Framework For Forensic Analysis Research Articles

Ergonomics and Forensic Engineering

In disputes, forensic engineers routinely investigate available hardware and software and may examine other engineering attributes and activities. Human factors and ergonomic (HF&E) aspects may be considered, but these tend to be more limited or overlooked. This paper discusses an HF&E framework for forensic analysis, including its four major subdisciplines (micro-, meso-, macro-, and mega-ergonomics), the role each plays throughout the product life cycle, and examines their relationship to known and foreseeable use and misuse of a product or system. A taxonomy of errors, including distinguishing features of individual user errors versus system use errors, is presented and then used in a diagnostic rubric developed for forensic engineers to help identify HF&E issues as part of a forensic analysis. A health care setting case study is offered to demonstrate rubric use, but the rubric is generalizable to other domains.

An easy-to-explain decision support framework for forensic analysis of dynamic signatures

Forensic handwriting examination is often criticized for its lack of objective standards and rigorous scientific validation. On the other hand, cutting-edge techniques for biometric handwriting and signature verification are often perceived as perfect black boxes and are not used by forensic handwriting examiners in their work environment. This paper presents an easy-to-explain yet effective framework to support semi-automatic signature verification in forensic settings. The proposed approach is based on measuring similarities between signatures by applying Dynamic Time Warping on easy-to-derive dynamic features. The goal is to provide forensic handwriting examiners with a decision support tool for making reproducible and less questionable inferences, while being both intuitive and easy to explain. The method is tested on a newly proposed dataset that also takes into account the so-called disguised signatures which are of extreme importance in this scenario.

Efficient monitoring and forensic analysis via accurate network-attached provenance collection with minimal storage overhead

Provenance, the history or lineage of an object, has been used to enable efficient forensic analysis in intrusion prevention system to detect intrusion, correlate anomaly, and reduce false alert. Especially for the network-attached environment, it is critical and necessary to accurately capture network context to trace back the intrusion source and identify the system vulnerability. However, most of the existing methods fail to collect accurate and complete network-attached provenance. In addition, how to enable efficient forensic analysis with minimal provenance storage overhead remains a big challenge.This paper proposes a provenance-based monitoring and forensic analysis framework called PDMS that builds upon existing provenance tracking framework. On one hand, it monitors and records every network session, and collects the dependency relationships between files, processes and network sockets. By carefully describing and collecting the network socket information, PDMS can accurately track the data flow in and out of the system. On the other hand, this framework unifies both efficient provenance filtering and query-friendly compression. Evaluation results show that this framework can make accurate and highly efficient forensic analysis with minimal provenance storage overhead.

Multi-agent Based Forensic Analysis Framework for Infrastructures Involving Storage Networks

In this paper, we present a framework based on collaborative multi-agent approach for performing real-time forensic analysis on those infrastructures which involve storage networks such as storage area network, storage servers or network attached storage. For this activity is logged surrounding the file accesses made on the servers, storage devices and other components by deploying independent agents at different components, including storage networks and servers. The agents keep on collecting event logs and collaborate with each other to identify malicious accesses and generate alerts accordingly. The framework offers a consolidated view of the sequence of different activities happened on storage network infrastructure and allied servers at any point in time.

A log aggregation forensic analysis framework for cloud computing environments

Cloud computing has emerged in the past decade to provide wide-ranging computational facilities at cheaper cost. Cloud computing facilitates the sharing of processing units, storage devices and applications. The National Institute of Standards and Technology describes cloud computing as a model for facilitating on-demand ubiquitous network access to a combined pool of computing resources – eg, networks, storage, servers, services and applications. These resources can easily be provisioned and released without the service provider's interaction. Cloud computing is now in widespread use. But it does pose a number of security challenges. Muhammad Naeem Ahmed Khan and ShahWali Ullah of the Shaheed Zulfikar Ali Bhutto Institute of Science and Technology propose an analysis model based on aggregating available logs from clients and servers that could help identify and detail suspicious activity on cloud-based systems.

Quantifying Morphological Features of α-U3O8 with Image Analysis for Nuclear Forensics.

Morphological changes in U3O8 based on calcination temperature have been quantified enabling a morphological feature to serve as a signature of processing history in nuclear forensics. Five separate calcination temperatures were used to synthesize α-U3O8, and each sample was characterized using powder X-ray diffraction (p-XRD) and scanning electron microscopy (SEM). The p-XRD spectra were used to evaluate the purity of the synthesized U-oxide; the morphological analysis for materials (MAMA) software was utilized to quantitatively characterize the particle shape and size as indicated by the SEM images. Analysis comparing the particle attributes, such as particle area at each of the temperatures, was completed using the Kolmogorov-Smirnov two sample test (K-S test). These results illustrate a distinct statistical difference between each calcination temperature. To provide a framework for forensic analysis of an unknown sample, the sample distributions at each temperature were compared to randomly selected distributions (100, 250, 500, and 750 particles) from each synthesized temperature to determine if they were statistically different. It was found that 750 particles were required to differentiate between all of the synthesized temperatures with a confidence interval of 99.0%. Results from this study provide the first quantitative morphological study of U-oxides, and reveals the potential strength of morphological particle analysis in nuclear forensics by providing a framework for a more rapid characterization of interdicted uranium oxide samples.

Firefox OS 포렌식 기법에 관한 연구

ABSTRACT As the market share of smartphone exponentially increases in mo bile market, a number of manufacturers have developed their own operating system. Firefox OS is an open source operating sy stem for the smartphone and tablet which is being developed by the Mozilla Foundation. This OS is designed using JavaScript and operated based on HTML5. Even though the number of manufacturers which release the Firefox OS smartphone is consis tently increasing, However it is difficult to analyze artifacts in a smartphone in terms of investigation since existing researche s on Firefox OS focused on imaging velocity according to abstra ct forensic process and block size. In this paper, we propose how to collect data in Firefox OS whi le minimizing data loss and forensic analysis framework based on analysis results on system and user data leaving in a smartphone.Keywords: Forensics, Smartphone Forensics, Data Acquisition, Firefox OS, yaffs2, IndexedDB I.서 론 * 모바일 시장에서 스마트폰의 점유율이 기하급수적으로 높아짐에 따라 많은 제조사들은 자신들의 스마트폰 점유율을 높이기 위해 자체적으로 모바일용 운

Water distribution system failure: a framework for forensic analysis

The main purpose of a water distribution system (WDS) is to deliver safe water of desirable quality, quantity and continuity to consumers. However, in many cases, a WDS fails to fulfill its goal owing to structural and associated hydraulic failures and/or water quality failures. The impact of these failures can be reduced significantly if preventive actions are taken based on their potential of occurrences or if a failure occurs and is detected within a minimum period of time after its occurrence. The aim of this research was to develop a forensic system for WDS failures. As part of the proposed forensic analysis, a framework has been developed, which investigates structural and associated hydraulic failures as well as water quality failures and integrates all failure investigation under a single platform. Under this framework, four different models have been developed to evaluate and identify structural and associated hydraulic failures and water quality failures. If a failure is detected in the system, the framework is capable of identifying the most probable location of the failure. To investigate the effectiveness of the proposed framework, the developed models have been tested and implemented in different WDSs.

CFES: Comprehensive Framework for Forensic Analysis of Embedded Systems

Nowadays, embedded systems such as mobile phones, MP3 players, PMPs, and GPS navigation systems have become an integral part of our life. However, the increasing popularity of the use of digital devices has led to an increase in the diversity of cyber crime. Therefore, the forensic community has concentrated on countermeasures against emerging cyber crime techniques and embedded system investigations. While novel forensic analysis methodologies have been proposed for each embedded system known to the forensic community, there is no comprehensive framework for general embedded system forensics. Therefore, in this paper, we introduce a generalpurpose framework for forensic analysis of embedded systems for future communications and computing. The CFES framework (Comprehensive Framework for Forensic analysis of Embedded Systems) is designed for a comprehensive analysis environment and is a general methodology of extracting useful information about various embedded systems. CFES provides an effective analysis environment and various analysis toolkits, which can be applied to most of embedded systems. Further, it can perform a correlation analysis on the results of embedded system investigations.

Towards an integrated e-mail forensic analysis framework

Due to its simple and inherently vulnerable nature, e-mail communication is abused for numerous illegitimate purposes. E-mail spamming, phishing, drug trafficking, cyber bullying, racial vilification, child pornography, and sexual harassment are some common e-mail mediated cyber crimes. Presently, there is no adequate proactive mechanism for securing e-mail systems. In this context, forensic analysis plays a major role by examining suspected e-mail accounts to gather evidence to prosecute criminals in a court of law. To accomplish this task, a forensic investigator needs efficient automated tools and techniques to perform a multi-staged analysis of e-mail ensembles with a high degree of accuracy, and in a timely fashion. In this article, we present our e-mail forensic analysis software tool, developed by integrating existing state-of-the-art statistical and machine-learning techniques complemented with social networking techniques. In this framework we incorporate our two proposed authorship attribution approaches; one is presented for the first time in this article.