Search

Cloud computing can be generally regarded as the technology enabler for Internet of Things (IoT). To ensure the most effective collection of evidence from cloud-enabled IoT infrastructure, it is vital for forensic practitioners to possess a contemporary understanding of the artefacts from different cloud services and applications. In this paper, we seek to determine the data remnants from the use of the newer BitTorrent Sync applications (version 2.x). Findings from our research using mobile and computer devices running Windows, Mac OS, Ubuntu, iOS, and Android devices suggested that artefacts relating to the installation, uninstallation, log-in, log-off, and file synchronisation could be recovered, which are potential sources of IoT forensics. We also extend the cloud forensics framework of Martini and Choo to provide a forensically sound investigation methodology for the newer BitTorrent Sync applications. [ABSTRACT FROM AUTHOR]

• Fileless malware has no signature because it does not leverage executable files. • We suggest a memory-based approach for detecting and analyzing fileless malware. • This proposed method offers useful insight for the experts working in this field. • The proposed methodʼs applicability was demonstrated using a real case study sample. The rapid advancements in cyber-attack strategies are in parallel with the measures for detection, analysis, and prevention. Attackers have recently developed fileless malware that can simply bypass existing security mechanisms. Researchers publish reports to help discover fileless malware and to better understand the threatʼs scope to counteract it. However, with the lack of studies on fileless malware regarding the classification and the scale of the threat, they have not been thoroughly analyzed. As a result, in this research, we explored the most recent advancements in fileless malware prevention and detection and highlighted future research challenges. We also propose an analytical approach based on the attack strategies and attributes of the selected sample. Our method simplifies feature extraction and reduces processing load. Furthermore, compared to the static analysis we do not need for decompression and unpacking for the analysis. We applied the proposed method on a real case example. It has been seen that information about fileless malware detection, working mechanism, attack method and attacker named "Kovter" can be accessed. Our approach is advantageous and can be applied as a new technique for fileless malware detection to protect systems from cyber threats. This paper also presents an insight to the fileless malware threat and provides a basic review of the methods and techniques used in the detection and analysis of fileless malware attacks. [ABSTRACT FROM AUTHOR]

Computer forensics and privacy protection fields are two conflicting directions in computer security. In the other words, computer forensics tools try to discover and extract digital evidences related to a specific crime, while privacy protection techniquesaim at protecting the data owner's privacy. As a result, finding a balance between these two fields is a serious challenge. Existing privacy-preserving computer forensics solutions consider all data owner's data as private and, as a result, they collect and encrypt the entire data. This increases the investigation cost in terms of time and resources. So, there is a need for having privacy levels for computer forensics so that only relevant data are collected and then only private relevant data are encrypted. This research paper proposes privacy levels for computer forensics. It starts with classifying forensic data, and analyzing all data access possibilities in computer forensics. Then, it defines several privacy levels based on the found access possibilities. The defined privacy levels lead to more efficient privacy-preserving computer forensics solution. [ABSTRACT FROM AUTHOR]

Abstract: In this paper, we give a clear description of the running memory acquiring tool on a target system, especially for possibility covering the key trace during capturing volatile memory. Some key trace of offender may still in the running memory after the scene of a crime and have critical role in court and security applications. However, some key trace, such as rootkits in the memory, memory occupied by their corresponding process will probably be covered/ reallocated during the procedure of obtaining evidence of the crime. Therefore, the covered ratio (lost data) should be evaluated and investigated after the forensic tools run. Firstly, we model the distribution of key trace exacted in the unallocated memory space, then form a formula to evaluate the coverage rate of the key trace in which the corresponding process has just been killed. At last, we give some cases to analyze the evidence coverage ratio which can be estimated by the new allocated memory space. [Copyright &y& Elsevier]

Abstract: Computer forensics is the technology of applying computer technology to access, investigate and analysis the evidence of computer crime. It mainly include the process of determine and obtain digital evidence, analyze and take data, file and submit result. And the data analysis is the key link of computer forensics. As the complexity of real data and the characteristics of fuzzy, evidence analysis has been difficult to obtain the desired results. This paper applies fuzzy c-means clustering algorithm based on particle swarm optimization (FCMP) in computer forensics, and it can be more satisfactory results. [Copyright &y& Elsevier]

Abstract: As virtualization technologies become more prevalent in computer forensics, there is a great need to grasp for recovering digital evidence. In this paper, we present the history of virtualization, the definition of virtualization and demonstrate two main types of virtualization technologies. Further we compare static and live digital forensic analysis and combine them with novel virtualization techniques in a real case. [Copyright &y& Elsevier]

Abstract: Visualizing digital evidence in an easy and constructive manner is a major problem because of the advanced techniques for hiding, wiping, encrypting and deleting digital data developed during the last few years. To tackle this problem, a system for visualizing digital data in 3-Dimensional (3D) mode has been developed. XML was used as a common language to allow fine-grained management of digital data with flexibility and ease. The extensibility of the implementation makes it particularly suitable as a research and development platform in the sector of open source computer forensics tools for the future. This article examines real-life problems that benefit from using this tool in a congenial and constructive manner to validate its key underlining concept. The design decisions that have been taken in producing the system architecture, and the features it supports are elaborated upon. To determine the effectiveness of the tool, an actual case study is presented which examines the results of the tool and why it is necessary to go for an open source model as a standard. The paper concludes with performance measurements of the tool and suggests possible extensions to make the tool even smarter. [Copyright &y& Elsevier]

Abstract: Visualizing digital evidence in an easy and constructive manner is a major problem because of the advanced techniques for hiding, wiping, encrypting and deleting digital data developed during the last few years. Òo tackle this problem, a system for visualizing digital data in 3-dimensional (3D) mode has been developed. XML was used as a common language to allow fine-grained management of digital data with flexibility and ease. The extensibility of the implementation makes it particularly suitable as a research and development platform in the sector of open source computer forensics tools for the future. This article examines real-life problems that benefit from using this tool in a congenial and constructive manner to validate its key underlining concept. The design decisions that have been taken in producing the system architecture, and the features it supports are elaborated upon. To determine the effectiveness of the tool, an actual case study is presented which examines the results of the tool and why it is necessary to go for an open source model as a standard. The paper concludes with performance measurements of the tool and suggests possible extensions to make the tool even smarter. [Copyright &y& Elsevier]

Abstract: With the rapid growth of computer and network systems in recent years, there has also been a corresponding increase in cyber-crime. Cyber-crime takes many forms and has garnered much attention in the media, making information security a more urgent and important priority. In order to fight cyber-crime, criminal evidence must be gathered from these computer-based systems. This is quite different from the collection of conventional criminal evidence and can confuse investigators attempting to deal with the forensics of cyber-crime, highlighting the importance of computer forensics. In this paper, we offer solutions to guard against cyber-crime through the implementation of software toolkits for computer-based systems. In this way, those who engage in criminal acts in cyber-space can be more easily apprehended. [Copyright &y& Elsevier]