Digital Forensic Tools: A Literature Review

Testing digital forensic tools is important to determine relevant tool properties like effectiveness and efficiency. Since many different forensic tool categories exist, different testing techniques and especially suitable test data are required. Considering test data for disk analysis and data recovery tools, synthetic disk images provide significant advantages compared to disk images created from real-world storage devices. In this work we propose a framework for generating synthetic disk images for testing digital forensic analysis tools. The framework provides functionality for building models of real-world scenarios in which data on a storage device like a hard disk is created, changed, or deleted. Using such a model our framework allows simulating actions specified in the model in order to generate synthetic disk images with realistic characteristics. These disk images can then be used for testing the performance of forensic disk analysis and data recovery tools.

Digital forensics (DF) tools are used for post-mortem investigation of cyber-crimes. CFTT (Computer ForensicsTool Testing) Program at National Institute of Standards and Technology (NIST) has defined expectations for aDF tool’s behavior. Understanding these expectations and how DF tools work is critical for ensuring integrityof the forensic analysis results. In this paper, we consider standardization of one class of DF tools which arefor Deleted File Recovery (DFR). We design a list of canonical test file system images to evaluate a DFR tool.Via extensive experiments we find that many popular DFR tools do not satisfy some of the standards, and wecompile a comparative analysis of these tools, which could help the user choose the right tool. Furthermore,one of our research questions identifies the factors which make a DFR tool fail. Moreover, we also providecritique on applicability of the standards. Our findings is likely to trigger more research on compliance ofstandards from the researcher community as well as the practitioners.

The new research approaches are needed to be adopted to deal with security threats in Artificial Intelligence (AI)-based systems. This research is aimed at investigating the AI attacks that are “malicious by design.” It also deals with conceptualization of the problem and strategies for attacks on AI using digital forensic tools. A specific class of problems in adversarial attacks are tampering of images for computational processing in applications of digital photography, computer vision, pattern recognition (facial capping algorithms). State-of-the-art developments in forensics, such as 1. Application of end-to-end Neural Network training pipeline for image rendering and provenance analysis. 2. Deep fake image analysis using frequency methods, wavelet analysis, and tools like Amped Authenticate. 3. Capsule networks for detecting forged images. 4. Information transformation for feature extraction via image forensic tools, such as EXIF-SC, Splice Radar, and Noiseprint. 5. Application of generative adversarial networks (GAN) based models as anti-image forensics [8], will be studied in great detail and a new research approach will be designed incorporating these advancements for utility of digital forensics.

Digital investigation is becoming an increasing concern. Many digital forensic tools are being developed to deal with the challenge of investigating digital crimes. Acquisition of volatile memory is one of the vital steps of digital forensics process. Passwords data, indications of digital forensics methods, memory malware may be contained in volatile data which may overlooked by the investigator. The Success of memory acquisition mainly depends on the effectiveness of the memory acquisition tool. This paper compares memory forensics tools based on processing time and left artifacts on volatile memory. Furthermore, we examined how the processing time of the tools varies in terms of different volatile memory size. In order to conduct this work, we use the following tools: FTK Imager, Pro Discover, Nigilant32, Helix3(dd), OSForensics and Belkasoft RAM Capturer. The results show that Belkasoft RAM Capturer has the least amount of left artifacts, and it has also the lowest processing time. Moreover, this work concludes that tested tools are significantly different based on left artifacts on the volatile memory with 95% confidence level. Also, statistically, increasing the memory size × times does not increase the processing time × times of the tools.

During the development of a new specialist graduate professional study program at Zagreb University of Applied Science “Information Security and Digital Forensics”, a number of challenges was addressed. The key challenges were: a) Defining the curriculum and b) Defining and building computer infrastructure for conducting laboratory exercises. We will address second: defining the necessary equipment for conducting laboratory exercises. New possibilities are given by new technologies, and it would be possible to expand the working environment which, apart from laboratory exercises, will enable independent student work. We will describe and define setting of the environment that can also be used for independent research in the field of information security and digital forensics for expert and scientific community. We will use TVZ private cloud as a place to build digital forensic laboratory, maintained by digital forensic management process tool, where different virtual machines with different digital forensic software will be accessible for students and independent researches.

With the continued growth of the mobile device market, the possibility of their use in criminal activity will only continue to increase. While the mobile device market provides a great variety of manufactures and models causing a strong diversity. It becomes difficult for a professional investigator to choose the proper forensics tools for seizing internal data from mobile devices. Through this paper, we will give a comprehensive perspective of each popular digital forensic tool and offer an inside view for investigators to choose their free sources or commercial tools. In addition, a summary for the future direction for forensics tools in mobile devices.

Digital forensics investigators have access to a wide variety of tools, both commercial and open source, which assist in the preservation and analysis of digital evidence. Unfortunately, most current digital forensics tools fall short in several ways. First, they are unable to cope with the ever-increasing storage capacity of target devices. As capacities grow into hundreds of gigabytes or terabytes, the traditional approach of utilizing a single workstation to perform a digital forensics investigation against a single evidence source, such as a hard drive, will become completely intractable. Further, huge targets will require more sophisticated analysis techniques, such as automated categorization of images. We believe that the next generation of digital forensics tools will employ high-performance computing, more sophisticated evidence discovery and analysis techniques, and better collaborative functions to allow digital forensics investigators to perform investigations much more efficiently than they do today. This chapter examines the next generation of digital forensics tools.

Digital transformation rapidly changes how we live our lives in the post pandemic world. Unfortunately, digital technology is not limited to law abiding organisations and citizens. Criminal organisations and individuals are quick to identify new opportunities with new technologies, and digital transformation is dramatically changing the character of crimes, terror, and other threats. The fast emergence of new crimes is facilitated by possibilities brought by disruptive technologies such as AI, Internet of Things, drones, and cryptocurrencies that can be disastrous tools in the hands of criminals. Consequently, our society needs far better capacity to prevent and investigate criminal acts to protect organisations and citizens. This brings an urgent need to proactively reform digital forensics to significantly increase our capability to meet the strain on society brought by crimes evolving in the digital transformation era. The future of forensic science is already here, characterized by a mix of opportunities and challenges. It is essential to make it harder to effectively use digital technologies for criminal activities, while leveraging the possibilities of digital technologies by those affected, law enforcement agencies, business and organisations. As digital technologies continue to evolve, we need to stay up to date with the latest developments to effectively investigate and prosecute crimes in the digital age. There is an increased reliance on digital evidence, and the amount of heterogeneous digital evidence in criminal cases keep increasing. The forensic science techniques thus become more sophisticated and play an increasingly important role. However, the scientific area is extremely broad, and beyond the capability of most forensic science labs to keep up with the technology forefront development speed. Besides an urgent need to bring up the subject to the political arena, examples of how we can meet the challenges are discussed such as by extending our cooperation, encourage and facilitate cooperation for training and education to handle the extremely broad and rapid development, working out methods for explaining and visualising evidence for the treatment and legal values of digital evidence in prosecution, and cooperation between product developers and crime investigators for swift innovation of digital forensics tools and methodologies for quickly emerging threats. This paper will highlight specific examples where modern digital techniques are used to solve crimes in the physical world as well as crimes committed in the digital domain and discuss how “good AI” can be used to fight “evil AI” and finally touch on the sensitive balance between the increased power of the new digital forensic tools and private integrity.

In the era of Information technology textual evidence is important to the vast majority of digital investigations. Important text-based evidence include Email, Internet browsing history instant messaging, system logs and so on. The investigator is flooded with data and has to spend valuable investigative time scanning through noisy search results and reviewing irrelevant search results. Current digital forensic text string search tools use match and/or indexing algorithms to search digital evidence at the physical level to locate specific text strings. The text string search tools fail to group and/or order search hits. This research uses text data mining principles and technologies for design and implementation which improves IIR (Intelligent Information Retrieval) effectiveness in digital forensics. The proposed system can analyze the corpus of mail data or SMS data with domain specific keywords. The searching and ranking of the mails in the proposed system is based on the weight of keywords of forensic interest.

This paper reviews the existing methodologies and best practices for digital investigations phases like collecting, evaluating and preserving digital forensic evidence and chain of custody of cybercrimes. Cybercriminals are adopting new strategies to launch cyberattacks within modified and ever changing digital ecosystems, this article proposes that digital investigations must continually readapt to tackle cybercrimes and prosecute cybercriminals, working in international collaboration networks, sharing prevention knowledge and lessons learned. The authors also introduce a compact cyber forensics model for diverse technological ecosystems called Cyber Forensics Model in Digital Ecosystems (CFMDE). Transferring the knowledge, international collaboration, best practices and adopting new digital forensic tools, methodologies and techniques will be hereinafter paramount to obtain digital evidence, enforce organizational cybersecurity policies, mitigate security threats, fight anti-forensics practices and indict cybercriminals. The global Digital Forensics community ought to constantly update current practices to deal with cybercriminality and foreseeing how to prepare to new technological environments where change is always constant.

The advancement of digital technology has introduced significant challenges to evidentiary processes, particularly within the Syariah judiciary in Malaysia. Electronic evidence—including mobile application messages, closed-circuit television (CCTV) recordings, emails, and online transactions—is increasingly tendered in Syariah proceedings. However, the absence of a detailed legal framework under the Syariah Court Evidence (Federal Territories) Act 1997 [Act 561] has created substantial uncertainty, especially regarding authentication and integrity. In contrast, the Civil Courts operate under the Evidence Act 1950 [Act 56], which contains comprehensive provisions governing the admissibility of electronic evidence. This article examines the existing legal framework on electronic evidence in Malaysia, analyses the principles of authentication and integrity from a Syariah perspective, and evaluates the role of digital forensics in enhancing evidentiary reliability. The study employs a qualitative method through doctrinal document analysis, subsequently organised into subthemes. The findings demonstrate that digital forensic tools—such as cryptographic hashing, digital signatures, metadata analysis, and blockchain—are indispensable in ensuring the authenticity of electronic documents, while remaining consistent with the objectives of the maqāṣid al-sharīʿah in protecting rights (ḥifẓ al-ḥuqūq), property (ḥifẓ al-māl), and dignity (ḥifẓ al-ʿirḍ). The article concludes that integrating digital forensics into Syariah evidentiary practice is essential to reinforce justice, strengthen legal certainty, and safeguard the credibility of judicial outcomes in the digital era.

The Ext4 file system is often used by Android cell phones and by Linux distributions. As a mobile forensic expert, it is necessary to understand the structures of this file system to recover data, verify tool results, and detect anti-forensics techniques that may be present in the file system. In this chapter, we will have a deep dive into topics important for an investigation. Many digital forensic tools do not recover much from the Ext4 file system [52], and therefore we show some of the most useful Ext4 recovery techniques proposed by current research.The Ext4 file system is often used by Android1 operating systems, and also by Linux desktop distributions [14], and this file system is open source. The Ext4 file system replaces the Ext2 and Ext3, but it is mostly backwards compatible. Carrier described Ext2 and Ext3 in his File System forensic analysis book [10], which includes information also relevant for Ext4. Fairbanks describes the Ext4 file system at a low level and from a Digital Forensics perspective. This chapter will describe file system information important for mobile forensic investigators and other digital forensic experts.

Along with the diverse types of electronic goods and digital evidence, techniques have also developed in conducting digital forensic investigations. Another effect is the increase in types and types of tools for conducting digital forensic investigations. The problem is the increasing number of digital forensic tools is not always developed in conjunction with the manual book. So this is what makes the investigator to check the tool to make it suitable for investigations. Choosing the right tool is very important in the investigation process, because each stage of the forensic investigation process has a different treatment for each of its staging. Seeing these conditions, then in this paper we make a system design to facilitate investigators in choosing the right digital forensic tool and in accordance with using an expert system. The design system shows that it’s still needed to confirm to an expert to get a match output if there is a new rule. Later this system will be implemented with website technology.

This research aims to compare the effectiveness of two prominent digital forensics tools, Autopsy TSK and Forensic Explorer, in analysing a well-known forensic image, specifically the Lone Wolf image from Digital Corpora. The aim is to assess their capabilities in detecting and handling forensic artefacts and their responses to selected anti-forensic techniques. Autopsy TSK and Forensic Explorer exhibited robust performance in identifying and analysing forensic artefacts within the Lone Wolf image. They successfully retrieved most of the available digital evidence. Data was concealed using encryption techniques, both tools failed to detect the hidden information, highlighting a limitation in their ability to uncover encrypted steganographic content. In cases of altered Exif and metadata, both tools could retrieve the original information from the hex data of the files. However, it is noteworthy that neither tool provided an alert or warning to guide the investigator regarding potential data manipulation. Based on the findings of this research, it is advisable for digital forensic investigators to exercise caution and employ additional techniques or tools when handling cases which may involve encrypted steganography.

In recent years the use of digital communication has increased. This also\nincreased the chance to find privileged data in the digital evidence.\nPrivileged data is protected by law from viewing by anyone other than the\nclient. It is up to the digital investigator to handle this privileged data\nproperly without being able to view the contents. Procedures on handling this\ninformation are available, but do not provide any practical information nor is\nit known how effective filtering is. The objective of this paper is to describe\nthe handling of privileged data in the current digital forensic tools and the\ncreation of a script within the digital forensic tool Nuix. The script\nautomates the handling of privileged data to minimize the exposure of the\ncontents to the digital investigator. The script also utilizes technology\nwithin Nuix that extends the automated search of identical privileged document\nto relate files based on their contents. A comparison of the 'traditional' ways\nof filtering within the digital forensic tools and the script written in Nuix\nshowed that digital forensic tools are still limited when used on privileged\ndata. The script manages to increase the effectiveness as direct result of the\nuse of relations based on file content.\n