Chapter 6 - Digital Forensics at Work in the Legal System

Handling cybercrime investigations by identifying digital forensic evidence that intent to analyze and preserve it in well terms and conditions. Most research materials did implement frameworks on handling digital forensic evidence based on their source, format, and type of classification without understanding the process of digital evidence accordingly. As a forensic investigator is a MUST to understand the concept of handling digital evidence by studying each stage of the process with law facts. To this end, we have designed a use case framework on how to handle digital forensic evidence along the process with an explanation in detail. Therefore, evaluating the cyber resilience at this pandemic crisis to highlight the influence of advanced technologies on people. Cyber resilience has been planted in all aspects such as medical fields, business, or industrial areas, or even through cyber threat intelligence with advanced technologies like Artificial Intelligence (AI). Based on cyber resilience studies, the developer had analyzed and identified the evidence collected to conclude a cybercrime investigation works in the corporate world currently.

BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem

Is digital evidence reliable? Does digital forensics in criminal investigations uphold to fair trial principles and forensics standards? What is the impact of the increased use of science and technology in the investigation on the rights of suspects, accused, and defendants? This research attempts to address those questions through the lens of the right to a fair trial (Art. 6 ECHR). Selected fair trial guarantees are analysed in order to clarify specific evidence rules for digital investigations. These evidence rules feed into a gap analysis exemplifying unaddressed threats to the right to a fair trial rooted in the specifics of digital investigations and the underdeveloped reliability standard for digital evidence. The imminent challenges with digital evidence in practice are demonstrated in the review of the Encrochat investigation.To address the identified challenges the thesis employs action research and examines practical solutions for improvement of digital evidence reliability by integrating fair trial based evidence rules, with existing digital forensics methodology and given law enforcement requirements. As a result, a new reliability validation enabling framework for digital evidence is proposed. The practical benefits of the proposed framework for digital forensic examiners and law enforcement are tested in two case studies in cooperation with the Norwegian police.The argumentative legal analysis further explores the feasibility and implications of a new digital right to procedural accuracy to comprehensively address the significant impact of digital forensic science and technology on individuals’ rights in criminal proceedings and to serve as a legislative anchor for digital evidence reliability assurance.

The development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

The budding progress and relevance of digital information technology in quite a few areas of business, engineering, medical, agricultural and scientific studies are resulting in data explosion coined by the term “big data”. The dependency on digital media drives and devices has enlarged the dimensions of data formation and storage exponentially around the world, with a need of keeping a record of what data is accumulated and how the data is exercised. So it has raised an alarm of security for the data asset. To discover the pattern of interest leading to a decision from these voluminous data has put forth a challenge for the law enforcement and investigative agencies. Also, tracing such type of misutilization of digital technology in a big data age from the perspective of digital forensics requires minute bit-level examination and observations to locate the digital evidence that explains how maliciously nefarious activities have been done and by whom with the possible extent of the damage. The forensic examination and analysis in such a big data era requires appropriate digital investigation model with the application of tools, techniques and methodologies to boost decision-making and diagnostic process for advanced outfitted competence in digital forensic investigation with the intent of assembling valuable evidence from it. So, the need of the hour is to have a holistic outlook of the big data challenges and opportunities for its application in the digital forensic domain with the goal of making full-bodied investigation pronouncements. Much work has been done to model digital investigation as well as digital evidence but a comprehensive correlated and aggregated merging of voluminous data coming from different heterogeneous sources along with timely and accurate detection and analysis is the need of the hour. This chapter depicts the trends of digital forensics served for big data and the challenges of evidence acquisition, and further suggests the revision of the existing fusion-based digital investigation model by highlighting the formalization, quick detection and timely accurate analysis of digital evidence from multiple sources simultaneously. The modification adopted the inclusion of look-up table into the architecture with the application of data fusion to practice voluminous data effectually.

Recent high profile court trials around the world, including South Africa, have highlighted the importance of forensic science evidence in court. They have also show what can happen when forensic science is handled poorly in court leading to incorrect convictions or acquittals. Most often the problems have been linked to the qualifications, training, competency and experience of the forensic practitioners who examined and analysed the evidence. With digital forensics being recognised as a forensics science and criminal trials such as Casey Anthony and Julia Amero dominated by errors in the digital forensics process attributed to the examiners, it is crucial to understand what the current situation is in South Africa with regards local digital forensic practitioners, so as to identify any strengths or shortcomings which could impact on digital evidence in a court of law. The research focused on understanding the academic qualifications, digital forensics training, competency, and experience of South African digital forensic practitioners. General trends were identified through the research showing that South African digital forensic practitioners often lacked the necessary academic qualifications, training, competency and experience required of a digital forensics practitioner, raising concerns about the quality of digital forensics practice in South Africa. When contrasted against international standards, the research identified areas of improvement, and suggested potential remedial actions to address the situation.

A new triage model conforming to the needs of selective search and seizure of electronic evidence

Digital transformation rapidly changes how we live our lives in the post pandemic world. Unfortunately, digital technology is not limited to law abiding organisations and citizens. Criminal organisations and individuals are quick to identify new opportunities with new technologies, and digital transformation is dramatically changing the character of crimes, terror, and other threats. The fast emergence of new crimes is facilitated by possibilities brought by disruptive technologies such as AI, Internet of Things, drones, and cryptocurrencies that can be disastrous tools in the hands of criminals. Consequently, our society needs far better capacity to prevent and investigate criminal acts to protect organisations and citizens. This brings an urgent need to proactively reform digital forensics to significantly increase our capability to meet the strain on society brought by crimes evolving in the digital transformation era. The future of forensic science is already here, characterized by a mix of opportunities and challenges. It is essential to make it harder to effectively use digital technologies for criminal activities, while leveraging the possibilities of digital technologies by those affected, law enforcement agencies, business and organisations. As digital technologies continue to evolve, we need to stay up to date with the latest developments to effectively investigate and prosecute crimes in the digital age. There is an increased reliance on digital evidence, and the amount of heterogeneous digital evidence in criminal cases keep increasing. The forensic science techniques thus become more sophisticated and play an increasingly important role. However, the scientific area is extremely broad, and beyond the capability of most forensic science labs to keep up with the technology forefront development speed. Besides an urgent need to bring up the subject to the political arena, examples of how we can meet the challenges are discussed such as by extending our cooperation, encourage and facilitate cooperation for training and education to handle the extremely broad and rapid development, working out methods for explaining and visualising evidence for the treatment and legal values of digital evidence in prosecution, and cooperation between product developers and crime investigators for swift innovation of digital forensics tools and methodologies for quickly emerging threats. This paper will highlight specific examples where modern digital techniques are used to solve crimes in the physical world as well as crimes committed in the digital domain and discuss how “good AI” can be used to fight “evil AI” and finally touch on the sensitive balance between the increased power of the new digital forensic tools and private integrity.

In the implementation of Digital Forensics, one of the derivatives of practice is the handling of Digital Evidence. Handling Digital Evidence requires important steps and procedures. Digital evidence is a source of artifacts in handling a digital-based crime case, one of which comes from digital storage. In this research, the author will design a framework for Digital Forensic investigations by simulating digital evidence in the form of a non-volatile architecture. The reference commonly used by researchers in previous articles is the National Institute of Justice (NIST). The framework is a reference and steps in the practice of acquiring digital evidence. The purpose of designing this framework is as a legal procedure that is specifically implemented in the practice of acquiring non-volatile digital evidence. In the design, the author conducted a literature study on the NIST SP 800-86 and ISO 27037:2012 standards and then combined them in a hybrid terminology. The output of this research is to combine the two standards to become framework as reference for handling and investigating Digital Forensic science.

Digital Forensics is being actively researched and performed in various areas against changing IT environment such as mobile phone, e-commerce, cloud service and video surveillance. Moreover, it is necessary to research unified digital evidence management for correlation analysis from diverse sources. Meanwhile, various triage approaches have been developed to cope with the growing amount of digital evidence being encountered in criminal cases, enterprise investigations and military contexts. Despite of debating over whether triage inspection is necessary or not, it will be essential to develop a framework for managing scattered digital evidences. This paper presents a framework with unified digital evidence management for appropriate security convergence, which is based on triage investigation. Moreover, this paper describes a framework in network video surveillance system to shows how it works as an unified evidence management for storing diverse digital evidences, which is a good example of security convergence.

Cloud Storage Forensics

Korea-EU FTA, which came to an agreement in April of 2007, was resolved at the National Assembly in May of 2011, thereby having been concluded the ratification. As for the procedure of opening a market in legal service according to settlement and ratification of Korea-EU FTA, Step 1 is allowed the establishment of representative office(law firm with foreign-law consultation) at home by EU member countries' law firms. Step 2 is made available for law firm with foreign-law consultation to jointly handle and distribute profits as for a case that is mixed the domestic law firm and the domestic & foreign laws. Step 3 is allowed EU member countries' law firm to establish a joint venture with domestic law firm. This study researches into a change and influence upon legal service and forensic investigation according to Korea-EU FTA ratification. Also, it researches into position and prospect that digital forensic evidence, which possesses the majority of legal evidences, takes up in the middle of court-oriented trials. The prediction of influence in digital evidence as professional proof upon judgment will led to being capable of coping with the opening of legal service market and of wisely preparing for the advance to domestic market by law firm of Anglo-American Law.

Medical is a new field in the rapidly evolving world of computers lately with Banta-news showed that review of crimes in the field of computers and the increasing number of books that explore about digital forensics, so the add reference knowledge for young researchers. With the birth of Information Act Electronic Transaction number 11 of 2008, it is increasingly making these disciplines into the tools to dismantle crime involving computer world, because in general, computer crime is leaving digital traces, hence the need for a computer forensics expert who will secure evidence-called digital or digital evidence. Computer Forensics would require a standard operational procedure in taking digital evidence from being contaminated by the time the data was taken from the digital evidence that are easy to forensic computer expert to perform a system recovery after damage. Keywords: Medical Informatics, Digital Evidence, Forensic Disk

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

Another brick in the wall: An exploratory analysis of digital forensics programs in the United States