Forensic Investigation Process Research Articles

Artificial intelligence in mobile forensics: A survey of current status, a use case analysis and AI alignment objectives

As the capabilities and utility of Artificial Intelligence and Machine Learning systems continue to improve, they are expected to have an increasingly powerful influence in the digital forensic investigation process. The concurrent proliferation of mobile devices and rapid increase of forensic value of related artifacts creates the requirement for a comprehensive review of the current status of artificial intelligence software usage and usefulness in Mobile Forensics. In this context, we conducted a survey to evaluate the characteristics and properties of AI functions in mobile forensic software from the practitioners' perspective and enhance understanding to the work in the field. In this study, we evaluated the performance of image categorization software in digital forensics using a variety of evaluation metrics including accuracy, precision, recall, and F1-score, as well as the confusion matrix. In this research we also identify and integrate theoretical principles to conceptualize an AI Alignment framework pertaining to Mobile Forensics and Digital Forensics in general, in order to accurately determine specific AI strategy objectives and potential solutions to the current technical and administrative landscape. We emphasized the importance of interpretability and transparency in AI systems and the need for a comprehensive approach to understanding the reasoning behind the software's decisions. Additionally, we highlighted the importance of robustness in image categorization software, as well as the consideration of AI governance and standardized procedures concepts. Our results show that the accuracy and robustness of the image categorization software have a significant impact on the outcome of legal cases and that the software should be designed with interpretability, transparency, and robustness in mind. Through the examination of the survey responses, the evaluation of the image categorization software and research literature, we explore existing and potential approaches to aligned Artificial Intelligence and analyze their contribution to the forensic examination of cases.

DNA Profiling, Bioinformatics and Databases in Forensics: Human Identification Purposes

Individual identification is an essential element in establishing truth the forensic investigation process, be it in criminal, medico-legal, or mass disasters case. When ante-mortem data are not available, the only thing that can be used is identification trough DNA. Alec Jeffrey, a geneticist (1984), found that certain regions of DNA contain repetitive sequences and the number of repetitions in individuals differs from one another. This identification method known as DNA profiling. DNA profiling is described as an important and significant discovery in forensics and has been considered as the standard in modern human identification. Until now, the recommended DNA profiling method must be based on the PCR to analyze degraded DNA and short-sized DNA (Short Tandem Repeats) through PCR amplification. In profiling, the result DNA amplification are analyzed through genetic markers (DNA Markers) and then matched into the database or compared with the collected reference samples. In the human genome, the genetic markers most frequently used in forensics are autosomal STR, Y-STR, mtDNA, X-STR, SNPs, and Amelogenin. Accomplishment of proving the suitability of DNA profiles, an application of bioinformatics in forensics is carried out. Bioinformatics is a combination of molecular biology and computer informatics that aims to manage and analyze data and store biological (genetic) information. DNA database is an application of bioinformatics in the form of special software which has become an important tool for biologists and forensics. This genetic database will predict the similarities between one DNA profile and another.

The Practice of Forensic Structural Engineering in IABSE's Member Countries

The IABSE Task Group 5.1 on Forensic Structural Engineering aims to examine and to mitigate structural failures by sharing knowledge of technical, human and organizational causes of failure, in addition to methods and techniques in forensic investigation processes. Forensic engineering expertise has yet to be recognized worldwide as a specific domain of civil engineering practice, and this paper amends previously published technical reports in 2012, 2014 and 2015 by former IABSE Working Group 8 following a new survey carried out in 2020–2022. This new survey has been developed with the lessons learnt from the previous survey in 2013–2014, including the validation of the results obtained by eliminating potential subjectivity in the former assessment. This survey also includes further understanding of the institutional and national regulatory framework. The survey was completed by 22 IABSE member countries whose responses were provided by national experts on forensic structural engineering. This paper will allow the reader to familiarize him/herself with the state of the art in forensic structural engineering practice across 22 countries, allowing a national-level diagnosis. The survey will also help to identify the main challenges within each country related to forensic engineering. Furthermore, recommended steps, as suggested by the national experts, for the awareness and/or development of good industry practice within forensic structural engineering are highlighted in this paper. Online supplemental data for this article can be accessed at https://doi.org/10.1080/10168664.2024.2307411.

A Conceptual Cloud Forensic Investigation Process Model for Software as a Service(SaaS) Applications

This paper explore a structured and systematic approach cloud forensic investigation process model for SaaS applications, to investigate the digital crimes in the cloud environment and contributing to enhanced security and privacy of acquired data during forensic investigation .The proposed model offers the distinctive characteristics of cloud environments and the varying levels of access and control within them. In this proposed model, the systematic forensic investigation process is detailed with microscopic details with four phases namely the initial phase, the acquisition phase, the analysis phase, and the reporting phase in Cloud environment. Ultimately, this research aims to enhance the overall trustworthiness and reliability of SaaS applications forensic for fostering a safer and more secure cloud computing forensic investigation landscape by using the chain of custody.

Tracing footprints of anti-forensics and assuring secured data transmission in the cloud using an effective ECCDH and Kalman Filter

The work “Tracing Footprints of Anti-Forensics and Ensuring Secured Data Transmission in the Cloud Using an Effective ECCDH and Kalman Filter” addresses the critical challenge of thwarting anti-forensic operations to protect data integrity in the context of cloud computing. This research digs into the complex difficulties encountered by digital forensics in multi-tenant virtual infrastructures in the context of cloud technology vulnerabilities and privacy issues inside cloud settings. The inquiry covers both technical and legal ground, including the examination of evidentiary photos and residual data. The complexity of forensic attempts is amplified by the convergence of diverse settings, the widespread use of privacy, encryption, and anti-forensic measures, and the intricate architecture of Cloud Service Providers (CSPs). Because of its decentralized nature, cloud computing exacerbates problems caused by quickly growing databases. Anti-forensic assaults are a serious concern within the realm of cloud security risks because they obfuscate attack evidence throughout the whole forensic investigation process. The research presents a novel method of combating these evasive strategies by combining ECCDH (Elliptic Curve Cryptography Diffie-Hellman) with Kalman Filters. This cutting-edge combination not only successfully identifies anti-forensic traces, but also guarantees private data transfer to the right people. The suggested approach uses the Kalman Filter in conjunction with encryption, decryption, compression, and decompression of data to identify attacked and un-attacked packets. The KDD-Cup dataset is used to conduct empirical validation of the approach. The results of the investigation corroborate the usefulness of the suggested method for enhancing cloud data transmission security and revealing potential anti-forensic actions. In particular, the attained values for accuracy, precision, recall, and F-score are as follows: 98.68, 99.06, 98.68, and 98.68. The proposed method outperforms state-of-the-art methods in terms of accuracy, recall, precision, and F-score, according to a comparison with the latter.

Blockchain meets Internet of Things (IoT) forensics: A unified framework for IoT ecosystems

With the continuously increasing number of security incidents targeting sensors, embedded devices, and other electronics appliances and systems that comprise the so-called Internet of things (IoT), the field of IoT forensics emerged as a branch of digital forensics focusing on the investigation of attacks in the IoT ecosystem. Digital evidence authenticity, integrity, confidentiality, and privacy are among the factors affecting the investigation process in IoT forensics, which can be addressed by employing the blockchain as the means not only for the preservation of digital evidence, but also for other steps of a digital forensics investigation process. The high-level goal of the paper is three-fold: to establish a holistic IoT forensics process as a reference point against which blockchain integration patterns and best practices will be identified in order to yield a robust, widely accepted and scalable architecture of the blockchain-enabled solution; to integrate the blockchain with the proposed IoT forensics process for addressing the above challenges; and to evaluate the overall solution highlighting improvements and potential performance bottlenecks. The proposed blockchain-enabled platform leverages multi-access edge computing and has been implemented with Hyperledger Fabric on an extensive virtualized testbed providing a realistic smart home environment. A thorough evaluation was conducted with real cyber-attacks generating digital evidence at high rates for testing the platform’s behavior at high load. The experimental results showed that the proposed platform achieved high throughput, excessively low latency, and zero error rate in the operation of the blockchain network.

Propuesta metodológica para la generación de soportes que apoyen la recolección de evidencia digital, en entidades del sector financiero

With the development of this article, a methodology is proposed that supports commercial and business processes for companies in the financial sector, as an alternative to face the high rates of cybercrime reported in recent years, ensuring orderly and articulated execution, among the different dependencies, to mitigate the impacts of an attack, in addition to facilitating the identification and collection of digital evidence for forensic investigation processes in cases in which it is demonstrated that an incident has occurred that violates cybersecurity mechanisms, this is a Currently a dominant need, because due to the social changes resulting from the pandemic, more and more people find themselves in need of resorting to digital infrastructures to access financial services and electronic commerce platforms. Based on the analysis and in accordance with the financial context, a review of documents recovered from digital repositories is carried out to identify the main computer infringements related to the materialization of financial crimes. By way of the scientific impact achieved through this research work, a starting point is established through which it is possible to reinforce the computer security of management systems in companies in the financial sector, complementing it with the generation of supports that can be used as digital evidence in an eventual forensic investigation process, it is also evidenced the need to implement a holistic vision in the processes, which allows an efficient response to IT security needs.

Digital Forensic Framework for Protecting Data Privacy during Investigation

Rapid technological breakthroughs, a surge in the use of digital devices, and the enormous amount of data that these devices can store continuously put the state of digital forensic investigation to the test. The prevention of privacy breaches during a digital forensic investigation is a significant challenge even though data privacy protection is not a performance metric. This research offered solutions to the problems listed above that centre on the efficiency of the investigative process and the protection of data privacy. However, it’s still an open problem to find a way to shield data privacy without compromising the investigator's talents or the investigation's overall efficiency. This system proposes an efficient digital forensic investigation process which enhances validation, resulting in more transparency in the inquiry process. Additionally, this suggested approach uses machine learning techniques to find the most pertinent sources of evidence while protecting the privacy of non-evidential private files.

Cloud DDoS Attack Detection Model with Data Fusion & Machine Learning Classifiers

In the current situation, digital technology is a necessary component of daily life for people. During the Covid-19 pandemic, every profit and non-profit making businesses organizations moved online, which caused an exponential rise in incursions and attacks on the digital platform. The Distributed Denial of Service (DDoS) attack, which may quickly paralyse Internet-based services and applications, is one of the deadly threats to emerge. The attackers regularly update their skill tactics, which allows them to get around the current detection and protection systems. The standard detection systems are ineffective for identifying novel DDoS attacks since the volume of data generated and stored has multiplied. So, the main goal of this work is to employ data fusion applications for secure cloud services and demonstrate the detection of DDoS attacks with the applications of machine learning classifiers that can further be helpful for cloud forensic investigation process. A variety of machine learning models, including decision trees, Navies Bayes, SVM, and KNN are used to detect and classify cloud DDoS attacks. The outcomes of the experiments demonstrated that decision tree is the most feasible and better performer method to classify cloud DDoS attacks.

Towards the Development of Indicators of Fake Websites for Digital Investigation

A fake website is considered a website that is intended to cause harm and manipulate users, especially novice users without some knowledge of indicators of fakeness. Understanding the indicators of fake websites is thus considered an important concept to avoid being a victim of malicious attacks in online engagements. In some cases, such knowledge is required to reduce the potential attack surface of cyber criminals. However, the increasing rate of website diversity and complexities makes it difficult for an individual to distinguish between a fake and a real website while compounding the investigation process of a website. Also, the growing rate of website imitation technology and website domain closure presents a veritable platform for the development of fake websites. As a step towards determining the genuineness of a website, this study developed a forensic framework based on an exploratory analysis of different genres of fake websites. To achieve this, forensic methodologies and processes were applied to methodically selected samples of known fake websites based on three fakeness categories: Hoaxes, Cybersquatting, and Sweepstakes. The result revealed the existence of salient markers which can be used as indicators of fakeness and can be applied across a wide genre of websites. Furthermore, the resultant observation was used to develop a digital forensic framework for website fakeness evaluation. The developed framework was benchmarked to the ISO 27043/2015 and the NIST SP800-86 standard for completeness and relevance to forensic investigation processes. By leveraging the proposed digital forensic framework, an investigation can develop a reliable pointer to evaluate the genuineness of any website, which can significantly reduce the investigation time. For a non-forensic individual, the developed framework can be leveraged to identify, at first glance, the degree of fakeness of a website. Such a mechanism can therefore provide a useful tool to reduce the potential susceptibility of users thereby creating user awareness.

An Overview Diversity Framework for Internet of Things (IoT) Forensic Investigation

The increasing utilization of IoT technology in various fields creates opportunities and risks for investigating all cybercrimes. At the same time, many research studies have concentrated on security and forensic investigations to collect digital evidence on IoT devices. However, until now, the IoT platform has not fully evolved to adjust the tools, methods, and procedures of IoT forensic investigations. The main reasons for investigators are the characteristics and infrastructure of IoT devices. For example, device number variations, heterogeneity, distribution of protocols used, data duplication, complexity, limited memory, etc. As a result, resulting is a tough challenge to identify, collect, examine, analyze, and present potential IoT digital evidence for forensic investigative processes effectively and efficiently. Indeed, there is not fully used and adapted international standard for the perfect IoT forensic investigation framework. In the research method, a literature review has been carried out by producing previous research studies that have contributed to further facing challenges. To keep the quality of the literature review, research questions (RQ) were conducted for all studies related to the IoT forensic investigation framework between 2015-2022. This research results highlight and provides a comprehensive overview of the twenty current IoT forensic investigation framework that has been proposed. Then, a summary or contribution is presented focusing on the latest research, grouping the forensic phases, and evaluating essential frameworks in the IoT forensic investigation process to obtain digital evidence. Finally, open research issues are presented for further research in developing IoT forensic investigative framework.

DNA profiling in forensic investigation – A review

DNA Profiling is a revolutionary method for individual and relationship analysis, crime investigation, hereditary disorders, etc. It is a universal method used to establish accurate results during the process of forensic investigation. DNA profiling techniques, which are based on repetitive sequences within DNA, have proven to be of paramount importance, albeit the complete utilization of knowledge still remaining unexplored. Even a hair strand, blood drop or even skin flakes can be used to identify DNA sequences. It has a wide range of applications both in forensics and law. Because of the advancement in the field of forensics in the past four decades, DNA evidence now stands as one of the most reliable forms of proof in a court of law. In the following article, the authors explore the main concepts of DNA Profiling, and the techniques which are widely used in forensic laboratories such as RFLP, VNTR, STR, AFLP, mtDNA analysis, Y-chromosome analysis and gender typing.

TAARA Method for Processing on the Network Forensics in the Event of an ARP Spoofing Attack

According to reports in 2021 by Kaspersky, requests for investigations into suspicious network activity, such as ARP Spoofing, which can result in sophisticated attacks, reached up to 22%. Several difficulties with examining network systems have been overcome thanks to network forensic investigations. This study aims to perform a network forensic analysis of ARP spoofing attacks using Wireshark forensic tools and Network Miner with a sniffer design process to capture traffic on the router side. In order to gather reliable evidence, this study employs the TAARA method as a network forensic investigation process. Based on the research conducted, it can be demonstrated that an attack took place from eight PCAP files. The information that was gathered, such as the IP address and MAC address of the attacker, the IP address and MAC address of the target, and the date and time of the attack are examples of evidence information that was gathered. This study also shows that network forensic operations can use the Wireshark forensic tool to obtain more detailed data.

Framework for Digital Forensic Ethical Violations: A Systematic Literature Review

Handling digital forensic cases plays a critical role in maintaining public interest and trust. However, the lack of an ethical code in digital forensics work processes can compromise the integrity and reliability of inspection results. This study aims to address this issue by conducting a systematic literature review (SLR) to explore existing standards for digital forensic frameworks. This study uses SLR techniques to identify and map various digital forensic investigation processes described in the literature. While there are some topics that address digital forensic frameworks in this review, we find it to be overwhelmingly focused on testing or evaluating digital forensic investigations. Unfortunately, the reviewed frameworks often neglected the code of ethics validation process, leaving the potential for ethical violations in the field of digital forensics. Integrating ethical considerations into existing frameworks is essential to ensure the credibility and reliability of digital forensic investigations. This study highlights the need to establish comprehensive policies and standards that include not only technical aspects but also ethical practices. In this way, digital forensics professionals can effectively maintain professional ethics, mitigate ethical violations, and restore public confidence in their findings. Future research should focus on the development and implementation of robust ethical frameworks in the field of digital forensics.

COMBINING DIGITAL FORENSICS WITH TRADITIONAL SAFETY MEASURES TO IMPROVE DATA SECURITY IN BANKING

This study aims to investigate a new method of forensic cybersecurity to improve data protection in the banking industry. The document is based on several experiments that demonstrate the effectiveness of digital forensics, combined with traditional banking security measures, as a reliable data security method. Banking data is a prime target for most cyber attackers, and securing this data has always been one of the most critical challenges in the banking industry, especially in modern society, where numerous money transfer systems have emerged. This research suggests and explains a more specialized security system that employs disk imaging, data carving, memory analysis, and network forensics to detect, investigate, and counteract cybercrimes against banking data. The authors illustrate how these techniques can combine with traditional security measures to improve banking data security and enhance forensic investigation processes. The method allows banking firms to improve the efficiency of incidence response, protect confidential information, improve risk management and adhere to government regulations. The researchers employed standardized scientific experiments that proved the effectiveness of this security enhancement method. Result analysis indicates that by implementing this method of forensic cybersecurity, bankers can reduce losses due to cyberattacks by at least 40%. They can also improve their customer’s trust, consequently maintaining a high client retention rate, helping firms boost profits by up to 30%. Besides its benefits to financial institutions, this research project contributes to the scientific literature on digital forensics and cybersecurity. Additionally, it provides practical solutions and suggestions that can be used in other data security subsectors. Keywords: Forensic Computer Science, Banking Data, Cybercrime, Digital Forensics, Data Security DOI： https://doi.org/10.35741/issn.0258-2724.58.2.29

Advanced Intuitive Model for Digital Forensics Collection Methods in the Context of Cloud Computing and IoT

Abstract: With the wide scale adoption of cloud computing paradigms and Internet of Things implementations, the arena of service delivery has changed significantly for the world of technology-oriented services. While these new modes of service delivery have provided innovations that were not fathomable earlier, they not only create new non-traditional pathways for evidence generation, nevertheless, they have also been seen to carry a potential of creating and exposing a whole new set of security vulnerabilities that malicious actors can exploit. Traditional forensic investigation process falls short in many ways including the way it aims to identify and link crucial pieces of evidence in these scenarios due to a myriad of internal and external factors. Challenges and inadequacies have been identified in the community in relation to these specific sets of advancing technologies that hinder the efficient identification, extraction and processing of evidence generated in crimes involving them. In this paper we wish to surmise the current forensic collection methods, how they pose challenges when put together with the latest cloud and IoT technologies and then attempt to propose an advanced, more intuitive, and theoretically validated digital forensic collection process guided by zero trust principle and enforced with artificial intelligence and machine learning methodologies with the aim to fill the gaps and provide a more reliable, robust and intuitive model to perform digital evidence collection in the given context.

Restorable-inpainting: A novel deep learning approach for shoeprint restoration

Shoeprints are important information collected at the crime scene and are of great value for forensic analysis. Shoeprints collected in real-world scenarios are normally unclear, abrasive, and lack contextual and other kinds of missing information. In this research, we apply a novel deep learning technique called restorable inpainting to repair shoeprint contours and missing parts. Existing inpainting methods aim to fill artificially occluded areas with plausible pixels, but these methods may not restore missing information for occlusions in shoeprint images. In addition, because no ground-truth shoeprints exist for training samples, inpainting occluded regions becomes challenging. In this paper, we propose DeepShoePaint, a novel deep learning approach to perform restorable inpainting by restoring synthetic information resembling desirable shoeprint images necessary for forensics. DeepShoePaint novelly adapts a probabilistic distribution borrowed from the variational autoencoder into a U-Net-like structure forming a unified architecture trained in an unsupervised fashion to restore occluded and masked regions to produce human-verifiable shoeprints. The experimental results reveal that DeepShoePaint achieves outstanding human inspection and statistical assessment results and outperforms conventional inpainting models. We believe that this study can provide valuable insights, not limited to inpainting, into restoring desirable shoeprints to automate and facilitate the forensic investigation and examination process instead of using handcrafted methods.

Some Remarks regarding the Criminalization and the Forensic Investigation of the Crime of Computer Forgery in the Romanian Legislation

The article presents and analyzes issues related to the criminalization of the offence of computer forgery, provided by the Article 325 of the Romanian Criminal Code, as well as issues related to the criminalization of the offence of computer forgery in the main legal instrument in the field of combating cybercrime at the European level: the Council of Europe Convention on Cybercrime. Moreover, the article also mentions some aspects related to the criminalization of the crime of computer forgery in some countries of the European Union. Finally, this study also presents the main issues to be clarified in the forensic investigation process of the crime of computer forgery.

Unboxing the digital forensic investigation process

As digital forensics continues to play an important role in criminal investigations, its investigative work must be underpinned with well-defined and robust methodologies. Over the last 20 years, a substantial body of research has been produced to define and codify the digital forensic investigation process and the stages/sub-processes involved. Whilst current digital forensic investigation process models provide a solid foundation, it is argued that existing attempts often only focus on those physical tasks, which a practitioner must carry out at any given stage of an examination, omitting to identify those core thought processes, decisions and behaviours that form part of effective investigative practices. This work presents the Digital Forensic Workflow Model (DFWM), a novel approach to the structuring and definition of the procedures and tasks involved in the digital forensic investigation process starting from the initial ‘Review of Client Requirements & Planning’ stage, right through to the ‘Evaluation of Deployed Workflow’ stage. The DFWM contributes to the digital forensic management toolbox, where it enables the identification and management of risk and supports error mitigation at each stage of the workflow. The paper demonstrates how the DFWM functions as a framework for unboxing the digital forensic investigation process based on the investigative strategy of the particular case, providing a detailed structure and depiction of the physical and investigative tasks and decisions. From a research perspective, DFWM is a descriptive starting point, and future empirical studies may expand and provide further detail to the various physical and cognitive tasks and associated risks during the DF workflow.

Intelligent Forensic Investigation Using Optimal Stacked Autoencoder for Critical Industrial Infrastructures

Industrial Control Systems (ICS) can be employed on the industrial processes in order to reduce the manual labor and handle the complicated industrial system processes as well as communicate effectively. Internet of Things (IoT) integrates numerous sets of sensors and devices via a data network enabling independent processes. The incorporation of the IoT in the industrial sector leads to the design of Industrial Internet of Things (IIoT), which find use in water distribution system, power plants, etc. Since the IIoT is susceptible to different kinds of attacks due to the utilization of Internet connection, an effective forensic investigation process becomes essential. This study offers the design of an intelligent forensic investigation using optimal stacked autoencoder for critical industrial infrastructures. The proposed strategy involves the design of manta ray foraging optimization (MRFO) based feature selection with optimal stacked autoencoder (OSAE) model, named MFROFS-OSAE approach. The primary objective of the MFROFS-OSAE technique is to determine the presence of abnormal events in critical industrial infrastructures. The MFROFS-OSAE approach involves several subprocesses namely data gathering, data handling, feature selection, classification, and parameter tuning. Besides, the MRFO based feature selection approach is designed for the optimal selection of feature subsets. Moreover, the OSAE based classifier is derived to detect abnormal events and the parameter tuning process is carried out via the coyote optimization algorithm (COA). The performance validation of the MFROFS-OSAE technique takes place using the benchmark dataset and the experimental results reported the betterment of the MFROFS-OSAE technique over the recent approaches interms of different measures.