Digital Forensic and Machine Learning

Digital Forensic as it sounds coerce human mind primarily with exploration of crime. However in the contemporary world, digital forensic has evolved as an essential source of tools from data acquisition to legal action. Basically three stages are involved in digital forensic namely acquisition, analysis and reporting. Digital Forensic Research Workshop (DFRW) defined digital forensic as “Use of Scientifically derived and proven method towards the identification, collection, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of event to be criminal”. The hard problem in digital forensic is such that the acquired data need to be cleaned and is required to be intelligible for reading by human. As a solution to this complexity problem a number of tools are present which may be repeated until relevant data is obtained.

Current crime is increasing, one of which is the crime of using social media, although no crime does not leave digital evidence. Twitter application is a social media that is widely used by its users. Acts of crime such as fraud, insults, hate speech, and other crimes lately use many social media applications, especially Twitter. This research was conducted to find forensic evidence on the social media Twitter application that is accessed using a smartphone application using the Digital Forensics Research Workshop (DFRWS) method. These digital forensic stages include identification, preservation, collection, examination, analysis, and presentation in finding digital evidence of crime using the MOBILedit Forensic Express software and Belkasoft Evidence Center. Digital evidence sought on smartphones can be found using case scenarios and 16 variables that have been created so that digital proof in the form of smartphone specifications, Twitter accounts, application versions, conversations in the way of messages and status. This study's results indicate that MOBILedit Forensic Express digital forensic software is better with an accuracy rate of 85.75% while Belkasoft Evidence Center is 43.75%.

A novel blockchain-based digital forensics framework for preserving evidence and enabling investigation in industrial Internet of Things

Digital forensics is an essential and expanding field focused on the collection and analysis of digital evidence for legal cases. As digital devices and online communications become more integrated with criminal investigations, investigators need to understand the basics of digital forensics. While certifications still provide a quick route to a career in digital forensics, higher education institutions are now offering programs centered on cybercrime, making digital forensic coursework more accessible. Due to the shortage of cybersecurity professionals, early exposure to digital forensics can help students discover relevant academic and career options. This paper emphasizes the importance of introducing high school students to digital forensics. It details the development of a hands-on activity using the open-source forensic tools SleuthKit and Autopsy. We explore practical aspects of designing and implementing the activity, identify potential improvements, and highlight the importance of early engagement in building a pipeline of skilled cyber professionals.

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

The development of sixth‐generation (6G) wireless communication technology is expected to provide super high‐speed data transmission, and advanced network performance than the current fifth‐generation (5G) and be fully functional by the 2030s. This development will have a significant impact and add improvements to digital extended reality (XR), autonomous systems, vehicular ad hoc networks (VANETs), artificial intelligence (AI), underwater communications, blockchain technology, pervasive biomedical informatics and smart cities built on the digital infrastructure backbone of the Internet of Things (IoT). The ubiquitous nature of this large‐scale 6G‐enabled IoT that offers faster connectivity capabilities and integrates both terrestrial and non‐terrestrial networks will not only create new data security and privacy issues but also provide a treasure trove of digital evidence useful for digital forensic examiners investigating security incidents and cybercrime. However, for digital forensic examiners, evidence collection, preservation and analysis will become a priority in the successful deployment of 6G IoT networks. In this study, we define key applications of 6G network technology to the Internet of Things and its existing architectures. The survey introduces potential digital forensic challenges and related issues affecting digital forensic investigations specific to 6G IoT networks. Finally, we highlight and discuss forensic readiness and future research directions for identified challenges within the 6G IoT network environments.This article is categorized under: Digital and Multimedia Science > IoT Forensics

Cloud computing provides to the consumers basic computing resources that range from storage and computing power to sophisticated applications. When digital forensics is needed for suspected cases involving cloud computing, the provider is responsible for collecting the digital evidence. Limitations of this approach include lack of efficient incident response, and that the consumers may have a little or no choice but to accept electronic evidences made available by the cloud provider. This research investigates whether it is possible to perform consumer-side digital forensics where a consumer independently collects all digital evidences required for a suspected case from Infrastructure as a Service resources (IaaS). In particular, the research contributes to a digital forensics readiness framework that shows how digital evidence collection can be made strongly consumer-centric, so that all the electronic evidences that digital forensic investigation requires for suspected cases can be provided independently by the IaaS consumers.

Chapter 1 - Understanding Digital Forensics

Recent trends in global networks are leading toward service-oriented architectures and sensor networks. On one hand of the spectrum, this means deployment of services from numerous providers to form new service composites, and on the other hand this means emergence of Internet of things. Both these kinds belong to a plethora of realms and can be deployed in many ways, which will pose serious problems in cases of abuse. Consequently, both trends increase the need for new approaches to digital forensics that would furnish admissible evidence for litigation. Because technology alone is clearly not sufficient, it has to be adequately supported by appropriate investigative procedures, which have yet become a subject of an international consensus. This paper therefore provides appropriate a holistic framework to foster an internationally agreed upon approach in digital forensics along with necessary improvements. It is based on a top-down approach, starting with legal, continuing with organizational, and ending with technical issues. More precisely, the paper presents a new architectural technological solution that addresses the core forensic principles at its roots. It deploys so-called leveled message authentication codes and digital signatures to provide data integrity in a way that significantly eases forensic investigations into attacked systems in their operational state. Further, using a top-down approach a conceptual framework for forensics readiness is given, which provides levels of abstraction and procedural guides embellished with a process model that allow investigators perform routine investigations, without becoming overwhelmed by low-level details. As low-level details should not be left out, the framework is further evaluated to include these details to allow organizations to configure their systems for proactive collection and preservation of potential digital evidence in a structured manner. The main reason behind this approach is to stimulate efforts on an internationally agreed "template legislation," similarly to model law in the area of electronic commerce, which would enable harmonized national implementations in the area of digital forensics.

Digital Forensics has become an indispensable tool in contemporary cybercrime investigations, which ensures systematic identification, collection, preservation, and presentation of electronic evidence in a legally admissible manner. As cybercrimes continue to escalate, investigative authorities are required to operate across multiple digital domains, including personal devices, mobile platforms, cloud infrastructures, and transnational communication networks, with strict adherence to the law. Digital forensics is important not only because it can recover the deleted or concealed data, but also because it ensures that the evidence remains authentic and untouched throughout the investigation. Due to its dual emphasis on both technology and law, it effectively bridges the gap between technical accuracy and legal accountability. Despite being so advanced in the contemporary world, the field of digital forensics still faces persistent challenges. The extensive reliance on data encryption, rapid technological innovations, and the issue of complex jurisdiction in cross-border investigations complicate and hamper the effective use of digital forensics. Moreover, the escalation of data generated in the digital age raises concerns about privacy, transparency, and the timely administration of justice. Addressing these concerns requires some advanced and well-developed standardized forensic frameworks, legal protocols, and greater international cooperation to harmonize investigative procedures. This paper shall dwell upon the continuous evolution of the role of digital forensics in cybercrimes in the contemporary world. It shall particular ly focus on the foundations, challenges, evidentiary value, and implications for law enforcement and global cybersecurity. It shall also emphasize the strengthening of digital forensics so that harmonious international relations and global cybersecurity can be achieved.

Cybersecurity incidents have been growing in number with high severity. To response to the Cybersecurity incidents, the attacked organizations generally execute predetermined procedures and then apply digital forensics to recover and investigate material on digital media and networks. The digital forensics procedure composes of four important processes including identification, preservation, analysis, and presentation of digital evidence which is legally admitted in any legal proceedings. This paper is aimed to study effecting factors on selecting methods of digital forensics according to standards and international practices from reliable international organizations. The paper demonstrated internal and external organization factors that used for determining the digital forensic methods to conform to enforced laws or principal rules in the organizations. Additionally, it revealed viewpoints from information security professionals to determine standards and international practices for digital forensics to apply in an organization. The study pointed out that factors relating to law and regulations was the most significant factor that most of organizations (67 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">%</sup> ) used to determine international approach or standards for digital forensic. This made the standards of NIST more reliable, and it has been adopted by most organizations for digital forensic. This research can be further applied to develop the methods for digital forensics in near future.

Medical Internet of Things (MIoT) Forensics is an important subject that has received little attention. With the advancement of the Internet of Things (IoT), Machine Learning (ML), and Artificial Intelligence (AI) applications, a large amount of data gets generated with increased complexity. Consequently, it gives rise to cyber-attacks and data theft. The consequences of these malicious activities can be life-threatening. Therefore, organizations must identify these threats to implement proactive and reactive measures. Digital Forensics of medical devices focuses on reactive measures to generate evidence of unprecedented events presented in court. Digital forensics, in combination with ML, might aid in the development of a secure MIoT system that can detect cyber-attacks and provide evidence for the legal process. Implementing digital forensics in medical systems is challenging, given their complex functioning. This paper presents a novel methodology for developing a forensic-ready MIoT system with two distinct approaches: an intrusion detection system and modeling of the physiological data. In addition, we cover various digital forensic processes for MIoT systems to log evidence of malicious activity at various system levels. This research highlights the importance of digital forensics for MIoT privacy assurance.

Another brick in the wall: An exploratory analysis of digital forensics programs in the United States

Digital forensics (DF) has become a substantial process to perform in depth investigations. But due to the digitalization, the potential Data volumes are increasing and hence it has become difficult to analyze them. Machine Learning (ML) is a panacea in this regard. It not only facilitates the analysis process but also yields accurate results. Therefore, with a focus on DF, this paper surveys a wide range of publications mentioning ML based techniques that can be used to ease the process of DF principally in the field of malware, network forensics, image/video forensics, and mobile/memory forensics. The results of the review show that ML is a fast and reliable procedure and needs to be explored more actively, particularly in DF field. The results are also used to develop a conceptual framework for a general procedure of ML based Digital Forensics.

How can organisations be forensically ready? As organisations are bound to be criticised in the digitally developing world, they must ensure that they are forensically ready. The readiness of digital forensics ensures compliance in an organisation’s legal, regulatory, and operational structure. Several digital forensic investigative methods and duties are based on specific technological designs. The present study is the first to address the core principles of digital forensic studies, namely, reconnaissance, reliability, and relevance. It reassesses the investigative duties and establishes eight separate positions and their obligations in a digital forensics’ investigation. A systematic literature review revealed a gap in the form of a missing comprehensive direction for establishing a digital forensic framework for ethical purposes. Digital forensic readiness refers to the ability of a business to collect and respond to digital evidence related to security incidents at low levels of cost and interruption to existing business operations. This study established a digital forensic framework through a systematic literature review to ensure that organisations are forensically ready to conduct an efficient forensic investigation and to cover ethical aspects. Furthermore, this study conducted a focus group evaluation through focus group discussions to provide insights into the framework. Lastly, a roadmap was provided for integrating the system seamlessly into zero-knowledge data collection technologies.