Forensic Tools Research Articles

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Mobile Forensic Tools for Digital Crime Investigation: Comparison and Evaluation

Sharpening Your Tools

This article presents our experience updating the high-performance Digital forensics tool BE (bulk_extractor) a decade after its initial release. Between 2018 and 2022, we updated the program from C++98 to C++17. We also performed a complete code refactoring and adopted a unit test framework. DF tools must be frequently updated to keep up with changes in the ways they are used. A description of updates to the bulk_extractor tool serves as an example of what can and should be done.

Novel Convolutional Neural Networks based Jaya algorithm Approach for Accurate Deepfake Video Detection

Deepfake videos are becoming an increasing concern due to their potential to spread misinformation and cause harm. In this paper, we propose a novel approach for accurately detecting deepfake videos using the combination of Convolutional Neural Networks (CNNs) with the Jaya algorithm optimization. The approach is evaluated on two publicly available datasets, the DeepFake Detection Challenge (DFDC) dataset and the Celeb-DF dataset, and achieves state-of-the-art performance on both datasets. Our approach achieves an accuracy of 99.3% on the DFDC dataset and 97.6% on the Celeb-DF dataset, with high F1 scores indicating a high precision and recall for detecting deepfake videos. Furthermore, our approach is more robust against adversarial attacks than existing state-of-the-art methods. The combination of CNNs with the Jaya algorithm optimization enables effective capture of the temporal information in the video sequence, while the use of robust evaluation metrics ensures objective measurement and comparison with existing methods. Our proposed approach offers a highly effective solution for detecting deepfake videos, which has the potential to be a valuable tool for media forensics, content moderation, and cyber security.

НЕКОТОРЫЕ КРИМИНАЛИСТИЧЕСКИЕ ОСОБЕННОСТИ РАССЛЕДОВАНИЯ ПРЕСТУПЛЕНИЙ, СВЯЗАННЫХ С НЕЗАКОННОЙ ДОБЫЧЕЙ (ВЫЛОВОМ) ВОДНЫХ БИОЛОГИЧЕСКИХ РЕСУРСОВ

In the article, the authors highlight the forensic features of the preliminary investigation in cases of illegal fishing of aquatic biological resources. The authors draw attention to the problematic aspects of conducting such an investigative action as an inspection of the scene. The article emphasizes the importance of using the situational modeling method, and deduces three main types of typical investigative situations. The authors note the importance of using new forensic tools in the activities of law enforcement agencies.

Poaching Forensics: Animal Victims in the Courtroom.

Poaching and the international trade in wildlife are escalating problems driven by poverty and greed and coordinated by increasingly sophisticated criminal networks. Biodiversity loss, caused by habitat change, is exacerbated by poaching, and species globally are facing extinction. Forensic evidence underpins human and animal criminal investigations and is critical in criminal prosecution and conviction. The application of forensic tools, particularly forensic genetics, to animal case work continues to advance, providing the systems to confront the challenges of wildlife investigations. This article discusses some of these tools, their development, and implementations, as well as recent advances. Examples of cases are provided in which forensic evidence played a key role in obtaining convictions, thus laying the foundation for the future application of techniques to disrupt the criminal networks and safeguard biodiversity through species protection.

Comparison of Forensic Tool Results on Android Smartphone Backup Files Using NIST Method

Smartphone technology currently developing not only has a positive impact but can also have a negative impact if it is used to commit crimes which can be called cybercrime. Choosing the right forensic tools is very important when conducting an investigation. So it is necessary to research the results of the comparative analysis of the performance of forensic tools on android smartphone backup files. The National Institute of Standards and Technology (NIST) method was used in this study as a parameter and for the digital evidence obtained. The results of the extraction of the OPPO A37f android smartphone from the MOBILedit tools acquired android backup files and the analysis results from using the Magnet AXIOM tools with a data accuracy rate of 39.3% from the predetermined variables. The Oxygen Forensic Tools obtained a data accuracy rate of 28.6% from the variable that has been determined. The Belkasoft Evidence Center tools can get a data accuracy rate of 35.7% of the predetermined variables. The results of this study can be concluded that the Magnet Axiom tool has a high level of accuracy compared to the Oxygen Forensic and Belkasoft Evidence Center tools in extracting data from android smartphone backup files.

We are meeting on Microsoft Teams: Forensic analysis in Windows, Android, and iOS operating systems

Microsoft released a new communication platform, Microsoft Teams, in 2017. Due in part to COVID-19, the popularity of communication platforms, like Microsoft Teams, increased exponentially. Given its user base and increased popularity, it seems likely that digital forensic investigators will encounter cases where Microsoft Teams is a relevant component. However, because Microsoft Teams is a relatively new application, there is limited forensic research on the application particularly focusing on mobile operating systems. To address this gap, an analysis of data stored at rest by Microsoft Teams was conducted on the Windows 10 operating system as well as on Android and Apple iOS mobile operating systems. Basic functionalities, such as messaging, sharing files, participating in video conferences, and other functionalities that Teams provides, were performed in an isolated testing environment. Cellebrite UFED Physical Analyzer and Magnet AXIOM Examine tools were used to analyze the mobile devices and the Windows device, respectively. Manual or non-automated investigation recovered, at least partially, the majority of artifacts across all three operating systems. In this study, a total of 77.6% of the populated artifacts were partially or fully recovered in the manual investigation. On the other hand, forensic tools used did not automatically recover many of the artifacts found with the manual investigation. Only 13.8% of artifacts were partially or fully recovered by the forensic tools across all three devices. These discovered artifacts and the results of the investigations are presented in order to aid digital forensic investigations.

The cloud forensics frameworks and tools: A brief review

A Cloud is a platform that allows for quick application deployment and dynamic scaling. The cloud differs from on-premise software and data storage in terms of cost, security, scalability, recovery, and mobility which makes more businesses are switching from on-premise to cloud solutions every year. Although cloud computing models have several benefits over on-site models, they are nonetheless vulnerable to both internal and external threats. Even malicious operations can be carried out on the cloud with ease because of the flexible environment. Forensic investigations require the extraction of evidence, and analysis of a cloud system after an intrusion or break-in. It enables investigators to find and retrieve data from a variety of sources in the cloud environment. It is very challenging to find proof of a crime since the distributed nature of the cloud prevents evidence from being retained on a specific physical machine and instead disperses the data over various regions. This paper focuses on current forensic investigation tools used in the Cloud environment and highlights the need for the development of efficient cloud forensic tools.

An efficient hidden marking approach for forensic and contents verification of digital images

Recently, forensic tools have been presented for detecting the forged image and illegal image manipulations. This paper presents an efficient and simple image contents verifying approach acting as a forensic technique. The presented approach mechanism is built by adding a hidden mark in a secret images, this mark achieves image integrity verification and detecting the tampering or forgery in the secret/authentic images. The secret/authentic/authentic image is divided to two main partitions, each portion is segmented to small blocks. These blocks in one partition are used to mark the blocks of the second partition using data transform technique. Firstly, the sensitive image is marked according to a self-embedding method. Then, a transform domain is utilized in order to embed a block-based signature into another block of the same image. Common discrete transform domains like DWT, DCT, and DFT are examined individually. Different analyses and comparison measurements are employed. The DCT is proved to be the most suitable and efficient transform domain to be used with the proposed scheme. At the receiver side, the reverse process is performed to verify image integrity. As proved from the experiments, this mark-algorithm is not visible or observable and robust against various attacks.

An Insight into the Machine-Learning-Based Fileless Malware Detection

In recent years, massive development in the malware industry changed the entire landscape for malware development. Therefore, cybercriminals became more sophisticated by advancing their development techniques from file-based to fileless malware. As file-based malware depends on files to spread itself, on the other hand, fileless malware does not require a traditional file system and uses benign processes to carry out its malicious intent. Therefore, it evades conventional detection techniques and remains stealthy. This paper briefly explains fileless malware, its life cycle, and its infection chain. Moreover, it proposes a detection technique based on feature analysis using machine learning for fileless malware detection. The virtual machine acquired the memory dumps upon executing the malicious and non-malicious samples. Then the necessary features are extracted using the Volatility memory forensics tool, which is then analyzed using machine learning classification algorithms. After that, the best algorithm is selected based on the k-fold cross-validation score. Experimental evaluation has shown that Random Forest outperforms other machine learning classifiers (Decision Tree, Support Vector Machine, Logistic Regression, K-Nearest Neighbor, XGBoost, and Gradient Boosting). It achieved an overall accuracy of 93.33% with a True Positive Rate (TPR) of 87.5% at zeroFalse Positive Rate (FPR) for fileless malware collected from five widely used datasets (VirusShare, AnyRun, PolySwarm, HatchingTriage, and JoESadbox).

Role of Vitreous Humor and Synovial Fluid Potassium Levels in Estimating Postmortem Interval: A Study

Determining the time since death is a crucial aspect of a forensic autopsy as it helps establish the sequence ofevents leading to death, narrow down the list of potential suspects, and aid in legal investigations. The postmorteminterval can be estimated using various indicators such as body temperature, rigor mortis, and biochemicalchanges in bodily fluids, and this information can provide valuable insights into the circumstances surroundingthe death. This study aimed to investigate the correlation between post-mortem interval and the levels of sodiumand potassium in vitreous humor and synovial fluid. The study included 100 cases, with 71% males and 29%females, and poisoning cases were the most prevalent. The results indicated a linear correlation between time sincedeath and potassium levels in both vitreous humor and synovial fluid, suggesting that potassium concentrationvalues could be useful for estimating time since death. However, sodium levels showed a negative correlation,indicating they are not significant for this purpose. These findings could be valuable for forensic investigationsand the determination of the time since death. Additionally, the study found that alcohol could be detected fromvitreous humor, further highlighting its potential as a forensic tool.

EXPERT INVESTIGATION OF ILLEGAL ACTIONS WITH RECEIVABLES OF A BUDGET INSTITUTION

Purpose. The article is devoted to the problem of studying the accounting practice of reflecting the receivables of budget institutions, as an object of investigation with the participation of forensic economic experts. The relevance of the study is determined by the need for information support for pre-trial investigation requests, especially those where the budget funds aimed at payments for goods, works and services, which are classified as accounts receivable and all relevant transactions, are the object of the crime. Methodology of research. The research methodology included theoretical and traditional legal methods using empirical research data. When writing the article, an analysis of the accounting treatment of receivables of budgetary institutions was carried out and an assessment of its regulatory and legal support for the work of a forensic expert was performed. Findings. The article analyses the stages of reflection the process of accounting, documentation of receivables of budgetary institutions in the understanding of how the existing forensic tools of forensic economic examination interact with the object to solve the issues raised by investigative bodies. An analysis of the accounting process was carried out separately by types of receivables - current, past due, expired, bad. The peculiarities of the display on the accounts of debts due to settlements with accountable persons, which are potential objects of forensic economic examination, are taken into account. The information on the accounting support for the examination of amounts of receivables that arose in previous budget periods, taking into account the sources of funding from the general or special funds of the budget of institutions, banks (except for own revenues) and its return, was detailed. The correct algorithm for displaying funds received in the current budget period as a return of receivables that arose in previous budget periods in the accounting was specified, and it is also proposed to consider actual actions in the institution regarding the adjustment of the result of the estimate in the course of the examination. The impact of calculations that arise in the process of performing estimates between the main managers of funds and managers of a lower level on the order of accounting display and generalization of information about such calculations in the reporting is analysed. The need to carry out separate procedures for advance payment (advancement) of goods (works, services) is substantiated, taking into account the limitations of advance payment by budget legislation. Originality. The scientific novelty of the study consists in the improvement of the regulatory and legal support for conducting a forensic and economic examination of the receivables of budget institutions. Practical value. Recommendations are given for the step-by-step reflection in the work of a forensic economic expert of the object of receivables by its types, taking into account the specifics of the accounting process of budget institutions. Recommendations for improving the methodical aspect of forensic economic examination work are offered. Key words: forensic economic examination, methodology, accounting, accounts receivable, budgetary institution, analytical accounting of receivables

Anti-fraud measures and corporate policies to combat financial fraud in the financial institutes of Malaysia

The rising concern about fraud in the financial sector and its impact on the economy requires massive changes and efforts that provide an avenue to fight against fraud. The primary goal of this study is to examine the effectiveness of Anti-fraud measures and corporate policies to combat financial fraud in financial institutes in Malaysia. In this study, three variables that affect combatting financial fraud have been identified to be evaluated, including digital forensic tools, regulations, and corporate policies. This study used questionnaires to obtain data from workers of financial institutions as a primary data source. The findings indicated that all variables have a significant relationship with combating financial fraud. Thus, this study raises awareness about the need for anti-fraud measures in financial institutions to combat fraud.

Visual User-Generated Content Verification in Journalism: An Overview

Over the past few years, social media has become an indispensable part of the news generation and dissemination cycle on the global stage. These digital channels along with the easy-to-use editing tools have unfortunately created a medium for spreading mis-/disinformation containing visual content. Media practitioners and fact-checkers continue to struggle with scrutinising and debunking visual user-generated content (UGC) quickly and thoroughly as verification of visual content requires a high level of expertise and could be exceedingly complex amid the existing computational tools employed in newsrooms. The aim of this study is to present a forward-looking perspective on how visual UGC verification in journalism can be transformed by multimedia forensics research. We elaborate on a comprehensive overview of the five elements of the UGC verification and propose multimedia forensics as the sixth element. In addition, different types of visual content forgeries and detection approaches proposed by the computer science research community are explained. Finally, a mapping of the available verification tools media practitioners rely on is created along with their limitations and future research directions to gain the confidence of media professionals in using multimedia forensics tools in their day-to-day routine.

Mobile Forensic Analysis of Signal Messenger Application on Android using Digital Forensic Research Workshop (DFRWS) Framework

Cybercrime is a crime committed using equipment connected to the internet. One of the cybercrimes that occured during the COVID-19 pandemic was the spread hoaxes about the COVID-19 vaccine which caused panic in society. Signal Messenger is one of the social media that has become a trending topic since the number of personal data security issues and the emergence of end-to-end encryption features. This research aims to find digital evidence on Signal Messenger application installed on the perpetrator's Android smartphone. This research uses Belkasoft, Magnet AXIOM, and MOBILedit Forensic Express tools and implements the Digital Forensics Research Workshop (DFRWS) framework in each stage of the research experiment. The research was carried out according to the case scenario with 11 predetermined parameters. Digital evidence is found from the Signal Messenger application: application information, account information, chat, pictures, videos, contacts, and stickers. The results of this research indicate that Belkasoft Evidence Center forensic tool is better, with an accuracy rate of 78.69%, while Magnet AXIOM is 26.23% and MOBILedit Forensic Express is 9.84%. The results of this research can be used as a reference for other forensic researchers/experts in handling similar crime cases on the Signal Messenger application to get better results.

ANALISIS DATA FORENSIK INVESTIGASI KASUS PEREDARAN NARKOBA PADA SMARTPHONE BERBASIS ANDROID

Along with the development of Smartphone technology, especially Android-based which is a communication tool whose features develop from time to time with a total of 89.2% of users, which is also followed by an increase in users of the WhatsApp Instant Messaging Platform. WhatsApp is one of the most popular social media in the world with a total of 2.20 billion users. On the other hand, WhatsApp is often used as a medium of crime (cybercrime) such as the case of narcotics trafficking, whose transactions are carried out online by sending messages, pictures, videos, locations and so on. The purpose of this study is to find forensic evidence and to compare two tools using the (Without Root Access) and (Root Access) approaches, using the NIJ (National Institute of Justice) method. The results of the extraction were then analyzed using the forensic tools Magnet Axiom without Rooting access managed to obtain data extraction of 33.33% while MobilEdit forensics was equal to a total of 33.33%. While the comparison with Rooting access, Magnet Axiom obtained greater data extraction as much as 77.77% and MobilEdit Forensic as much as 66.66%. The results of the study based on the scenario used, it can be concluded that the recommended tool is Magnet Axiom because it has better performance

The Role of Digital Forensic Experts in Cybercrime Investigations in Indonesia Based on The Scopus Research Index

The development of information technology, besides having a positive impact, has negative impacts, such as an increase in cybercrime. Several parties are involved in handling cybercrimes in Indonesia, including expert witnesses in digital forensics. It is hoped that cybercrimes can be uncovered through a digital forensic approach. Research related to cybercrime and Digital Forensics in Indonesia is experiencing increasing growth from 2010 to 2021. A very rapid increase was shown in 2017. Through bibliometric analysis, you can analyze expert witnesses in the field of digital forensics by region in Indonesia, such as Sumatera, Western Java, Central Java, and Eastern Java. An expert witness in digital forensics must have technical skills in operating digital forensic tools and analysis and academic skills in uncovering crimes. The results of this study are very useful for law enforcement officers or lawyers in determining expert witnesses in the field of digital forensics. List of digital forensic experts in Indonesia who have been tested from their scientific studies by conducting various paper publications. So, law enforcement can synergize with digital forensic experts to solve cybercrime. One of the roles of a digital forensic expert is as an expert witness in court. Through research, it is hoped that there will be an increase in awareness of digital forensic experts to conduct scientific publications so that it is easier to be recognized by law enforcement and academics for updating methods and techniques of cybercrime investigation

Digital Forensics Analysis of IoT Nodes using Machine Learning

With the versatility and exponential growth of IoT solutions, the probability of being attacked has increased. Resource constraint IoT devices raised a challenge for the security handler to track logs of different variety of attacks generated on them while performing the forensic analysis. Commonly forensic analysis is performed on the devices that calculate how much loss has occurred to the device due to the diversity of attacks. The main objective of this paper to develop a framework through which secueity can perfrom the forensic analysis on resource contraint IoT devices. In this paper, we have proposed a framework that intelligently performs forensic analysis and detects the different types of attacks performed on the endpoint (IoT device) using a node to node (N2N) framework. Furthermore, this proposed solution is a blend of different forensic tools and Machine learning techniques to identify different types of attacks. Using a third-party log server, the problem of evidence recovery from the endpoint under attack is addressed. To determine the nature and effect of the attack we have used the logs by using the security onion (forensic server). Additionally, this framework is equipped to automatically detect attacks by using the different machine learning algorithms. The efficiency of machine learning models is measured upon the values of (1) Accuracy, (2) Precision, (3) Recall, and (4) F-Measure. The results show that the decision tree algorithm stands out with the optimum performance compared to other ML models. Overall this framework can be used for the secuirty of IoT devices as well as the evidence collection from the IoT endpoint. For the validation of the proposed framework more detailed results and performance, analysis is presented in this paper.

Computer Forensics Education: The Applications of Forensic Tools in Modern Education System

Cybercrime and computer-related incidents are becoming more prevalent and common, resulting in billions of dollars in damages. To address these crimes and scams, there is an urgent need to build digital forensics training programme, that will equip relevant professionals to investigate computer crime and events efficiently. There is presently no standard that governs the development of an academic program’s digital forensics curriculum. This study extensively investigates prior work on curriculum design in digital forensics as well as existing computer forensics course offered at the first is the Community College in Buraidah, and the second is the Community College in Unaizah namely, “Cyber Security Diploma” The Cyber Security Diploma is offered in both colleges, the Community College in Buraidah and Unaizah, and the diploma is at the third level of the course “Computer Forensic Analysis,” which is the focus of the research topic. Interviews were conducted with both digital forensic trainers and practitioners, and the findings were examined in order to identify and assess the skills and knowledge required by the industry and law enforcement agencies for their digital forensic examiners. Hands-on training may be delivered by constructing and managing a student laboratory specifically designed for digital forensic examination instruction. A laboratory can be outfitted with a wide range of software solutions, ranging from commercial investigation suites to free command line tools. Similarly, the forensic workstations that execute the software might be supplied by the vendor as stand-alone devices or assembled from separate components in-house. Building and administering a student lab successfully can be a daunting task, but it can also be done on a little budget as long as the focus stays on student achievement.

A Morphometric Analysis of Palatal Rugae Patterns in a Saudi Arabian Population.

Background Palatal rugae patterns are useful in the field of forensic dentistry. Ethnicity has a significant effect on the development and final morphological pattern of palatal rugae. This study focused on a morphological analysis of the palatal rugae in a Saudi population to determine if any differences based on age and gender could support identifying an individual. Materials and methods This cross-sectional study conducted at the College of Dentistry, King Saud bin Abdul Aziz University for Health Sciences, was undertaken to evaluate 496 dental casts from the participant database of Saudi nationals from Riyadh. The rugae were delineated using a sharp graphite pencil under adequate light and magnification. The rugae patterns were classified based on the length, shape, and direction of the rugae by two observers as per Thomas and Kotze's criteria. Results The asymptotic chi-square McNemar test indicatedbilateral symmetry for all the characteristics of the palatal rugae, except for the backward and forward directions of the rugae. Two-way analysis of variance (ANOVA) revealed a statistically significant interaction between the effects of age group and gender on the primary rugae count (F(3, 488) = 7.466, p <0.05)). In addition, age had a statistically significant effect on the fragmentary rugae (p <0.05), and gender had a statistically significant effect on the circular and backward patterns of the rugae (p<0.05). The females had a higher incidence of backward-directed rugae and the males had more circular rugae. No other significant difference was evident, based on gender. The logistic regression analyses showed a significant association between the circular (OR=1.298; 95% CI= 1.061-1.588)and backward (OR= 0.898; 95% CI= 0.828-0.975) palatal rugae and gender. Also, there was a significant association of the fragmentary palatal rugae (PR) (OR=1.274; 95% CI= 1.084-1.498) with the age group younger than 16 years. Conclusion In a Saudi Arabian ethnic group, the varying type of length of the palatal rugae patterns can be used to identify the age groupwhile the direction and shape can be used to determine gender, although with limited accuracy. Post-mortem identification may benefit from using them along with other reliable forensic tools. There is a need to conduct continued research on diverse populations and ethnic groups in order to evaluate the PR potential in forensic dentistry.