Digital evidence

About: Digital evidence is a research topic. Over the lifetime, 1621 publications have been published within this topic receiving 18476 citations.

Computer forensics: a critical need in computer science programs

Abstract: The number of computer security incidents is growing exponentially and society's collective ability to respond to this crisis is constrained by the lack of trained professionals. The field of computer forensics is relatively new and this paper describes the discipline, its development, and critical issues associated with its practice. The increased use of the Internal and computer technology to commit crimes indicates an abuse of new developments that requires a response by those involved in law enforcement. Cyber crimes and many child-related sex crimes leave clear digital evidence that must be investigated by those who are trained in computer forensics. University computer science programs are perfectly suited to respond to this crisis. With minor changes, computer science programs can address the growing demand for forensics professionals.

Online Acquisition of Digital Forensic Evidence

Abstract: Providing the ability to any law enforcement officer to remotely transfer an image from any suspect computer directly to a forensic laboratory for analysis, can only help to greatly reduce the time wasted by forensic investigators in conducting on-site collection of computer equipment. RAFT (Remote Acquisition Forensic Tool) is a system designed to facilitate forensic investigators by remotely gathering digital evidence. This is achieved through the implementation of a secure, verifiable client/server imaging architecture. The RAFT system is designed to be relatively easy to use, requiring minimal technical knowledge on behalf of the user. One of the key focuses of RAFT is to ensure that the evidence it gathers remotely is court admissible. This is achieved by ensuring that the image taken using RAFT is verified to be identical to the original evidence on a suspect computer.

A Model for Hybrid Evidence Investigation

Abstract: With the advent of Information and Communication Technologies, the means of committing a crime and the crime itself are constantly evolved. In addition, the boundaries between traditional crime and cybercrime are vague: a crime may not have a defined traditional or digital form since digital and physical evidence may coexist in a crime scene. Furthermore, various items found in a crime scene may worth be examined as both physical and digital evidence, which the authors consider as hybrid evidence. In this paper, a model for investigating such crime scenes with hybrid evidence is proposed. Their model unifies the procedures related to digital and physical evidence collection and examination, taking into consideration the unique characteristics of each form of evidence. The authors' model can also be implemented in cases where only digital or physical evidence exist in a crime scene.

Digital Forensic Investigation of Social Media, Acquisition and Analysis of Digital Evidence

Abstract: Various social networking sites (SNSs), widely referred to as social media, provide services such as email, blogging, instant messaging and photo sharing for social and commercial interactions. SNSs are facilitating new forms of social interaction, dialogue, exchange and collaboration. They allow millions of users and organisations worldwide to exchange ideas, post updates and comments or participate in activities and events, while sharing their wider interests. At the same time, such a phenomenon has led to an upsurge in significant criminal activities by perpetrators who are becoming increasingly sophisticated in their attempts to deploy technology to circumvent detection. Digital forensic Examiners (DFEs) often face serious challenges in relation to data acquisition. Therefore, this article aims to analyse the significance of SNSs in DFIs and challenges that DFEs often encounter when acquiring evidence from SNSs. Furthermore, this article describes the steps of the digital forensic investigation process that must be taken to acquire digital evidence that is both authentic and forensically sound.

Proposal of Digital Forensic System Using Security Device and Hysteresis Signature

Abstract: With the development of the Internet society, digital forensics, i.e., the technology and procedures used to prepare digital evidence for litigating against Internet crime, has been used extensively. In particular, digital forensics used in the corporate world, primarily in relation to litigation involving computer-related evidence in civil matters such as breaches of contract or breaches of confidence, has recently gained a great deal of attention. Digital forensics requires the following two functions: (1) All records must be left unaltered if they are handled in a computer, and (2) the record must be tamper-resistant. In order to realize these functions in a standalone environment, we developed a system named "dig-force" (digital forensic system with chaining signature for evidence) that uses a USB device with a smart card function and a hysteresis signature based on digital signature technology. In this paper, we report the proposed system and the evaluation results of the function and performance of the system with this prototype program.