National Institute of Standards and Technology における超伝導研究及び生活

The rapid growth in usage and application of Social Networking (SN) platforms make them a potential target by cyber criminals to conduct malicious activities such as identity theft, piracy, illegal trading, sexual harassment, cyber stalking and cyber terrorism. Many SN platforms are extending their services to mobile platforms, making them an important source of evidence in cyber investigation cases. Therefore, understanding the types of potential evidence of users’ SN activities available on mobile devices is crucial to forensic investigation and research. In this paper, we examine four popular SN applications: Facebook, Twitter, LinkedIn and Google+, on Android and iOS platforms, to detect remnants of users’ activities that are of forensic interest. We detect a variety of artefacts (e.g. usernames, passwords, login information, personal information, uploaded posts, exchanged messages and uploaded comments from SN applications) that could facilitate a criminal investigation.

Investigating Social Networking applications on smartphones detecting Facebook, Twitter, LinkedIn and Google+ artefacts on Android and iOS platforms

In today’s Internet-connected world, mobile devices are increasingly used to access cloud storage services, which allow users to access data anywhere, anytime. Mobile devices have, however, been known to be used and/or targeted by cyber criminals to conduct malicious activities, such as data exfiltration, malware, identity theft, piracy, illegal trading, sexual harassment, cyber stalking and cyber terrorism. Consequently, mobile devices are an increasing important source of evidence in digital investigations. In this paper, we examine four popular cloud client apps, namely OneDrive, Box, GoogleDrive, and Dropbox, on both Android and iOS platforms (two of the most popular mobile operating systems). We identify artefacts of forensic interest, such as information generated during login, uploading, downloading, deletion, and the sharing of files. These findings may assist forensic examiners and practitioners in real-world examination of cloud client applications on Android and iOS platforms.

/pdf/forensic-investigation-of-onedrive-box-googledrive-and-1nsrlyye5g.pdf

Forensic investigation of OneDrive, Box, GoogleDrive and Dropbox applications on Android and iOS devices

Forensic investigation of P2P cloud storage services and backbone for IoT networks

The increasing use of smartphones and cloud storage apps allows users to access their data anywhere, anytime. Due to the potential of mobile devices being used and/or targeted by criminals, such devices are an important source of evidence in investigations of both cybercrime and traditional crimes, such as drug trafficking. In this paper, we study the MEGA cloud client app, an increasingly popular alternative to Google Drive, Dropbox and OneDrive, on both Android and iOS platforms. In our study, we identify a range of artefacts arising from user activities, such as login, uploading, downloading, deletion, and the sharing of files, which could be forensically recovered, as well as findings such as modification of files’ timestamps. Our findings contribute to an up-to-date understanding of cloud storage forensics.

Cloud storage forensics: MEGA as a case study

Cloud storage services are popular with both individuals and businesses as they offer cost-effective, large capacity storage and multi-functional services on a wide range of devices such as personal computers (PCs), Mac computers, and smart mobile devices (e.g. iPhones). However, cloud services have also been known to be exploited by criminals, and digital forensics in the cloud remains a challenge, partly due to the diverse range of cloud services and devices that can be used to access such services. Using SugarSync (a popular cloud storage service) as a case study, research was undertaken to determine the types and nature of volatile and non-volatile data that can be recovered from Windows 8, Mac OS X 10.9, Android 4 and iOS 7 devices when a user has carried out different activities such as upload and download of files and folders. We then document the various digital artefacts that could be recovered from the respective devices.

SugarSync forensic analysis

STorage as a Service (STaaS) cloud services have been adopted by both individuals and businesses as a dominant technology worldwide. Similar to other technologies, this widely accepted service can be misused by criminals. Investigating cloud platforms is becoming a standard component of contemporary digital investigation cases. Hence, digital forensic investigators need to have a working knowledge of the potential evidence that might be stored on cloud services. In this chapter, we conducted a number of experiments to locate data remnants of users' activities when utilizing the Ubuntu One cloud service. We undertook experiments based on common activities performed by users on cloud platforms including downloading, uploading, viewing, and deleting files. We then examined the resulting digital artifacts on a range of client devices, namely, Windows 8.1, Apple Mac OS X, and Apple iOS. Our examination extracted a variety of potentially evidential items ranging from Ubuntu One databases and log files on persistent storage to remnants of user activities in device memory and network traffic.

Ubuntu One investigation : detecting evidences on client machines

STorage as a Service (STaaS) cloud services has been adopted by both individuals and businesses as a dominant technology worldwide. Similar to other technologies, this widely accepted service can be misused by criminals. Investigating cloud platforms is becoming a standard component of contemporary digital investigation cases. Hence, digital forensic investigators need to have a working knowledge of the potential evidence that might be stored on cloud services. In this chapter, we conducted a number of experiments to locate data remnants of users' activities when utilizing the Ubuntu One cloud service. We undertook experiments based on common activities performed by users on cloud platforms including downloading, uploading, viewing, and deleting files. We then examined the resulting digital artifacts on a range of client devices, namely, Windows 8.1, Apple Mac OS X, and Apple iOS. Our examination extracted a variety of potentially evidential items ranging from Ubuntu One databases and log files on persistent storage to remnants of user activities in device memory and network traffic.

Ubuntu One Investigation: Detecting Evidences on Client Machines

A successful migration from current C-band based optical networks to a multiband scenario primarily depends on the development of solutions that can reliably measure physical properties of optical links over broad spectral transmission windows. Additionally, these solutions must be capable of delivering wavelength-dependent and spatially-resolved indicators that can empower network operators to identify faults before they lead to severe service disruptions. Recently, the exploitation of receiver based digital signal processing as a tool for optical performance monitoring has gained tremendous popularity. One successful example is the so-called in-situ power profile estimator, which can reconstruct the per-channel longitudinal power profile along the optical fiber link solely processing the received signal samples. In this work, we propose a novel application for the in-situ power profile estimator by harnessing it on multiple wavelengths to accurately estimate the spectral gain profile of C+L-band in-line Erbium-doped fiber amplifiers deployed in a 280-km single mode fiber link. Furthermore, we show how this scheme can be efficiently used to detect amplification-related anomalies, such as gain tilt and narrowband gain compression. In our measurements, we achieved a sub-dB estimation accuracy by comparing the proposed gain extraction approach with the back-to-back characterization obtained from an optical spectrum analyzer.

/pdf/dsp-based-link-tomography-for-amplifier-gain-estimation-and-19lqma0u.pdf

Mohammad Shariati

Papers

SugarSync forensic analysis

Ubuntu One investigation : detecting evidences on client machines

Ubuntu One Investigation: Detecting Evidences on Client Machines

DSP-Based Link Tomography for Amplifier Gain Estimation and Anomaly Detection in C+L-Band Systems