Today is the era of the Internet of Things (IoT). The recent advances in hardware and information technology have accelerated the deployment of billions of interconnected, smart and adaptive devices in critical infrastructures like health, transportation, environmental control, and home automation. Transferring data over a network without requiring any kind of human-to-computer or human-to-human interaction, brings reliability and convenience to consumers, but also opens a new world of opportunity for intruders, and introduces a whole set of unique and complicated questions to the field of Digital Forensics. Although IoT data could be a rich source of evidence, forensics professionals cope with diverse problems, starting from the huge variety of IoT devices and non-standard formats, to the multi-tenant cloud infrastructure and the resulting multi-jurisdictional litigations. A further challenge is the end-to-end encryption which represents a trade-off between users’ right to privacy and the success of the forensics investigation. Due to its volatile nature, digital evidence has to be acquired and analyzed using validated tools and techniques that ensure the maintenance of the Chain of Custody. Therefore, the purpose of this paper is to identify and discuss the main issues involved in the complex process of IoT-based investigations, particularly all legal, privacy and cloud security challenges. Furthermore, this work provides an overview of the past and current theoretical models in the digital forensics science. Special attention is paid to frameworks that aim to extract data in a privacy-preserving manner or secure the evidence integrity using decentralized blockchain-based solutions. In addition, the present paper addresses the ongoing Forensics-as-a-Service (FaaS) paradigm, as well as some promising cross-cutting data reduction and forensics intelligence techniques. Finally, several other research trends and open issues are presented, with emphasis on the need for proactive Forensics Readiness strategies and generally agreed-upon standards.

/pdf/a-survey-on-the-internet-of-things-iot-forensics-challenges-3w6jzejgc2.pdf

A Survey on the Internet of Things (IoT) Forensics: Challenges, Approaches, and Open Issues

The rapid growth in usage and application of Social Networking (SN) platforms make them a potential target by cyber criminals to conduct malicious activities such as identity theft, piracy, illegal trading, sexual harassment, cyber stalking and cyber terrorism. Many SN platforms are extending their services to mobile platforms, making them an important source of evidence in cyber investigation cases. Therefore, understanding the types of potential evidence of users’ SN activities available on mobile devices is crucial to forensic investigation and research. In this paper, we examine four popular SN applications: Facebook, Twitter, LinkedIn and Google+, on Android and iOS platforms, to detect remnants of users’ activities that are of forensic interest. We detect a variety of artefacts (e.g. usernames, passwords, login information, personal information, uploaded posts, exchanged messages and uploaded comments from SN applications) that could facilitate a criminal investigation.

Investigating Social Networking applications on smartphones detecting Facebook, Twitter, LinkedIn and Google+ artefacts on Android and iOS platforms

Forensic-chain: Blockchain based digital forensics chain of custody with PoC in Hyperledger Composer

Automated event and social network extraction from digital evidence sources with ontological mapping

The smart devices have been used in the most major domain like the healthcare, transportation, smart home, smart city and more. However, this technology has been exposed to many vulnerabilities, which may lead to cybercrime through the devices. With the IoT constraints and low-security mechanisms applied, the device could be easily been attacked, treated and exploited by cyber criminals where the smart devices could provide wrong data where it can lead to wrong interpretation and actuation to the legitimate users. To comply with the IoT characteristics, two approaches towards of having the investigation for IoT forensic is proposed by emphasizing the pre-investigation phase and implementing the real-time investigation to ensure the data and potential evidence is collected and preserved throughout the investigation.

IoT Forensic: Bridging the Challenges in Digital Forensic and the Internet of Things

Chain of custody of digital evidence in digital forensic field are today essential part of digital investigation process. In order the evidence to be accepted by the court as valid, chain of custody for digital evidence must be kept, or it must be known who exactly, when, where, why and how came into contact with evidence in each stage of the digital investigations process. This paper deals with digital evidence and chain of custody of digital evidence. Authors definetaxonomy and use an ontological approach to manage chain of custody of digital evidence. The aim of this paper was to develop ontology to provide a new approach to study and better understand chain of custody of digital evidence . Additionally, developed ontology can be used as a method to further develop a set of standard and procedures for secure management with digital evidence.

/pdf/an-ontological-approach-to-study-and-manage-digital-chain-of-4yrft6u8sh.pdf

An Ontological Approach to Study and Manage Digital Chain of Custody of Digital Evidence

Life cycle and chain of digital evidence are very important parts of digital investigation process. It is very difficult to maintain and prove chain of custody. Investigators and expert witness must know all details on how the evidence was handled every step of the way. At each stage in life cycle of digital evidence, there is more impact (human, technical and natural) that can violate digital evidence. This paper presents a basic concept of "chain of custody of digital evidence" and "life cycle of digital evidence". It will address a phase in life cycle in digital archiving. The authors also warn of certain shortcomings in terms of answering specific questions, and gives same basic definition.

Chain of Custody and Life Cycle of Digital Evidence

Information System Management and the creation of security policies in order to ensure protection from security incidents is becoming a key issue of Information Security engineering. Authors of this paper give an overview of defining security policies in ISMS in general as well as defining the areas of its use in specific.

Information security management — Defining approaches to Information Security policies in ISMS

This paper deals with a new challenge for digital forensic experts - the forensic analysis of social networks. There is a lot of identity theft, theft of personal data, public defamation, cyber stalking and other criminal activities on social network sites. This paper will present a forensic analysis of social networks and cloud forensics in the internet environment. For the purpose of this research one case study is created like - a common practical scenario where the combination of identity theft and public defamation through Facebook activity is explored. Investigators must find the person who stole some others profile, who publish inappropriate and prohibited contents performing act of public defamation and humiliation of profile owner.

Forensic analysis of social networks (case study)

The aim of this paper is to highlight the problems encountered by investigators in the pursuit of  forensic investigations of digital devices, primarily because of misunderstanding or false understanding of certain important concepts. An ontology of digital evidence was proposed as one of possible method suitable as a solution of this problem.

Zoran Ćosić

Papers

An Ontological Approach to Study and Manage Digital Chain of Custody of Digital Evidence

Chain of Custody and Life Cycle of Digital Evidence

Information security management — Defining approaches to Information Security policies in ISMS

Forensic analysis of social networks (case study)

The Necessity of Developing an Digital Evidence Ontology