidance for data base experts to perform investigations while preserving the digital evidence's integrity and leaving it unchanged. Using an example, we demonstrate that the proposed enhanced meta-framework can guide the detection of suspicious transactions in an accounting data base.

Formal concept analysis approach to understand digital evidence relationships

The number of cyber attacks is constantly increasing daily, which demands organizations to respond quickly and adequately to security incidents. Digital forensics plays an essential role in these activities. In the digital investigation process, it is necessary to identify and separate relevant digital evidence from that which is not. In this paper, we describe the construction of ordinary and fuzzy formal contexts based on digital evidence collected from event logs and the filesystem (New Technology File System). We generated four concept lattices for various subsets of attributes regarding timestamps, types of files, or event logs. The association rules and their connections with Formal Concept Analysis are explored, and several algorithms, including GUHA methods, are applied to our data. We compare, evaluate and interpret the various methods for association rules mining. Moreover, we describe the state-of-the-art of fuzzy attribute implications in Formal Concept Analysis and provide the interpretation of implications in our epoch-time attributes. Our solution provides warnings for the security analyst to manually check and inspect the suspicious records in data. Hence, the analyst can quickly find relevant records for the case and perform further analysis.

Digital Forensics Techniques and Trends: A Review

The research work presented in this paper aims to review Digital Forensics (DF) techniques and trends. As computer technology advances day by day, the chances of data being misused and tampered with are also growing daily. The advancement in technology results in various cyber-attacks on computers and mobile devices. DF plays a vital role in the investigation and prevention of cyber-attacks. DF can be used to find the shreds of evidence and prevent attacks from happening in the future. Earlier presented reviews highlighted specific issues in DF only. This paper explores deeply DF issues by highlighting domain-specific issues and possible helpful areas for DF. This article highlights the investigation process framework and related approaches for the digital investigation process. The cognitive and human factors that affect the DF process are also presented to strengthen the investigation process. Nowadays, many DF tools are available in the industry that helps in DF investigation. A comparative analysis of the four DF tools is also presented. Finally DF performance is discussed. The submitted work may help the researchers go deeper into DF and apply the best tools and models according to their requirements

Error Level Analysis Technique for Identifying JPEG Block Unique Signature for Digital Forensic Analysis

The popularity of unique image compression features of image files opens an interesting research analysis process, given that several digital forensics cases are related to diverse file types. Of interest has been fragmented file carving and recovery which forms a major aspect of digital forensics research on JPEG files. Whilst there exist several challenges, this paper focuses on the challenge of determining the co-existence of JPEG fragments within various file fragment types. Existing works have exhibited a high false-positive rate, therefore rendering the need for manual validation. This study develops a technique that can identify the unique signature of JPEG 8 × 8 blocks using the Error Level Analysis technique, implemented in MATLAB. The experimental result that was conducted with 21 images of JFIF format with 1008 blocks shows the efficacy of the proposed technique. Specifically, the initial results from the experiment show that JPEG 8 × 8 blocks have unique characteristics which can be leveraged for digital forensics. An investigator could, therefore, search for the unique characteristics to identify a JPEG fragment during a digital investigation process.

Web Application based Image Geolocation Analysis to Detect Human Trafficking

Migrant smuggling is a dangerous phenomenon threatening international peace and security. This global concern for many countries is mainly due to the high use of multimedia devices and social media. There are great demands to specify an in depth gathering of information about a suspect’s mobile device while investigating cases of human trafficking and migrant smuggling. The primary purpose of this study is to help resolve the human trafficking problem that currently faces Sudan. In this paper we cover the steps used to geolocate images captured from suspects and victims’ mobile devices cameras. The obtained images are then analyzed using our specialized developed web application. This latter is built using open-source tools such as the Laravel framework and a Google Maps API which is considered as the main component of the web application. The results of the developed web application on a real case in Sudan has proven its usefulness in easing and speeding up the digital investigation process

A Novel Android Memory Forensics for Discovering Remnant Data

As recently updated on the vulnerability statistics shown in 2019, Android-driven smartphones, tablet PCs, and other Android devices are vulnerable, whether from internal or external threats. Most users store sensitive data like emails, photos, cloud storage access, and contact lists on Android smartphones. This information holds a growing-importance for the digital investigation process of mobile devices, e.g., internal memory or random-access memory (RAM) forensics, or external memory or read-only memory (ROM) forensics on Android smartphones. Internal memory retrieval is considered flawed and difficult by some researchers as it alters the digital evidence in an intrusive way. On the other hand, external memory retrieval also called logical acquisition that implies the image of logical storage items (e.g., files, database, directories, etc.) that locate on logical storage. This research provides a novel methodology that focuses only on internal memory forensic in a forensically sound manner. This research also contributes two algorithms, e.g., collect raw information (CRI) for parsing the raw data, and investigate raw information (IRI) for extracting the digital evidence to be more readable. This research conducted with fourteenth events to be analyzed, and each event was captured by SHA-1 as digital evidence. By using GDrive as the case study, the authors concluded that the proposed methodology could be used as guidance by forensics analyst(s), cyberlaw practitioner(s), and expert witness(es) in the court.

An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

Digital forensics practitioners encounter numerous new terminologies during time-intensive digital investigation processes because of the explosive growth of the web, an immense amount of data, and rapid changes in technology. In such a scenario, the time needed to find and interpret the cause of the potential digital incident can be affected by the complexity involved in understanding the meaning of newly encountered terminologies. Although various approaches have been designed to assist digital practitioners in understanding the newly encountered terminologies during the investigation of the accident, none of them is capable of supporting investigators to interpret new terminologies. Our work focuses on reconstructing and analyzing the timeline of events and artifacts backed by the abstraction concept to help practitioners in reasoning about the perceived meaning of different digital forensics terminologies that are encountered during the investigation. This paper introduces an ontological approach based on the abstraction concept to reconstruct the timeline provided by command-based digital forensic tools, i.e., Log2timeline and Psort in the L2TCSV format, and assist in resolving the meaning of new encountered concepts. The performed experiments show that the novel methodology is capable of enhancing the timeline and assisting practitioners in determining the significance of encountered terminologies or concepts.

Secure data transmission and detection of anti-forensic attacks in cloud environment using MECC and DLMNN

Anti-forensics is a set of techniques and measures adopted by an attacker aimed at compromising the digital investigation process in a computational environment. Cloud computing, which is an environment providing on demand resources to users, is susceptible to anti-forensic attacks. An anti-forensic attacker in the cloud can influence the cloud forensic process and tamper with evidences, causing damage to the investigation. Though some solutions have been proposed against anti-forensic attacks in cloud, there is a need to secure the evidences while in transit as well as in storage. In this work, we propose efficient algorithms for secure data (evidence) transmission and early detection of Anti-Forensic Attack (AFA). First, the data packets are compressed using a B-tree Huffman Encoding (BHE) algorithm; next, the packet marking technique is implemented to secure the IP address of the sender. For securely sending the data, we propose the Modified Elliptic curve cryptography (MECC) algorithm which encrypts the data packets and transmits it to a receiver. At the receiver side, the training is done using a Deep Learning Modified Neural Network (DLMNN) classifier, which tests the received data packet IP-address. Based on the IP-address of the sender, DLMNN identifies whether the received packet is an packet attacked or a non-attacked one. After the identification of the data packets, the decryption and de-compression of non-attacked data packets are done to obtain the original information. The original evidence information is further analyzed for investigation purposes. Experimental results shown by the proposed method are weighed against the prevailing techniques for performace comparison.

On the importance of standardising the process of generating digital forensic reports

The ISO/IEC 27043:2015 international standard provides new standardised guidelines for common investigation processes across various investigation scenarios that mostly involve digital evidence. The reporting process is one of the many investigative processes described in the ISO/IEC 27043:2015 standard, but the manner in which the reporting process is presented does not constitute or cover the specificity of the presentation of the entire processes covered in the standard. In this paper, we posit the importance of having the report generation process covering details obtained from all other classes of the digital investigation processes in a standardised format, as well as the need to standardise the process of generating digital forensic reports. Such a standardised process can facilitate future automation and text analytics, sharing of reports and knowledge across jurisdictions, etc. We also identify a number of key factors, such as the use of Blockchain, which should be added to the ISO/IEC 27043 international standard in order to support a standardised digital forensic report generation process.

Estudio Comparativo De Las Metodologías De Análisis Forense Informático Para La Examinación De Datos En Medios Digitales

The aim of this research is to compare the different standards and methodologies of computer forensic analysis used in the examination of data in digital media. The research was developed based on the scientific method, and a standard and two analysis methodologies were specifically used, which were applied to ten researchers. The analysis variables were based on the feasibility of use and on the time of extracting information from the computer. Among the comparison results of the different methodologies analyzed, it was determined that for the Methodology UNE 71506: 2013, 60% of the researchers used it due to the feasibility of use because it is made up of a robust process (contains the most detailed steps of computer forensics). Reliable and applicable in any field necessarily supervised by specialists working in the area, compared to the National Institute of Standards and Technology that selected 30%, Integrated Digital Investigation Process 10%. Regarding the time of analysis in the examination of digital media with different methodologies (Case study: Extraction of a file of 100 Mb, of a hard disk of 20 Gb in off mode. It is revealed that in the UNE 71506: 2013 it took less than 1 hour compared to the National Institute of Standards and Technology, which took between 1 and less than 2 hours, the Integrated Digital Investigation Process, which lasted longer than 3 hours. In addition, with the use of the Methodology UNE 71506: 2013, it was possible to have greater feasibility in the examination of digital media, since it is composed of four stages such as the preservation, acquisition, analysis and presentation of information results.

Digital Chain of Custody

Digital chain of custody is the record of preservation of digital evidence from collection to presentation in the court of law. This is an essential part of digital investigation process. Its key objective is to ensure that the digital evidence presented to the court remains as originally collected, without tampering. The chain of custody is important for admissible evidence in court. Without a chain of custody, the opposing attorney can challenge or dismiss the evidence presented. The aim of this paper is to provide a brief introduction to the concept of digital chain custody.

JPEG image classification in digital forensic via DCT coefficient analysis

From the digital forensics point of view, image forgery is considered as evidence that could provide a major breakthrough in the investigation process. Additionally, the development of storage device technologies has increased storage space significantly. Thus a digital investigator can be overwhelmed by the amount of data on storage devices that needs to be analysed. In this paper, we propose a model for classifying bulk JPEG images produced by the data carving process or other means into three different classes to solve the problem of identifying forgery quickly and effectively. The first class is JPEG images that contain errors or corrupted data, the second class is JPEG images that contain forged regions, and the third is JPEG images that have no signs of corruption or forgery. To test the proposed model, some experiments were conducted on our own dataset in addition to CASIA V2 image forgery dataset. The experiments covered different types of forgery technique. The results yielded around 88% accuracy rate in the classification process using five different machine learning methods on CASIA V2 dataset. It can be concluded that the proposed model can help investigators to automatically classify JPEG images, which reduce the time needed in the overall digital investigation process.

Studying the Documentation Process in Digital Forensic Investigation Frameworks/ Models

With the proliferation of the digital crime around the world, there are numerous and diverse digital forensic investigation models for driving digital investigation processes. Now more than ever, it must be a criminal investigation to obtain digital evidence which wouldn't be admissible in court. Therefore, digital forensic investigation should be implemented successfully, and there are a number of significant steps that should be taken into account. Each step and phase produces documents that are essential in understanding how the investigation process is built.The aim of this paper is to study models/ frameworks for the digital forensic investigation over a time period of ten years and find out the degree and level of attention to the process of documentation. This paper also includes definitions and descriptions of the basic and core concepts that the frameworks/ models use.

A Framework for Integrating Multimodal Biometrics with Digital Forensics

Multimodal biometrics represents various categories of morphological and intrinsic aspects with two or more computerized biological characteristics such as facial structure, retina, keystrokes dynamics, voice print, retinal scans, and patterns for iris, facial recognition, vein structure, scent, hand geometry, and signature recognition. The objectives of Digital Forensics (DF), on the other hand, is to inspect digital media in a forensically sound manner with the essence of identifying, discovering, recovering, analysing the artifacts and presenting facts and suggestions about the discovered information to any court of law or civil proceedings. Because the accuracy of biometric indicators may rarely be investigated during a digital forensic investigation processes, integrating digital forensics with multimodal biometrics can enable effective digital forensic investigations on multiple captured physiological and behavioural characteristics. This paper, therefore, presents a self-adaptive approach for integrating digital forensics with multimodal biometrics. This is motivated by the fact that, as of the time of writing this paper, there is lack of effective and standardised methods for performing digital investigation across multimodal biometric indicators. In addition, there are also no proper digital forensic biometric management strategies in place. For this reason, to enable effective digital investigations on multiple captured physiological and behavioural characteristics, this paper aims at proposing a framework that is meant to facilitate the integration of DF and multimodal biometrics. The framework is also meant to enhance the analysis of potential digital evidence during investigations. Integrating multimodal biometrics and digital forensics using the proposed framework gives a promising approach to add value especially in enforcing security measures in different systems as well as a restricting factor to unauthorized access key discoveries. The integration of digital forensics with multimodal biometrics is the main focus of this paper.

Methodology and implementation for tracking the file sharers using BitTorrent

Sharing copyright protected content without the copyright holder’s permission is illegal in many countries. Regardless, the number of illegal file sharing using BitTorrent continues to grow and most of file sharers and downloader are unconcerned legal action to transfer copywrite-protected files. However, it is difficult to gather enough probative evidence to prosecute illegal file sharers in criminal court and/or sued for damages in civil court. Further, there is a lack of research on investigation techniques to reveal illegal BitTorrent sharers. This is because the role of the server in BitTorrent networks has been changed compared to servers in conventional P2P networks. As a result, it is difficult to apply previous investigation processes for investigation of conventional P2P networks to the investigation of suspected illegal file sharing using BitTorrent. This paper proposes a methodology for the investigation of illegal file sharers using BitTorrent networks through the use of a P2P digital investigation process.

Digital forensics: An Analytical Crime Scene Procedure Model (ACSPM)

In order to ensure that digital evidence is collected, preserved, examined, or transferred in a manner safeguarding the accuracy and reliability of the evidence, law enforcement and digital forensic units must establish and maintain an effective quality assurance system. The very first part of this system is standard operating procedures (SOP's) and/or models, conforming chain of custody requirements, those rely on digital forensics “process-phase-procedure-task-subtask” sequence.An acceptable and thorough Digital Forensics (DF) process depends on the sequential DF phases, and each phase depends on sequential DF procedures, respectively each procedure depends on tasks and subtasks. There are numerous amounts of DF Process Models that define DF phases in the literature, but no DF model that defines the phase-based sequential procedures for crime scene identified. An analytical crime scene procedure model (ACSPM) that we suggest in this paper is supposed to fill in this gap. The proposed analytical procedure model for digital investigations at a crime scene is developed and defined for crime scene practitioners; with main focus on crime scene digital forensic procedures, other than that of whole digital investigation process and phases that ends up in a court.When reviewing the relevant literature and interrogating with the law enforcement agencies, only device based charts specific to a particular device and/or more general perspective approaches to digital evidence management models from crime scene to courts are found. After analyzing the needs of law enforcement organizations and realizing the absence of crime scene digital investigation procedure model for crime scene activities we decided to inspect the relevant literature in an analytical way. The outcome of this inspection is our suggested model explained here, which is supposed to provide guidance for thorough and secure implementation of digital forensic procedures at a crime scene. In digital forensic investigations each case is unique and needs special examination, it is not possible to cover every aspect of crime scene digital forensics, but the proposed procedure model is supposed to be a general guideline for practitioners.

Honing digital forensic processes

The number of forensic examinations being performed by digital forensic laboratories is rising, and the amount of data received for each examination is increasing significantly. At the same time, because forensic investigations are results oriented, the demand for timely results has remained steady, and in some instances has increased. In order to keep up with these growing demands, digital forensic laboratories are being compelled to rethink the overall forensic process. This work dismantles the barriers between steps in prior digital investigation process models and concentrates on supporting key decision points. In addition to increasing efficiency of forensic processes, one of the primary goals of these efforts is to enhance the comprehensiveness and investigative usefulness of forensic results. The purpose of honing digital forensic processes is to empower the forensic examiner to focus on the unique and interesting aspects of their work, allowing them to spend more time addressing the probative questions in an investigation, enabling them to be decision makers rather than tool runners, and ultimately increase the quality of service to customers. This paper describes a method of evaluating the complete forensic process performed by examiners, and applying this approach to developing tools that recognize the interconnectivity of examiner tasks across a digital forensic laboratory. Illustrative examples are provided to demonstrate how this approach can be used to increase the overall efficiency and effectiveness of forensic examination of file systems, malware, and network traffic.

Application of data fusion methodology for computer forensics dataset analysis to resolve data quality issues in predictive digital evidence

The digital information systems have become increasingly complex and inex- tricably intertwined with the infrastructure of national, public, and private organizations. The forensic digital analysis as a whole, in its relative infancy, is the unwilling victim of the rapid advancement of computer technology, so it is at the mercy of ever more new and complex computing approaches. Forensic digital analysis is unique among the forensic sciences in that it is inherently mathematical and generally comprises more data from an investigation than is present in other types of forensics. The digital investigation process can be driven using numerous forensic investigation models. Among these is the need to analyze forensic materials over complex chains of evidence in a wide variety of hetero- geneous computing platforms. The current computer forensic investigation paradigm is laborious and requires significant expertise on the part of the investigators. This paper presents the application of JDL data fusion model in computer forensics for analyzing the information from seized hard drives along with an analysis of the inter- preted information to prove that the respective user has misused internet. This paper is an attempt to use the data fusion and decision mining processes, to help in enhancing the quality of the investigation process which is in turn is validated by statistical evalua- tion. The mining rules generation process is based on the decision tree as a classification method to study the main attributes that may help in detecting the suspicious behavior. A system that facilitates the use of the generated rules is built which allows investigating agencies to predict the suspicious behavior under study.