Search

Your Phone is a Microsoft system that comprises two applications: a smartphone app for Android 7 + smartphones and a desktop application for Windows 10/18.03+. It allows users to access their most recent smartphone-stored photos/screenshots and send/receive short message service (SMS) and multimedia messaging service (MMS) within their Your Phone-linked Windows 10 personal computers. In this paper, we analyze the digital forensic artifacts created at Windows 10 personal computers whose users have the Your Phone system installed and activated. Our results show that besides the most recent 25 photos/screenshots and the content of the last 30-day of sent/received SMS/MMS, the contact database of the linked smartphone(s) is available in a accessible SQLite3 database kept at the Windows 10 system. This way, when the linked smartphone cannot be forensically analyzed, data gathered through the Your Phone artifacts may constitute a valuable digital forensic asset. Furthermore, to explore and export the main data of the Your Phone database as well as recoverable deleted data, a set of python scripts – Your Phone Analyzer (YPA) – is presented. YPA is available wrapped within an Autopsy module to assist digital practitioners to extract the main artifacts from the Your Phone system. [ABSTRACT FROM AUTHOR]

Understanding the Hadoop Distributed File System (HDFS) is currently an important issue for forensic investigators because it is the core of most Big Data environments. The HDFS requires more study to understand how forensic investigations should be performed and what artifacts can be extracted from this framework. The HDFS framework encompasses a large amount of data; thus, in most forensic analyses, it is not possible to gather all of the data, resulting in metadata and logs playing a vital role. In a good forensic analysis, metadata artifacts could be used to establish a timeline of events, highlight patterns of file-system operation, and point to gaps in the data. This paper provides metadata observations for HDFS operations based on fsimage and hdfs-audit logs. These observations draw a roadmap of metadata changes that aids in forensic investigations in an HDFS environment. Understanding metadata changes assists a forensic investigator in identifying what actions were performed on the HDFS. This study focuses on executing day-to-day (regular) file-system operations and recording which file metadata changes occur after each operation. Each operation was executed, and its fingerprints were detailed. The use of those fingerprints as artifacts for file-system forensic analysis was elaborated via two case studies. The results of the research include a detailed study of each operation, including which system entity (user or service) performed this operation and when, which is vital for most analysis cases. Moreover, the forensic value of examined observations is indicated by employing these artifacts in forensic analysis. [ABSTRACT FROM AUTHOR]

In order for technical research in digital forensics to progress a cohesive set of electronic forensics characteristics must be specified. To date, although the need for such a framework has been expressed, with a few exceptions, clear unifying characteristics have not been well laid out. We begin the process of formulating a framework for digital forensics research by identifying fundamental properties and abstractions. [Copyright &y& Elsevier]

Facial recognition has played an essential role in digital forensics due to the widespread use of digital technology such as CCTV, mobile phones, and digital cameras. Therefore, the growing volume of multimedia files (photos and videos), in particular, are a valuable source of evidence and the ability to identify culprits’ is invaluable. Despite significant efforts that have been given to this area, facial recognition suffers from several drawbacks in achieving recognition. These reasons are caused by photos conditions issues such as bad illumination, facial orientation, facial expression, photo quality, accessories (e.g., hat, glasses), and aging. The Facial-Forensic Analysis Tool (F-FAT) provides a technique that aids the forensic investigation in terms of the automatic facial recognition. It is a holistic system that is developed to collect, exam, and analyse multimedia evidence (photos and videos) using a multi-algorithmic fusion approach to overcome the weaknesses in individual algorithms and achieve a better accuracy for identification. The proposed approach also helps to reduce the cognitive load placed upon the investigator by providing a variety of forensic analyses such as, geo-location, facial modification, and social networks, to enable quicker answers to queries. This tool has also been designed based upon a case management concept that helps to manage the overall system, provide robust authentication, authorization and chain of custody. [ABSTRACT FROM AUTHOR]

In crime investigation, especially in computer crime investigations, seizure and analysis of digital evidence is a de facto standard procedure. To prevent alterations on the original digital evidence a so called (bitwise) image is created. In this image all data contained on the digital evidence is stored, even non-relevant content or content with the risk of associated privacy violations. In countries with an elaborate protection of private personal or confidential data, this data has to be securely deleted from the image. Facing the rising request for a selective deleting functionality, common problems, limitations and requirements for a tool selectively deleting non-relevant data are outlined in this paper. For demonstration purposes, a prototype as a plugin for the Digital Forensics Framework (DFF) was implemented. The design of the implementation, some considerations as well as a comparison between a commercial tool and the evaluation of the implemented wiping strategy are presented. [ABSTRACT FROM AUTHOR]

Abstract: This paper analyzes the National Software Reference Library Reference Data Set (NSRL RDS) and constructs a Korean RDS (KRDS) based on it. The fact that NSRL RDS offers the largest amount of hash data sets has led to its widespread adoption. However, the effectiveness analysis of NSRL RDS indicates that there are both duplicate/obsolete data that can be eliminated and unused metadata that can be deleted. Moreover, language-specific software and domestic software that has been widely used for years have to be added. Bearing these issues in mind, we develop a strategy and model for both importing effective NSRL RDS and adding Korea-specific data sets. We then construct initial KRDS using proprietary software designed to manage the entire process of analysis and construction. Lessons learned during this work are believed to be useful for those who need to construct their own RDS (based on NSRL RDS or not) and later upgrade of the NSRL RDS. [Copyright &y& Elsevier]