Digital forensics

About: Digital forensics is a research topic. Over the lifetime, 4270 publications have been published within this topic receiving 49676 citations. The topic is also known as: digital forensic science & Digital forensics.

New Digital Forensics Investigation Procedure Model

Abstract: In this paper, we presented a new digital forensics investigation procedure model which is as follows: investigation preparation, classifying cyber crime and deciding investigation priority, investigating damaged (victim) digital crime scene, criminal profiling consultant and analysis, tracking suspects, investigating injurer digital crime scene, summoning suspect, additional investigation, writing criminal profiling, writing report.

Forensic-chain: Ethereum blockchain based digital forensics chain of custody

Abstract: Digital evidence plays an important role in cyber crime investigation, as it is used to link persons with criminal activities. Thus it is of extreme importance to guarantee integrity, authenticity, and auditability of digital evidence as it moves along different levels of hierarchy in chain of custody during cyber crime investigation. Blockchain technology’s capability of enabling comprehensive view of transactions (events/actions) back to origination provides enormous promise for the forensic community. In this research we proposed to use a blockchain that can be leveraged for forensic applications in particular bringing integrity and tamper resistance to digital forensics chain of custody.

Computer Forensics: An Essential Ingredient for Cyber Security

Abstract: Computer forensics uses computer investigation and analysis techniques to collect evidence regarding what happened on a computer that is admissible in a court of law. Computer forensics requires a wellbalanced combination of technical skills, legal acumen, and ethical conduct. Computer forensics specialists use powerful software tools to uncover data to be sorted through, and then must figure out the important facts and how to properly present them in a court of law. Cyber crime rates are accelerating and computer forensics is the crucial discipline that has the power to impede the progress of these cyber criminals. Computer forensics is defined by SearchSecurity.com as “the application of computer investigation and analysis techniques to gather evidence suitable for presentation in a court of law” (2005). The goal of computer forensics is to carry out a structured investigation while documenting a chain of evidence to discover exactly what happened on a computer and who was responsible for it. The main priority of computer forensics is accuracy. Forensic practitioners must follow strict guidelines and maintain the highest standards of work ethic to achieve accuracy because emphasis must be on evidential integrity and security (The DIBS Group, 2004). There is a widespread use of personal computers in businesses and homes. Companies are exchanging more information online than ever before, and high-tech crimes are increasing at a rapid rate (Solomon, 2005, p.3). This creates more of a need for crime investigators to have access to computer based information. There is an increased awareness in the legal community of the need for computer forensic services to obtain successful prosecutions which could otherwise fail because of unsatisfactory equipment, procedures, or presentation in court (The DIBS Group, 2004).

Automated construction of a false digital alibi

Abstract: Recent legal cases have shown that digital evidence is becoming more widely used in court proceedings (by defense, accusation, public prosecutor, etc.). Digital tracks can be left on computers, phones, digital cameras as well as third party servers belonging to Internet Service Providers (ISPs), telephone providers and companies that provide services via Internet such as YouTube, Facebook and Gmail. This work highlights the possibility to set up a false digital alibi in a fully automatic way without any human intervention. A forensic investigation on the digital evidence produced cannot establish whether such traces have been produced through either human activity or by an automated tool. These considerations stress the difference between digital and physical - namely traditional - evidence. Essentially, digital evidence should be considered relevant only if supported by evidence collected using traditional investigation techniques. The results of this work should be considered by anyone involved in a Digital Forensics investigation, due to it demonstrating that court rulings should not be based only on digital evidence, with it always being correlated to additional information provided by the various disciplines of Forensics Sciences.