Traditional Digital Forensics Research Articles

Cyber bullying Detection on Social Media Using Machine Learning

Cyber bullying has become a growing concern in today's society, with more and more people turning to the internet to harass and intimidate others. Digital forensics is an essential tool for investigating cyber bullying activities, as it allows for the collection and analysis of digital evidence. However, traditional digital forensics techniques can be time-consuming and require a significant amount of human effort. In this paper, we propose the use of machine learning algorithms to aid in the investigation of cyber bullying activities. By training these algorithms on a dataset of known cyber bullying incidents, we can create a predictive model that can automatically classify new instances of cyber bullying. This can significantly reduce the time and effort required for investigations, allowing for a more efficient response to cyber bullying incidents. The challenges associated with using machine learning for cyber bullying detection, including the need for high-quality training data and the potential for bias in the algorithms. We also explore the various types of digital evidence that can be used in cyber bullying investigations, such as social media posts, emails, and instant messages. We present a case study in which we apply our proposed approach to a real-world cyber bullying incident. Our results show that the machine learning algorithm was able to accurately identify the cyber bullying activity with a high level of precision, demonstrating the potential of this approach for improving the efficiency and effectiveness of cyber bullying investigations.

Search and CompAre Reverse (SCAR): A Bioinformatics–Inspired Methodology for Detecting File Remnants in Digital Forensics

A storage device may contain data that an individual is legally or morally not allowed to possess. Or, a disgruntled company employee may intentionally destroy corporate files, assuming once deleted the information is lost forever. The data could take the form of a database owned by a competitor, illegal images, or videos, or trade secrets or confidential business information. Fragments of the data may very well still be present on the disk drive, for example, and forensic tools may be capable of recovering some of the confidential information. This paper introduces Search and CompAre Reverse (SCAR), inspired from tools used in the bioinformatics community. The contribution is an initial empirical investigation into the use of this bioinformatics-inspired approach to deduce the partial existence of patterns in cases where traditional digital forensics tools cannot detect the type of the file due to overwriting the file signature portion of the file.

Research on IoT Forensics System Based on Blockchain Technology

In recent years, mobile edge computing (MEC) has become a research hotspot in academia. The Internet of Things (IoT) is an excellent way to build the infrastructure required for a MEC environment. Its rich digital tracking repository can provide insights into people's daily activities at home and elsewhere. Meanwhile, due to the open connectivity of the Internet of things devices, they can easily become the target of network attacks and be used by criminals as criminal tools. As a result, civil and criminal cases have increased year by year. This article conducts in-depth research on IoT forensics. By comparing its difference with traditional digital forensics (DF), the definition of IoT forensics is given. We have systematically sorted out the research results since the concept of IoT forensics was proposed in 2013 and proposed a generalized IoT forensics model. By studying blockchain technology and introducing it into the IoT forensics framework, a blockchain-based IoT forensics architecture is further proposed. Further, an alliance chain IoT forensics system is proposed. From the perspective of the data provider and the data visitor, the process of evidence storage and forensics of the IoT system is discussed. Finally, taking Unmanned Aerial Vehicle (UAV) forensics as an example, we give an experiment of IoT forensics analysis.

IoT Forensic Frameworks (DFIF, IoTDOTS, FSAIoT): A Comprehensive Study

Abstract In the Internet of Things, millions of electronic items, including automobiles, smoke alarms, watches, eyeglasses, webcams, and other devices, are now connected to the Internet (IoT). Aside from the luxury and comfort that the individual obtains in the field of IoT, as well as its ability to communicate and obtain information easily and quickly, the other concerning aspect is the achievement of privacy and security in this connection, especially given the rapid increase in the number of existing and new IoT devices. Concerns, threats, and assaults related to IoT security have been regarded as a potential and problematic area of research. This necessitates the quick development or creation of suitable technologies with the nature of crimes in the IoT environment. On the other hand, criminal investigation specialists encounter difficulties and hurdles due to various locations, data types, instruments used, and device recognition. This paper provides an in-depth explanation of the criminal content of the Internet of Things. It compares its stages to the detailed stages of traditional digital forensics in terms of similarities and differences, the frameworks used in dealing with electronic crimes, and the techniques used in both types. This paper presents previous discussions of researchers in the field of digital forensics. For the IoT, which brings us to the most important parts of this paper, which is a comprehensive study of the IoT criminal frameworks that are used to protect communication in the field of IoT, such as Digital Forensic Investigation Framework (DFIF), Digital Forensic Framework for Smart Environments (IoTDOTS), Forensic State Acquisition from the Internet of Things (FSAIoT), and discusses the challenges in their general frameworks and provides solutions and strategies. Keywords: digital forensic, FSAIoT, IoT, IoT Challenges, IoT Forensic, IoT Framework, IOTDOTS.

Process based volatile memory forensics for ransomware detection

AbstractRansomware is an emerging category of malware that locks computer data via powerful cryptographic algorithms. The global propagation of ransomware is a serious threat for individuals and organizations. The banking sector and financial institutions are the prime targets of such ransomware attacks. In case of such an attack, the field of digital forensics helps in estimation of the severity and data loss caused by the attack. Traditional digital forensics investigations make use of static or behavioral analysis to detect malware in infected systems. However, these procedures are challenged by malware obfuscation techniques. Malicious processes can stay inactive and undetected if only a single memory dump is analyzed. Thus, there is a need to collect numerous memory dumps of an individual program that can help with comprehensive and accurate analysis. In this article, we have developed a framework for volatile memory acquisition at regular time intervals to analyze the behavior of individual processes in memory. Through memory forensics, salient features are extracted from the infected memory dumps. These features can be utilized to classify malicious and benign processes efficiently through machine learning as compared to conventional techniques.

Digital Forensics Subdomains: The State of the Art and Future Directions

For reliable digital evidence to be admitted in a court of law, it is important to apply scientifically proven digital forensic investigation techniques to corroborate a suspected security incident. Mainly, traditional digital forensics techniques focus on computer desktops and servers. However, recent advances in digital media and platforms have seen an increased need for the application of digital forensic investigation techniques to other subdomains. This includes mobile devices, databases, networks, cloud-based platforms, and the Internet of Things (IoT) at large. To assist forensic investigators to conduct investigations within these subdomains, academic researchers have attempted to develop several investigative processes. However, many of these processes are domain-specific or describe domain-specific investigative tools. Hence, in this paper, we hypothesize that the literature is saturated with ambiguities. To further synthesize this hypothesis, a digital forensic model-orientated Systematic Literature Review (SLR) within the digital forensic subdomains has been undertaken. The purpose of this SLR is to identify the different and heterogeneous practices that have emerged within the specific digital forensics subdomains. A key finding from this review is that there are process redundancies and a high degree of ambiguity among investigative processes in the various subdomains. As a way forward, this study proposes a high-level abstract metamodel, which combines the common investigation processes, activities, techniques, and tasks for digital forensics subdomains. Using the proposed solution, an investigator can effectively organize the knowledge process for digital investigation.

SNAPS: Towards building snapshot based provenance system for virtual machines in the cloud environment

Recent threats in cloud show the necessity to perform forensics in the cloud environment. But performing forensic investigation in the cloud is different from traditional digital forensics. Cloud characteristics like multi-tenancy, rapid elasticity, diversity, and complexity raise additional challenges for cloud forensics. For each cloud Virtual Machine (VM), there will be several evidences like vdisk, vRAM, Snapshots, Volumes, Service logs, and VM logs. The forensic challenges differ from one evidence to the other. In this paper, we look at the challenges of snapshot acquisition and analysis. In reality, snapshots for a VM may not always exist. To increase their availability, we suggest the use of Cloud Forensic Readiness (CFR) models in which the snapshots are collected before the actual incident. The captured snapshots have to be transferred to the investigators environment via network. Since the cloud VM snapshots will be generally of huge size, transferring them elsewhere for processing may lead to the problem of data gravity. We resolve this problem by designing a framework named SNAPS (Snapshots based Provenance Aware System) which is derived from the existing spatio-temporal models and then customized to suit cloud forensic investigation. The motivation behind proposing SNAPS is to generate provenance for each object in the target virtual machine using its multiple snapshots. Moreover, SNAPS can be used to address various forensic challenges starting from simple to complex ones. Few of those were illustrated with the VM snapshots acquired from the Openstack Cloud Environment.

Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes

The state-of-the-art and practice show an increased recognition, but limited adoption, of Behavioural Evidence Analysis (BEA) within the Digital Forensics (DF) investigation process. Yet, there is currently no BEA-driven process model and guidelines for DF investigators to follow in order to take advantage of such an approach. This paper proposes the Behavioural Digital Forensics Model to fill this gap. It takes a multidisciplinary approach which incorporates BEA into in-lab investigation of seized devices related to interpersonal cases (i.e., digital crimes involving human interactions between offender(s) and victim(s)). The model was designed based on the application of traditional BEA phases to 35 real cases, and evaluated using 5 real digital crime cases - all from Dubai Police archive. This paper, however, provides details of only one case from this evaluation pool. Compared to the outcome of these cases using a traditional DF investigation process, the new model showed a number of benefits. It allowed a more effective focusing of the investigation, and provided logical directions for identifying the location of further relevant evidence. It also enabled a better understanding and interpretation of victim/offender behaviours (e.g., probable offenders' motivations and modus operandi), which facilitated a more in depth understanding of the dynamics of the specific crime. Finally, in some cases, it enabled the identification of suspect's collaborators, something which was not identified via the traditional investigative process.

Applying Semantic Technologies to Fight Online Banking Fraud

Cybercrime tackling is a major challenge for Law Enforcement Agencies (LEAs). Traditional digital forensics and investigation procedures are not coping with the sheer amount of data to analyse, which is stored in multiple devices seized from distinct, possibly-related cases. Moreover, inefficient information representation and exchange hampers evidence recovery and relationship discovery. Aiming at a better balance between human reasoning skills and computer processing capabilities, this paper discusses how semantic technologies could make cybercrime investigation more efficient. It takes the example of online banking fraud to propose an ontology aimed at mapping criminal organisations and identifying malware developers. Although still on early stage of development, it reviews concepts to extend from well-established ontologies and proposes novel abstractions that could enhance relationship discovery. Finally, it suggests inference rules based on empirical knowledge which could better address the needs of the human analyst.

Archival science, digital forensics, and new media art

Digital archivists and traditional digital forensics practitioners have significant points of convergence as well as notable differences between their work. This paper provides an overview of how digital archivists use digital forensics tools and techniques to approach their work, comparing and contrasting archival with traditional computer forensics. Archives encounter a wide range of digital materials. This paper details a specific example within archival forensics—the analysis of complex, interactive, new media digital artworks. From this, the paper concludes with considerations for future directions and recommendations to the traditional forensics community to support the needs of cultural heritage institutions.

Profiling software applications for forensic analysis

Computers are now a fundamental part of our professional lives. Although advanced technologies are being used to contain digital crimes, alongside these are other technologies that have expanded a criminal community that is constantly searching for new means to commit crimes in more sophisticated ways. Due to the availability of corporate data on the web, coupled with the open access nature of the web, digital miscreants can commit cybercrimes either as legitimate or illegitimate users. Traditional digital forensics involves static analysis of the data available on permanent storage media, while live analysis allows running systems to be examined to analyse volatile data. However, live analysis is not without its challenges, not least because each application has different effects on the system. Mamoona Rafique and Muhammad Naeem Ahmed Khan present a model for profiling the behaviour of application programs. This allows investigators to build a behavioural profile of each application in order to understand its effects on the system.

Cloud forensics: Technical challenges, solutions and comparative analysis

Cloud computing is arguably one of the most significant advances in information technology (IT) services today. Several cloud service providers (CSPs) have offered services that have produced various transformative changes in computing activities and presented numerous promising technological and economic opportunities. However, many cloud customers remain reluctant to move their IT needs to the cloud, mainly due to their concerns on cloud security and the threat of the unknown. The CSPs indirectly escalate their concerns by not letting customers see what is behind virtual wall of their clouds that, among others, hinders digital investigations. In addition, jurisdiction, data duplication and multi-tenancy in cloud platform add to the challenge of locating, identifying and separating the suspected or compromised targets for digital forensics. Unfortunately, the existing approaches to evidence collection and recovery in a non-cloud (traditional) system are not practical as they rely on unrestricted access to the relevant system and user data; something that is not available in the cloud due its decentralized data processing. In this paper we systematically survey the forensic challenges in cloud computing and analyze their most recent solutions and developments. In particular, unlike the existing surveys on the topic, we describe the issues in cloud computing using the phases of traditional digital forensics as the base. For each phase of the digital forensic process, we have included a list of challenges and analysis of their possible solutions. Our description helps identifying the differences between the problems and solutions for non-cloud and cloud digital forensics. Further, the presentation is expected to help the investigators better understand the problems in cloud environment. More importantly, the paper also includes most recent development in cloud forensics produced by researchers, National Institute of Standards and Technology and Amazon.

Real-time digital forensic triaging for cloud data analysis using MapReduce on Hadoop framework

Cloud computing is a relatively new model in the computing world after several computing paradigms like personal, ubiquitous, grid, mobile, and utility computing. Cloud computing is synonymous with virtualisation which is about creating virtual versions of the hardware platform, the operating system or the storage devices. Virtualisation is omnipresent in the cloud environment that poses challenges to implementation of security as well as cybercrime investigation. Techniques used in traditional digital forensics may not be appropriate for timely analysis of large capacity virtual hard disk files. Hence, there is a need for reducing analysis time for cloud crime cases like child pornography, financial frauds, etc. In this paper, we designed and developed a new 'real-time digital forensic analysis process' to minimise the overall processing time of evidence. Using this approach, the investigator can search user specified patterns for example headers, footers, which can also be used for carving files from evidence data.

Data Handling of Digital Forensics Cloud Computing

With development of network and digital devices, traditional digital forensics tools show their drawbacks, and investigators need new forensics tools to deal with enormous digital evidences. Therefore, this paper introduces digital forensics and cloud computing, then lists the advantages of private forensics cloud computing, proposes a model of Data Handling of Digital Forensics Cloud Computing.

A Machine Learning-based Triage methodology for automated categorization of digital media

The global diffusion of smartphones and tablets, exceeding traditional desktops and laptops market share, presents investigative opportunities and poses serious challenges to law enforcement agencies and forensic professionals. Traditional Digital Forensics techniques, indeed, may be no longer appropriate for timely analysis of digital devices found at the crime scene. Nevertheless, dealing with specific crimes such as murder, child abductions, missing persons, death threats, such activity may be crucial to speed up investigations. Motivated by this, the paper explores the field of Triage, a relatively new branch of Digital Forensics intended to provide investigators with actionable intelligence through digital media inspection, and describes a new interdisciplinary approach that merges Digital Forensics techniques and Machine Learning principles. The proposed Triage methodology aims at automating the categorization of digital media on the basis of plausible connections between traces retrieved (i.e. digital evidence) and crimes under investigation. As an application of the proposed method, two case studies about copyright infringement and child pornography exchange are then presented to actually prove that the idea is viable. The term “feature” will be regarded in the paper as a quantitative measure of a “plausible digital evidence”, according to the Machine Learning terminology. In this regard, we (a) define a list of crime-related features, (b) identify and extract them from available devices and forensic copies, (c) populate an input matrix and (d) process it with different Machine Learning mining schemes to come up with a device classification. We perform a benchmark study about the most popular mining algorithms (i.e. Bayes Networks, Decision Trees, Locally Weighted Learning and Support Vector Machines) to find the ones that best fit the case in question. Obtained results are encouraging as we will show that, triaging a dataset of 13 digital media and 45 copyright infringement-related features, it is possible to obtain more than 93% of correctly classified digital media using Bayes Networks or Support Vector Machines while, concerning child pornography exchange, with a dataset of 23 cell phones and 23 crime-related features it is possible to classify correctly 100% of the phones. In this regards, methods to reduce the number of linearly independent features are explored and classification results presented.