Forensic Framework Research Articles

Vision: An empirical framework for examiners to accessing password-protected resources for on-the-scene digital investigations

It is increasingly becoming difficult to acquire meaningful information in the field of digital forensics through the traditional approach owing to advances in information security and anti-forensics techniques. To counteract anonymous services such as data in remote areas without authentication information, data encryption, device locks, and cryptocurrencies, it is important to acquire key information through live forensics at search and seizure sites. Thus, it is necessary to establish a response system that explores and processes credential information on site and extracts meaningful information based on the processed information. To this end, this study proposes a new digital forensics framework for application at search and seizure sites. The proposed framework is designed to allow expansion in the form of additional functions on account of a module type development for the system even when new services and digital devices appear in the future. We then explain its applicability through case studies of actual digital investigations.

Benefits and outcomes of a new multidisciplinary approach for the management and financing of sudden unexplained death cases in a forensic setting in Switzerland

Sudden cardiac death (SCD) is an important public health issue. In young persons aged between 1 and 40 years, most SCDs are caused by potentially inherited cardiac diseases, often not detectable during conventional medico-legal investigations and therefore termed as sudden unexplained deaths (SUD). In this study, we describe the implementation, feasibility and importance of a standardized procedure to investigate SUD cases within the forensic framework at the Zurich Institute of Forensic Medicine in Switzerland. This new approach involves a multidisciplinary collaboration including forensic autopsy, second pathology expert opinion, post-mortem molecular genetic testing, cardiac counselling of relatives, and a tentative financing. This procedure is in line with the published Swiss and European recommendations on the management of SCDs. During a two-year pilot project, 39 sudden and unexpected death cases were collected, whereof 10 deceased remained without any identifiable cause of death after medico-legal investigation and second expert evaluation. Molecular autopsy, including 393 genes involved in cardio-vascular and metabolic diseases, identified eight pathogenic or likely pathogenic genetic variants in five out of the 10 deceased (50%). Cardio-genetic follow-up investigations in the families of the 10 deceased revealed phenotype-positive relatives in four families and required specific therapies, including an implantable cardioverter defibrillator (ICD) for primary prevention. Multidisciplinary collaboration is crucial for an optimal management of sudden unexplained death cases, to identify additional relatives at risk, and to prevent other tragic deaths within a family.

A new Intelligent Satellite Deep Learning Network Forensic framework for smart satellite networks

By combining the Internet of Things (IoT) and Artificial Intelligence (AI), new augmentations and enhancements are realized, resulting in environment-aware systems that can enable intelligent decision making, with one such example being smart satellite networks. However, smart satellite networks attract the attention of hackers, resulting in them being targeted by severe cyber-attacks that can compromise their integrity, affect their availability, or breach the confidentiality of the data they generate, collect or rout. Lately, several prominent cyber-attacking scenarios have been observed to target IoT-enabled systems, resulting in loss, alteration, or exfiltration of data, disabling of devices, (distributed) denial of services, the formation of botnets, and lateral movement into otherwise secured networks. In this paper, we propose a network forensic framework based on Deep Learning (DL), the so-called Intelligent Satellite Deep Learning Network Forensic (INSAT-DLNF), for the detection and tracing of cyber-attack activities targeting smart satellite networks. For this framework, we trained a Long Short-term Memory Recurrent Neural Network (LSTM-RNN) and Gated Recurrent Unit (GRU) and compared their performances to five supervised and two unsupervised Machine Learning (ML) algorithms. The experimental results indicate that ML and DL algorithms can be employed effectively for the discovery and tracing of cyber-attacks, resulting in more adaptive and resilient cyber-security solutions, compared to legacy forensic tools that cannot discover zero-day attack surfaces and vectors.

Implementation of ACPO Framework for Digital Evidence Acquisition in Smartphones

A forensic investigator or analyst should implement an appropriate digital forensic framework to acquire valid digital evidence to be presented at court. Choosing an unsuitable digital forensic framework with the investigation process may lead to failure at acquiring or maintaining complete digital evidence. Missing a step or turning a certain step into another irrelevant step may lead to unclear results and invalid conclusions. Digital evidence extracted from risky electronic evidence cannot be accepted by the court. Accordingly, a forensic investigator or forensic analyst should refer to a structuralized standard structure to perform well.Several internal digital forensic frameworks are available, one of which is the Good Practice Guide for Computer-based Electronic Evidence [1], an English issuance by ACPO (Association of Chief Police Officers) in cooperation with 7Safe. The digital forensic framework is commonly called the digital forensic framework from ACPO or the ACPO Framework. This research brings into focus the analysis of the percentage of success rate for using the ACPO digital forensic framework or the ACPO Framework in comparison with another digital forensic framework, i.e., NIST Framework. This research is also aimed at examining the performance of a mobile forensic tool, i.e., Cellebrite’s UFED Touch2 in comparison with another mobile forensic tool for digital evidence acquisition in smartphones.The research objects were smartphones containing deleted WhatsApp messages. This research successfully implemented the ACPO Framework for digital evidence acquisition in smartphones using Cellebrite’s UFED Touch2 as the mobile forensic tool.

Identification of forensic artifacts from the registry of windows 10 device in relation to idrive cloud storage usage

The accessibility of cloud storage over the internet as a result of cloud computing technology provides the opportunity to store, share and upload data online with the use of digital devices which can be accessed anytime and anywhere. These benefits can also be exploited by the cybercriminals to perform various criminal activities including storing and exchanging of illegal materials on cloud storage platforms. The logs of malicious usages can be obtained from the cloud service providers for forensic investigations but the privacy issue among other factors make it difficult for such logs to be shared. Therefore, there is a need to perform client-side forensics to be able to carry out forensic investigation on digital devices as related to the activities on cloud storage. This study identifies relevant artifacts that can be forensically extracted from the registry of a window 10 device that accessed iDrive cloud storage. The study explores different experimental setups for the forensic analysis and adopted an integrated conceptual digital forensic framework in the investigation process to detect relevant forensic artifacts from the registry of a windows 10 device. This study increases the knowledge of cloud storage forensics and the significance of registry analysis during digital investigations.

Membangun Framework Konseptual Terintegrasi Menggunakan Metode Composite Logic untuk Cloud Forensic Readiness pada Organisasi

In the Forensic Readiness approach, incident readiness is the goal of the company or organization in dealing with incidents that may occur. Forensic Readiness can consist of actions or steps, technical and non-technical, that supposedly maximize an organization's ability to use digital evidence. A well-built Cloud Forensic Readiness Framework can help speed up and simplify decision-making regarding an incident occurring in a cloud computing environment. This creates new opportunities for collaboration in the field of digital forensics and cloud computing or cloud computing, so that solutions can be studied and researched by analyzing various literature sources of cloud computing forensic readiness framework and building an integrated cloud forensic readiness framework on an institutional scale using the composite logic method. With the completeness of the readiness framework designed, it is a kind of research that is expected to ease decision making process for organizational stakeholders to handle incident responses.

Mobile Digital Forensics Framework to Increase Security Level of for Smartphone User

Mobile Digital Forensics Framework to Increase Security Level of for Smartphone User

Making Decision in Criminal Proceedings within a General Theory of Forensic Science in Romania

The judicial process of making decision in criminal cases is, generally speaking, increasingly analysed within a complex framework, one of these being harmonized with principles, and concepts organized along with the forensic activities of investigation. To this regard, the Romanian judicial activity in criminal cases is not away from these values of respecting standards in criminal proceedings. This situation is particularly viewed during the judgment phase of criminal proceedings at the stage of making decision. Taking into consideration all these aspects, the current paper is focused on the best practices of the activity of decision making in criminal cases in Romania, particular attention being paid to the forensic science and the way in which it influences the process of achieving decision in the framework of administering and assessing evidence based on forensic activity of investigation. An in-depth analysis of both the doctrine trends and the case-law presentation on the topic of decision making in criminal proceedings within the forensic framework in Romania will be presented, as well as the case-law remarks and comments of this topic. The idea of this paper was conducted by the fact that several criminal cases are usually solved by taking into account the involvement of forensic investigation records of gathering evidence which help judicial bodies in making decision in criminal proceedings.

Making Decision in Criminal Proceedings within a General Theory of Forensic Science in Romania

The judicial process of making decision in criminal cases is, generally speaking, increasingly analysed within a complex framework, one of these being harmonized with principles, and concepts organized along with the forensic activities of investigation. To this regard, the Romanian judicial activity in criminal cases is not away from these values of respecting standards in criminal proceedings. This situation is particularly viewed during the judgment phase of criminal proceedings at the stage of making decision. Taking into consideration all these aspects, the current paper is focused on the best practices of the activity of decision making in criminal cases in Romania, particular attention being paid to the forensic science and the way in which it influences the process of achieving decision in the framework of administering and assessing evidence based on forensic activity of investigation. An in-depth analysis of both the doctrine trends and the case-law presentation on the topic of decision making in criminal proceedings within the forensic framework in Romania will be presented, as well as the case-law remarks and comments of this topic. The idea of this paper was conducted by the fact that several criminal cases are usually solved by taking into account the involvement of forensic investigation records of gathering evidence which help judicial bodies in making decision in criminal proceedings.

Investigation Framework for Cloud Forensics using Dynamic Genetic-based Clustering

Cloud computing allows a pool of resources, such as storage, computation power, communication bandwidth, to be shared and accessed by many users from different locations. High dependency on sharing resources among different cloud users allows some attacker to hide and commit crimes using cloud resources and as a result, cloud computing forensics become essential. Many solutions and frameworks for cloud computing forensics have been developed to deal with could based crimes. However, many problems and issues face the proposed solutions and frameworks. In this paper, a new framework for cloud computing forensics is proposed to enhance the investigation process performance and accuracy by adding a new stage to conventional stages. This new stage includes the implementation of a new way for matching based on the LSH algorithm. The proposed framework evaluation results show an improvement for matching and accurate cluster retrieval through the collection process.

Email Analysis in Fraud Investigation: Digital Forensic and Network Analysis Approach

Email is an imperative method of communication that is changing the way people share their data and information. It provides effective and efficient communication, especially in business, convenience, and easy access and replication. Those electronic data should be considered by a fraud investigator to comprehend the investigation. Email can be divided into two parts: the head of the email and the email body. The head of the email is metadata that consists of unstructured data, and the body and its attachment consist of semi-structured data. The email data usually comes in large volumes and ranges of types. Therefore, a manual investigation of an email should be avoided. This paper uses the Design Science Research Methodology to discover the most profound framework in an email fraud investigation. Using email metadata and email body, this research performs a digital forensic framework: preparation, gathering, processing, and presentation, combines with social network analysis to be applicable in the investigation. The result shows that digital forensics process, network analysis, data visualization provides a more valuable and comprehensive insight into email analysis.

Revised forensic framework validation and cloud forensic readiness

Revised forensic framework validation and cloud forensic readiness

AutoProfile: Towards Automated Profile Generation for Memory Analysis

Despite a considerable number of approaches that have been proposed to protect computer systems, cyber-criminal activities are on the rise and forensic analysis of compromised machines and seized devices is becoming essential in computer security. This article focuses on memory forensics, a branch of digital forensics that extract artifacts from the volatile memory. In particular, this article looks at a key ingredient required by memory forensics frameworks: a precise model of the OS kernel under analysis, also known as profile . By using the information stored in the profile, memory forensics tools are able to bridge the semantic gap and interpret raw bytes to extract evidences from a memory dump. A big problem with profile-based solutions is that custom profiles must be created for each and every system under analysis. This is especially problematic for Linux systems, because profiles are not generic : they are strictly tied to a specific kernel version and to the configuration used to build the kernel. Failing to create a valid profile means that an analyst cannot unleash the true power of memory forensics and is limited to primitive carving strategies. For this reason, in this article we present a novel approach that combines source code and binary analysis techniques to automatically generate a profile from a memory dump, without relying on any non-public information. Our experiments show that this is a viable solution and that profiles reconstructed by our framework can be used to run many plugins, which are essential for a successful forensics investigation.

P2DF

The extensive use of digital devices by individuals generates a significant amount of private data which creates challenges for investigation agencies to protect suspects' privacy. Existing digital forensics models illustrate the steps and actions to be followed during an investigation, but most of them are inadequate to investigate a crime with all the processes in an integrated manner and do not protect suspect's privacy. In this paper, we propose the development of a privacy-preserving digital forensics (P2DF) framework, which facilitates investigation through maintaining confidentiality of the suspects through various privacy standards and policies. It includes an access control mechanism which allows only authorized investigators to access private data and identified digital evidences. It is also equipped with a digital evidence preservation mechanism which could be helpful for the court of law to ensure the authenticity, confidentiality, and reliability of the evidences, and to verify whether privacy of the suspect was preserved during the investigation process.

Forensic analysis for AI speaker with display Echo Show [formula omitted] generation as a case study

As the Internet of Things (IoT) era arrives, many Internet-connected devices are being released, and their use is increasing. One of these, the AI speaker, is designed to augment user convenience by using voice recognition. The best-known products are the Amazon Echo family, including Echo and Echo Dot and more recently, Echo Show with display. An AI speaker with display provides diverse functions such as surfing the Internet, taking pictures, making voice or video calls, and controlling smart home devices. To do this, Alexa cloud servers store a variety of configuration values and historical logs, and users can manage their own cloud-native data through interfaces (e.g., Web sites or mobile apps). For this reason, AI speakers with smart display are similar to PCs or smartphones, which can be very profitable from a digital forensic perspective. This paper focuses on detailed research on the second generation of Echo Show. The first step was to collect forensic artifacts stored inside the product by teardown, identifying eMMC flash memory chips and performing chip-off on Echo Show. Alexa app-related artifacts used on smartphones and how to automatically acquire data from the Alexa cloud were also investigated. From three sources including Echo Show, a companion client (smartphone), and the Alexa cloud, it was possible to acquire user credentials, traces of photos, records of watching videos, log files, and Internet histories with timestamp. The second step was to identify the possibility of inferring new information by correlating artifacts collected from different sources. Integrative analysis enables investigators to track suspect activity across digital devices. Third, this paper introduces an updated version of Cloud-based IoT Forensic Toolkit (CIFT) to support digital investigation of Echo Show. Based on the technical findings, this study proposes a digital forensic framework for a smart speaker with a display that can play an important role as a digital witness at a crime scene. Until now, there has been no multilevel approach to acquisition and analysis of Echo Show data in the field of digital forensics. Therefore, this study makes a contribution to the digital forensic community.

Ext4 and XFS File System Forensic Framework Based on TSK

Recently, the number of Internet of Things (IoT) devices, such as artificial intelligence (AI) speakers and smartwatches, using a Linux-based file system has increased. Moreover, these devices are connected to the Internet and generate vast amounts of data. To efficiently manage these generated data and improve the processing speed, the function is improved by updating the file system version or using new file systems, such as an Extended File System (XFS), B-tree file system (Btrfs), or Flash-Friendly File System (F2FS). However, in the process of updating the existing file system, the metadata structure may be changed or the analysis of the newly released file system may be insufficient, making it impossible for existing commercial tools to extract and restore deleted files. In an actual forensic investigation, when deleted files become unrecoverable, important clues may be missed, making it difficult to identify the culprit. Accordingly, a framework for extracting and recovering files based on The Sleuth Kit (TSK) is proposed by deriving the metadata changed in Ext4 file system journal checksum v3 and XFS file system v5. Thereafter, by comparing the accuracy and recovery rate of the proposed framework with existing commercial tools using the experimental dataset, we conclude that sustained research on file systems should be conducted from the perspective of forensics.

Analysis of Challenges in Modern Network Forensic Framework

Network forensics can be an expansion associated with network security design which typically emphasizes avoidance and detection of community assaults. It covers the necessity for dedicated investigative abilities. When you look at the design, this indeed currently allows investigating harmful behavior in communities. It will help organizations to examine external and community this is undoubtedly around. It is also important for police force investigations. Network forensic techniques can be used to identify the source of the intrusion and the intruder’s location. Forensics can resolve many cybercrime cases using the methods of network forensics. These methods can extract intruder’s information, the nature of the intrusion, and how it can be prevented in the future. These techniques can also be used to avoid attacks in near future. Modern network forensic techniques face several challenges that must be resolved to improve the forensic methods. Some of the key challenges include high storage speed, the requirement of ample storage space, data integrity, data privacy, access to IP address, and location of data extraction. The details concerning these challenges are provided with potential solutions to these challenges. In general, the network forensic tools and techniques cannot be improved without addressing these challenges of the forensic network. This paper proposed a thematic taxonomy of classifications of network forensic techniques based on extensive. The classification has been carried out based on the target datasets and implementation techniques while performing forensic investigations. For this purpose, qualitative methods have been used to develop thematic taxonomy. The distinct objectives of this study include accessibility to the network infrastructure and artifacts and collection of evidence against the intruder using network forensic techniques to communicate the information related to network attacks with minimum false-negative results. It will help organizations to investigate external and internal causes of network security attacks.

Modern macOS userland runtime analysis

The continued rise of Apple's macOS in both the home and workplace has led to a significant rise in the capabilities of both malware and attacker toolkits that target the operating system and its users. Over the last several years there have been numerous documented instances of macOS users being targeted by governments, intelligence agencies, and criminal groups, and the end results of these attacks were the victims having highly sophisticated malware installed on their systems. Unfortunately, the rise of these threats has not been met with an equal research and development effort by the memory forensics community. This has led to a gap in automated analysis in memory forensic frameworks and has left inexperienced investigators with little chance of detecting the malware's presence. Even for experienced investigators, detection was still difficult in many circumstances and require significant manual investigation for a chance at success. This paper documents our research effort to close this gap through the development of novel memory forensic capabilities aimed at detecting advanced, real-world malware that targets macOS systems. This research was driven through analysis of numerous malware samples that were used as part of espionage and criminal attack campaigns, and the end result was three new Volatility plugins that automate the detection of such malware. By leveraging these plugins, investigators of all skill levels can detect macOS userland malware in an automated, scalable, and flexible manner.

Seance: Divination of tool-breaking changes in forensically important binaries

The value of memory analysis during digital forensics, incident response, and malware investigations has been realized for over a decade. The power of memory forensics is based on the fact that volatile memory contains a substantial number of artifacts that are simply never recorded to disk or sent across the network in plaintext form. Orderly recovery of this data, known as structured analysis, allows for recovery of the full system state at the time of acquisition. For structured analysis to be successful, a memory analysis framework must have an accurate model of the data structures and algorithms of the target operating system and applications. Unfortunately, acquiring this layout is often a difficult task for even one version of an executable module, and the problem is only compounded when support for a wide variety of versions is desired. This issue can be manifested in several ways, including forensics frameworks being unable to process memory samples containing unsupported versions of executable code or worse, generating erroneous or incomplete results. Given the vital role memory analysis plays in modern investigations, these issues are unacceptable. In this paper, we present Seance, a system that implements automated binary analysis to provide accurate data structure layout information for different versions of targeted executed modules. The results of Seance can be consumed by analysis frameworks to accurately support all versions of a target module.

Stature Estimation from Dry Bone and Radiographic Clavicular Measurements in A Thai Population

Stature is one of the main biological features which can be used to classify unidentified skeletal deceased. Also, precise population data is crucial for forensic anthropology frameworks. Nonetheless, the studies concerning this subject in Thailand are limited and regularly focus on long bones. This study attempts to establish stature estimation equations from clavicular dry bone and radiographic measurements. Both sides of the clavicular bones are separated from 25 female and 112 male deceased in an autopsy room situated in Bangkok, Thailand. Twelve variables of each side of the clavicle are measured. The study outcomes show that stature can be estimated by applying 3 variables in a stepwise regression analysis model in unidentified sex remains, with R2 = 0.49 and standard error of estimation (SEE) 5.238 cm. Moreover, the height of the sternal end of clavicle bones can be used to estimate stature in cases of fragmented clavicles recovered from crime scenes with R2 = 0.238 and SEE 6.353 cm. Maximum length shows the best correlation and model fit with stature (R = 0.562, R2 = 0.316 and SEE 6.020 cm) from radiographic measurements. Therefore, this study presents a complementary, beneficial method for forensic anthropologists to create biological profiles of unidentified skeletal remains in cases where the long bones are not obtainable. Moreover, stature estimation from radiographic measurements can be applied in cases of partial skeletonisation.