Digital evidence

About: Digital evidence is a research topic. Over the lifetime, 1621 publications have been published within this topic receiving 18476 citations.

Device and method for providing security in remote digital forensic environment

Abstract: An apparatus and method for collecting digital evidence from a target system to be analyzed at a remote location and then providing security in a remote digital forensic environment based on the collected digital evidence. The method of providing security includes making, by a security providing apparatus, an evidence collection request for collection of evidence of an evidence collection-target apparatus from an evidence collection agent in a remote digital forensic environment, collecting evidence data corresponding to the evidence collection request from the evidence collection agent, verifying the evidence data based on a signature value of the evidence data collected from the evidence collection agent, generating evidence analysis data based on the verified evidence data, verifying the evidence analysis data based on a signature value of the evidence analysis data, and providing security for the evidence collection-target apparatus based on results of the verification of the evidence analysis data.

Cyber Forensics and Comparative Analysis of Digital Forensic Investigation Frameworks

Abstract: With industrial revolution 4.0, automation foster communications between digital devices around the globe which involves several digital devices including cyber physical system devices, IoT devices, mobile devices, storage devices and network devices or even PCs as digital evidence; increasing the number of cybercrime rate. This brings us to question a necessity for advanced Digital Forensics Investigation Framework (DFIF) for the effective prosecution of digital crime in court of law; such that the framework should preserve integrity of evidence throughout steps while in process. Our paper is descriptive in nature that surveys recent trends of cybercrime attacks and explored associated Cyber Forensics. In addition, we have mapped process and output produced by different phase in the DFIF that have been examined from previously proposed frameworks and represented a comparative mapping of all frameworks. The mapping process results in optimized investigation process.

Analysis of the digital evidence presented in the Yahoo! case

Abstract: The “Yahoo! Case” led to considerable debate about whether or not an IP address is personal data as defined by the Personal Data (Privacy) Ordinance (Chapter 486) of the Laws of Hong Kong. This paper discusses the digital evidence presented in the Yahoo! Case and evaluates the impact of the IP address on the verdict in the case. A Bayesian network is used to quantify the evidentiary strengths of hypotheses in the case and to reason about the evidence. The results demonstrate that the evidence about the IP address was significant to obtaining a conviction in the case.

Gringotts: Securing Data for Digital Evidence

Abstract: As digital storage and cloud processing become more common in business infrastructure and security systems, maintaining the provable integrity of accumulated institutional data that may be required as legal evidence also increases in complexity. Since data owners may have an interest in a proposed lawsuit, it is essential that any digital evidence be guaranteed against both outside attacks and internal tampering. Since the timescale required for legal disputes is unrelated to computational and mathematical advances, evidential data integrity must be maintained even after the cryptography that originally protected it becomes obsolete. In this paper we propose Gringotts, a system where data is signed on the device that generates it, transmitted from multiple sources to a server using a novel signature scheme, and stored with its signature on a database running Evidence Record Syntax, a protocol for long-term archival systems that maintains the data integrity of the signature, even over the course of changing cryptographic practices. Our proof of concept for a small surveillance camera network had a processing (throughput) overhead of 7.5%, and a storage overhead of 6.2%.

Analysis of Evidence Using Formal Event Reconstruction

Abstract: This paper expands upon the finite state machine approach for the formal analysis of digital evidence. The proposed method may be used to support the feasibility of a given statement by testing it against a relevant system model. To achieve this, a novel method for modeling the system and evidential statements is given. The method is then examined in a case study example.