Packet capture infrastructure based on Moloch

The use of computer data as evidence within litigation is growing rapidly. Additionally, courts define computer data as a form of scientific evidence. The courts recognize that subject matter of scientific evidence is outside the general knowledge of the public, and it is beneficial for someone with special skills in the subject to explain the scientific evidence to the court; therefore, expert witnesses are permitted to enter their opinions into evidence to explain the data. However, a recent study identified widespread conflict among professionals in the field of computer forensics. This conflict raises serious questions concerning the data presented as evidence, the conclusions drawn by judges and juries, and the impact of those affected by the outcomes of legal proceedings. This paper discusses the findings of an analysis performed on data collected from computer forensics examiners and attorneys with computer forensics experience and provides a call for additional research.

Baofeng Energy awards contracts to KBR for Chinese methanol-to- olefins project

Can computer forensic tools be trusted in digital investigations?

The article considers the term "forensic", new for Russian economic theory and practice, that means "forensic science" from English. Its importance and implementation is justified by the increasing number of cases of widespread financial fraud. Forensic is just intended for their regulation and prevention. The conducted systematization of scientific publications testifies to the accumulation and theoretical generalization of materials that provide the basis for the formation of forensic as a separate type of expert research. Forensic is a certain niche in the professional sphere and is endowed with such mandatory attributes as rationality, neutrality and independence. The main goal of the forensic investigation is the disclosure of fraud, in general which includes the identification of those involved, the formation of evidence base, the establishment of facts and mechanisms of fraudulent activity. Forensic is held at the invitation of managers, investors and shareholders to identify not only additional resources, but also possible risks of the organization. It is indicated that underground economy, fraudulent activity can serve as an object of forensic. The forensic classification is proposed for corporate (internal) and forensic counterparties (external). In addition, we should pay attention to a rather new direction in the field of computer forensics with a similar name - forensic, which can be part of the forensic investigation. It is revealed that experts in the field of forensic use to a greater extent accounting and auditing procedures in their activities. Despite the forensic similarity to the audit and forensic accounting expertise, there are still distinctive features that are discussed in the article. Spheres of additional knowledge necessary for a specialist to work in the field of forensic are: sociology, psychology, criminal law, business law, law enforcement, business and finance, information systems, communism. It is concluded that the consolidation at the legislative level of the main provisions and standards concerning specialists in the field of forensic is necessary in the current conditions of management.

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that uses the fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

Computer virtualization is not a new technology, it has become increasingly important because of the many advantages it offers to businesses and individuals to reduce costs, while introducing new challenges to the field of digital forensics. As virtualization continues to be adopted by more and more companies every year, malware and hacker attacks are going to have an increasing effect on virtualized systems. Therefore, the increasing growth of virtualization has created the need for a new generation of computer forensic tools and techniques to analyze these compromised systems. Because of the rapid growth of virtualization, new techniques to interact with virtual systems have been developed. Some of these techniques reduce the limitations of traditional forensics tools abilities to analyze the virtual system. Virtual Machine Introspection (VMI) is one of these techniques that have formed the basis for a number of novel approaches in the fields of cyber security and digital forensics. This paper explores how VMI improves traditional digital forensics to overcome its downfalls when used to investigate virtual machines, especially during a live analysis of the machine.

This study evaluates the effect of forensic accounting techniques on fraud prevention in public sector financial management in Northwestern Nigeria. Using a cross-sectional survey design, descriptive statistics results showed high mean scores across variables, with Fraud Risk Assessment (M = 4.30, SD = 0.61) emerging as the most relevant technique, while Digital Forensics (M = 3.95, SD = 0.81) was the least adopted. Correlation analysis revealed significant positive relationships between all forensic techniques and fraud prevention, with Fraud Risk Assessment (r = 0.665, p < 0.01) and Document Examination (r = 0.612, p < 0.01) showing the strongest associations. Regression results confirmed that the model significantly predicts fraud prevention (F(5,249) = 119.24, p < 0.001), explaining 63.2% of the variance (R2 = 0.632). Among predictors, Fraud Risk Assessment (β = 0.331, p < 0.001) had the greatest influence, followed by Data Analysis (β = 0.178, p = 0.001) and Litigation Support (β = 0.167, p < 0.001). Document Examination (β = 0.152, p = 0.003) and Digital Forensics (β = 0.121, p = 0.008) also contributed significantly, though comparatively weaker. The findings demonstrate that forensic accounting techniques collectively play a critical role in strengthening fraud prevention mechanisms in the Nigerian public sector, with risk-based approaches being particularly impactful. Keywords: Forensic accounting, fraud prevention, risk assessment, data analysis, public sector financialmanagement,

Digital forensic methods for cybercrime investigation in a cloud computing environment (i.e., cloud forensic) is a broad term that encompasses a number of different fields, including digital forensics and cloud computing. The authors hope to gain a better understanding of cloud computing and identify challenges and opportunities in forensic science. They present research that may be used to establish strategies for the creation of measures, standards, and technological research to minimise the issues that cannot be solved with current technology and methodologies. Among the topics covered in this chapter are cloud computing, digital forensics, cybercrimes, and cloud forensics. Also covered are an overview and principles of cloud computing as well as digital forensics, cybercrimes, and challenges, as well as opportunities in the field of cloud forensics. The state of the art in the cloud forensic domain is also presented, as is a literature review on related work to digital forensics techniques in the cloud computing environment.

In an environment where computer compromises are no longer anomalies, but are frequent occurrences, the field of computer forensics has increasingly gained importance. The development of this forensic field is matched by a growth in anti-forensic techniques. To overcome potential difficulties with external applications, operating systems should contain methods for storing and protecting meaningful information. The Linux Ext3 journal is one source of information that should be fully utilized for its intended purpose and forensics as well. However, due to its limited size and circular nature, this source of information has restrictions that can be addressed by the operating system. For example, when collecting and examining Ext3 journal data, it can be difficult to determine the filename that an inode number is associated with. In this paper, the design of a method for honeypots is presented which takes advantage of the Virtual File System Layer in Linux to address this difficulty. This technique allows the translation of inode numbers to filenames in a historical context thereby providing a forensic analyst with a better picture of what has transpired.

During the development of a new specialist graduate professional study program at Zagreb University of Applied Science “Information Security and Digital Forensics”, a number of challenges was addressed. The key challenges were: a) Defining the curriculum and b) Defining and building computer infrastructure for conducting laboratory exercises. We will address second: defining the necessary equipment for conducting laboratory exercises. New possibilities are given by new technologies, and it would be possible to expand the working environment which, apart from laboratory exercises, will enable independent student work. We will describe and define setting of the environment that can also be used for independent research in the field of information security and digital forensics for expert and scientific community. We will use TVZ private cloud as a place to build digital forensic laboratory, maintained by digital forensic management process tool, where different virtual machines with different digital forensic software will be accessible for students and independent researches.

As our lives become more dependent on digital technology, cyber crime is increasing in our society. There is now an ever-increasing need to counter cyber crime through digital forensics investigations. With rapid developments in technology such as cloud computing, the Internet of Things, and mobile computing, it is vital to ensure proper training of law enforcement personnel and judges in the theory and practice of digital forensics. In this paper, we describe our methods and approach to create curricula, educational materials, and courses for training law enforcement and judicial personnel in digital forensics. We partnered with legal experts to design a series of modules/courses on digital forensics to educate the actual target demographics. Training materials have been designed to be not only scalable to nationwide law enforcement and judicial professionals, but also amenable to regular updates to respond to rapidly changing attacks and forensic techniques.

In the evolving field of digital forensics, the increasing sophistication of anti-forensic techniques poses significant challenges to digital forensic investigations, as perpetrators employ methods such as data encryption, steganography, time stomping, and file wiping to conceal or destroy digital evidence. Along with the rise in internet crime, the advances in anti-forensic techniques have added new layers of complexity for digital forensic investigators. Studies show that Zambian private and public sectors have low level compliance and have experienced cyber-attacks which indicated only 10% could recover from the attacks within a day and the rest it will require days, weeks and months to recover. That calls for considered efforts in developing measures for mitigation of these challenges in order to ensure national cyber-attacks preparedness defense strategy (Mwila & Kingstone, 2020). This study aims to analyze and implement countermeasures to anti-forensic techniques used by perpetrators in order to contribute and assure that the advancement of digital forensic techniques used by investigators does not lag behind, in this age of increasing technology sophistication.

The adoption of computers into every aspect of modern society has been accompanied by the rise of E-crime. The processes and techniques employed by the field of computer forensics offer huge potential for the extraction and presentation of electronic evidence in a court of law. This article analyzes the legal issues that currently or could potentially impact the computer forensics field from the perspective of experts in Australia.

The field of digital forensics is crucial in the examination of cybercrimes, data breaches, and other illicit activities in a world that is becoming more interconnected. The advent of blockchain technology has introduced a novel aspect to the field of digital forensics. This study provides an extensive examination of the convergence of blockchain and digital forensics, investigating the many impacts and obstacles that blockchain technology poses to conventional methods of digital forensic investigations. This chapter starts by clarifying the essential principles of blockchain technology, highlighting its decentralized and unchangeable nature, cryptographic foundations, and its use in cryptocurrency transactions. Afterwards, it explores the possible advantages of blockchain technology for digital forensics, including the provision of transparent and unalterable records of digital activity and transactions. Moreover, this chapter also examines the distinctive obstacles presented by blockchain in the context of digital forensic investigations.

This chapter introduces the field of digital forensics. It is intended as an overview to permit the reader to understand the concepts and to be able to procure the appropriate assistance should the need for digital forensics expertise arise. Digital forensics is the application of scientific techniques of discovery and exploitation to the problem of finding, verifying, preserving, and exploiting digital evidence for use in a court of law. It involves the use of hardware and software for finding evidence of criminal activity on digital media, either in a computer or in a network device, and attributing that evidence to a suspect for the purposes of conviction. Digital forensics can also be used for non-law enforcement purposes. Data recovery is a form of computer forensics used outside of the legal arena. The authors hope that the reader will understand some of the intricacies of digital forensics and be able to intelligently respond to incidents requiring a digital forensic response.