Digital Investigation Research Articles

Management of Fecal Incontinence: Etiology, Diagnostic Approach, and Conservative Therapy

Background: Fecal incontinence is a common problem especially in the elderly resulting in a reduced quality of life. Summary: The etiology of fecal incontinence is often multifactorial with little options for a causal therapy. The mechanisms causing incontinence can be detected by sophisticated methods in most of the patients. Using therapeutic algorithms, incontinence can be improved or even continence restored in many patients. Key Messages: Diagnostic work-up starts with history, digital investigation, and anoproctoscopy. The specialist will further investigate with anorectal manometry, anal endosonography, and electromyography of the external anal sphincter muscle. Nonoperative therapy comprises hygienic methods, medical therapy, intraanal electrostimulation, and training methods like pelvic floor exercises or biofeedback. Second-line conservative therapies are tibial nerve stimulation, transanal irrigation, or anal inserts.

The Court of Justice in Staatsanwaltschaft Berlin v. M.N. (EncroChat): From cross-border, data-driven police investigations to evidence admissibility

The ruling of the Grand Chamber of the Court of Justice of the EU (CJEU) in Case C-670/22 Staatsanwaltschaft Berlin v. M.N. addresses the realities of data-driven police investigations in the light of the Directive 2014/41/EU on the European Investigation Order (EIO Directive). In particular, it examines the cross-border, digital investigation of the encrypted communication network EncroChat and the use and sharing of intercepted telecommunication data in criminal proceedings. In doing so, the CJEU offers clarifications as to the interpretation of the term ‘issuing authority’ under the EIO Directive and the proportionality requirements for issuing an EIO, taking into account its prior jurisprudence on the implications of access to traffic and location data for the private life of the persons concerned. More importantly, this CJEU ruling takes a stand on admissibility of intercepted data as evidence in criminal proceedings, considering the technical complexity of contemporary investigation measures and the secrecy of said police methods. Overall, although this judgment seems to hold no great surprises regarding the interpretation of the EIO Directive's provisions, it underscores the important role of the national legislator and national courts in striking the right balance between rearing the rewards of data-driven policing and safeguarding defence rights.

A FRAMEWORK TO ANALYZE OS SYSTEMS ARTIFACTS FROM LINUX MACHINES

Memory forensics plays a pivotal role in digital investigations, providing crucial insights into the activities and artifacts of an operating system. This paper explores the application of deep learning techniques in the domain of memory forensics within the Linux environment. Linux-based systems are widely used in various contexts, including servers, embedded devices, and desktops, making memory analysis in this ecosystem of paramount importance. Traditional memory forensics techniques have relied on manual analysis, which is often time-consuming and error prone. Deep learning, a subfield of machine learning, has demonstrated remarkable capabilities in pattern recognition and feature extraction tasks. In response, this paper presents a novel framework that automates and improves memory analysis through deep learning. Key components of this framework include data collection, preprocessing, feature extraction, and model selection. We introduce a unique dataset specifically curated for Linux memory forensics, facilitating the development and evaluation of deep learning models. Our experimental results demonstrate the efficacy of using a ResNet-50 model for detecting and classifying malware from memory dumps, achieving a detection rate of 98.75% and an accuracy rate of 89% in classifying malware types. Additionally, we acknowledged the challenges and limitations of applying deep learning in memory forensics, such as model interpretability and data privacy concerns. Future research directions are discussed, including real-time memory analysis integration and techniques for handling encrypted and compressed memory data.

Do You “Relay” Want to Give Me Away? – Forensic Cues of Smart Relays and Their IoT Companion Apps

As IoT devices become more prevalent in everyday environments, their relevance to digital investigations increases. The product class of “smart relays”, which are connected to the low-voltage grid and usually installed in sockets behind walls, has not yet received much attention in the context of smart home forensics. To close a category-specific gap in the device forensics literature, we conducted a multi-device analysis of 16 smart relays from 9 manufacturers, which support six different companion apps in total. Our examination shows that forensic artifacts can be found locally on the smart relays and in the companion app data, as well as remotely on cloud servers of the vendors. Based on our findings, we developed a Python framework to extract forensic artifacts automatically from obtained firmware dumps, from companion app data, and from captured network traffic.

Forensically analyzing IoT smart camera using MAoIDFF-IoT framework

IoT devices spread over a wide range of applications these days, and their vast amount of data generated becomes a target for intruders. IoT digital forensics, which involves extracting the digital evidence from the IoT device itself and/or its network traffic using a framework is important and challenging. The challenges include the diversity of types of IoT devices, resource constraints, and users’ privacy. In this article, we focus on network forensics investigations of smart camera traffic as a case study. The investigation process followed the MAoIDFF-IoT framework, a comprehensive and effective framework for IoT devices, and focusing on the locations of potential Artifacts of Interest (AoI). In addition, a few scenarios in using the camera are investigated to obtain a valuable artifact. The results show that it is possible to extract a few artifacts from the network captured traffic even though the traffic is encrypted. Moreover, this research offers guidelines for digital investigators to conduct network forensics on smart camera devices, with detailed results provided.

Merging Responsibilities

Abstract In emergent fields of practice, there is often an ‘ethics lag’ — a period of significant innovation during which the focus is on what can be accomplished more than on the safeguards that should be put in place to protect the public from the unanticipated consequences of that innovation. This is true of the emergent field of digital open-source investigations conducted for international criminal justice purposes, in which researchers and analysts comb the Internet for information relevant to their research. One sub-field where the ethics lag is particularly of concern is digital investigations of conflict-related sexual and gender-based violence (CRSV), especially with regards to whether and when investigators need consent from social media posters, survivors, bystanders and others to use information discovered in online spaces. This article explores options for centring and promoting victim safety and dignity by clarifying ethical issues that investigators should consider before using open-source information to support international investigations and prosecutions of CRSV. After identifying where the relevant law leaves gaps in guidance, the authors discuss a series of considerations that may help investigators ethically handle such sensitive data. Ultimately, the authors underscore the importance of securing consent from survivors when engaging in digital open-source investigations into sexual violence. What arguably varies is who should seek that consent, when, and how.

Multidimensional Forensic Analysis of Onion Sites Using LSTM and Fuzzy Encoded Techniques: Insights and Applications in Digital Investigations

When it comes to digital investigations, the fact that onion sites make people anonymous makes investigative research much harder. For multidimensional forensic analysis of onion sites, this study suggests a new method that combines Long Short-Term Memory (LSTM) networks with fuzzy encoding methods. When you use the Tor network to get to onion sites, both users and services become anonymous, which makes it harder to do regular investigations. LSTM networks are used to look at trends in how people use the site and when material is updated over time. These networks are good at modeling sequential data. Fuzzy encoding methods work with LSTM to handle the uncertainty that comes with analyzing anonymous data, which makes investigative results more accurate. The method involves keeping time logs of what people do on onion sites and turning them into fuzzy sets to show how user interactions and content changes change over time. LSTM models are taught on these recorded sequences to find patterns that point to suspicious activity, like sudden changes in content or strange patterns of user access. This method can be used to find illegal activities, find secret services that host illegal content, and make profiles of how users behave in an anonymous network. Investigators can better track actions across onion sites when they use LSTM's ability to see how events depend on each other over time and fuzzy encoding's ability to deal with inaccurate data. Real-world onion site data used for experiments shows that the proposed method can find secret behaviors and patterns that are hard for traditional investigative methods to find. The results show that the accuracy and efficiency of detecting are much better than with traditional methods.

On enhancing memory forensics with FAME: Framework for advanced monitoring and execution

Memory Forensics (MF) is an essential aspect of digital investigations, but practitioners often face time-consuming challenges when using popular tools like the Volatility Framework (VF). VF, a widely-adopted Python-based memory forensics tool, presents difficulties for practitioners due to its slow performance. Thus, in this study, we evaluated methods to accelerate VF without modifying its code by testing four alternative Python Just In Time (JIT) interpreters - CPython, Pyston, PyPy, and Pyjion - using CPython as our baseline. Tests were conducted on 14 memory samples, totaling 173 GB, using a search-intensive VF plugin for Windows hosts. Employing our custom Framework for Advanced Monitoring and Execution (FAME), we deployed interpreters in Docker containers and monitored their real-time performance. A statistically significant difference was observed between the Python JIT interpreters and the standard interpreter. With PyPy emerging as the best interpreter, yielding a 15–20 % performance increase compared to the standard interpreter. Implementing PyPy has the potential to save significant time (many hours) when processing substantial memory samples. FAME enhances the efficiency of deploying and monitoring robust forensic tool testing, fostering reproducible research and yielding reliable results in both MF and the broader field of digital forensics.

Transfer Learning-Based Models for Comparative Evaluation for the Detection of AI-Generated Images

As the pace of artificial intelligence (AI) evolution accelerates, the line separating authentic from AI-produced imagery becomes increasingly indistinct. This shift carries profound consequences for sectors such as content verification and digital investigation, underscoring the need for proficient AI-generated image identification systems. Our study utilizes established architectures like AlexNet, Convolutional Neural Networks (CNNs), and VGG16 to explore and evaluate the effectiveness of models based on transfer learning for spotting AI-crafted images. Transfer learning, which applies models pre-trained on large datasets, has proven beneficial in numerous computer vision tasks. In this research, we modify the intricate patterns recognized by AlexNet, CNNs, and VGG16 from extensive datasets to specifically target the detection of AI-generated content. We introduce models that are trained, validated, and tested on a comprehensive dataset that includes both real and AI-generated images. Our experimental findings demonstrate the utility of transfer learning methods in discerning between real and synthetic visuals. By conducting a comparative analysis, we highlight the comparative advantages and limitations of each model in terms of metrics such as precision, recall, accuracy, and the F1-score. Further, we investigate the distinct features identified by each model to elucidate their contribution to accurate classification.

Volatile Data Acquisition and Analysis by Using Memory Forensics Techniques

Memory forensics is a vital component of digital investigations, involving the analysis of volatile memory (RAM) in computer systems to gather evidence, identify malicious activities, and reconstruct cybercrime incidents. This paper provides an overview of memory forensics, highlighting its defini-tion, importance, purpose, and scope. It explores the evolution and significance of memory forensics in response to increasingly complex cyber threats. The memory forensics process is discussed, cover-ing memory acquisition and analysis. Legal and ethical considerations related to the admissibility of memory evidence and privacy protection are examined. The paper also discusses the types of memory, including physical and virtual memory, and their characteristics and significance in memory forensics. Furthermore, it explores the memory acquisition process, different methods, tools, and techniques used, as well as the importance of preserving evidence integrity. Finally, the paper introduces various tools for memory analysis, such as Volatility, Volatility Workbench, FTK Imager, Encase, Hibernation Recon, and Xplico, and highlights their role in extracting valuable evidence from memory dumps.

Video Forgery Detection with Deep Learning Using RESNET and CNN Algorithm

Video forgery is continuously increasing in the digital world due to breaches of information security, consequently establishing a scenario for image and video content monitoring for forgery identification. The spread of fake videos raises security risks and anarchy in society. The reason for video forgery is to the augmentation in the malware, which has facilitated user (anyone) to upload, download, or share objects online comprising audio, images, or video. With the development of technology and ease of creation of fake content, the manipulation of media is carried out on a large scale in recent times. Video forgery detection has applications in media science, forensic analysis, digital investigations, and authenticity verification of a video. The purpose of video forensic technology is to extract features to distinguish fake content frames from original videos.

Chain of Custody and Evidence Integrity Verification Using Blockchain Technology

The validity and integrity of digital evidence and the chain of custody are crucial to all digital forensic investigations. All new evidence and access logs of the original evidence should be logged in a document called the ‘chain of custody’. This document shows the timeline of any piece of evidence from the time it was recorded until the end of the investigation. In a traditional digital investigation, trusted parties, such as an investigator, are allowed access to the digital evidence and follow a strict process when dealing with data. These trusted parties have the capability to alter the data making the evidence inadmissible in a court of law. Alternatively, these trusted parties may also alter the data accidentally or with malicious intent, due to a lack of transparency and non-repudiation. Blockchain technology can solve this issue, however, existing research shows that adopting blockchain does not provide adequate transparent access control mechanisms. Consequently, this makes blockchain difficult to adopt due to the one-to-one mapping and the inability to easily validate the chain of custody and evidence admissibility. Current methodologies rely on an external off-chain access control mechanism, which, regrettably, remains susceptible to potential breaches that could compromise its integrity and validity. This paper proposes an enhanced model to provide access control through smart contracts, ensuring immutability, flexibility, transparency, and non-repudiation of both the access control mechanisms and the digital evidence itself. This is achieved by moving the access control mechanism to the blockchain. This tracks any changes made through the access control mechanism, further ensuring transparency and integrity. This smart contract-based access control builds off role-based access control, allowing for more complex hierarchies to be used. This model aims to allow for both modularity, making adoption easier for existing digital forensic tools, and encouraging digital investigation and litigation to become more streamlined. Existing tools can easily integrate with the proposed model adding an extra layer of non-repudiation, transparency, and integrity.

Digital Investigations: Navigating Challenges in Tool Selection for Operating System Forensics

The process of gathering, identifying, extracting, and documenting electronic evidence for use in court is known as "digital forensics." We have a lot of tools at our disposal to make this procedure quick and straightforward. Four tools have been selected for investigation and analysis in this work. For every kind of digital forensics, the top tools have been selected based on several criteria. For computer forensic tools, (Stellar and Forensic Tool Kit) have been investigated; for network forensic tools, Network Map has been selected, and OSF mount has been examined as a live forensic tool. Other forensic tool types, such as database, operating system, and mail forensic tools, are also covered in this work. The role of Artificial intelligence in Digital Forensic tools has been discussed in this paper by using both Decision Stump and Bayes net machine learning techniques. After making an investigation of the IoT device traffic dataset using these two techniques, Decision Stump gives us less accurate results compared with Bayes net.

Collecting and analyzing network-based evidence

Since nearly the beginning of the Internet, malware has been a significant deterrent to productivity for end users, both personal and business related. Due to the pervasiveness of digital technologies in all aspects of human lives, it is increasingly unlikely that a digital device is involved as goal, medium or simply ‘witness’ of a criminal event. Forensic investigations include collection, recovery, analysis, and presentation of information stored on network devices and related to network crimes. These activities often involve wide range of analysis tools and application of different methods. This work presents methods that helps digital investigators to correlate and present information acquired from forensic data, with the aim to get a more valuable reconstructions of events or action to reach case conclusions. Main aim of network forensic is to gather evidence. Additionally, the evidence obtained during the investigation must be produced through a rigorous investigation procedure in a legal context.

Collecting and analyzing network-based evidence

Since nearly the beginning of the Internet, malware has been a significant deterrent to productivity for end users, both personal and business related. Due to the pervasiveness of digital technologies in all aspects of human lives, it is increasingly unlikely that a digital device is involved as goal, medium or simply ‘witness’ of a criminal event. Forensic investigations include collection, recovery, analysis, and presentation of information stored on network devices and related to network crimes. These activities often involve wide range of analysis tools and application of different methods. This work presents methods that helps digital investigators to correlate and present information acquired from forensic data, with the aim to get a more valuable reconstructions of events or action to reach case conclusions. Main aim of network forensic is to gather evidence. Additionally, the evidence obtained during the investigation must be produced through a rigorous investigation procedure in a legal context.

Correlating forensic data for enhanced network crime investigations: Techniques for packet sniffing, network forensics, and attack detection

<p class="MDPI18keywords">In today’s digitally saturated world, digital devices are frequently involved in criminal events as targets, mediums, or witnesses. Forensic investigations encompass the collection, recovery, analysis, and presentation of information stored on network devices, with specific relevance to network crimes. Such investigations often necessitate the use of diverse analysis tools and methods. This study introduces techniques that support digital investigators in correlating and presenting information derived from forensic data, with a primary focus on packet sniffing, network forensics, and attack detection. By leveraging these methodologies, investigators aim to achieve more valuable reconstructions of events or actions, resulting in enhanced case conclusions. The study emphasizes the importance of understanding how malware operates within the context of the Internet. It explores packet sniffing techniques to capture and analyze network data, enabling investigators to detect and trace the origins of malicious activities. Additionally, it delves into the realm of network forensics, proposing effective methods for gathering evidence from network devices and reconstructing digital events. Furthermore, the study covers the significance of attack detection in network crime investigations. It highlights techniques to identify and analyze attack patterns, facilitating the identification of perpetrators and their motivations. By correlating information obtained from forensic data, investigators can obtain comprehensive insights into the nature and impacts of network crimes. Overall, this study aims to arm digital investigators with the knowledge and tools necessary to navigate the complexities of packet sniffing, network forensics, and attack detection. By incorporating these techniques into their investigations, investigators can achieve more robust reconstructions of events, draw well-informed conclusions, and contribute to the successful resolution of network crime cases.</p>

Digital Investigation Forensic Model with P2P Timestamp Blockchain for Monitoring and Analysis

Forensic analysis of Blockchain data is a new field in police work. It's now one of the largest problems facing law enforcement. The paper discussed the worldwide need for digital forensics in law enforcement and Blockchain forensics to counteract crimes committed using Blockchain technology. It's been said that we've entered a new age of technology that's heavily dependent on the principles of Blockchain. The research produced a set of guidelines for Digital Investigators. on addition, a theoretical framework grounded on the concept of regular activity has been developed, and a legislative framework has been proposed to ensure that its illegal purpose will always be punished severely.

The effects of document's format, size, and storage media on memory forensics

Main memory or RAM contains volatile but critical data about the system's state and its recent activities. Often, RAM based artifacts are hard to be found elsewhere. Digital investigators can find in this volatile data an essential information about the recent usage of a system including the used documents. Nowadays, documents are often fetched from a variety of storage media, most of which are internet based. This can complicate the digital investigation process due to the remote nature of these storage media; most of these remote files cannot be traced on the local hard disk drive (HDD) of the captured machine. However, whenever the document's contents are successfully recovered from RAM images, it can ensure the actual usage of the document. This paper studies the effects of various storage media (local and remote) on the amount of volatile artifacts of different types of documents. Experiments are designed to evaluate the effects of local hard drives, removable media, and a set of cloud based platforms such as Dropbox, Google Drive, and OneDrive on the RAM based artifacts of a used document. Results show that the recovered contents are significantly affected by the used storage media. Moreover, the document's type has an effect too. Frequently, a good ratio of the document's contents are recovered from RAM even when the document is living on the cloud, the document is closed, and the connection is terminated.

Natural Language Processing Applied to Forensics Information Extraction With Transformers and Graph Visualization

Digital forensics analysis is a slow process mainly due to the large amount and variety of data. Some forensic tools help categorize files by type and allow automatization of tasks, like named entity recognition (NER). NER is a key component in many natural language processing (NLP) applications, such as relation extraction (RE) and information retrieval. The introduction of neural networks and transformer architectures in the last few years made it possible to develop more accurate models in different languages. This work proposes a reproducible setup to build a forensic pipeline for information extraction using NLP of texts. Our results show that it is possible to develop both NER and RE models in any language and tune its hyper-parameters to achieve state-of-art performance and build comprehensive knowledge graphs, decreasing the amount of time required for human supervision and review. We also find that solving this task in phases can further improve the performance, not only for digital investigation applications, but also for general-purpose information extraction and analysis.

ASMF: Ambient social media forensics chain of custody with an intelligent digital investigation process using federated learning

Ambient Intelligence is a concept that relates to a new paradigm of pervasive computing and has the objective of automating responses from the system to humans without any human intervention. In social media forensics, gathering, analyzing, storing, and validating relevant evidence for investigation in a heterogeneous environment is still questionable. There is no hierarchy for automation, even though standardization and secure processes from data collection to validation have not yet been discussed. This poses serious issues for the current investigation procedures and future evidence chain of custody management. This paper contributes threefold. First, it proposes a framework using a blockchain network with a dual chain of data transmission for privacy protection, such as on-chain and off-chain. Second, a protocol is designed to detect and separate local and global cyber threats and undermine multiple federated principles to personalize search space broadly. Third, this study manages personalized updates by means of optimizing backtracking parameters and automating replacements, which directly affects the reduction of negative influence on the social networking environment in terms of imbalanced and distributed data issues. This proposed framework enhances stability in digital investigation. In addition, the simulation uses an extensive social media dataset in different cyberspaces with a variety of cyber threats to investigate. The proposed work outperformed as compared to traditional single-level personalized search and other state-of-the-art schemes.