Completing the Post Mortem Investigation

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

Current crime is increasing, one of which is the crime of using social media, although no crime does not leave digital evidence. Twitter application is a social media that is widely used by its users. Acts of crime such as fraud, insults, hate speech, and other crimes lately use many social media applications, especially Twitter. This research was conducted to find forensic evidence on the social media Twitter application that is accessed using a smartphone application using the Digital Forensics Research Workshop (DFRWS) method. These digital forensic stages include identification, preservation, collection, examination, analysis, and presentation in finding digital evidence of crime using the MOBILedit Forensic Express software and Belkasoft Evidence Center. Digital evidence sought on smartphones can be found using case scenarios and 16 variables that have been created so that digital proof in the form of smartphone specifications, Twitter accounts, application versions, conversations in the way of messages and status. This study's results indicate that MOBILedit Forensic Express digital forensic software is better with an accuracy rate of 85.75% while Belkasoft Evidence Center is 43.75%.

Digital Forensic as it sounds coerce human mind primarily with exploration of crime. However in the contemporary world, digital forensic has evolved as an essential source of tools from data acquisition to legal action. Basically three stages are involved in digital forensic namely acquisition, analysis and reporting. Digital Forensic Research Workshop (DFRW) defined digital forensic as “Use of Scientifically derived and proven method towards the identification, collection, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of event to be criminal”. The hard problem in digital forensic is such that the acquired data need to be cleaned and is required to be intelligible for reading by human. As a solution to this complexity problem a number of tools are present which may be repeated until relevant data is obtained.

Digital Forensic as it sounds coerce human mind primarily with exploration of crime. However in the contemporary world, digital forensic has evolved as an essential source of tools from data acquisition to legal action. Basically three stages are involved in digital forensic namely acquisition, analysis and reporting. Digital Forensic Research Workshop (DFRW) defined digital forensic as “Use of Scientifically derived and proven method towards the identification, collection, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of event to be criminal”. The hard problem in digital forensic is such that the acquired data need to be cleaned and is required to be intelligible for reading by human. As a solution to this complexity problem a number of tools are present which may be repeated until relevant data is obtained.

Digital forensics is the digital equivalence of traditional crime investigations that leverages digital technologies to facilitate criminal investigations. The expertise and previous experience of an investigator or any security agent in traditional forensic investigations play an important role in the success, efficiency, and effectiveness of the investigation. Similarly employing the power of intelligence in the current computational resources in the digital investigation process will lead to more efficient and effective digital investigation results. This study builds on existing works in the literature to propose the use of clustering and classification machine learning algorithms on evolving database files to achieve intelligence in the digital investigation process and finally come up with a comprehensive block diagram as a general-purpose framework for intelligent forensic investigation.

The number of digital crimes or cybercrimes today continues to increase every year, and lately a lot of it happens on social media like Instagram. The social behavior of today's people who communicate more through social media encourages the perpetrators of these digital crimes. Instagram is a social media that is often found content that contains elements of pornography, hoax news, hate speech, etc. This research is aimed at processing digital evidence of cases of the spread of hoax news on the Instagram application. This research follows the framework of the Digital Forensics Research Workshop (DFRWS) with six stages, namely identification, preservation, collection, examination, analysis, and presentation. The process of obtaining digital evidence is assisted by the application of Axiom Magnet and Cellebrite UFED. Digital evidence sought from the smartphone device of the suspected hoax news disseminator seized following the case scenario consists of 8 variables in the form of accounts, emails, images, videos, URLs, times, IP address, and location. The results of this research with the help of the application of Magnet Axiom digital proof obtained 87.5% and the Cellebrite UFED application of 68.75%. The results of this study show that Magnet Axiom has better performance than MOBILedit Forensics.

From the digital forensics point of view, image forgery is considered as evidence that could provide a major breakthrough in the investigation process. Additionally, the development of storage device technologies has increased storage space significantly. Thus a digital investigator can be overwhelmed by the amount of data on storage devices that needs to be analysed. In this paper, we propose a model for classifying bulk JPEG images produced by the data carving process or other means into three different classes to solve the problem of identifying forgery quickly and effectively. The first class is JPEG images that contain errors or corrupted data, the second class is JPEG images that contain forged regions, and the third is JPEG images that have no signs of corruption or forgery. To test the proposed model, some experiments were conducted on our own dataset in addition to CASIA V2 image forgery dataset. The experiments covered different types of forgery technique. The results yielded around 88% accuracy rate in the classification process using five different machine learning methods on CASIA V2 dataset. It can be concluded that the proposed model can help investigators to automatically classify JPEG images, which reduce the time needed in the overall digital investigation process.

In digital investigations, many software and hardware components can be searched for possible relevant evidences. Digital forensic investigators should not only have knowledge on the subject case, but also on technical skills related to how to search for and acquire relevant information. Skills in disk and computer forensics continuously evolve with the evolution of computer hardware, software, operating systems and environments.

The advancement in information technology has changed our life significantly. No doubt, the Internet, smartphones, and social media have connected people and society. It has contributed to various aspects of our daily life. However, there is also a dark side of cyberspace, that is, cybercrime. It is becoming a global threat and needs technological solutions to combat. Whenever there is a crime, there is a law to curb the crime. The role of digital forensics is to understand the 'Who, What, Where and Why' of the incident. Digital forensics is a scientific process to collect, analyze, and present the evidence in a court of law. As it is used to link the person with criminal activities, it is crucial that the entire process of investigation be trustworthy. Managing the digital evidence and maintaining the chain of custody and integrity of digital evidence are utmost important. This chapter discusses the applications of blockchain technology to address the challenging issues faced by the digital investigation process and forensic readiness. The chapter also discusses the legal issues and admissibility of blockchain-based evidence in a court of law.

Data has become a bigger challenge to handle in mobile networks, today. In case of mobile devices data needs to be processed in large amounts so insufficient space issues may occur in case of low hardware configurations. For this, cloud platform provides ease of migrating apps to various places without giving platform dependency, space issues and also giving better data processing on low hardware costs. But is highly susceptible to malware attacks and data loss due to various factors and in case of digital data forensics becomes a greater challenge. In this paper, we present an overview of MCC and digital forensics, focusing on its key aspects and significant forensic challenges faced by digital investigators in MCC. The purpose of this paper is to provide a comprehensive understanding about forensic research challenges and re-direct researchers towards new research areas.

Can computer forensic tools be trusted in digital investigations?

Formal concept analysis approach to understand digital evidence relationships

In today's era, efficiency of digital forensic investigation process is the biggest challenge for digital forensic community. The efficiency of investigation depends on the other various factors like storage capacity of digital media, proficiency of investigator and type of investigating case. Moreover, these storage devices do not store only investigating case related data but also stores accused personal and professional information which can lead a breach of privacy of accused. Very little attention has been given to make digital investigation process fully automated. In the Privacy Preserving Efficient Digital Forensic Investigation (PPEDFI) framework, we bridge the gap between efficiency and the privacy issue in digital forensic investigation process. The main contribution of the PPEDFI framework is to make the digital investigation process automated and shorten the turnaround time in evidence extraction process, thus saving the cost and time of digital investigation process. To evaluate the system, we conducted an investigation study namely: Digitized Document Fraud. The proposed framework was able to extract the evidence files and also rank them on the basis of their relevancy for being evidence.

Image metadata is an important piece of information in any digital investigation process. It can tell you information about where a picture was taken, what time it was taken, what device took the picture, and so much more. In this research paper we have designed and developed a java application to help aid investigators by pulling relevant metadata out of a set of images inside a folder. Once this metadata was retrieved, we displayed it in a user friendly fashion with the goal being to help an investigator draw insight into the pictures that were taken. One method for helping insight be drawn easier was implementing the google maps API in a javafx front end.

Is digital evidence reliable? Does digital forensics in criminal investigations uphold to fair trial principles and forensics standards? What is the impact of the increased use of science and technology in the investigation on the rights of suspects, accused, and defendants? This research attempts to address those questions through the lens of the right to a fair trial (Art. 6 ECHR). Selected fair trial guarantees are analysed in order to clarify specific evidence rules for digital investigations. These evidence rules feed into a gap analysis exemplifying unaddressed threats to the right to a fair trial rooted in the specifics of digital investigations and the underdeveloped reliability standard for digital evidence. The imminent challenges with digital evidence in practice are demonstrated in the review of the Encrochat investigation.To address the identified challenges the thesis employs action research and examines practical solutions for improvement of digital evidence reliability by integrating fair trial based evidence rules, with existing digital forensics methodology and given law enforcement requirements. As a result, a new reliability validation enabling framework for digital evidence is proposed. The practical benefits of the proposed framework for digital forensic examiners and law enforcement are tested in two case studies in cooperation with the Norwegian police.The argumentative legal analysis further explores the feasibility and implications of a new digital right to procedural accuracy to comprehensively address the significant impact of digital forensic science and technology on individuals’ rights in criminal proceedings and to serve as a legislative anchor for digital evidence reliability assurance.