Forensic Process Research Articles

IoT 기기 플래시 메모리의 Ext4 파일 시스템을 위한 디지털 포렌식 절차

최근 급격한 통신기술의 발달에 따라 IoT(Internet of Things)의 확산이 가속화되고 있으며 IoT 기기는 인간의 삶과 밀접한 분야에서 활용되어 범죄 및 사고 경황 정보 조사에 적극적으로 활용되고 있다. 이에 따라 디지털 포렌식의 중요성이 부각되며 그 수행 절차에 관한 연구들이 진행되고 있다. 하지만 IoT 기기는 상이한 규격으로 인해 실제 현장에서 사용될 수 없는 추상적인 방법론을 제시하는 연구가 대부분이다. 또한 펌웨어 분석 도구로 활발히 사용되는 binwalk 분석 도구는 ext4 파일 시스템에 대한 분석 및 추출을 제대로 수행하지 못하고 있다. 이에 본 논문에서는 이러한 문제점을 해결하기 위해 binwalk의 올바른 ext4 파일 시스템 추출 및 분석 방안을 제시하고 이를 이용해 IoT 기기의 플래시 메모리로부터 ext4 파일 시스템을 추출하는 절차를 제안한다. 또한, DJI Phantom 4 Pro V2.0 드론으로 PoC를 구현하여 제안하는 절차를 검증한다.

Review Paper on Introduction to Cyber Forensics

Abstract: Cyber Forensics is termed as scientific methods or applications in association with the judiciary or court of laws. The aim behind these methods is to unveil the digital evidence to be utilized in court for solving crime cases. This sort of technology wasn’t practiced before therefore most criminals tend to urge away with their criminal acts without valid proof to incriminate or prosecute them. During that time the oaths, confessions, testimonies from witnesses were the sole determining factors of evidence Crimes committed within electronic or digital domains, particularly within cyberspace, have become common. Criminals are using technology to commit their offenses and make new challenges for law enforcement agents, attorneys, judges, military, and security professionals. Digital forensics has become a vital instrument in identifying and solving computer-based and computerassisted crime. This paper provides a quick introduction to cyber forensics. During this paper we present a typical model for both Incident Response and Computer Forensics processes which mixes their advantages in an exceedingly flexible way: It allows for a management oriented approach in digital investigations while retaining the chance of a rigorous forensics investigation. Keywords: cyber forensics, digital forensic science, computer forensics, evidence, judicial system.

Finite state machine for cloud forensic readiness as a service (CFRaaS) events

AbstractThe importance of demonstrating the correctness of forensic analysis tools and automated incident management tools reinforces the need for a finite state machine (FSM) engine that can generate automated forensic processes. Hence, in this paper, we present an event‐based FSM representation for Cloud Forensic Readiness as a Service (CFRaaS), where we also show how the FSM's predetermined states and transitions could be used to formulate an automated forensic process and generate a hypothesis for litigation purposes. Specifically, this proposition comprises a two‐step level CFRaaS‐FSM with possible transitions and states. This representation is useful because it can alert digital forensic investigators on how to deduce current and next state of attacks based on transitions and current states.

Forensic conflict studies: Making sense of war in the social media age

Online media is a blessing and a curse for academic research on war. On the one hand, the internet provides unprecedented access to information from conflict zones. On the other hand, the prevalence of disinformation can make it difficult to use this information in a transparent way. This article proposes digital forensic process tracing as a methodological innovation to tackle this challenge and make case study research on the causes of war fit for the social media age. It argues that two important features of process-tracing methodology – source criticism and Bayesian updating – are well developed in theory but are rarely applied to the study of armed conflict. Digital forensic process tracing applies these features to online media sources by drawing on the journalistic practice of open source intelligence (OSINT) analysis. This article uses the case of the war in eastern Ukraine’s Donbas region to illustrate the usefulness of the proposed methodology.

Laboratory Forensics for Open Science Readiness: an Investigative Approach to Research Data Management

Recently, the topic of research data management has appeared at the forefront of Open Science as a prerequisite for preserving and disseminating research data efficiently. At the same time, scientific laboratories still rely upon digital files that are processed by experimenters to analyze and communicate laboratory results. In this study, we first apply a forensic process to investigate the information quality of digital evidence underlying published results. Furthermore, we use semiotics to describe the quality of information recovered from storage systems with laboratory forensics techniques. Next, we formulate laboratory analytics capabilities based on the results of the forensics analysis. Laboratory forensics and analytics form the basis of research data management. Finally, we propose a conceptual overview of open science readiness, which combines laboratory forensics techniques and laboratory analytics capabilities to help overcome research data management challenges in the near future.

Residue-Free Computing

Abstract Computer applications often leave traces or residues that enable forensic examiners to gain a detailed understanding of the actions a user performed on a computer. Such digital breadcrumbs are left by a large variety of applications, potentially (and indeed likely) unbeknownst to their users. This paper presents the concept of residue-free computing in which a user can operate any existing application installed on their computer in a mode that prevents trace data from being recorded to disk, thus frustrating the forensic process and enabling more privacy-preserving computing. In essence, residue-free computing provides an “incognito mode” for any application. We introduce our implementation of residue-free computing, ResidueFree, and motivate ResidueFree by inventorying the potentially sensitive and privacy-invasive residue left by popular applications. We demonstrate that ResidueFree allows users to operate these applications without leaving trace data, while incurring modest performance overheads.

Media Forensics Considerations on DeepFake Detection with Hand-Crafted Features.

DeepFake detection is a novel task for media forensics and is currently receiving a lot of research attention due to the threat these targeted video manipulations propose to the trust placed in video footage. The current trend in DeepFake detection is the application of neural networks to learn feature spaces that allow them to be distinguished from unmanipulated videos. In this paper, we discuss, with features hand-crafted by domain experts, an alternative to this trend. The main advantage that hand-crafted features have over learned features is their interpretability and the consequences this might have for plausibility validation for decisions made. Here, we discuss three sets of hand-crafted features and three different fusion strategies to implement DeepFake detection. Our tests on three pre-existing reference databases show detection performances that are under comparable test conditions (peak AUC > 0.95) to those of state-of-the-art methods using learned features. Furthermore, our approach shows a similar, if not better, generalization behavior than neural network-based methods in tests performed with different training and test sets. In addition to these pattern recognition considerations, first steps of a projection onto a data-centric examination approach for forensics process modeling are taken to increase the maturity of the present investigation.

HoneyNetCloud Investigation Model, A Preventive Process Model for IoT Forensics

With the pervasive usage of sensing systems and IoT things, the importance of security has increased. Attempts towards breaching IoT security systems by attackers are on upsurge. Many intrusions in embedded systems, sensing equipment and IoT things have occurred in the past. Though there are cyber security tools like Antivirus, Intrusion detection and prevention systems available for securing the digital devices and its networks. However, a forensic methodology to be followed for the analysis and investigation to detect origin cause of network incidents is lacking. This paper derives a comprehensive preventive cyber forensic process model with honeypots for the digital IoT investigation process which is formal, that can assist in the court of law in defining the reliability of the investigative process. One year data of various attacks to the IoT network has been recorded by the honeypots for this study. The newly derived model HIM has been validated using various methods and instead of converging on a particular aspect of investigation, it details the entire lifecycle of IoT forensic investigation. The model is targeted to address the forensic analysts’ requirements and the need of legal fraternity for a forensic model. The process model follows a preventive method which reduce further attacks on network.

Analysis of Conti Ransomware Attack on Computer Network with Live Forensic Method

Ransomware viruses have become a dangerous threat increasing rapidly in recent years. One of the variants is Conti ransomware that can spread infection and encrypt data simultaneously. Attacks become a severe threat and damage the system, namely by encrypting data on the victim's computer, spreading it to other computers on the same computer network, and demanding a ransom. The working principle of this Ransomware acts by utilizing Registry Query, which covers all forms of behavior in accessing, deleting, creating, manipulating data, and communicating with C2 (Command and Control) servers. This study analyzes the Conti virus attack through a network forensic process based on network behavior logs. The research process consists of three stages, the first stage is simulating attacks on the host computer, the second stage is carrying network forensics by using live forensics methods, and the third stage is analysing malware by using statistical and dynamic analysis. The results of this study provide forensic data and virus behavior when running on RAM and computer networks so that the data obtained makes it possible to identify ransomware traffic on the network and deal with zero-day, especially ransomware threats. It is possible to do so because the analysis is an initial step in generating virus signatures based on network indicators.

Seeing like a scientist: subjunctive forensics and shared ways of seeing in the Spanish forensic archive

For two decades, Spaniards have turned to forensic science as a mode of unearthing diverse forms of evidence that shed light on the mechanics of fascist repression that emerged during the Spanish Civil War and the dictatorship that followed it. Due to the lasting effects of Spain’s Amnesty Law, which prohibits defining Franco’s victims as victims of crime, these exhumation projects exist at the unruly boundaries of legal procedure. In the absence of courts equipped to manage the evidence exhumed and produced in these endeavors, photographs documenting the forensic process are not sequestered by the law. Instead, they are made to be seen. Drawing on what the author describes as subjunctive forensics, she analyzes the emergence of new bodies of knowledge —or what could be called the forensic archive— in order to understand how visual evidence that straddles the scientific and the political, particularly photography, is produced, circulated and safe-guarded in contemporary Spain. Drawing on ethnographic research and the experience of photographing mass grave exhumations, the author explores how shared forms of seeing are produced, acquired, and shared among the community of practice surrounding historical memory work. By focusing on how professional and skilled visions are constituted, the article argues that it is in the production, circulation, and display of forensic photography that Spaniards visualize an uncomfortable past while also imagining alternative political futures.

Estimation of Stature from Percutaneous Tibial Length amongst Nepalese Students in Nobel Medical College Teaching Hospital

Background: Estimation of stature is an integral part of forensic anthropology and identification process in dead bodies. Mutilated and skeletonized body parts, which are generally received during disasters and mass casualties, carries significant burden of identification for a forensic expert. This study is aimed at estimating stature from percutaneous tibial length.
 Material and Methods: A cross sectional study was conducted from February 2020 to February 2021 in Nobel Medical College Teaching Hospital. 350 Nepalese medical students, 183 males and167 females, who were between 18 – 30 years, were included in the study. Their height and percutaneous tibial length was measured. Simple regression analysis was done using SPSS software version 20 to obtain a correlation between two parameters.
 Results: The results showed a significant correlation between the stature and percutaneous tibial length in both sexes. The regression formulae derived for calculation of stature was 104.80 + 1.81 * percutaneous tibial length(cm) for male and 93.58 + 1.91 * percutaneous tibial length(cm) for female. All the measurements were higher in males than in females.
 Conclusion: The study revealed a significant correlation between stature and percutaneous tibial length for both sexes in Nepalese population. Hence stature can be estimated from tibial length in both sexes which can aid in identification process and anthropological studies in Nepal.

Cyberbullying Analysis on WhatsApp Messenger Using the National Institute of Justice (NIJ) Method

Social media is no stranger to today's digital era. Many people prefer to use social media because of its simplicity and safety, This is what makes social media more popular than other services. However, because of its convenience and security, social media, especially WhatsApp Messenger, are vulnerable to crime, one of the most common is cyberbullying. For this reason, a mobile forensic investigation is required to find evidence related to cyberbullying. In this study, the National Institute of Justice (NIJ) method was used to investigate the WhatsApp Messenger platform used for cyberbullying. The NIJ method has 5 (five) stages to carry out the forensic process, namely Preparing, Collection, Examination, Analysis, and Reporting. This study also uses 3 assistance from software, namely MOBILedit Forensic, DB Browser for SQLite, and Odin3. This research is expected to be able to help solve the problem of cyberbullying and other crimes found on social media, especially WhatsApp Messenger.

Reliability validation for file system interpretation

This paper examines current best practices for Digital Forensic (DF) tool and method validation in the context of file system interpretation for digital evidence. In order to meet the legal and scientific requirements in criminal procedures file system (FS) reverse engineering (RE) is a necessity. Currently, there is no standard procedure for reliability testing of FS RE. Ideal validation requirements exist, but they are on high-level and practical implementation is missing. In this paper we propose a formal reliability validation procedure for file system reverse engineering, documenting the forensic process, including the tools used, ensuring reliability and reproducibility of the method and the results. The procedure is based on legal and scientific criteria and tested against file system reverse engineering methods. It is applicable to all types of reverse engineering methods in digital forensics.

Illicit drug profiling practices in Finland: An exploratory study about end users’ perceptions

Illicit drug profiling (i.e. chemical and/or physical profiling) to compare and relate illicit drugs samples has been actively used in routine case work at the National Bureau of Investigation (NBI) in Finland. This preliminary and exploratory work reviews NBI’s illicit drug profiling practices. Particular emphasis is put on communication of forensic results and how the NBI has promoted the use of forensic data in an intelligence perspective by establishing a case coordination service. Moreover, our study evaluates the comprehension, integration and usefulness of illicit drug profiling from end users’ point of view by means of an online survey and face-to-face interviews. Findings are compared with theoretical aspects as described in literature. Results show that in the Finnish context illicit drug profiling is used and useful in the investigation and in court. From end users’ perspective, real practical relevance relies in its use as intelligence during the investigation. However, to be truly useful, illicit drug profiling results must be communicated promptly during the investigation, with sufficient clarity and interpreted correctly by end users. Factors influencing the integration of illicit drug profiling in the forensic process are addressed.

Cloud and Edge Computing-Based Computer Forensics: Challenges and Open Problems

In recent years, there has been a dramatic change in attitude towards computers and the use of computer resources in general. Cloud and Edge computing have emerged as the most widely used technologies, including fog computing and the Internet of Things (IoT). There are several benefits in exploiting Cloud and Edge computing paradigms, such as lower costs and higher efficiency. It provides data computation and storage where data are processed, enables better data control, faster understanding and actions, and continuous operation. However, though these benefits seem to be appealing, their effects on computer forensics are somewhat undesirable. The complexity of the Cloud and Edge environments and their key features present many technical challenges from multiple stakeholders. This paper seeks to establish an in-depth understanding of the impact of Cloud and Edge computing-based environmental factors. Software and hardware tools used in the digital forensic process, forensic methods for handling tampered sound files, hidden files, image files, or images with steganography, etc. The technical/legal challenges and the open design problems (such as distributed maintenance, multitasking and practicality) highlight the various challenges for the digital forensics process.

Analysis of Cloud Forensics : Review and Impact on Digital Forensics Aspects

Digital forensics is the science of finding evidence to digital crimes and attacks. Cloud Forensics is a part of Digital Forensics that watches over the crime that has taken place over the cloud and carries out an investigation on it. Cloud computing is an evolutionary technology based on a huge network, which spreads globally. Hence, Cloud Forensics is a part of Network Forensics, which in turn is a part of Digital Forensics. Cloud organizations along with the providers of cloud service and customers that uses cloud service, are still awaiting the establishment of an explicit forensic revolution. Without the much-needed forensic capability, they will not be able to safeguard the robustness of their system and suitability of their services that assist criminal and cybercrime investigations. In this paper, we review the forensic process, challenges in cloud forensics, and its impact on digital forensics.

A variable scale case-based reasoning method for evidence location in digital forensics

With the increasing usage of information technology on the criminal side, the digital forensic analysis, especially multimedia forensics, becomes an emerging technique for cybercrime investigators to improve examination efficiency. The study focuses on the digital triage problem for evidence location during the automatic forensic process. After defining the multi-scale knowledge base for storing digital forensic investigators’ prior knowledge, a variable scale case-based reasoning method (VSCBR) is proposed to support investigators predicting evidential areas. The variable-scale clustering algorithm based on the scale transformation strategy (VSC-STS) is also put forward, which could identify highly similar past cases containing candidate evidence in the case reuse and revise phase. A case study is established using a real 15.9 GB bidding case dataset, which contains both text bidding documents and image technical drawings. Numerical experimental results show that the validation of the proposed VSC-STS is significantly improved compared with the traditional single-scale clustering algorithm, and it is insensitive to the initial parameter threshold. Moreover, the proposed method VSCBR is able to help investigators locate suspicious rule-violating evidences in practice.

FEATURES OF THE QUALIFICATION AND FACT OF PROOF IN THE VIOLATION OF TRAFFIC RULES AND OPERATION OF VEHICLES USING ARTIFICIAL INTELLIGENCE SYSTEMS

The article addresses the problem of criminal liability for harm caused by the use of artificial intelligence in unmanned driving of a motor vehicle and related criminal, criminal procedure and forensic problems, it proposes the author's approaches to their solution. The purpose of the article is to establish the features of the qualification, fact of proof and forensic character of the offences in relation to traffic violations and the operation of vehicles in unmanned control using artificial intelligence. Methods: the author uses dialectical, formal methods, as well as specific scientific methods of criminal law, criminal procedure, administrative law, forensic theory in connection with the specificity of their sectoral content in violation of traffic rules and operation of vehicles using artificial intelligence systems. Results: It is substantiated that when collecting the evidence base on the fact of proof, the principal element of the nature of the crime, such as a method of committing a crime (unmanned driving), is central to the forensics process. The characteristics of the crime committed will determine the other elements of the crime (components).

A Comprehensive Study of Cloud Forensics

Cloud Computing has many facets to it which makes it diverse. Investigation of a cyber-crime that involves the cloud as a subject, object, or as an environment, is cloud forensics. Challenges in cloud forensics exist at every phase of digital forensics. To provide a holistic solution to overcome these challenges we must first understand the cloud forensics landscape (the Cloud). The elements which give the Cloud the diversity that it has, and have an impact on the forensics process of the cloud should be taken into consideration while designing the cloud forensics framework. In this paper, the researchers present a comprehensive survey of the research trend in cloud forensics. The paper also proposes a cloud forensics taxonomy based on the paradigms of cloud computing that have an impact on cloud forensics. Although forensics solution taxonomies have been proposed earlier, this paper aims at a taxonomy solution at a more generic level. The proposed taxonomy provides cloud forensics solution strategies for efficient cloud forensics.

A generalized approach to automotive forensics

In the past years, software became an essential topic in modern vehicles, e.g., with the rise of more and more complex driver assistance systems. The advent of automated driving will drive this trend even further. Today, accident investigation, as well as warranty claim analysis, need to take into consideration an analysis of the rapidly increasing proportion of software and security based implementations as part of modern vehicles, the so-called digital forensics. This paper evaluates the general feasibility of digital forensics on a state-of-the-art vehicle. To do so, we analyzed current digital forensics techniques on a state-of-the-art vehicle to constitute gaps in the automotive forensics process used on in-vehicle systems. We present a general process for automotive forensics to close existing gaps and implemented it on a state-of-the-art vehicle in an in-vehicle device manipulation scenario. The implementation uses the on-board diagnostics interface, the diagnostics over internet protocol, as well as the unified diagnostic services for communication. Our implementation requires automotive Ethernet at the diagnostic interface.Our research shows future directions for efficient automotive forensic as well as the exemplary feasibility of automotive forensic analysis on state-of-the-art vehicles without the need for additional in-vehicle components such as intrusion detection systems or event data recorders.