Towards a framework for enhancing potential digital evidence presentation

For the past decade, digital forensics has been the subject of scientific study, and as a result it has become an established research and application field. One of the foundational methods in which the researchers in the field have attempted to comprehend the scientific basis of this discipline has been to develop models which reflect their observations. Various process models have been developed describing the steps and processes to follow during a digital forensic investigation. This paper provides a detailed review of 11 published papers representing digital forensic process models. The aim of this review is to gain background knowledge of the existing research on the digital forensic investigation process models and the problems associated with those models.

A formal process model is needed to enable digital forensic practitioners in following a uniform approach and to enable courts of law in determining the reliability of digital evidence presented to them. Such a model also needs to be generic in that it can be applicable in the different fields of digital forensics including law enforcement, corporates and incident response. There does not currently exist such a comprehensive process model that is both formal and generic. To address these shortcomings, this paper proposes a model that is formal in that it can enable the digital forensic practitioners in following a uniform approach when carrying out investigations and that is generic in that it can be applied in the different environments of digital forensics.

Integrated digital forensic process model

The field of digital forensics is crucial in the examination of cybercrimes, data breaches, and other illicit activities in a world that is becoming more interconnected. The advent of blockchain technology has introduced a novel aspect to the field of digital forensics. This study provides an extensive examination of the convergence of blockchain and digital forensics, investigating the many impacts and obstacles that blockchain technology poses to conventional methods of digital forensic investigations. This chapter starts by clarifying the essential principles of blockchain technology, highlighting its decentralized and unchangeable nature, cryptographic foundations, and its use in cryptocurrency transactions. Afterwards, it explores the possible advantages of blockchain technology for digital forensics, including the provision of transparent and unalterable records of digital activity and transactions. Moreover, this chapter also examines the distinctive obstacles presented by blockchain in the context of digital forensic investigations.

Digital forensics is a vital part of almost every criminal investigation given the amount of information available and the opportunities offered by electronic data to investigate and evidence a crime. However, in criminal justice proceedings, these electronic pieces of evidence are often considered with the utmost suspicion and uncertainty, although, on occasions are justifiable. Presently, the use of scientifically unproven forensic techniques are highly criticized in legal proceedings. Nevertheless, the exceedingly distinct and dynamic characteristics of electronic data, in addition to the current legislation and privacy laws remain as challenging aspects for systematically attesting evidence in a court of law. This article presents a comprehensive study to examine the issues that are considered essential to discuss and resolve, for the proper acceptance of evidence based on scientific grounds. Moreover, the article explains the state of forensics in emerging sub-fields of digital technology such as, cloud computing, social media, and the Internet of Things (IoT), and reviewing the challenges which may complicate the process of systematic validation of electronic evidence. The study further explores various solutions previously proposed, by researchers and academics, regarding their appropriateness based on their experimental evaluation. Additionally, this article suggests open research areas, highlighting many of the issues and problems associated with the empirical evaluation of these solutions for immediate attention by researchers and practitioners. Notably, academics must react to these challenges with appropriate emphasis on methodical verification. Therefore, for this purpose, the issues in the experiential validation of practices currently available are reviewed in this study. The review also discusses the struggle involved in demonstrating the reliability and validity of these approaches with contemporary evaluation methods. Furthermore, the development of best practices, reliable tools and the formulation of formal testing methods for digital forensic techniques are highlighted which could be extremely useful and of immense value to improve the trustworthiness of electronic evidence in legal proceedings.

Forensic analysis for AI speaker with display Echo Show [formula omitted] generation as a case study

BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem

Digital forensics field faces new challenges with emerging technologies. Virtualization is one of the significant challenges in the field of digital forensics. Virtual Machines (VM) have many advantages either it be an optimum utilization of hardware resources or cost saving for organizations. Traditional forensics’ tools are not competent enough to analyze the virtual machines as they only support for physical machines, to overcome this challenge Virtual Machine Introspection technologies were developed to perform forensic investigation of virtual machines. Until now, we were dealing with persistent virtual machines; these are created once and used many times. We have extreme version of virtual machine and that is disposable virtual machine. However, the disposable virtual machine once created and are used one time, it vanish from the system without leaving behind any significant traces or artifacts for digital investigator. The purpose of this paper is to discuss various disposable virtualiza-tion technologies available and challenges posed by them on the digital forensics investigation process and provided some future directions to overcome these challenges.

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that uses the fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

In the evolving field of digital forensics, the increasing sophistication of anti-forensic techniques poses significant challenges to digital forensic investigations, as perpetrators employ methods such as data encryption, steganography, time stomping, and file wiping to conceal or destroy digital evidence. Along with the rise in internet crime, the advances in anti-forensic techniques have added new layers of complexity for digital forensic investigators. Studies show that Zambian private and public sectors have low level compliance and have experienced cyber-attacks which indicated only 10% could recover from the attacks within a day and the rest it will require days, weeks and months to recover. That calls for considered efforts in developing measures for mitigation of these challenges in order to ensure national cyber-attacks preparedness defense strategy (Mwila & Kingstone, 2020). This study aims to analyze and implement countermeasures to anti-forensic techniques used by perpetrators in order to contribute and assure that the advancement of digital forensic techniques used by investigators does not lag behind, in this age of increasing technology sophistication.

Formalising investigative decision making in digital forensics: Proposing the Digital Evidence Reporting and Decision Support (DERDS) framework

During the development of a new specialist graduate professional study program at Zagreb University of Applied Science “Information Security and Digital Forensics”, a number of challenges was addressed. The key challenges were: a) Defining the curriculum and b) Defining and building computer infrastructure for conducting laboratory exercises. We will address second: defining the necessary equipment for conducting laboratory exercises. New possibilities are given by new technologies, and it would be possible to expand the working environment which, apart from laboratory exercises, will enable independent student work. We will describe and define setting of the environment that can also be used for independent research in the field of information security and digital forensics for expert and scientific community. We will use TVZ private cloud as a place to build digital forensic laboratory, maintained by digital forensic management process tool, where different virtual machines with different digital forensic software will be accessible for students and independent researches.

PurposeGathering, analyzing and securing electronic data from various digital devices for use in legal or investigative procedures is the key process of computer forensics. Information retrieved from servers, hard drives, cellphones, tablets and other devices is all included in this. This article tackles the challenging problem of how to prioritize different kinds of computer forensics and figure out which kind is most useful in cases of cybercrime, fraud, theft of intellectual property, harassment and espionage.Design/methodology/approachTherefore, we first introduce enhanced versions of Hamacher power aggregation operators (AOs) within the framework of bipolar complex fuzzy (BCF) sets. These include BCF Hamacher power averaging (BCFHPA), BCF Hamacher power-weighted averaging (BCFHPWA), BCF Hamacher power-ordered weighted averaging (BCFHPOWA), BCF Hamacher power geometric (BCFHPG), BCF Hamacher power-weighted geometric (BCFHPWG) and BCF Hamacher power-ordered-weighted geometric (BCFHPOWG) operators. Employing the devised AOs, we devise a technique of decision-making (DM) for dealing with DM dilemmas with the BCF set (BCFS).FindingsWe prioritize different types of computer forensic by taking artificial data in a numerical example and getting the finest computer forensic. Further, by this example, we reveal the applicability of the proposed theory. This work provides a more elaborate and versatile procedure for classifying computer forensics with dual aspects of criteria and extra fuzzy information. It allows for better and less biased DM in the more intricate digital investigations, which may lead to better DM and time-saving in real-life forensic scenarios. To demonstrate the significance and impression of the devised operators and techniques of DM, they are compared with existing ones.Originality/valueThis research is the first to combine Hamacher and power AOs in BCFS for computer forensics DM. It presents new operators and a DM approach that is not encountered in the existing literature and is specifically designed to deal with the challenges and risks associated with the classification of computer forensics. The framework’s capacity to accommodate bipolar criteria and extra fuzzy information is a major development in the field of digital forensics and decision science.

Our world is proliferated with high-end devices that have multiple capabilities. These devices have an array of sensors embedded into them that collect an enormous amount of data. Because of rapid development in technology, these devices are capable of rendering state-of-the-art services that are based on the cloud. Assuredly, the proliferation of ultra-modern devices with high-end services, have modernized and eased our lives. But, some entities or adversaries of our society are exploiting the same technological innovation for their benefits. Such criminal activities have become even easier to be carried out with modern devices and other technologies. Fortunately, we can examine the confiscated digital devices such as android smartphones, laptops, smartwatches, etc., from a crime scene and gain insight into the criminal activities carried out by the adversaries. It is also possible for us to recover the data the adversaries have collected or transmitted. Since modern devices utilize the services provided by cloud computing, it naturally becomes essential for the analysis of the cloud in case of the investigation of a crime scene. IoT forensics is interdisciplinary, as the data to be investigated may be collected from sensors, smart devices, etc., connected to a crime scene and the cloud too. Digital Forensics is an easier task to be performed when compared to Cloud Forensics. The segregation and collection of evidence in a cloud forensic investigation is a mammoth task due to the distributed and multi-tenant nature of cloud computing. But there is no such problem associated with digital forensic investigation. In this chapter, we have reviewed the work on Digital, Cloud and IoT Forensics by the scientific community. We have compared their effort and the outcome of their work, and summarized the state-of-the-art in the field of Digital, Cloud and IoT Forensics. Our aim of this chapter is to create a thorough review that will help fellow researchers in thought association for getting a clearer picture of the current state of research on Digital, Cloud and IoT Forensics and find the research gaps.

This research aims to explore the influence of digital forensics education and training on the quality of handling cyber crime cases. With the increasing complexity of cybercrime, it is important for law enforcement to have adequate skills in digital forensics. The research method used is qualitative with a case study approach in several law enforcement agencies. The research results show that effective education and training can improve investigators' abilities in identifying, collecting and analyzing digital evidence, thereby improving the quality of handling cyber crime cases. In addition, collaboration between investigators and digital forensic experts has been proven to increase the effectiveness of investigations. However, challenges such as limited resources and legal understanding remain obstacles that need to be overcome. Therefore, recommendations to improve education and training programs in the field of digital forensics are very necessary to face the growing threat of cybercrime.