Digital Forensics for Ransomware-based Software

How can organisations be forensically ready? As organisations are bound to be criticised in the digitally developing world, they must ensure that they are forensically ready. The readiness of digital forensics ensures compliance in an organisation’s legal, regulatory, and operational structure. Several digital forensic investigative methods and duties are based on specific technological designs. The present study is the first to address the core principles of digital forensic studies, namely, reconnaissance, reliability, and relevance. It reassesses the investigative duties and establishes eight separate positions and their obligations in a digital forensics’ investigation. A systematic literature review revealed a gap in the form of a missing comprehensive direction for establishing a digital forensic framework for ethical purposes. Digital forensic readiness refers to the ability of a business to collect and respond to digital evidence related to security incidents at low levels of cost and interruption to existing business operations. This study established a digital forensic framework through a systematic literature review to ensure that organisations are forensically ready to conduct an efficient forensic investigation and to cover ethical aspects. Furthermore, this study conducted a focus group evaluation through focus group discussions to provide insights into the framework. Lastly, a roadmap was provided for integrating the system seamlessly into zero-knowledge data collection technologies.

This study examined the impact of technology on digital forensics and the challenges faced by forensic accountants in the era of cybercrime. The study highlights the four dimensions in which technology has an impact on digital forensics: technical, legal, organizational, and educational. The paper also discusses how emerging technologies such as artificial intelligence and machine learning can be used in digital forensics, along with the challenges they present. Cloud computing is also examined, and the challenges it poses for forensic accountants who need to access and analyze financial data stored or processed in the cloud are discussed. The research used a qualitative research design and incorporated the chain of custody theory in digital forensics. The findings of this study suggest that forensic accountants need to update their knowledge and skills in digital forensics to keep up with the latest trends and technologies in cybercrime in Nigeria. It is recommended that forensic accountants adopt a multidisciplinary approach that integrates accounting principles with digital forensics methods and tools. Additionally, following best practices and guidelines for digital evidence collection, preservation, analysis, and presentation is crucial to ensure the integrity, reliability, and admissibility of digital evidence in court.

Digital Forensic as it sounds coerce human mind primarily with exploration of crime. However in the contemporary world, digital forensic has evolved as an essential source of tools from data acquisition to legal action. Basically three stages are involved in digital forensic namely acquisition, analysis and reporting. Digital Forensic Research Workshop (DFRW) defined digital forensic as “Use of Scientifically derived and proven method towards the identification, collection, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of event to be criminal”. The hard problem in digital forensic is such that the acquired data need to be cleaned and is required to be intelligible for reading by human. As a solution to this complexity problem a number of tools are present which may be repeated until relevant data is obtained.

Digital Forensic as it sounds coerce human mind primarily with exploration of crime. However in the contemporary world, digital forensic has evolved as an essential source of tools from data acquisition to legal action. Basically three stages are involved in digital forensic namely acquisition, analysis and reporting. Digital Forensic Research Workshop (DFRW) defined digital forensic as “Use of Scientifically derived and proven method towards the identification, collection, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of event to be criminal”. The hard problem in digital forensic is such that the acquired data need to be cleaned and is required to be intelligible for reading by human. As a solution to this complexity problem a number of tools are present which may be repeated until relevant data is obtained.

Another brick in the wall: An exploratory analysis of digital forensics programs in the United States

Background: The rise of digital technology has transformed how children engage with the world but has also exposed them to online exploitation. Crimes such as child sexual abuse material (CSAM), grooming, cyberbullying, and trafficking have increased, making digital forensics essential in child protection. This presentation examines how forensic medicine and digital forensics aid in identifying, investigating, and preventing these crimes. The research objectives examine the roles of forensic medicine and digital forensics in identifying, investigating, and preventing online child exploitation, and highlight emerging forensic technologies and multidisciplinary approaches to enhance child safety. Method: A comprehensive literature review was conducted using PubMed, Web of Science, and Google Scholar, focusing on publications from 2015 to 2024. Search terms included "digital forensics," "child sexual abuse," "cyberbullying," "AI in forensic investigations," and "forensic medicine in child protection". Studies were included if they addressed forensic methods for detecting, investigating, or preventing online child exploitation. Results: Experts in digital forensics use cutting-edge technologies like blockchain analysis to track illegal financial transactions, automated Al-based systems for identifying and classifying exploitative content, dark web investigations to track encrypted communications, and metadata analysis to reveal hidden information in digital files. Contributions from forensic medicine specialists include assisting with victim identification, recording physical and psychological evidence of abuse, and working with digital forensic teams to conduct thorough case evaluations. The effectiveness of prevention and intervention initiatives is increased when forensic experts, law enforcement, and child protection organizations work together interdisciplinary. Conclusion: Strengthening digital forensic capabilities and promoting child-centered ethical practices are essential to minimize and prevent the growing threat of online child exploitation. Ongoing research, innovation, and policy development will be crucial to safeguarding the rights and wellbeing of children in the era of digital technology.

Digital forensic teams and laboratories are now common place within Australia, particularly associated with law enforcement and intelligence agencies. The digital forensics discipline is rapidly evolving to become a scientific practice with domain-specific guideline. These guidelines are still under discussion in an attempt to progress the discipline so as to become as solid and robust in its scientific underpinnings as other forensic disciplines. Influential players, practitioners and observers all agree that rigorous standards need to be adopted to align this science with other forensic sciences. How does one assess the scientific nature of digital forensics with so many independent computing and IT elements combined, and what are the outcomes of each assessment method? Solutions are proposed regularly justifying their use but to date no one international or national standard exists. This paper does not propose a solution but rather explores the concept of Validation and Verification (V&V) with particular respect to digital forensic tools. The paper also explores ISO17025 "General requirements for the competence of testing and calibration laboratories" and develops the testing process to satisfy this standard to allow for Australian digital forensic laboratories to be eligible for certification.

Cybersecurity incidents have been growing in number with high severity. To response to the Cybersecurity incidents, the attacked organizations generally execute predetermined procedures and then apply digital forensics to recover and investigate material on digital media and networks. The digital forensics procedure composes of four important processes including identification, preservation, analysis, and presentation of digital evidence which is legally admitted in any legal proceedings. This paper is aimed to study effecting factors on selecting methods of digital forensics according to standards and international practices from reliable international organizations. The paper demonstrated internal and external organization factors that used for determining the digital forensic methods to conform to enforced laws or principal rules in the organizations. Additionally, it revealed viewpoints from information security professionals to determine standards and international practices for digital forensics to apply in an organization. The study pointed out that factors relating to law and regulations was the most significant factor that most of organizations (67 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">%</sup> ) used to determine international approach or standards for digital forensic. This made the standards of NIST more reliable, and it has been adopted by most organizations for digital forensic. This research can be further applied to develop the methods for digital forensics in near future.

The chapter is organized as follows. In the next section we will give an overview of most important standards and best practice guides covered in this chapter, in order to show a big picture of what has been happening in this space since the early 1990s when electronic evidence started becoming an important area for law enforcement and forensic practitioners to look at seriously. This section will give a complete list of all standards and best practice guides covered in this chapter. After the overview a number of sections are dedicated to different groups of standards and best practice guides according to their contents: Section 2.3 covers electronic evidence and digital forensics in general, Section 2.4 focuses on multimedia evidence and multimedia forensics, Section 2.5 looks at digital forensics laboratory accreditation, Section 2.6 focuses on general quality assurance (management) procedures important for digital forensics laboratories, and finally Section 2.7 covers training, education and certification. The last section concludes this chapter with a summary of existing standards and best practices and also future trends.

Scope of Managing Knowledge in Digital Forensics

Data has become a bigger challenge to handle in mobile networks, today. In case of mobile devices data needs to be processed in large amounts so insufficient space issues may occur in case of low hardware configurations. For this, cloud platform provides ease of migrating apps to various places without giving platform dependency, space issues and also giving better data processing on low hardware costs. But is highly susceptible to malware attacks and data loss due to various factors and in case of digital data forensics becomes a greater challenge. In this paper, we present an overview of MCC and digital forensics, focusing on its key aspects and significant forensic challenges faced by digital investigators in MCC. The purpose of this paper is to provide a comprehensive understanding about forensic research challenges and re-direct researchers towards new research areas.

Most organizations underestimate the demand for digital evidence [1]. Often, when evidence is required to prove fraudulent transactions, not enough or trustworthy evidence is available to link the attacker to the incident. It is essential for organizations to prepare themselves for digital Forensic (DF) investigations and ensure that entire organizational operating environment is prepared for example for an investigation (criminal or internal) or acompliance tests. The accepted literature on DF readiness concentrates mainly on evidence identification, handling and storage, first line incident response and training requirements [2]. It does not consider the proactive application of DF tools to enhance the corporate governance structures (specifically Information Technology (IT) governance). Pro-active DF (ProDF) as defined in this paper will enable an organization to take the initiative by implementing adequate measures to become DF ready,demonstrate due diligence for good corporate Governance, specifically IT Governance and provide a mechanism to assess and improve IT Governance frameworks. The purpose of this paper is to define, identify goals, steps, and deliverables of ProDF, identify dimensions of DF, and propose a theoretical DF management framework to guidethe implementation of ProDF in an organization.

In recent years, there has been a push towards adopting artificial intelligence (AI) models in digital forensics (DF), particularly deep learning (DL) models. While these models assist DF experts, their lack of transparency raises concerns about reliability. Although eXplainable Artificial Intelligence (XAI) has progressed, current methods remain limited for DF applications. Existing visual XAI techniques do not provide sufficient clarity for challenging image forensics tasks such as Source Camera Identification (SCI), nor do they offer mechanisms to assess whether a model’s decision is correct. Most methods simply highlight influential regions without enabling examiners to validate the decision itself. Rule-based explainability is a promising strategy for increasing transparency, yet deploying it on real-world Convolutional Neural Networks (CNNs) is still challenging. Prior studies remain largely experimental and often require modifying the model to extract rules, conflicting with the integrity requirements of DF workflows. To address these gaps, this paper introduces a framework to make CNN models used in the analysis stage of digital forensics explainable. The framework, by following three fundamental steps—layers trace detection, layers majority voting, and rule extraction—provides structured and transparent visual output, and rule-based textual explainability that is understandable to the user. Based on this, the first explainable Source Camera Identification (SCI) model is introduced which is a challenging DF task to make it explainable. The explainable output allows for the rejection or confirmation of the main model’s prediction based on the decisions of the layers and compliance with the principle of integrity to the DF examiner. In addition, with the identification of 27 out of 37 incorrect predictions by the base model, the precision of the model was improved from 97.33% to 99.2%.

This paper prescribes a digital forensic policy framework for a State to introduce Digital Forensics as a Service (DFaaS) as an integral part of e-Government services. DFaaS constitutes of investigating services for crimes committed upon and using electronic media. The policy framework proposes to establish a Centralized Digital Forensic Facility (CDFF) for enabling digital forensic services across all digital forensic units of a State. The basic objective of CDFF is to standardize, disseminate knowledge and reduce duplication of works related to DFaaS maintaining Confidentiality, Integrity and Authenticity of information. The core of the Policy aims to impose a few cost effective security mechanism on top of any infrastructure, be it a data centre or be it a cloud computing environment. Such mechanism enforces State specific forensic agents to be executed at specified levels of any public or private Infrastructure to facilitate forensic activities on the Infrastructure on demand and as per convenience.

Medical Internet of Things (MIoT) Forensics is an important subject that has received little attention. With the advancement of the Internet of Things (IoT), Machine Learning (ML), and Artificial Intelligence (AI) applications, a large amount of data gets generated with increased complexity. Consequently, it gives rise to cyber-attacks and data theft. The consequences of these malicious activities can be life-threatening. Therefore, organizations must identify these threats to implement proactive and reactive measures. Digital Forensics of medical devices focuses on reactive measures to generate evidence of unprecedented events presented in court. Digital forensics, in combination with ML, might aid in the development of a secure MIoT system that can detect cyber-attacks and provide evidence for the legal process. Implementing digital forensics in medical systems is challenging, given their complex functioning. This paper presents a novel methodology for developing a forensic-ready MIoT system with two distinct approaches: an intrusion detection system and modeling of the physiological data. In addition, we cover various digital forensic processes for MIoT systems to log evidence of malicious activity at various system levels. This research highlights the importance of digital forensics for MIoT privacy assurance.