Digital forensics research: The next 10 years

Digital Evidence and Computer Crime, Third Edition provides the knowledge necessary to uncover and use digital evidence effectively in any kind of investigation. The widely-adopted first and second editions introduced thousands of students to this field and helped them deal with digital evidence. This completely updated edition provides the introductory materials that new students require, and also expands on the material presented in previous editions to help students develop these skills. The textbook teaches how computer networks function, how they can be involved in crimes, and how they can be used as a source of evidence. Additionally, this third edition includes updated chapters dedicated to networked Windows, Unix, and Macintosh computers, and Personal Digital Assistants. Ancillary materials include an Instructor's Manual and PowerPoint slides. * Provides a thorough explanation of how computers & networks function, how they can be involved in crimes, and how they can be used as evidence * Features coverage of the abuse of computer networks and privacy and security issues on computer networks

Digital Evidence and Computer Crime: Forensic Science, Computers and the Internet

Future challenges for smart cities

Memory encryption has yet to be used at the core of operating system designs to provide confidentiality of code and data. As a result, numerous vulnerabilities exist at every level of the software stack. Three general approaches have evolved to rectify this problem. The most popular approach is based on complex hardware enhancements; this allows all encryption and decryption to be conducted within a well-defined trusted boundary. Unfortunately, these designs have not been integrated within commodity processors and have primarily been explored through simulation with very few prototypes. An alternative approach has been to augment existing hardware with operating system enhancements for manipulating keys, providing improved trust. This approach has provided insights into the use of encryption but has involved unacceptable overheads and has not been adopted in commercial operating systems. Finally, specialized industrial devices have evolved, potentially adding coprocessors, to increase security of particular operations in specific operating environments. However, this approach lacks generality and has introduced unexpected vulnerabilities of its own. Recently, memory encryption primitives have been integrated within commodity processors such as the Intel i7, AMD bulldozer, and multiple ARM variants. This opens the door for new operating system designs that provide confidentiality across the entire software stack outside the CPU. To date, little practical experimentation has been conducted, and the improvements in security and associated performance degradation has yet to be quantified. This article surveys the current memory encryption literature from the viewpoint of these central issues.

http://romisatriawahono.net/lecture/rm/survey/computer%20engineering/Henson%20-%20Memory%20Encryption%20-%202014.pdf

Memory encryption: A survey of existing techniques

https://forensicsandsecurity.com/papers/SurveyEMSideChannelsForensics.pdf

A survey of electromagnetic side-channel attacks and discussion on their case-progressing potential for digital forensics

The integration of strong encryption into operating systems is creating challenges for forensic examiners, potentially preventing us from recovering any digital evidence from a computer. Because strong encryption cannot be circumvented without a key or passphrase, forensic examiners may not be able to access data after a computer is shut down, and must decide whether to perform a live forensic acquisition. In addition, with encryption becoming integrated into the operating system, in some cases, virtualization is the most effective approach to performing a forensic examination of a system with FDE. This paper presents the evolution of full disk encryption (FDE) and its impact on digital forensics. Furthermore, by demonstrating how full disk encryption has been dealt with in past investigations, this paper provides forensics examiners with practical techniques for recovering evidence that would otherwise be inaccessible.

The impact of full disk encryption on digital forensics

https://serval.unil.ch/resource/serval:BIB_52974E4C51C4.P001/REF.pdf

Gerasimos J. Stellatos

Papers

The impact of full disk encryption on digital forensics

The growing impact of full disk encryption on digital forensics