Field Of Digital Forensics Research Articles

Dataset construction challenges for digital forensics

As the digital forensic field develops, taking steps towards ensuring a level of reliability in the processes implemented by its practitioners, emphasis on the need for effective testing has increased. In order to test, test datasets are required, but creating these is not a straightforward task. A poorly constructed and documented test dataset undermines any testing which has taken place using it, eroding the reliability of any subsequent test results. In essence, given the time, effort and knowledge required to generate datasets, the field must guide those carrying out this task to ensure that it is done right at the first instance without wasting resources. Yet, there are currently few standards and best practices defined for dataset creation in digital forensics. This work defines three categories of dataset which typically exist in digital forensic - tool/process evaluation datasets, actions datasets and scenario-based datasets, where the minimum requirements for their creation are outlined and discussed to support those creating them and to help ensure that where datasets are created, they offer maximum value to the field.

Contemporaneous notes for digital forensic examinations

Given the complexity of many examination-scenarios, practitioners in the field of digital forensics should consider the production and maintenance of contemporaneous notes a core part of any examination process. Not only do contemporaneous notes support the practitioner as they conduct their case work, through to the production of any accompanying report, but in some instances disclosure of this information may be required in order for all parties to evaluate any evidential findings fully. This work discusses the need for, and role of, contemporaneous notes in digital forensics, where a ‘skeleton’ of content outlining the required information practitioners should look to include in their contemporaneous notes is offered.

UAV Forensic Analysis and Software Tools Assessment: DJI Phantom 4 and Matrice 210 as Case Studies

Unmanned Aerial Vehicles (UAVs) also known as drones have created many challenges to the digital forensic field. These challenges are introduced in all processes of the digital forensic investigation (i.e., identification, preservation, examination, documentation, and reporting). From identification of evidence to reporting, there are several challenges caused by the data type, source of evidence, and multiple components that operate UAVs. In this paper, we comprehensively reviewed the current UAV forensic investigative techniques from several perspectives. Moreover, the contributions of this paper are as follows: (1) discovery of personal identifiable information, (2) test and evaluation of currently available forensic software tools, (3) discussion on data storage mechanism and evidence structure in two DJI UAV models (e.g., Phantom 4 and Matrice 210), and (4) exploration of flight trajectories recovered from UAVs using a three-dimensional (3D) visualization software. The aforementioned contributions aim to aid digital investigators to encounter challenges posed by UAVs. In addition, we apply our testing, evaluation, and analysis on the two selected models including DJI Matrice 210, which have not been presented in previous works.

Deep neural network and model-based clustering technique for forensic electronic mail author attribution

Electronic mail is the primary source of different cyber scams. Identifying the author of electronic mail is essential. It forms significant documentary evidence in the field of digital forensics. This paper presents a model for email author identification (or) attribution by utilizing deep neural networks and model-based clustering techniques. It is perceived that stylometry features in the authorship identification have gained a lot of importance as it enhances the author attribution task's accuracy. The experiments were performed on a publicly available benchmark Enron dataset, considering many authors. The proposed model achieves an accuracy of 94% on five authors, 90% on ten authors, 86% on 25 authors and 75% on the entire dataset for the Deep Neural Network technique, which is a good measure of accuracy on a highly imbalanced data. The second cluster-based technique yielded an excellent 86% accuracy on the entire dataset, considering the authors' number based on their contribution to the aggregate data.

Digital forensics and the DSAR effect

The digital forensics field has seen much evolution over the last thirty years. Methods for data extraction and protocols for accuracy and admissibility are the cornerstones on which the field is based. Recently these protocols have been used for responses to data subject access requests (DSARs). The cost to an organisation of servicing DSARs can run into millions of Euro per year. Every organisation working with EU citizens is affected. Their far-reaching scope, cost and the penalties for non-compliance have stimulated the development of solutions addressing this regulatory requirement. This paper charts the evolution of the DSAR process and how improvements have in turn led to the advancement of the digital forensics field itself.

Part 2: The Phase-oriented Advice and Review Structure (PARS) for digital forensic investigations

This work forms the second part of a two part series providing the necessary scaffolding for the digital forensic discipline to conduct effective peer review in their laboratories and units. The first part articulated the need for a structured approach to peer review in digital forensic investigations (Horsman and Sunde, 2020). Here in part two, the Phase-oriented Advice and Review Structure (PARS) for digital forensic investigations is offered. PARS is the first documented peer review methodology for the digital forensics field, a six staged approach designed to formally support organisations and their staff in their goal of facilitating effective peer review of DF work, from investigative tasks to forensic activities and forensic analysis processes (Pollitt et al., 2018). This article discusses how the PARS methodology can be implemented, and the available options and mechanisms available to ease the interpretation of this model into existing practices. Both the early ‘Advisor’ and later ‘Reviewer’ roles in PARS are discussed and their requirements and expectations are defined. Three template documents are provided and explained: The PARS Advisors template, the PARS Advisor Brief template and the PARS Peer Review Hierarchy template, for direct use by organisations seeking to adopt the PARS methodology.

Detecting Deepfakes with Haralick’s Texture Properties

In the recent years, the detection of deepfake videos has become a major topic in the field of digital media forensics, as the amount of such videos circulating on the internet has drastically risen. Providers of content, such as Facebook and Amazon, have become aware of this new threat to spreading misinformation on the Internet. In this work, a novel forgery detection method based on the texture analysis known from image classification and segmentation is proposed. In the experimental results, its performance has shown to be comparable to related works.

Disposable Virtual Machines and Challenges to Digital Forensics Investigation

Digital forensics field faces new challenges with emerging technologies. Virtualization is one of the significant challenges in the field of digital forensics. Virtual Machines (VM) have many advantages either it be an optimum utilization of hardware resources or cost saving for organizations. Traditional forensics’ tools are not competent enough to analyze the virtual machines as they only support for physical machines, to overcome this challenge Virtual Machine Introspection technologies were developed to perform forensic investigation of virtual machines. Until now, we were dealing with persistent virtual machines; these are created once and used many times. We have extreme version of virtual machine and that is disposable virtual machine. However, the disposable virtual machine once created and are used one time, it vanish from the system without leaving behind any significant traces or artifacts for digital investigator. The purpose of this paper is to discuss various disposable virtualiza-tion technologies available and challenges posed by them on the digital forensics investigation process and provided some future directions to overcome these challenges.

File Fragment Classification using Content Based Analysis

One of the major components in Digital Forensics is the extraction of files from a criminal’s hard drives. To achieve this, several techniques are used. One of these techniques is using file carvers. File carvers are used when the system metadata or the file table is damaged but the contents of the hard drive are still intact. File carvers work on the raw fragments in the hard disk and reconstruct files by classifying the fragments and then reassembling them to form the complete file. Hence the classification of file fragments has been an important problem in the field of digital forensics. The work on this problem has mainly relied on finding the specific byte sequences in the file header and footer. However, classification based on header and footer is not reliable as they may be modified or missing. In this project, the goal is to present a machine learningbased approach for content-based analysis to recognize the file types of file fragments. It does so by training a Feed-Forward Neural Network with a 2-byte sequence histogram feature vector which is calculated for each file. These files are obtained from a publicly available file corpus named Govdocs1. The results show that content-based analysis is more reliable than relying on the header and footer data of files.

A feature-based approach for digital camera identification using photo-response non-uniformity noise

Source camera identification of an image is an emerging field of digital forensics. To identify the source camera through which the image is captured, photo-response non-uniformity (PRNU) noise is used as a camera fingerprint, as it is a unique characteristic that distinguishes images taken from the similar cameras. This paper presents a feature-based approach to identify the source camera. The input image is denoised using the denoising filter and from this denoised image, PRNU noise pattern is extracted. These PRNU noise patterns are represented by Hu's invariants, which are perpetual under image scaling, translation and rotation. These features are fed to fuzzy min-max neural network (FMNN) for training and classification for digital camera identification. The proposed approach has the ability to identify the cameras capturing the same scene.

Part 1: The need for peer review in digital forensics

The importance of peer review in the field of digital forensics cannot be underestimated as it often forms the primary, and sometimes only form of quality assurance process an organisation will apply to their practitioners' casework. Whilst there is clear value in the peer review process, it remains an area which is arguably undervalued and under-researched, where little academic and industrial commentary can be found describing best practice approaches. This work forms the first of a two part series discussing why the digital forensics discipline and its organisations should conduct peer review in their laboratories, what it should review as part of this process, and how this should be undertaken. Here in part one, a critical review of the need to peer review is offered along with a discussion of the limitations of existing peer review mechanisms. Finally, the ‘Peer Review Hierarchy’ is offered, outlining the seven levels of peer review available for reviewing practitioner findings.

Analyzing Cyber Trends in Online Financial Frauds using digital Forensics Techniques

Online financial frauds are one of the leading issues in the fields of digital forensics and cyber-security today. Various online firms have been employing several methodologies for the prevention of finance-related malpractices. This domain of criminal activity is becoming increasingly common in the present cyberspace. In this paper, we will try to implement an online financial fraud investigation using the digital forensics tool: Autopsy. A few existing cyber-security techniques for the investigation of such crimes, namely the Formal Concept Analysis and Confirmatory Factor Analysis; have been analyzed and reviewed. These techniques are primarily based on mathematical cyber-security concepts. Henceforth, it has been tried to find out whether the investigation of similar crimes can be done satisfactorily using the readily-accessible digital forensics tool: Autopsy. Also, it has been explored whether the aforementioned cyber-security techniques can be embedded along with the digital forensics tool to achieve the best results, through training a bot to automatically perform accurate investigations of such crimes. Thus, it has been tried to automate the process of online financial fraud investigation.

Gaslight revisited: Efficient and powerful fuzzing of digital forensics tools

The fields of digital forensics and incident response have seen significant growth over the last decade due to the increasing threats faced by organizations and the continued reliance on digital platforms and devices by criminals. This rise has coincided with a significant and continued increase in the size, complexity, and number of digital forensic investigations that must be performed. In the past, such investigations were performed manually by expert investigators, but this approach is no longer viable given the amount of data that must be processed compared to the relatively small number of trained investigators. These resource constraints have led to the development and reliance on automated processing and analysis systems for digital evidence. Given the central role that such evidence plays in securing organizations and nations against attacks as well as in criminal and civil legal proceedings, it is necessary that such systems are developed in a robust and reliable manner. In this paper, we present our effort to develop a stress testing platform specifically tailored to assess the robustness and reliability of digital forensics tools. For our initial testing, we chose to target The Sleuth Kit framework given its prominence as both as a standalone tool as well as a programming library that is utilized by a large number of open source and commercial filesystem analysis systems. The results of our efforts were the automated discovery of many critical programming errors in The Sleuth Kit framework.

A glance at digital forensic academic research demographics

Whilst the field of digital forensics is now well established, its research community can be considered relatively emerging in comparison to the associated areas of traditional forensic and computer sciences. As a result, this comment article takes a quick look at the demographics of digital forensics research over the last 20 years, with metadata from 6589 articles being extracted and analysed from Scopus in order to provide a brief insight into this field’s research activity.

Evaluation of live forensic techniques in ransomware attack mitigation

Ransomware continues to grow in both scale, cost, complexity and impact since its initial discovery nearly 30 years ago. Security practitioners are engaged in a continual “arms race” with the ransomware developers attempting to defend their digital infrastructure against such attacks. Recent manifestations of ransomware have started to employ a hybrid combination of symmetric and asymmetric encryption to encode user's files.This paper describes an investigation that tried to determine if the techniques currently employed in the field of digital forensics could be leveraged to discover the encryption keys used by these types of malicious software thus mitigating the effects of a ransomware attack.Memory was captured from a system infected by ransomware and its contents was examined using live forensic tools, with the intent of identifying the symmetric encryption keys being used. NotPetya, Bad Rabbit and Phobos hybrid ransomware samples were tested during the investigation. If keys were discovered, the following two steps were also performed. Firstly, a timeline was manually created by combining data from multiple sources to illustrate the ransomware's behaviour as well as showing when the encryption keys were present in memory and how long they remained there. Secondly, an attempt was made to decrypt the files encrypted by the ransomware using the found keys. In all cases, the investigation was able to confirm that it was possible to identify the encryption keys used. A description of how these found keys were then used to successfully decrypt files that had been encrypted during the execution of the ransomware is also given.The resulting generated timelines provided a excellent way to visualise the behaviour of the ransomware and the encryption key management practices it employed, and from a forensic investigation and possible mitigation point of view, when the encryption keys are in memory.

PRECEPT: a framework for ethical digital forensics investigations

PurposeCyber-enabled crimes are on the increase, and law enforcement has had to expand many of their detecting activities into the digital domain. As such, the field of digital forensics has become far more sophisticated over the years and is now able to uncover even more evidence that can be used to support prosecution of cyber criminals in a court of law. Governments, too, have embraced the ability to track suspicious individuals in the online world. Forensics investigators are driven to gather data exhaustively, being under pressure to provide law enforcement with sufficient evidence to secure a conviction.Yet, there are concerns about the ethics and justice of untrammeled investigations on a number of levels. On an organizational level, unconstrained investigations could interfere with, and damage, the organization's right to control the disclosure of their intellectual capital. On an individual level, those being investigated could easily have their legal privacy rights violated by forensics investigations. On a societal level, there might be a sense of injustice at the perceived inequality of current practice in this domain.This paper argues the need for a practical, ethically grounded approach to digital forensic investigations, one that acknowledges and respects the privacy rights of individuals and the intellectual capital disclosure rights of organizations, as well as acknowledging the needs of law enforcement. The paper derives a set of ethical guidelines, and then maps these onto a forensics investigation framework. The framework to expert review in two stages is subjected, refining the framework after each stage. The paper concludes by proposing the refined ethically grounded digital forensics investigation framework. The treatise is primarily UK based, but the concepts presented here have international relevance and applicability.Design/methodology/approachIn this paper, the lens of justice theory is used to explore the tension that exists between the needs of digital forensic investigations into cybercrimes on the one hand, and, on the other, individuals' rights to privacy and organizations' rights to control intellectual capital disclosure.FindingsThe investigation revealed a potential inequality between the practices of digital forensics investigators and the rights of other stakeholders. That being so, the need for a more ethically informed approach to digital forensics investigations, as a remedy, is highlighted and a framework proposed to provide this.Research limitations/implicationsThe proposed ethically informed framework for guiding digital forensics investigations suggests a way of re-establishing the equality of the stakeholders in this arena, and ensuring that the potential for a sense of injustice is reduced.Originality/valueJustice theory is used to highlight the difficulties in squaring the circle between the rights and expectations of all stakeholders in the digital forensics arena. The outcome is the forensics investigation guideline, PRECEpt: Privacy-Respecting EthiCal framEwork, which provides the basis for a re-aligning of the balance between the requirements and expectations of digital forensic investigators on the one hand, and individual and organizational expectations and rights, on the other.

Digital Forensics

Considering the ever-growing ubiquity of technology, there is an associated growth in the possibility of digital devices related to a criminal investigation or civil litigation. As the variety of digital devices is increasing, the storage capacity of each is also rising exponentially. Due to the varied and large volumes of data produced, law enforcement agencies (LEAs) worldwide are facing a significant backlog of cases. This has culminated in significant delays in dealing with cases that urgently require digital forensic investigations (DFIs). It is of paramount importance that new research approaches be adopted to address such challenges. This article evaluates the existing set of circumstances surrounding the field of digital forensics (DF). The article provides two important contributions to the field of DF; it identifies and analyses the most important mid- and long-term challenges that need to be considered by LEAs. It also proposes important specific future research directions, the undertaking of which can assist LEAs in adopting a new approach to addressing these challenges.

ACPO principles for digital evidence: Time for an update?

Despite remaining largely unchanged for over 10 years, the Association of Chief Police Officers’s [1] Good Practice Guides for Digital Evidence and their four governing principles for evidence handling are amongst some of the most cited pieces of digital forensic best practice advice. However, given the pace of change in both technology and the field of digital forensics, this work debates whether it may be time to evaluate whether these principles remain wholly valid given the current forensic analysis landscape and their lack of updating or periodic evaluation. A discussion of the existing four ACPO principles is provided followed by an offering of eight new revised principles as a means of acknowledging the current challenges faced by practitioners in this field. It is hoped that this piece will spark a debate surrounding the principles we so frequently acknowledge as a mark of quality assurance in our investigations, and be a catalyst for evaluative considerations in this area.

Review of cyber security threats and proposed trustworthy memory acquisition mechanism

Due to the major exponential leap in the amount of digital data generated, processed, transferred and stored in a daily life brings challenges to the digital forensic field as like it does in other research and technical area. Digital forensics has become rapidly important as a method to investigate a cyber and mobile-assisted crime. While multiple tools are present and much research & development are being undertaken, but huge uncertainties and challenges exist regarding the future of cyber security. In this literature a detailed survey is discussed on security threats in cyber security and analyzing some network with existing tools and proposes a trustworthy memory acquisition management based security solution. The crucial challenges that exist within the domain, including increased volume of data as per platforms and systems that exist, security mechanism for securing the data on existing systems, analyzing the unwanted cyber threats and forensic investigation on stored database.

Deep Learning for Distinguishing Computer Generated Images and Natural Images: A Survey

With the development of computer graphics, realistic computer graphics (CG) have become more and more common in our field of vision. This rendered image is invisible to the naked eye. How to effectively identify CG and natural images (NI) has been become a new issue in the field of digital forensics. In recent years, a series of deep learning network frameworks have shown great advantages in the field of images, which provides a good choice for us to solve this problem. This paper aims to track the latest developments and applications of deep learning in the field of CG and NI forensics in a timely manner. Firstly, it introduces the background of deep learning and the knowledge of convolutional neural networks. The purpose is to understand the basic model structure of deep learning applications in the image field, and then outlines the mainstream framework; secondly, it briefly introduces the application of deep learning in CG and NI forensics, and finally points out the problems of deep learning in this field and the prospects for the future.