Digital Forensic Analysis of Cybercrimes

Is digital evidence reliable? Does digital forensics in criminal investigations uphold to fair trial principles and forensics standards? What is the impact of the increased use of science and technology in the investigation on the rights of suspects, accused, and defendants? This research attempts to address those questions through the lens of the right to a fair trial (Art. 6 ECHR). Selected fair trial guarantees are analysed in order to clarify specific evidence rules for digital investigations. These evidence rules feed into a gap analysis exemplifying unaddressed threats to the right to a fair trial rooted in the specifics of digital investigations and the underdeveloped reliability standard for digital evidence. The imminent challenges with digital evidence in practice are demonstrated in the review of the Encrochat investigation.To address the identified challenges the thesis employs action research and examines practical solutions for improvement of digital evidence reliability by integrating fair trial based evidence rules, with existing digital forensics methodology and given law enforcement requirements. As a result, a new reliability validation enabling framework for digital evidence is proposed. The practical benefits of the proposed framework for digital forensic examiners and law enforcement are tested in two case studies in cooperation with the Norwegian police.The argumentative legal analysis further explores the feasibility and implications of a new digital right to procedural accuracy to comprehensively address the significant impact of digital forensic science and technology on individuals’ rights in criminal proceedings and to serve as a legislative anchor for digital evidence reliability assurance.

Digital transformation rapidly changes how we live our lives in the post pandemic world. Unfortunately, digital technology is not limited to law abiding organisations and citizens. Criminal organisations and individuals are quick to identify new opportunities with new technologies, and digital transformation is dramatically changing the character of crimes, terror, and other threats. The fast emergence of new crimes is facilitated by possibilities brought by disruptive technologies such as AI, Internet of Things, drones, and cryptocurrencies that can be disastrous tools in the hands of criminals. Consequently, our society needs far better capacity to prevent and investigate criminal acts to protect organisations and citizens. This brings an urgent need to proactively reform digital forensics to significantly increase our capability to meet the strain on society brought by crimes evolving in the digital transformation era. The future of forensic science is already here, characterized by a mix of opportunities and challenges. It is essential to make it harder to effectively use digital technologies for criminal activities, while leveraging the possibilities of digital technologies by those affected, law enforcement agencies, business and organisations. As digital technologies continue to evolve, we need to stay up to date with the latest developments to effectively investigate and prosecute crimes in the digital age. There is an increased reliance on digital evidence, and the amount of heterogeneous digital evidence in criminal cases keep increasing. The forensic science techniques thus become more sophisticated and play an increasingly important role. However, the scientific area is extremely broad, and beyond the capability of most forensic science labs to keep up with the technology forefront development speed. Besides an urgent need to bring up the subject to the political arena, examples of how we can meet the challenges are discussed such as by extending our cooperation, encourage and facilitate cooperation for training and education to handle the extremely broad and rapid development, working out methods for explaining and visualising evidence for the treatment and legal values of digital evidence in prosecution, and cooperation between product developers and crime investigators for swift innovation of digital forensics tools and methodologies for quickly emerging threats. This paper will highlight specific examples where modern digital techniques are used to solve crimes in the physical world as well as crimes committed in the digital domain and discuss how “good AI” can be used to fight “evil AI” and finally touch on the sensitive balance between the increased power of the new digital forensic tools and private integrity.

Along with the diverse types of electronic goods and digital evidence, techniques have also developed in conducting digital forensic investigations. Another effect is the increase in types and types of tools for conducting digital forensic investigations. The problem is the increasing number of digital forensic tools is not always developed in conjunction with the manual book. So this is what makes the investigator to check the tool to make it suitable for investigations. Choosing the right tool is very important in the investigation process, because each stage of the forensic investigation process has a different treatment for each of its staging. Seeing these conditions, then in this paper we make a system design to facilitate investigators in choosing the right digital forensic tool and in accordance with using an expert system. The design system shows that it’s still needed to confirm to an expert to get a match output if there is a new rule. Later this system will be implemented with website technology.

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

The budding progress and relevance of digital information technology in quite a few areas of business, engineering, medical, agricultural and scientific studies are resulting in data explosion coined by the term “big data”. The dependency on digital media drives and devices has enlarged the dimensions of data formation and storage exponentially around the world, with a need of keeping a record of what data is accumulated and how the data is exercised. So it has raised an alarm of security for the data asset. To discover the pattern of interest leading to a decision from these voluminous data has put forth a challenge for the law enforcement and investigative agencies. Also, tracing such type of misutilization of digital technology in a big data age from the perspective of digital forensics requires minute bit-level examination and observations to locate the digital evidence that explains how maliciously nefarious activities have been done and by whom with the possible extent of the damage. The forensic examination and analysis in such a big data era requires appropriate digital investigation model with the application of tools, techniques and methodologies to boost decision-making and diagnostic process for advanced outfitted competence in digital forensic investigation with the intent of assembling valuable evidence from it. So, the need of the hour is to have a holistic outlook of the big data challenges and opportunities for its application in the digital forensic domain with the goal of making full-bodied investigation pronouncements. Much work has been done to model digital investigation as well as digital evidence but a comprehensive correlated and aggregated merging of voluminous data coming from different heterogeneous sources along with timely and accurate detection and analysis is the need of the hour. This chapter depicts the trends of digital forensics served for big data and the challenges of evidence acquisition, and further suggests the revision of the existing fusion-based digital investigation model by highlighting the formalization, quick detection and timely accurate analysis of digital evidence from multiple sources simultaneously. The modification adopted the inclusion of look-up table into the architecture with the application of data fusion to practice voluminous data effectually.

Digital forensics (DF) tools are used for post-mortem investigation of cyber-crimes. CFTT (Computer ForensicsTool Testing) Program at National Institute of Standards and Technology (NIST) has defined expectations for aDF tool’s behavior. Understanding these expectations and how DF tools work is critical for ensuring integrityof the forensic analysis results. In this paper, we consider standardization of one class of DF tools which arefor Deleted File Recovery (DFR). We design a list of canonical test file system images to evaluate a DFR tool.Via extensive experiments we find that many popular DFR tools do not satisfy some of the standards, and wecompile a comparative analysis of these tools, which could help the user choose the right tool. Furthermore,one of our research questions identifies the factors which make a DFR tool fail. Moreover, we also providecritique on applicability of the standards. Our findings is likely to trigger more research on compliance ofstandards from the researcher community as well as the practitioners.

This research aims to compare the effectiveness of two prominent digital forensics tools, Autopsy TSK and Forensic Explorer, in analysing a well-known forensic image, specifically the Lone Wolf image from Digital Corpora. The aim is to assess their capabilities in detecting and handling forensic artefacts and their responses to selected anti-forensic techniques. Autopsy TSK and Forensic Explorer exhibited robust performance in identifying and analysing forensic artefacts within the Lone Wolf image. They successfully retrieved most of the available digital evidence. Data was concealed using encryption techniques, both tools failed to detect the hidden information, highlighting a limitation in their ability to uncover encrypted steganographic content. In cases of altered Exif and metadata, both tools could retrieve the original information from the hex data of the files. However, it is noteworthy that neither tool provided an alert or warning to guide the investigator regarding potential data manipulation. Based on the findings of this research, it is advisable for digital forensic investigators to exercise caution and employ additional techniques or tools when handling cases which may involve encrypted steganography.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

A review of collisions in cryptographic hash function used in digital forensic tools

Digital forensics investigators have access to a wide variety of tools, both commercial and open source, which assist in the preservation and analysis of digital evidence. Unfortunately, most current digital forensics tools fall short in several ways. First, they are unable to cope with the ever-increasing storage capacity of target devices. As capacities grow into hundreds of gigabytes or terabytes, the traditional approach of utilizing a single workstation to perform a digital forensics investigation against a single evidence source, such as a hard drive, will become completely intractable. Further, huge targets will require more sophisticated analysis techniques, such as automated categorization of images. We believe that the next generation of digital forensics tools will employ high-performance computing, more sophisticated evidence discovery and analysis techniques, and better collaborative functions to allow digital forensics investigators to perform investigations much more efficiently than they do today. This chapter examines the next generation of digital forensics tools.

Chapter 6 - Digital Forensics at Work in the Legal System

Digital forensics is a process of collection, identification, extraction, and documentation of electronic evidence which is used in a court of law. There are a large number of tools that help us to make this process easy and simple. In this paper, four tools have been chosen to explore and study. The best digital forensic tools have been chosen according to different parameters in each type of digital forensics. The (Stellar) basis tool and (Forensic Tool Kit) have been explored for computer forensic tools while (Network Map) has been chosen for network forensic tools and (OSFmount) has been studied as a live forensic tool. This paper also covers other types of forensic tools like Database forensic tools, O.S. forensic tools, and Mail forensic tools. The role of Artificial intelligence in Digital Forensic tools has been discussed in this paper by using both Decision Stump and Bayes net machine learning techniques. After making an investigation of the IoT device traffic dataset using these two techniques, Decision Stump gives us less accurate results compared with Bayes net.

In the implementation of Digital Forensics, one of the derivatives of practice is the handling of Digital Evidence. Handling Digital Evidence requires important steps and procedures. Digital evidence is a source of artifacts in handling a digital-based crime case, one of which comes from digital storage. In this research, the author will design a framework for Digital Forensic investigations by simulating digital evidence in the form of a non-volatile architecture. The reference commonly used by researchers in previous articles is the National Institute of Justice (NIST). The framework is a reference and steps in the practice of acquiring digital evidence. The purpose of designing this framework is as a legal procedure that is specifically implemented in the practice of acquiring non-volatile digital evidence. In the design, the author conducted a literature study on the NIST SP 800-86 and ISO 27037:2012 standards and then combined them in a hybrid terminology. The output of this research is to combine the two standards to become framework as reference for handling and investigating Digital Forensic science.

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

Another brick in the wall: An exploratory analysis of digital forensics programs in the United States