Building theoretical underpinnings for digital forensics research

Currently, about half of all global enterprises are adopting and using some form of cloud computing services. In cloud computing, potential digital evidence is distributed across multiple isolated ...

A natural human language framework for digital forensic readiness in the public cloud

Summary Constant developments in information technology and communication have posed challenges for those policing cyber crimes. Due to the application of computer used to investigate computer-based crime has led to development of a new field called computer forensics. This paper discusses the research category in computer forensics and identifies key research issues of each of the category. Hopefully this paper would provide foundation and new ideas for the researcher to better understand the concepts of computer forensic. The outcome presents in this paper came from thoroughly review of recent computer forensic literatures.

/pdf/advances-in-computer-forensics-2r1c5uq3y3.pdf

Advances in computer forensics

Virtual machine technology has emerged with powerful features, offering several benefits and promising revolutionary outcomes. It is one technology that combines into one package several computing concepts like resource management, emulation, time-sharing, isolation and partitioning. These features have made evidence acquisition and preservation difficult and in some cases unfeasible. The aftermath is that conventional approaches to integrity preservation have not yielded the best results required to facilitate acceptability. Subjects around virtualization forensics, its affiliation with digital evidence integrity, and impacts on admissibility have been decisively examined. A part of this discourse dwelt on recognising potential threats to the integrity and reliability of evidence from a virtual environment; specifically using VMware Virtual Machine Monitor as a case study. A theoretical framework for preserving the integrity of digital evidence from such environments is introduced. This structure highlights guidelines, processes and parameters essential for keeping the accuracy, consistency and trustworthiness of digital evidence, made possible via abstractions from eminent integrity principles of well-formed transactions and separation of duties as proposed by Clark and Wilson. Key parameters in the model include; strength of hash functions, number of evidence attributes, and number of evidence cycle covered; all represented conceptually in a mathematical model. This is further consolidated with the introduction of an integrity rating factor/threshold and the definition of an integrity enforcement process in line with globally recommended standards. While still working on practical demonstration of the proposed model, the work done so far is seen to open a path for unification and amplification of trust levels required for the admissibility of virtual environment evidence.

/pdf/safeguarding-forensic-integrity-of-virtual-environment-nyrdh3wk0b.pdf

Safeguarding Forensic Integrity of Virtual Environment Evidence

Mobile devices form an integral part of our daily lives and have the potential to be used as tools to curb crime. In recent years, many criminal activities have gone unsolved due to a lack of sufficient evidence to convict the perpetrators. Together with recent developments and advances in research, technology such as mobile devices (popularly known as ’smart phones’) is now capable of acting as devices for capturing real-time potential digital evidence. The continued advancement in the features of mobile devices such as photos, as well as video and voice-recording options, has enhanced their applicability as capturing devices for real-time potential digital forensic evidence. In digital forensic investigation, one of the challenges that law enforcement agencies encounter is to corroborate the findings at the crime scene with digital evidence of the crime. By using a mobile and portable device as a tool for acquiring real-time potential digital evidence in the form of photos or video and voice recordings, this challenge can be greatly overcome. The problem is that it is difficult to ascertain, the integrity of the captured digital evidence of a crime scene when using the advanced capabilities of these mobile and portable devices. The research in hand proposes an online neighbourhood watch (ONW) system that can overcome these challenges. The ONW system is a tool that can be used to acquire potential digital evidence (PDE) and preserve the integrity of the captured PDE. Access to the stored PDE in an ONW system’s repository is strictly monitored and controlled in order to maintain the confidentiality and integrity of the PDE. The ONW system enables members of a community in South Africa to upload PDE of a crime scene in the form of audio, video and digital images to the ONW repository. The PDE is then made available to the law enforcement agents and digital forensics analysts to assist them in furthering investigations or in solving the crimes involved. The ONW system balances public safety with the privacy rights of the PDE generators and the possible offenders whose images have been captured. It takes into consideration the privacy policies, laws and ethics that may apply due to the devices’ generated metadata of users’ personal details, especially during a digital evidence presentation in a court of law. © University of Pretoria

Digital forensic evidence acquisition to mitigate neighbourhood crime

https://dfrws.org/wp-content/uploads/2019/06/2002_USA_paper-can_digital_evidence_endure_the_test_of_time.pdf

Michael Duren

Papers

Can Digital Evidence Endure the Test of Time