Digital forensics is a relatively new scientific discipline, but one that has matured greatly over the past decade. In any field of human endeavor, it is important to periodically pause and review the state of the discipline. This paper examines where the discipline of digital forensics is at this point in time and what has been accomplished in order to critically analyze what has been done well and what ought to be done better. The paper also takes stock of what is known, what is not known and what needs to be known. It is a compilation of the author’s opinion and the viewpoints of twenty-one other practitioners and researchers, many of whom are leaders in the field. In synthesizing these professional opinions, several consensus views emerge that provide valuable insights into the “state of the discipline.”

/pdf/digital-forensic-research-the-good-the-bad-and-the-2cnxvlgjel.pdf

Digital forensic research: the good, the bad and the unaddressed

Anti-forensics is the practice of circumventing classical forensics analysis procedures making them either unreliable or impossible. In this paper we propose the use of machine learning algorithms and anomaly detection to cope with a wide class of definitive anti-forensics techniques. We test the proposed system on a dataset we created through the implementation of an innovative technique of anti-forensics, and we show that our approach yields promising results in terms of detection.

/pdf/seeing-the-invisible-forensic-uses-of-anomaly-detection-and-3x09nywabe.pdf

Seeing the invisible: forensic uses of anomaly detection and machine learning

Digital forensics starts to show its role and contribution in the society as a solution in disclosure of cybercrime. The essential in digital forensics is chain of custody, which is an attempt to preserve the integrity of digital evidence as well as a procedure for performing documentation chronologically toward evidence. The characteristics of digital evidence have caused the handling chain of custody is becoming more complicated and complex. A number of researchers have contributed to provide solutions for the digital chain custody through a different point of views. This paper gives an overview of the extent to which the problem and challenges are faced in the digital chain of custody issue as well as the scope of researches that can be done to contribute in the issue of the digital chain of custody.

/pdf/digital-chain-of-custody-state-of-the-art-4aoyc2h7uy.pdf

Digital Chain of Custody: State of the Art

Designing a cluster-based covert channel to evade disk investigation and forensics

File system anti-forensics - types, techniques and tools

The use of digital forensic tools by law enforcement agencies has made it difficult for malicious individuals to hide potentially incriminating evidence. To combat this situation, the hacker community has developed anti-forensic tools that remove or hide electronic evidence for the specific purpose of undermining forensic investigations. This paper examines the latest techniques for hiding data in the popular Ext2 and Ext3 file systems. It also describes techniques for detecting hidden data in the reserved portions of these file systems.

/pdf/detecting-hidden-data-in-ext2-ext3-file-systems-92p9dkzmmu.pdf

Detecting Hidden Data in Ext2/Ext3 File Systems

The storage and handling of digital evidence are creating significant challenges for federal, state and local law enforcement agencies. The problems include acquiring and processing massive amounts of digital evidence, maintaining the integrity of the evidence, and storing digital evidence for extended periods of time. This paper describes a network-based storage architecture that helps address these issues. The architecture also supports collaborative efforts by examiners and investigators located at geographically dispersed sites.

/pdf/a-network-based-architecture-for-storing-digital-evidence-1adpxfmiho.pdf

A Network-Based Architecture for Storing Digital Evidence

Individuals who wish to avoid leaving evidence on computers and networks often use programs that conceal data from conventional digital forensic tools. This paper discusses the application of passive file system analysis techniques to detect trace evidence left by data concealment programs. In addition, it describes the design and operation of Seraph, a tool that determines whether certain encryption, steganography and erasing programs were used to hide or destroy data.

/pdf/detecting-data-concealment-programs-using-passive-file-mh7pfdtdyz.pdf

Detecting Data Concealment Programs Using Passive File System Analysis

Data can be hidden in BIOS chips without hindering computer performance. This feature has been exploited by virus writers and computer game enthusiasts. Unused BIOS storage can also be used by criminals, terrorists and intelligence agents to conceal secrets. However, BIOS chips are largely ignored in digital forensic investigations. Few techniques exist for imaging BIOS chips and no tools are available specifically for analyzing BIOS data.

/pdf/forensic-analysis-of-bios-chips-zrve17wu9c.pdf

Forensic Analysis of BIOS Chips

Digital forensic investigations can be subverted by hostile forensic techniques and tools. This paper examines various hostile forensic techniques, including the exploitation of vulnerabilities in standard forensic procedures and denial of service attacks on forensic tools during imaging and analysis. Several techniques for concealing evidence within file systems and external to file systems are highlighted. In addition, strategies for countering hostile forensic techniques and tools are discussed.

/pdf/countering-hostile-forensic-techniques-3lapmyadir.pdf

Mark Davis

Papers

Detecting Hidden Data in Ext2/Ext3 File Systems

A Network-Based Architecture for Storing Digital Evidence

Detecting Data Concealment Programs Using Passive File System Analysis

Forensic Analysis of BIOS Chips

Countering Hostile Forensic Techniques