Digital evidence

About: Digital evidence is a research topic. Over the lifetime, 1621 publications have been published within this topic receiving 18476 citations.

Special issue on cyberharassment investigation: Advances and trends

Abstract: Empirical and anecdotal evidence indicates that cyberharassment is more prevalent as the use of social media becomes increasingly widespread, making geography and physical proximity irrelevant. Cyberharassment can take different forms (e.g., cyberbullying, cyberstalking, cybertrolling), and be motivated by the objectives of inflicting distress, exercising control, impersonation, and defamation. Little is currently known about the modus operandi of offenders and their psychological characteristics. Investigation of these behaviours is particularly challenging because it involves digital evidence distributed across the devices of both alleged offenders and victims, as well as online service providers, sometimes over an extended period of time. This special issue aims to improve understanding of cyberharassment from a multidisciplinary perspective in order to further develop theoretical knowledge and investigative practice.

Forensic Investigation and Analysis of User Input Information in Business Application

Abstract: Objectives: This paper investigates the amount of user input that can be recovered from the volatile memory of Windows computer systems while an application is still running. Additionally, an investigation into temporal, functional analysis and event reconstruction of user input activities in business application is discussed and reported upon. Methods/Analysis: Forensically, relevant user information is suitable for an evidentiary purpose. Therefore, the qualitative assessment of user input on commonly used windows-based applications is presented. Findings: In this research, detailed emphasis has been laid on the quality of evidence recovered from the allocated line numbers of the application memory. This approach describes the process of securing digital evidence for investigators. The research uncovers the process of analysing the forensically relevant data recovered from Windows applications. The investigation comprises of the following; dumping of memory, data extraction, strings evidence strings conversion, result finding of the evidence and also, reconstructing the extracted evidence of user information. Applications/Improvement: This research focuses on digital forensic investigation of digital images captured and the memory analysis of user information on using some very popular windows based applications. It is aimed that this may become part of forensic analysis in digital investigations.

A development of mobile phone forensics procedures for law enforcement agencies in Thailand

Abstract: At present, mobile phone has become one of the very important digital evidence. As a result, the standard Operation Procedure (SOP) was studied and developed by all law enforcement agencies in each country in order to obtain some information for legal proceeding against criminal. However, the improperly managing and collecting of the evidence may be a cause of degradation in the reliable procedure and evidence. Thailand also has encountered such enormous problems. This paper has realized that the study of mobile phone forensics procedure and existing Behavioral Performance of Law Enforcement Agencies in Thailand need to be carefully considered about limitation and suitability of procedure which is essential and must be prioritized because it will be used for prosecution in court. This paper consists of 3 main steps: 1) studying general mobile phone forensics processing and procedures. 2) Qualitative research using Focus group included 20 experts from law enforcement agencies. 3) Quantitative research using 200 questionnaires. A result of the focus group especially introduces a new framework of mobile phone forensics processing and procedures for Thai law enforcement agencies, which can be separated into 2 main parts with 9 sections. A result of ANOVA and LSD for questionnaires, a factor influencing of the duty and responsibility is significant for all sections.

Exploring solutions put forth to solve computer forensic investigations of large storage media.

Abstract: The capacity of digital storage media is growing at a phenomenal rate, leading to an increase in the overall time it takes to process a typical digital forensics investigation. Conventional tools and techniques simply do not cater for the size of potential evidence that investigators have to analyse. With digital evidence being available on an increasing number of digital media types, ranging from portable media players, to Global Positioning System (GPS) devices, to rack-mountable servers, in addition to the fact that there is a rising trend for digitizing information in the business world, the problem is only getting worse. This paper endeavours to initiate an investigation into the current solutions put forth to solve computer forensic investigations of large storage media for the purpose of stimulating ideas and encouraging expansion of current solutions within the research community.

Inter-regional digital forensic knowledge management: needs, challenges, and solutions

Abstract: Increasing demand for digital evidence in criminal investigations is driving decentralization of forensic capabilities closer to the crime scene. Law enforcement agencies are struggling to keep pace with technological developments, cybercrime growth, and scientific advances. In federated environments, digital forensic knowledge and practices vary widely across regions. To reduce delays, wasted resources, missed opportunities, mistakes, and misinterpretations, there is a pressing need to balance the democratization of digital forensic capabilities with knowledge management and sharing between decentralized regions. There are multiple forms of knowledge to be managed, including procedural, technical, investigative, scientific, behavioral, crime analysis, and forensic intelligence. In addition, there are multiple knowledge producers and consumers, including police investigators, digital forensic practitioners, criminal intelligence analysts, attorneys, and judges. Knowledge management becomes even more challenging when multiple interdependent regions are involved, speaking different languages. Taking all of these factors into consideration, this work presents an inter-regional knowledge management solution for improving the quality, consistency, reliability, efficiency, cost-effectiveness, and return on investment of digital forensic capabilities. The basis of this work is a community-driven initiative of Swiss regional police authorities. Interviews were conducted with 15 digital forensic units to determine their current knowledge management practices and needs. The results were then generalized into a prioritized set of requirements for inter-regional digital forensic knowledge management that may be applicable in other countries. These requirements were used to evaluate knowledge management platforms, and one was selected. Implementation, operations, and maintenance challenges of an inter-regional digital forensic knowledge management platform are discussed.