Privacy Levels for Computer Forensics: Toward a More Efficient Privacy-preserving Investigation

Evidence is the key to solve any crime. Evidence integrity needs to be protected in order to make it admissible in the court of law. Digital evidence is more revealing, but it is fragile; it can easily be tampered with or modified. There are different techniques available to protect the integrity of digital evidence. Different automated digital evidence acquisition tools are available in the market. In this paper, we have analyzed two automated tools (EnCase and FTK Imager) that are used for disk imaging. These tools claim to protect the integrity of digital evidence. The techniques used by these tools are analyzed in this paper. Problems with their approaches are discussed and a solution is proposed to address the problems. A prototype of an automated tool is developed with an implementation of the proposed solution.

/pdf/protecting-digital-evidence-integrity-and-preserving-chain-3x9p4ue3cb.pdf

Protecting Digital Evidence Integrity and Preserving Chain of Custody

http://digitalcommons.newhaven.edu/cgi/viewcontent.cgi?article=1052&context=electricalcomputerengineering-facpubs

A method and a case study for the selection of the best available tool for mobile device forensics using decision analysis

This paper argues the need for a practical, ethically grounded approach to digital forensic investigations, one that acknowledges and respects the privacy rights of individuals and the intellectual capital disclosure rights of organizations, as well as acknowledging the needs of law enforcement. The paper derives a set of ethical guidelines, and then maps these onto a forensics investigation framework. The framework to expert review in two stages is subjected, refining the framework after each stage. The paper concludes by proposing the refined ethically grounded digital forensics investigation framework. The treatise is primarily UK based, but the concepts presented here have international relevance and applicability.,In this paper, the lens of justice theory is used to explore the tension that exists between the needs of digital forensic investigations into cybercrimes on the one hand, and, on the other, individuals' rights to privacy and organizations' rights to control intellectual capital disclosure.,The investigation revealed a potential inequality between the practices of digital forensics investigators and the rights of other stakeholders. That being so, the need for a more ethically informed approach to digital forensics investigations, as a remedy, is highlighted and a framework proposed to provide this.,The proposed ethically informed framework for guiding digital forensics investigations suggests a way of re-establishing the equality of the stakeholders in this arena, and ensuring that the potential for a sense of injustice is reduced.,Justice theory is used to highlight the difficulties in squaring the circle between the rights and expectations of all stakeholders in the digital forensics arena. The outcome is the forensics investigation guideline, PRECEpt: Privacy-Respecting EthiCal framEwork, which provides the basis for a re-aligning of the balance between the requirements and expectations of digital forensic investigators on the one hand, and individual and organizational expectations and rights, on the other.

/pdf/precept-a-framework-for-ethical-digital-forensics-2ld675gyj8.pdf

PRECEPT: a framework for ethical digital forensics investigations

In today’s information technology age, our political discourse is shrinking to fit our smartphone screens. Further, with the availability of inexpensive and ubiquitous mass communication tools like social media, disseminating false information and propaganda is both convenient and effective. Groups use social media to coordinate cyber propaganda campaigns in order to achieve strategic and political goals, influence mass thinking, and steer behaviors or perspectives about an event. In this research, we study the online deviant groups (ODGs) who created a lot of cyber propaganda that were projected against the NATO’s Trident Juncture Exercise 2015 (TRJE 2015) on both Twitter and blogs. Anti-NATO narratives were observed on social media websites that got stronger as the TRJE 2015 event approached. Call for civil disobedience, planned protests, and direct action against TRJE 2015 propagated on social media websites. We employ computational social network analysis and cyber forensics informed methodologies to study information competitors who seek to take the initiative and the strategic message away from NATO in order to further their own agenda. Through social cyber forensics tools, e.g., Maltego, we extract metadata associated with propaganda-riddled websites. The extracted metadata helps in the collection of social network information (i.e., friends and followers) and communication network information (i.e., network depicting the flow of information such as tweets, retweets, mentions, and hyperlinks). Through computational social network analysis, we identify influential users and powerful groups (or the focal structures) coordinating the cyber propaganda campaigns. The study examines 21 blogs having over 18,000 blog posts dating back to 1997 and over 9000 Twitter users for the period between August 3, 2014, and September 12, 2015. These blogs were identified, crawled, and stored in our database that is accessible through the Blogtrackers tool. Blogtrackers tool further helped us identify the activity patterns of blogs, keyword patterns, and the influence a blog or a blogger has on the community, and analyze the sentiment diffusion in the community.

Leveraging Social Network Analysis and Cyber Forensics Approaches to Study Cyber Propaganda Campaigns

In this research, a literature review was conducted where twenty (n=20) frameworks and models highlighting preservation of the integrity of digital evidence and protection of basic human rights during digital forensic investigations were studied. The models not discussing the process at an abstract level were excluded. Therefore, thirteen (n=13) of the studied models were included in our analysis. The results indicated that published abstract models lack preserving the integrity of digital evidence and protecting the basic human rights as explicit overarching umbrella principles. To overcome this problem, we proposed an extension to Reith's abstract digital forensics model explicating preservation of integrity and protection of human rights as the two necessary umbrella principles.

Ibrahim Bagilli

Papers

Extended abstract digital forensics model with preservation and protection as umbrella principles