Digital Forensics

In recent past, there are a lot of research advancements in mobile forensics tools. This is so due to increase usage of mobile phones in storage of information, law enforcement, mobile online transactions, and also negatively by criminals due to increased computational capabilities. Mobile forensics devices continue to remain a very challenging task due to poor user data retrieval techniques for evidence retrieval. Recently, third party applications assume a veritable feet because it is supported by majority of mobile devices platforms, thereby making it easy to extract information of its users' for future criminal audit. This paper proposes an evidence data retrieval method from InstagramApp using two networks based platforms (that is, pure peer-to-peer (PPP) and special cluster peer (SCP) based), whose concept is to manage mobile device communication and generate multiple copies of users data/information to be dumped across three servers. The forensic test results were obtaine...

Crimes committed within electronic or digital domains, particularly within cyberspace, have become extremely common these days. Criminals are using technology to a great extent in committing various digital offences and creating new challenges for law enforcement agents, attorneys, judges, military, and security professionals. Digital forensics has become an incredible useful and invaluable tool in the detection of criminal activities, identifying and solving computer-based and computer-assisted crimes. This paper provides a brief introduction to digital forensics.

— Today’s growing number of security threats to computers and networks also increase the importance of log inspections to support the detection of possible breaches. The investigation and assessment of security incidents becomes more and more a dai-ly business. Further, the manual log analysis is essentially in the context of developing signatures for intrusion detection systems (IDS), which allow for an automated defense against security attacks or incidents. But the analysis of log data in the context of fo-rensic investigations and IDS signature development is a tedious and time-consuming task, due to the large amount of textual data. Moreover, this task requires a skilled knowledge to differentiate between the important and the non-relevant information. In this paper, we propose an approach for log resp. audit data representation, which aims at simplifying the analysis process for the secu-rity officer. For this purpose audit data and existing relations between audit events are ...

Abstract—Forensic analysis of a suspect program is a daily challenge encounters forensic analysts and law-enforcement. It requires determining the behavior of a suspect program found in a computer system subject to investigation and attempting to reconstruct actions that have been invoked in the system. In this research paper, a forensic analysis approach for suspect programs in an executable binary form is introduced. The proposed approach aims to reconstruct high level forensic actions and approximate action arguments from low level machine instructions; That is, reconstructed actions will assist in forensic inferences of evidence and traces caused by an action invocation in a system subject to forensics investigation.

German physicist Georg Christoph Lichtenberg once said, “The most dangerous of all falsehoods is a slightly distorted truth.” In our multimedia–driven society, where photographic and video evidence enjoys an epistemologically unique status, this observation is exceedingly ominous.

Dengan lebih dari 1000 juta pengguna aktif berdasarkan survey 2017 perkembangan ini semakin meningkat setiap tahunnya [1]. Perlu diketahui bahwa WhatsApp mempunyai suatu tabel database yang tersimpan secara rasahsia didalam sistem sistem Android yang selalu update secara realtime. Database ini selau dicadangkan secara otomatis melalui fitur autobackup yang tersimpan berbeda dengan database utama. Database hasil backup ini mempunyai format file .crypt12. File crypt12 ini tidak dapat diakses secara sembarang karena telah dienkripsi oleh apliksi ini. Beberapa penelitian telah banyak membahas tentang WhatsApp forensics diperangkat android dengan menggunakan beberapa medode salah satunya adalah metode " logical Extraction " [4]. Dalam melakukan uji coba forensics muncul permasalahan ketika akan dilakukan uji forensics pengguna aplikasi telah menghapus percakapan yang telah dilakukan ini bertujuan untuk menghilangkan jajak dari pengguna WhatsApp. Didalam kasus ini sebenarnya kit...

In this paper, an experimental evaluation of one of the most effective source camera identification techniques proposed so far, by Lukáš et al., is presented. This method uses the characteristic noise left by the sensor on a digital picture as a fingerprint in order to identify the source camera used to take the picture. The aim of the experiments is to assess the effectiveness of this technique when used with pictures that were previously modified using several common image-processing functions coming with photo-editing tools. The results seem to confirm that, in most cases, the method by Lukáš et al. is resilient to the modifications introduced by the considered image-processing functions. However, it was possible to identify several cases where the quality of the identification process deteriorated because of the noise introduced by the image-processing.

— An automatic verification of person's identity from its voice is a part of modern telecommunication services. In order to execute a verification task, a speech signal has to be transmitted to a remote server. So, a performance of the verification system can be influenced by various distortions that can occur when transmitting a speech signal through a communication channel. This paper studies an effect of the state of art wideband (WB) speech codecs on a performance of automatic speaker verification in the context of a channel/codec mismatch between enrollment and test utterances. The speaker verification system is developed on GMM-UBM method. The results show that EVS codec provides the best performance over all the investigated scenarios in this study. Moreover, deploying G.729.1 codec in a training process of the verification system provides the best equal error rate in the fully-codec mismatched scenario. Anyhow, differences between the equal error rates reported for all of the codecs involved in this scenario are mostly nonsignificant.

The success of any statistical steganalysis algorithm depends on the choice of features extracted and the classifier employed. This paper proposes steganalysis using random forests (SURF) employing HCS (Huffman Code Statistics) features and FR Index (ratio of File size to Resolution). The proposed algorithm is validated over an image database of over 30,000 images spanning various sizes, resolutions, qualities and textures to detect four widely used steganographic schemes namely LSB (Least Significant Bit) encoding, JPHS (JPEG Hide & Seek), MBS (Model Based Steganography) and PQ (Perturbed Quantization). The SURF algorithm proves random forest to be an efficient classifier for steganalysis and its performance is found to be superior compared to current steganalysis methods.

Substantial progress has been achieved in voice-based biometrics in recent times but a variety of challenges still remain for speech research community. One such obstacle is reliable speaker authentication from speech signals degraded by lossy compression. Compression is commonplace in modern telecommunications, such as mobile telephony, VoIP services, teleconference, voice messaging or gaming. In this study, the authors investigate the effect of lossy speech compression on text-independent speaker verification. Voice biometrics performance is evaluated on clean speech signals distorted by the state-of-the-art narrowband (NB) as well as wideband (WB) speech codecs. The tests are performed in both channel-matched and channel-mismatched scenarios. The test results show that coded WB speech improves voice authentication precision by 1–3% of equal error rate over coded NB speech, even at the lowest investigated bitrates. It is also shown that the enhanced voice services codec does not p...

—The field of digital forensic analysis has emerged in the past two decades to counter the digital crimes and investigate the modus operandi of the culprits to secure the computer systems. With the advances in technologies and pervasive nature of the computing devices, the digital forensic analysis is becoming a challenging task. Due to ease of digital equipment and popularity of Internet, criminals have been enticed to carry out digital crimes. Digital forensic is aimed to investigate the criminal activity and bring the culprits to justice. Traditionally the static analysis is used to investigate about an incident but due to a lot of issues related the accuracy and authenticity of the static analysis, the live digital forensic analysis shows an investigator a more complete picture of memory dump. In this paper, we introduce a module for profiling behavior of application programs. Profiling of application is helpful in forensic analysis as one can easily analyze the compromised system. Profiling is also helpful to the investigator in conducting malware analysis as well as debugging a system. The concept of our model is to trace the unique process name, loaded services and called modules of the target system and store it in a database for future forensic and malware analysis. We used VMware workstation version 9.0 on Windows 7 platform so that we can get the detailed and clean image of the current state of the system. The profile of the target application includes the process name, modules and services which are specific to an application program.

Digital forensics is the application of forensic and scientific knowledge to retrieve information legally from any digital device such as computers and smartphones. This legally fetched information is then presented as a piece of evidence in the courtroom further. Computer forensics also refers to digital forensics. It is the fusion of domains such as network forensics, server forensics, computer forensics, internet forensics, social media forensics, memory forensics, online gaming, data/disk forensics, and VR forensics. While investigating digital crimes, different steps are involved. These include the identification, recovery, investigation, validation, and presentation of evidence. Recent research has demonstrated the immense succession of cyber threats and attacks, requiring forensic experts and forensic scientists to simplify the digital world system. Since digital forensics is straightforwardly interconnected to data recovery and data carving, this area is dealing with different technical, legal, and resource challenges. In contrast to that, malware's constant rise allows forensic sector slacking. The objective of the present study was to explore new dimensions of digital forensics such as internet forensics, social media forensics, and IoT forensics in various emerging fields. Together, all our findings allow a better understanding of digital forensics, which can be helpful in forensic investigation.

With the raise in practice of Internet, in social, personal, commercial and other aspects of life, the cybercrime is as well escalating at an alarming rate. Such usage of Internet in diversified areas also augmented the illegal activities, which in turn, bids many network attacks and threats. Network forensics is used to detect the network attacks. This can be viewed as the extension of network security. It is the technology, which detects and also suggests prevention of the various network attacks. Botnet is one of the most common attacks and is regarded as a network of hacked computers. It captures the network packet, store it and then analyze and correlate to find the source of attack. Various methods based on this approach for botnet detection are in literature, but a generalized method is lacking. So, there is a requirement to design a generic framework that can be used by any botnet detection. This framework is of use for researchers, in the development of their own method of botnet detection, by means of providing methodology and guidelines. In this paper, various prevalent methods of botnet detection are studied, commonalities among them are established and then a generalized model for the detection of botnet is proposed. The proposed framework is described as UML diagrams.

When computer security violations are detected, com-puter forensic analysts attempting to determine the relevant causes and effects are forced to perform the tedious tasks of finding and preserving useful clues in large networks of op-erational machines. To augment a computer crime ...

During forensic examination, analysis of unallocated space of seized storage media is essential to extract the previously deleted or overwritten files when the file system metadata is missing or corrupted. The process of recovering files from the unallocated space based on file type-specific information (header and footer) and/or file contents is known as Data Carving. The research in this domain has witnessed various
technological enhancements in terms of tools and techniques over the past years. This paper surveys various data carving techniques, in particular multimedia files and classifies the research in the domain into three categories: classical carving techniques, smart carving techniques and modern carving
techniques. Further, seven popular multimedia carving tools are empirically evaluated. We conclude with the need to develop the new techniques in the field for carving multimedia files due to the fact that the fragmentation and compression are very common issues for these files.

Secure communication is a necessity that must be considered in any smart application to guarantee the confidentiality of information. Recently, ZigBee has been utilized in different smart applications such as automatic metering, power fraud detection, industrial automation and many more. In this research paper, we evaluate the performance of ZigBee from a security perspective. We explore the ZigBee built-in security services, encryption techniques, security keys, and the trust center. The research findings serve as guidelines to focus on wireless communication security in general and on the ZigBee security issues in specific. There is a crucial need to fill in the gap where ZigBee has low-complexity processing capabilities and the need to integrate more robust enhancements and security controls.

In this paper, we deal with introducing a technique of digital forensics for reconstruction of events or evidences after the commitment of a crime through any of the digital devices. It shows a clear transparency between Computer Forensics and Digital Forensics and gives a brief description about the classification of Digital Forensics. It has also been described that how the emergences of various digital forensic models help digital forensic practitioners and examiners in doing digital forensics. Further, discussed Merits and Demerits of the required models and review of every major model.

If we start from the concept: “Forensic Computer is the science of extracting data so that it can be presented as evidence in a court of law” (Albert J. Marcella, 2007), in the process of extraction is important the recovery, examination and analysis of digital evidence; the recovery should be logical and physical starting from the identification of the type of partition, the identification of hidden drives. In the above process “investigation and examination”, the using of tools to recover deleted information that is related to the case is necessary, These tools must be standardized for proper information security, each disk drives a record of the data in each cluster, when a file is deleted, the reference to that file is removed from the record but the data is not actually delete from the disk (Casey, 2003). In all storages devices, external and internal the data will remain on the disk indefinitely, even when a deleted file is overwritten if the new file does not take up the entire cluster, for this reason a portion of the old file might remain in the slack space. When collecting the entire contents of a computer, a bitstream copy copies what is in slack space and unallocated space, whereas a regular copy does not, bistream copy duplicates everything in a cluster. (Casey, 2003) According to (Schweitzer, 2003) the proper forensic analysis the first step is to collect computer evidence, image is one of the first procedure to be carried out after the contents of the computer’s memory have been copied and preserved, the imaging process is nondestructive to the data and some cases not require the operating system.

We are glad to inform you that the School of Engineering & Technology, Sharda University, Greater Noida is organizing One Week International FDP on "Recent Trends in Cyber Security" through online mode from 26th June -01st July, 2021.

You are invited to attend the same and register yourself.

Kindly register yourself at the earliest by visiting the following link: https://forms.gle/jpsutNDPE2apNdaC7

Software tools designed for disk analysis play a critical role today in digital forensics investigations. However, these digital forensics tools are often difficult to use, usually task specific, and generally require professionally trained users with IT backgrounds. The relevant tools are also often open source requiring additional technical knowledge and proper configuration. This makes it difficult for investigators without some computer science background to easily conduct the needed disk analysis. In this dissertation, we present AUDIT, a novel automated disk investigation toolkit that supports investigations conducted by non-expert (in IT and disk technology) and expert investigators. Our system design and implementation of AUDIT intelligently integrates open source tools and guides non-IT professionals while requiring minimal technical knowledge about the disk structures and file systems of the target disk image. We also present a new hierarchical disk investigation model whi...

The utilization of the internet within organizations has surged over the past decade. Though, it has numerous benefits, the internet also comes with its own challenges such as intrusions and threats. Bring Your Own Device (BYOD) as a growing trend among organizations allow employees to connect their portable devices such as smart phones, tablets, laptops, to the organization’s network to perform organizational duties. It has gained popularity over the years because of its flexibility and cost effectiveness. This adoption of BYOD has exposed organizations to security risks and demands proactive measures to mitigate such incidents. In this study, we propose a Digital Forensic Readiness (DFR) framework for BYOD using honeypot technology. The framework consists of the following components: BYOD devices, Management, People, Technology and DFR. It is designed to comply with ISO/IEC 27043, detect security incidents/threats and collect potential digital evidence using lowand high-level inte...

WhatsApp is a medium that everyone can use to interact and to share information effectively and efficiently. However, it can be misused for criminal activities. Analyzing WhatsApp' artifacts is quite challenging as the suspect may have a lot of random conversational data to be considered. This makes it difficult for the trial process to obtain digital traces that can be identified in malicious activities such as knowing who was involved when the conversation was held and the timespan. Therefore, in this research, a social media investigation of WhatsApp was carried out by acquiring data from rooted Android devices that were used as target devices for forensic activities. A python-based application is developed to show the content of the conversation, and a web-based application is presented to visualize the data using the Timeline method. Experimental results in this research display important timeline information such as information about who was involved when and what time the...

This paper discusses the concept of a virtual digital forensic laboratory, which incorporates networked examination and storage machines, secure communications, multi-factor authentication, role-based access control, and case management and digital asset management systems. Laboratory activities such as the examination, storage and presentation of digital evidence can be geographically distributed and accessed over a network by users with the appropriate credentials. The advantages of such a facility include reduced costs through shared resources and the availability of advanced expertise for specialized cases.

Similarity digesting is a class of algorithms and technologies that generate hashes from files and preserve file similarity.  They find applications in various  areas across security industry:  malware variant detection, spam filtering, computer forensic analysis, data loss  prevention and etc..  There are a few schemes and tools available that include ssdeep, sdhash and TLSH.  While being useful for detecting file similarity,  they define  similarity from different perspectives.  In other words, they take different approaches to describe what file similarity is about.  In order to compare those tools with better evaluation,  we introduce  a simple mathematical model to describe similarity that would cover  all three  schemes and beyond.  This model enables us to establish a theoretic framework  for  analyzing essential differences of  various similarity digesting algorithms & tools. As a result, a few tools are found to be complementary to each other so that we can use them in a hybrid approach in practice.  Data experiment results are provided to support the theoretic analysis.  In addition, we introduce a novel similarity digesting scheme that were designed based on the mathematical model.

I wrote this case study on 28 October 2002 for the book Hacking Exposed, Fourth Edition, published by McGraw-Hill Osborne Media on 25 February 2013. The book contained the first definition, in print, of the term "network security monitoring."

Cloud Storage is recently as emerging topic in these eras. As the data are increasing, the storage become major issue for the people. There are different kind of Cloud Storage application such as One Drive, Sky Drive, Drop Box and Google Drive. Google Drive is gaining more popularity as it is user friendly than any other Cloud Storage Application. Google Drive is a Cloud Storage Application which allows user to store, share and edit the file in the cloud. In these paper, the authors will perform forensics of Google Drive via di1fferent technique such as using client software, Google Drive access via browser, Memory Analysis, Network Analysis and other techniques. From that the Authors will find, what type of data remnants can be found in user device.

Traffic analysis consists of capturing network traffic in order to identify and respond to anomalies that could be indicative of security threats or other areas of concern.  The communication, network, and technological infrastructures are expanding at a rapid pace and increasingly complex. Moreover, the global community has expanded interconnectedness as routine resulting in extraordinary production of data. 
 
In the event of a cyber attack, the capacity to capture network traffic for analysis is critical to the success of a forensic investigation. Zhou, Yan, Fu, and Yao (2018) determined that the attributes displayed on the slide depict the relevance of capturing network traffic for subsequent analysis. As an analyst, it is important to have the correct tools depending on what is to be done, however if the nucleus is the data and if the rate, type, source, destination and other traffic factors can’t be determined, then you are still ill-equipped.  Capturing network data for investigative purposes is necessary not only to initiate investigations, but allows documentation of lessons learned to improve present infrastructure operations.  However, for it to be value-added, packets must be captured.