Digital Forensics

Background: Police has relentlessly reported increased crime rates in Uganda, many of which are committed with/or through mobile phones. This positions mobile phones as potential sources of incriminating evidences for digital investigations and crime reporting. In this study, we explored the use of mobile phones for crime investigation and propose an application framework for curbing mobile phone-related crimes in Eastern Uganda, East Africa.Main body: Data was collected using self-administered questionnaires from 36 respondents who were police investigators and State Attorneys. The framework proposed is based on a client-server-model. Results of the study indicated that whereas criminal investigators believe in the application of mobile phones in crime reporting and collaborating evidences, they seldomly use them as a potential source of evidence when making criminal case decisions. Of the 10 files of criminal cases encountered, only 1 to 3 of them were considered during prosecutio...

Yet Another Steganographic Scheme (YASS) is one of the recent steganographic schemes that embeds data at randomized locations in a JPEG image, to avert blind steganalysis. In this paper we present JHUF-5, a statistical steganalyzer wherein J stands for JPEG, HU represents Huffman based statistics, F denotes FR Index (ratio of file size to resolution) and 5 - the number

This paper introduces a mixed‐methods approach for forensically reconstructing the propagation of visual media via networked digital devices. The authors present case studies drawn from political misinformation around the January 6, 2021 riots at the U.S. Capitol. Using interpretive analysis, the authors identify traces of user interfaces that remain in images being shared about the riots. Using computational analysis, the authors evaluate compression levels in digital photographs of the events in question, thus identifying which instances of the image are closer to the source (as well as which images appear to be identical). By combining these two approaches, the authors argue that SMOC BRISQUEt refines our understanding of misinformation's memetic spread—helpful in curbing future abuses as well as in guiding the production of more effective cross‐platform spread when desired.

This paper presents an automated approach to record web activity as the user connects to Internet. It includes monitoring and logging of web URLs visited by the user. The distinctive features of this approach are a) it starts automatically, b) it is transparent to users, c) it is robust ...

The research paper covers one of the most important aspect of the digital forensics investigation “Registry Forensics” as there are several components that are necessary for carrying out digital forensics investigation, one cannot overall the windows registry. The research paper is basically divided into two segments, where the first segment fully explains what registry is, how it works, and what important information stored in it. Moreover, the research paper covers the aspect of anti-forensics elements that are incorporated by different cyber criminals in order to wipe the traces of fraudulent activities, and finally the author has concluded the research paper by highlighting the importance of windows registry in digital forensics investigation.

Blogging gives an ordinary person the ability to have a conversation with a wide audience and has become one of the fastest growing uses of the Web. However, dozens of employee-bloggers have been terminated for exercising what they consider to be their First Amendment right to free speech and would-be consumer advocates face potential liability for voicing their opinions. To avoid identification and prevent retribution, bloggers have sought to maintain anonymity by taking advantage of various tools and procedures antiforensics. Unfortunately some anonymous bloggers also post content that is in violation of one or more laws. Some blogging content might be viewed as harassing others an area known as cyber-bullying. Law enforcement and network forensics specialists are developing procedures called Counter Anti-forensics that show some promise to identify those who violate the law. However, these techniques must be used with caution so as not to violate the rights of others.

Blogging gives an ordinary person the ability to have a conversation with a wide audience and has become one of the fastest growing uses of the Web. However, dozens of employee-bloggers have been terminated for exercising what they consider to be their First Amendment right to free speech and would-be consumer advocates face potential liability for voicing their opinions. To avoid identification and prevent retribution, bloggers have sought to maintain anonymity by taking advantage of various tools and procedures antiforensics. Unfortunately some anonymous bloggers also post content that is in violation of one or more laws. Some blogging content might be viewed as harassing others an area known as cyber-bullying. Law enforcement and network forensics specialists are developing procedures called Counter Anti-forensics that show some promise to identify those who violate the law. However, these techniques must be used with caution so as not to violate the rights of others.

Blogging gives an ordinary person the ability to have a conversation with a wide audience and has become one of the fastest growing uses of the Web. However, dozens of employee-bloggers have been terminated for exercising what they consider to be their First Amendment right to free speech and would-be consumer advocates face potential liability for voicing their opinions. To avoid identification and prevent retribution, bloggers have sought to maintain anonymity by taking advantage of various tools and procedures- antiforensics. Unfortunately some anonymous bloggers also post content that is in violation of one or more laws. Some blogging content might be viewed as harassing others- an area known as cyber-bullying. Law enforcement and network forensics specialists are developing procedures called Counter Anti-forensics that show some promise to identify those who violate the law. However, these techniques must be used with caution so as not to violate the rights of others.

A web browser is a major attack vector which cyber-criminals utilize to land in an environment. The evidence related to the malicious browsing activities can be found in the host which gives valuable information related to the case. These digital footprints involve history, cookies, bookmarks, saved credentials and downloads etc. This paper presents a sophisticated tool aiding the conventional manual investigation process from evidence collection to the final v e rdict b y a u tomating h u man dependent functions, resulting a fast and unbiased analysis of browser forensic artifacts. This tool states its unique value over the existing tools by working operating systems independently, collecting all browsing evidence including deleted artifacts and encrypted saved credentials, automatically analysing the reputation of the extracted evidence, integrating evidence collected from different web browsers into a single timeline, and correlating the adjacent distrustful events inside and outside the host. Eventually, this tool calculates a browsing reputation scorecard and creates a profile for the host, condensing the findings g a thered t h roughout the investigation. The paper presents another important methodology to predict the future browsing reputation score based on the past browsing patterns. Furthermore, multiple cases management feature and dashboard provide a concise overview of overall findings to the forensic investigator.

ABSTRACT Regardless of the established security controls that organizations have put in place to protect their digital assets, a rise in insider threats has been observed and particularly in incidents of data leakage. The importance of data as corporate assets is leading to a growing need for detection, prevention and mitigation of such violations by the organisations. In this paper we are investigating the different types of insider threats and their implications to the corporate environment, with specific emphasis to the special case of data leakage. Organisations should evaluate the risk they are facing due to insider threats and establish proactive measures towards this direction. In response to the challenging problem of identifying insider threats, we design a forensic readiness model, which is able to identify, prevent and log email messages, which attempt to leak information from an organisation with the aid of steganography.

Signal & Image Processing : An International Journal is an Open Access peer-reviewed journal intended for researchers from academia and industry, who are active in the multidisciplinary field of signal & image processing. The scope of the journal covers all theoretical and practical aspects of the Digital Signal Processing & Image processing, from basic research to development of application.

Authors are solicited to contribute to the journal by submitting articles that illustrate research results, projects, surveying works and industrial experiences that describe significant advances in the areas of Signal & Image processing.

Any digital device generates information that may become valuable evidence in the event of a cybercrime incident, security incident, or cyber-attack, but often the collection, management and preservation of this information is not done properly. In the legal field, once information has been obtained from the devices, it is very important to maintain it and preserve it from the initial time, through investigation, until the trial or investigation is concluded, and to preserve it for long term use, in order to avoid it to be tainted, damaged, changed or manipulated and so assuring reliability through the whole process. Preservation of digital evidence is an important aspect when deciding its admissibility in a trial in process, or in any future process, reopened by appeal, or as source of historical information. This paper contains a review of the state of the art about digital preservation in institutions dedicated to criminal investigation, analyzing concepts, related projects, tools and legal support in this area. The motivation of this paper is the idea of finding how close we are to having a framework useful to preserve digital evidence, ensuring integrity, hence increasing its admissibility, and supported by long term preservation technique.

This article's objective is to screen and analyse the common models of digital preservation that exist, the elements, the degree of compliance with the general guidelines, the use of techniques and compliance with specific requirements as well as to evaluate the need for a solution to the environment of criminal investigation institutions, in the scenario that lacks a specific model. The importance of the preservation of digital objects is currently heavily analysed. Several aspects may serve to make the digital objects worthless, such as the uselessness of hardware, the deficiency of ancient computing formats to support their use, human errors and malicious software. The majority of crimes currently have a digital component, such that governments and the police are obliged by law to indefinitely hold digital evidence for a case's history. Until the presentation of the digital evidence in court, the evidence must be collected, preserved and properly distributed. The systems currently used often involve multiple steps that do not meet the demands of the growing digital world. The volume of digital evidence continues to grow, and these steps will soon become operationally and economically unfeasible for agencies responsible for performing these tasks.

The PREDECI model is a model for the preservation of digital evidence-based institutions of criminal investigations where it is essential to preserve evidence that has characteristics of the environment with the purpose of increasing the rate of admissibility of the evidence in court. The aim of this study was to establish a deployment guide to facilitate the implementation of a PREDECI model. This guide includes organizational, operational and administrative aspects and establishes an implementation plan, a development plan and a plan of evaluation of the implementation with a revised bibliography and model characteristics. It is necessary to have a political framework, an initial framework, an organizational framework, an administrative framework, a framework of infrastructure and security, a framework of institutions of criminal investigation, a framework for generation of tools and an evaluation framework.

ABSTRACT Digital preservation is considered as a vital process in order to have long-term information; it has a short history and a fairly coherent and justified fundament. In this article, a comparison of models and standards of digital preservation is developed, as well as the current situation of digital preservation and an analysis about the most outstanding projects that can serve as a basis for the application of an existing preservation model in a specific setting, or the proposal of a new one. A comparison of the existing models and their application in the specific environment of institutions of criminal investigation is performed by determining its applicability to the relevant aspects required in this environment. It is important to bear in mind that for every application domain and its reality, there is a very high probability of requiring a particular model which can be based on the existing ones.

Praise for Forensic Discovery"Farmer and Venema do for digital archaeology what Indiana Jones did for historical archaeology. Forensic Discovery unearths hidden treasures in enlightening and entertaining ways, showing how a time-centric approach to computer forensics reveals even the cleverest intruder. I highly recommend reading this book."--Richard Bejtlich, TaoSecurityPraise for Real Digital Forensics"Real Digital Forensics is as practical as a printed book can be. In a very methodical fashion, the authors cover live response (Unix, Windows), network-based forensics following the NSM model (Unix, Windows), forensics duplication, common forensics analysis techniques (such as file recovery and Internet history review), hostile binary analysis (Unix, Windows), creating a forensics toolkit and PDA, flash and USB drive forensics. The book is both comprehensive and in-depth; following the text and trying the investigations using the enclosed DVD definitely presents an effective way to learn forensic techniques."--Anton Chuvakin, LogLogicPraise for File System Forensic Analysis"Carrier has achieved what few technical authors do, namely a clear explanation of highly technical topics that retains a level of detail making it valuable for the long term. For anyone looking seriously at electronic forensics, this is a must have. File System Forensic Analysis is a great technical resource."--Jose Nazario, Arbor NetworksThe Computer Forensics LibraryWith the ever-increasing number of computer-related crimes, more and more professionals find themselves needing to conduct a forensics examination. But where to start? What if you don't have the time or resources to take a lengthy training course? We've assembled the works of today's leading forensics experts to help you dive into forensics, give you perspective on the big picture of forensic investigations, and arm you to handle the nitty-gritty technicalities of the toughest cases out there.Forensic Discovery, the definitive guide, presents a thorough introduction to the field of computer forensics. Authors Dan Farmer and Wietse Venema cover everything from file systems to memory andkernel hacks and malware. They expose many myths about forensics that can stand in the way of success. This succinct book will get you started with the realities of forensics.Real Digital Forensics allows you to dive right in to an investigation and learn by doing. Authors Keith J. Jones, Richard Bejtlich, and Curtis W. Rose walk you through six detailed, highly realistic investigations and provide a DVD with all the data you need to follow along and practice. Once you understand the big picture of computer forensics, this book will show you what a Unix or Windows investigation really looks like.File System Forensic Analysis completes the set and provides the information you need to investigate a computer's file system. Most digital evidence is stored within the computer's file system, so many investigations will inevitably lead there. But understanding how the file system works is one of the most technically challenging concepts for digital investigators. With this book, expert Brian Carrier closes out the set by providing details about file system analysis available nowhere else.

Over the last few years, law enforcement registered a growing number of crimes related to the worldwide diffusion of high storage capacity low-cost digital devices. As a consequence Computer Forensics, the investigative discipline that aims to find evidence among seized devices is becoming increasingly complex. In this paper, we propose a new approach to digital investigations, based on the application of Data Mining and Knowledge Management theory, which aims to give a theoretical foundation to "post-mortem" Triage. This new practice has the potential utility to speed-up investigations by assigning a priority to each seized device, with a positive impact on the upcoming forensic analysis. The paper shows how the proposed methodology could create intelligence from the extracted data and predict the model's dependent variable (i.e. the class) and its relation with the independent variables (i.e. system configuration files, installed software, file statistics, browser hi...

Forensic study of mobile devices is a relatively new field, dating from the early 2000s. The proliferation of phones (particularly smart phones) on the consumer market has caused a growing demand for forensic examination of the devices, which could not be met by existing Computer Forensics techniques. As a matter of fact, Law enforcement are much more likely to encounter a suspect with a mobile device in his possession than a PC or laptop and so the growth of demand for analysis of mobiles has increased exponentially in the last decade. Early investigations, moreover, consisted of live analysis of mobile devices by examining phone contents directly via the screen and photographing it with the risk of modifying the device content, as well as leaving many parts of the proprietary operating system inaccessible. The recent development of Mobile Forensics, a branch of Digital Forensics, is the answer to the demand of forensically sound examination procedures of gathering, retrieving, identifying, storing and documenting evidence of any digital device that has both internal memory and communication ability [1]. Over time commercial tools appeared which allowed analysts to recover phone content with minimal interference and examine it separately. By means of such toolkits, moreover, it is now possible to think of a new approach to Mobile Forensics which takes also advantage of "Data Mining" and "Machine Learning" theory. This paper is the result of study concerning cell phones classification in a real case of pedophilia. Based on Mobile Forensics "Triaging" concept and the adoption of self-knowledge algorithms for classifying mobile devices, we focused our attention on a viable way to predict phone usage's classifications. Based on a set of real sized phones, the research has been extensively discussed with Italian law enforcement cyber crime specialists in order to find a viable methodology to determine the likelihood that a mobile phone has been used to commit the specific crime of pedophilia, which could be very relevant during a forensic investigation.

ABSTRACT Over the past few years, the number of crimes related to the worldwide diffusion of digital devices with large storage and broadband network connections has increased dramatically. In order to better address the problem, law enforcement specialists have developed new ideas and methods for retrieving evidence more effectively. In accordance with this trend, our research aims to add new pieces of information to the automated analysis of evidence according to Machine Learning-based "post mortem" triage. The scope consists of some copyright infringement court cases coming from the Italian Cybercrime Police Unit database. We draw our inspiration from this "low level" crime which is normally sat at the bottom of the forensic analyst's queue, behind higher priority cases and dealt with the lowest priority. The present work aims to bring order back in the analyst's queue by providing a method to rank each queued item, e.g. a seized device, before being analyzed in detail. The paper draws the guidelines for drive-under-triage classification (e.g. hard disk drive, thumb drive, solid state drive etc.), according to a list of crime-dependent features such as installed software, file statistics and browser history. The model, inspired by the theory of Data Mining and Machine Learning, is able to classify each exhibit by predicting the problem dependent variable (i.e. the class) according to the aforementioned crime-dependent features. In our research context the "class" variable identifies with the likelihood that a drive image may contain evidence concerning the crime and, thus, the associated item must receive an high (or low) ranking in the list. Keywords: computer forensics, automated analysis of evidence, data mining, machine learning, "post mortem" triage.

... Verde 3 Classification of Attacks on Cryptographic Protocols 47 Luca Spalazzi and Simone Tacconi 4 Wi-Fi Security 83 Sufian Yousef 5 ... viii Contents 9 Security and E-Accessibility of Online Banking 155 Hamid Jahankhani, Liaqat Ali and Hossein Jahankhani 10 Towards an ...