Forensic Framework Research Articles

Development of Digital Forensic Framework for Anti-Forensic and Profiling Using Open Source Intelligence in Cyber Crime Investigation

Abstract. Cybercrime is a crime that increases every year. The development of cyber crime occurs by utilizing mobile devices such as smartphones. So it is necessary to have a scientific discipline that studies and handles cybercrime activities. Digital forensics is one of the disciplines that can be utilized in dealing with cyber crimes. One branch of digital forensic science is mobile forensics which studies forensic processes on mobile devices. However, in its development, cybercriminals also apply various techniques used to thwart the forensic investigation process. The technique used is called anti-forensics. Purpose: It is necessary to have a process or framework that can be used as a reference in handling cybercrime cases in the forensic process. This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. Methods/Study design/approach: This research will modify the digital forensic investigation process. The stages of digital forensic investigations carried out consist of preparation, preservation, acquisition, examination, analysis, reporting, and presentation stages. The addition of the use of Open Source Intelligence (OSINT) and toolset centralization at the analysis stage is carried out to handle anti-forensics and add information from digital evidence that has been obtained in the previous stage. By testing the scenario data, the results are obtained in the form of processing additional information from the files obtained and information related to user names. Result/Findings: The result is a digital forensic phase which concern on anti-forensic identification on media files and utilizing OSINT to perform crime suspect profiling based on the evidence collected in digital forensic investigation phase. Novelty/Originality/Value: Found 3 new types of findings in the form of string data, one of which is a link, and 7 new types in the form of usernames which were not found in the use of digital forensic tools. From a total of 408 initial data and new findings with a total of 10 findings, the percentage of findings increased by 2.45%.

Blockchain Forensics: A Systematic Literature Review of Techniques, Applications, Challenges, and Future Directions

Blockchain technology has gained significant attention in recent years for its potential to revolutionize various sectors, including finance, supply chain management, and digital forensics. While blockchain’s decentralization enhances security, it complicates the identification and tracking of illegal activities, making it challenging to link blockchain addresses to real-world identities. Also, although immutability protects against tampering, it introduces challenges for forensic investigations as it prevents the modification or deletion of evidence, even if it is fraudulent. Hence, this paper provides a systematic literature review and examination of state-of-the-art studies in blockchain forensics to offer a comprehensive understanding of the topic. This paper provides a comprehensive investigation of the fundamental principles of blockchain forensics, exploring various techniques and applications for conducting digital forensic investigations in blockchain. Based on the selected search strategy, 46 articles (out of 672) were chosen for closer examination. The contributions of these articles were discussed and summarized, highlighting their strengths and limitations. This paper examines the selected papers to identify diverse digital forensic frameworks and methodologies used in blockchain forensics, as well as how blockchain-based forensic solutions have enhanced forensic investigations. In addition, this paper discusses the common applications of blockchain-based forensic frameworks and examines the associated legal and regulatory challenges encountered in conducting a forensic investigation within blockchain systems. Open issues and future research directions of blockchain forensics were also discussed. This paper provides significant value for researchers, digital forensic practitioners, and investigators by providing a comprehensive and up-to-date review of existing research and identifying key challenges and opportunities related to blockchain forensics.

Pathogen Prevalence in Cetaceans Stranded along the Italian Coastline between 2015 and 2020.

The monitoring of stranded marine mammals represents a strategic method to assess their health, conservation status, and ecological role in the marine ecosystem. Networks worldwide track stranding events for the passive monitoring of mortality patterns, emerging and reemerging pathogens, climate change, and environmental degradation from a One Health perspective. This study summarizes pathogen prevalence data from the Italian Stranding Network (ISN) derived from post-mortem investigations on cetaceans found dead stranded along the Italian coastline between 2015 and 2020. The decomposition of the carcasses and logistics limited the post-mortem examination to 585 individuals, out of 1236 single-stranding reports. The most relevant pathogens identified were Cetacean Morbillivirus, Herpesvirus, Brucella spp., and Toxoplasma gondii, whose roles as environmental stressors are well known, despite their real impact still needing to be investigated in depth. Statistical analysis showed that age and sex seem to be positively related to the presence of pathogens. This study represents the first step in harmonizing post-mortem investigations, which is crucial for evidence-based conservation efforts. Implementing diagnostic and forensic frameworks could offer an indirect insight into the systematic monitoring of diseases to improve the identification of regional and temporal hotspots in which to target specific mitigation, management, and conservation strategies.

Enhanced Readiness Forensic Framework for the Complexity of Internet of Things (IoT) Investigation Based on Artificial Intelligence

Enhanced Readiness Forensic Framework for the Complexity of Internet of Things (IoT) Investigation Based on Artificial Intelligence

Advanced Volatile Memory Forensics through Autopsy Integration

The main goal of this study is to design a novel plugin for the Autopsy forensic framework to enable forensic analysts to identify and extract volatile memory from small-scale digital devices. This includes network peripherals and Internet of Things devices, smartphones, and industrial-control systems. Given the importance of volatile memory to digital crime and cybersecurity investigations, an accurate and reliable tool is needed to non-destructively acquire forensic copies of the evidence. In the context of small-scale devices, this study is of acute importance to bridge the gap that exists in current forensic research and forensic practice, using separate tools can be challenging due to compatibility issues and the complexity of managing multiple system. In conclusion, the developed Autopsy plugin, which has been termed the MemoryIntegrator, seamlessly harmonizes with Autopsy forensic framework and is designed to work together with Volatility tool, specializing in detailed memory analysis. Consequently, the following main outcomes result from the experimentation and application of the plugin: Promotes the default forensic activity of Autopsy by providing the analysts with a way to swiftly and directly harvest and evaluate volatile data from diverse small scale digital devices. The implementation of the plugin ensures that the integrity of the memory data is maintained throughout the extraction and analysis process. This is facilitated by cryptographic hash validations that confirm that there are no changes in the data from the extraction to the point of analysis. The plugin maintains the integrity of the memory data from the time of extraction to the time of analysis using cryptographic hash validations which verifies that these data has not been manipulated at this point. MemoryIntegrator outmatched all the forensic tools herewith because conducting forensic test back at home verified its superiority in terms of the extraction of data from memory speed and the authenticity and formula which it uses in analysis. In the modern world, this is critical to investigate digital crimes and incidences that affect cybersecurity.

A Cloud Forensics Framework to Identify, Gather, and Analyze Cloud Computing Incidents

A Cloud Forensics Framework to Identify, Gather, and Analyze Cloud Computing Incidents

Advancing Digital Forensic through Machine Learning: An Integrated Framework for Fraud Investigation

The rise of cybercrime and cyber-related crime encourages efficient digital forensic investigations more crucial than ever before. Traditional investigation methods can be time-consuming, costly, and resource-intensive, while machine learning algorithms have the potential to reduce the complexity by promoting automation and investigation capabilities. This study begins with an analysis of digital forensics framework using a document analysis methodology. Moreover, exploring current practice and potential implementation of machine learning in digital forensics for fraud investigation is demonstrated through the features of Autopsy 4.15.0, a widely known digital forensics tool. The findings suggest the implementation of a comprehensive digital forensic framework that prioritizes the interpretation phase, with the support of machine learning capabilities. At present, machine learning mainly supports the analysis phase, which happens to be the most time-intensive process of digital forensic investigations. Furthermore, as fraud investigation has a role of fraud detection and prevention, current digital forensics procedures do not support the fraud detection and prevention process, despite the potential for machine learning to support this through pattern recognition.These discoveries are particularly significant in the fight against fraudulent activities, such as tax fraud, data fraud, financial fraud, and asset misappropriation, in the digital age.

Mobile Device Forensics Framework: A Toolbox to Support and Enhance This Process

Cybercrime is growing rapidly, and it is increasingly important to use advanced tools to combat it and support investigations. One of the battlefronts is the forensic investigation of mobile devices to analyze their misuse and recover information. Mobile devices present numerous challenges, including a rapidly changing environment, increasing diversity, and integration with the cloud/IoT. Therefore, it is essential to have a secure and reliable toolbox that allows an investigator to thwart, discover, and solve all problems related to mobile forensics while deciphering investigations, whether criminal, civil, corporate, or other. In this work, we propose an original and innovative instantiation of a structure in a forensic toolbox for mobile devices, corresponding to a set of different applications, methods, and best practice information aimed at improving and perfecting the investigative process of a digital investigator. To ensure scientific support for the construction of the toolbox, the Design Science Research (DSR) methodology was applied, which seeks to create new and unique artifacts, drawing on the strength and knowledge of science and context. The toolbox will help the forensic investigator overcome some of the challenges related to mobile devices, namely the lack of guidance, documentation, knowledge, and the ability to keep up with the fast-paced environment that characterizes the mobile industry and market. Doi: 10.28991/ESJ-2024-08-03-011 Full Text: PDF

Cascaded Adaptive Graph Representation Learning for Image Copy-Move Forgery Detection

In the realm of image security, there has been a burgeoning interest in harnessing deep learning techniques for the detection of digital image copy-move forgeries, resulting in promising outcomes. The generation process of such forgeries results in a distinctive topological structure among patches, and collaborative modeling based on these underlying topologies proves instrumental in enhancing the discrimination of ambiguous pixels. Despite the attention received, existing deep learning models predominantly rely on convolutional neural networks (CNNs), falling short in adequately capturing correlations among distant patches. This limitation impedes the seamless propagation of information and collaborative learning across related patches. To address this gap, our work introduces an innovative framework for image copy-move forensics rooted in graph representation learning. Initially, we introduce an adaptive graph learning approach to foster collaboration among related patches, dynamically learning the inherent topology of patches. The devised approach excels in promoting efficient information flow among related patches, encompassing both short-range and long-range correlations. Additionally, we formulate a cascaded graph learning framework, progressively refining patch representations and disseminating information to broader correlated patches based on their updated topologies. Finally, we propose a hierarchical cross-attention mechanism facilitating the exchange of information between the cascaded graph learning branch and a dedicated forgery detection branch. This equips our method with the capability to jointly grasp the homology of copy-move correspondences and identify inconsistencies between the target region and the background. Comprehensive experimental results validate the superiority of our proposed scheme, providing a robust solution to security challenges posed by digital image manipulations.

VolMemDroid—Investigating android malware insights with volatile memory artifacts

Android based smartphones have become a top target for malware writers due to their widespread use. A number of malicious applications are present on play stores and downloaded on daily basis, posing a significant threat to users’ personal and business data. As a result, the design of malware analysis frameworks is crucial in protecting the growing number of users who rely on their smart phones for routine and business tasks. The traditional signature based schemes for malware detection are unable to handle new and sophisticated malware. Furthermore, generic solutions based on static analysis schemes become less effective in the presence of obfuscated malware. In this study, a dynamic analysis based framework, VolMemDroid, for detecting malicious applications for Android is proposed. The framework extracts the volatile memory artifacts for profiling malicious Android applications. For this purpose, the memory forensic framework of volatility is utilized. A number of volatility plugins are analyzed for their compatibility w.r.t the Android platform and their ability in modeling the application’s behavior. After testing a number of plugins, chosen plugins are further processed for extraction of features. A comprehensive feature set for Android malware detection and categorization is proposed. It has been found that the suggested framework is effective for detecting Android malicious applications with an F1-score of 0.972, which is better than existing volatile memory based approaches for Android malware detection. The framework is also found to be effective in categorizing malicious Android applications into four distinct classes.

1D-CNN-based audio tampering detection using ENF signals

The extensive adoption of digital audio recording has revolutionized its application in digital forensics, particularly in civil litigation and criminal prosecution. Electric network frequency (ENF) has emerged as a reliable technique in the field of audio forensics. However, the absence of comprehensive ENF reference datasets limits current ENF-based methods. To address this, this study introduces ATD, a blind audio forensics framework based on a one-dimensional convolutional neural network (1D-CNN) model. ATD can identify phase mutations and waveform discontinuities within the tampered ENF signal, without relying on an ENF reference database. To enhance feature extraction, the framework incorporates characteristics of the fundamental harmonics of ENF signals. In addition, a denoising method termed ENF noise reduction (ENR) based on the variational mode decomposition (VMD) and robust filtering algorithm (RFA) is proposed to reduce the impact of external noise on embedded electric network frequency signals. This study investigates three distinct types of audio tampering—deletion, insertion, and replacement—culminating in the design of binary-class tampering detection scenarios and four-class tampering detection scenarios tailored to these tampering types. ATD achieves a tampering detection accuracy of over 93% in the four-class scenario and exceeds 96% in the binary-class scenario. The effectiveness, efficiency, adaptability, and robustness of ATD in the two and four classification scenarios have been confirmed by extensive experiments.

Wet SPF: A wet powder suspension for the detection of latent fingermarks on the sticky side of adhesive tape for use in Seychelles

WET UCIO is an inexpensive carbon-based powder suspension, reportedly as effective as commercially available formulations for latent fingermark detection on the sticky side of adhesive tapes. However, the surfactant solution used in WET UCIO is not readily accessible outside Europe, limiting its use in Seychelles or other non-European jurisdictions. In this study, the UCIO formulation was modified based on a ‘frugal forensic’ approach, by replacing the surfactant solution with an in-house sodium dodecyl sulfate solution prepared in 5 % aqueous ethanol. A comparative assessment against Wetwop™ using eight different pressure-sensitive adhesive tapes found that the modified formulation was at least as effective as commercial powder suspension. Modifying this technique under the frugal forensic framework has enhanced its accessibility to other jurisdictions and is recommended for validation in Seychelles.

Proactive Analysis and Detection of Cyber-attacks using Deep Learning Techniques

Objectives: This study objective is to create a proactive forensic framework with a classification model to identify the malicious content to avoid cyber-attacks. Methods: In this proposed work, a novel framework is introduced to analyze and detect network attacks before it happens. It monitors the network packet flow, captures the packets, analyzes the packet flow proactively, and detects cyber-attacks using different machine learning algorithms and Deep Convolution Neural network (CNN) technique. The KDD dataset is used in this experiment with 30% for testing and 80% for training. Findings: The simulation results show that the detection percentage of the proposed framework reaches a maximum of 95.92% in different scenarios. It is approximately 10% higher than the existing proactive frameworks for example Gawand’s model, Ahmetoglu’s model and many more. Novelty and applications: The proposed framework is a proactive model which detects the cyber-attack in prior to avoid cyber-attacks. The deep CNN model highly efficient for detecting cyber-attack. Keywords: Proactive Forensic Framework, Deep CNN, Classification Algorithms, Cyber attack detection, Intrusion Detection System

Designing an automated, privacy preserving, and efficient Digital Forensic Framework

<p class="MDPI18keywords">The digital forensic investigation field faces continual challenges due to rapid technological advancements, the widespread use of digital devices, and the exponential growth in stored data. Protecting data privacy has emerged as a critical concern, particularly as traditional forensic techniques grant investigators unrestricted access to potentially sensitive data. While existing research addresses either investigative effectiveness or data privacy, a comprehensive solution that balances both aspects remains elusive. This study introduces a novel digital forensic framework that employs case information, case profiles, and expert knowledge to automate analysis. Machine learning techniques are utilized to identify relevant evidence while prioritizing data privacy. The framework also enhances validation procedures, fostering transparency, and incorporates secure logging mechanisms for increased accountability.</p>

An MSDCNN-LSTM framework for video frame deletion forensics

An MSDCNN-LSTM framework for video frame deletion forensics

ECC Based Encryption for the Secured Proactive Network Forensic Framework

ECC Based Encryption for the Secured Proactive Network Forensic Framework

A forensic framework to improve digital image evidence administration in IIoT✰

The extensive growth of Industrial Internet of Things (IIoT) has prompted cyber attackers to commence a variety of attacks which need to be identified to maintain the security of industrial data and services. Digital forensics is an extravagant need to detect cyber attacks and to identify cybercriminals. While conducting criminal investigation using digital forensics, there is high probability of leakage of collected digital evidence. Hence, the need for a secure and lightweight cryptosystem arises to protect it from cyber-attacks. In the present paper, authors aim to design a novel forensic framework for digital evidence administration using advanced encryption and preservation mechanisms. Authors focus to encrypt and preserve only digital image evidence but can be deployed on other types of multimedia data like video frames. Three types of Chaos-map algorithms namely 4D hyperchaotic map, 2D Arnold Cat map (ACM) and Henon Map have been utilized to encrypty and decrypt digital image evidence which enable high sensitivity and dependency on initial conditions, quasi-randomness, and ergodicity to digital content. The proposed approaches have been analyzed on different groups of images of different size and validated using various security parameters such as unified average changing intensity (UACI), correlation coefficient, and the number of pixels changing rate (NPCR). Image transformation and compression has been performed after encryption process using Fast Fourier Transformation (FFT). The proposed work has been analyzed using histogram and auto-correlation. Experimentations have provided the values of the correlation coefficient of plain images near 1 and the value of adjacent cipher images near zero which show a strong correlation. The evaluated results for UACI are more than 33 % for every considered images. The value for NPCR should be near 100 % and here the calculated results for each image are above 99 %. The complexity of the proposed encryption algorithm is O(n) due to key generation using a cryptographically secure pseudo-random number generator (CSPRNG). The compressed and transformed image evidence have been stored into decentralized blockchain to ensure the integrity and confidentiality. Decentralized blockchain has been used as a reliable and promising solution to preserve digital evidence due to its distinct features like secure peer to peer communication, improved trust and transparency among participants, integrity, confidentiality, immutability, without risk of single point-of-failure. The proposed digital forensic model is able to prevent various threats and security challenges which can contaminate or tamper off digital pieces of evidence and assures improved digital evidence administration and defensibility. In the proposed scheme, the encryption process takes only 2–3 s to perform the encryption of each size of image.

Design and development of software quality forensics framework and model

The illicit activist tampers the software for malcious purposes. The process of forensics examining and gathering evidence for software accused in forensic laboratories presents challenges in terms of software quality. Therefore, it is crucial to design and develop a framework, model, and dedicated standards for the forensic analysis of software quality. These resources can be employed for investigations, legal proceedings, as well as establishing criteria and standards for both past and present scenarios. The aim of the research work is to design a software-quality forensics framework for forensic investigation to the quality of software. The research primarily concentrates on developing a model for software quality assessment and identifying the pertinent existing standards through the conceptual framework of software quality forensics. The implementation of software quality forensics has improved the efficiency and effectiveness in investigating and managing incidents related to software quality. The proposed framework for software quality forensics allows for the evaluation and assessment of quality issues within specific software systems. To complement the software quality forensic framework, a comparative analysis has been conducted between existing software quality models and the proposed software quality forensic model.

An Enhanced STFT Segmentation Framework for ENF-based Media Forensics

An Enhanced STFT Segmentation Framework for ENF-based Media Forensics

To Study the Unique Characteristics of Cut Mark on Clothes with a Suspected Knife on the Basis of Microscopic Examination (Optical Comparator): A Case Report

Forensic physics plays a crucial role in cut mark examination, particularly in the analysis of tool marks, including those created by sharp objects like knives or other cutting instruments. The examination of cut marks involves the application of various principles and techniques from physics to understand the nature, characteristics, and potential source of the marks. In the State of Meghalaya, a numbers of cases are received to determine whether the cut marks on clothes are caused or cut by the suspected sharp object. This is predominantly occurring due to conflicts among individuals or groups often involving the use of hard objects or sharp weapons. The prevalence of such cases necessitates a closer examination of cut marks on clothing items as crucial forensic evidence. However, due to improper collection, preservation and packaging of exhibits has cause a potential hinder for the Forensic Expert's ability to provide a conclusive opinion. This study sheds light on the frequent occurrence of cases wherein cut marks on clothing serve as pivotal forensic evidence. Through a systematic scientific approach, this paper elucidates the significance of identifying and interpreting such distinctive features in forensic investigation. This study endeavours to empower forensic experts, enabling them to provide more reliable and insightful conclusions in cases involving cut mark examinations. The proposed improvements not only strengthen the forensic framework but also contribute to the effective resolution of cases involving attempted harm in this region.