Search

Technological advances are changing how forensic laboratories operate in all forensic disciplines, not only digital. Computers support workflow management, enable evidence analysis (physical and digital), and new technology enables previously unavailable forensic capabilities. Used properly, the integration of digital systems supports greater efficiency and reproducibility, and drives digital transformation of forensic laboratories. However, without the necessary preparations, these digital transformations can undermine the core principles and processes of forensic laboratories. Pertinent examples of problems involving technology that have occurred in laboratories are provided, along with opportunities and risk mitigation strategies, based on the authors' experiences. Forensic preparedness concentrating on digital data reduces the cost and operational disruption of responding to various kinds of problems, including misplaced exhibits, allegations of employee misconduct, disclosure requirements, and information security breaches. This work presents recommendations to help forensic laboratories prepare for and manage these risks, to use technology effectively, and ultimately strengthen forensic science. The importance of involving digital forensic expertise in risk management of digital transformations in laboratories is emphasized. Forensic laboratories that do not adopt forensic digital preparedness will produce results based on digital data and processes that cannot be verified independently, leaving them vulnerable to challenge. The recommendations in this work could enhance international standards such as ISO/IEC 17025 used to assess and accredit laboratories., (Copyright © 2020 The Authors. Published by Elsevier B.V. All rights reserved.)

This paper describes the design, implementation and research of the Cyber Sleuth Science Lab (CSSL), an innovative educational program and supporting virtual learning environment, that combines pedagogical theory, gender inclusive instruction strategies, scientific principles/practices, gamification methods, computational thinking, and real-world problem solving. This program provides underrepresented youth, especially girls, with digital forensic knowledge, skills and career pathways, challenging them to explore complex social issues related to technology and to become cyber sleuths using real-world digital forensic methods and tools to solve investigative scenarios. Students also learn about related careers while improving their cyber street smarts. The CSSL incorporates additional "outside of the computer" activities to strengthen students' engagement such as structured in-classroom discussions, mock trials, and in-person interactions with practitioner role models. The CSSL was piloted in various forms to assess the suitability for in-school and out-of-school settings, and the students predominantly represented racial minorities. Research in this project relied on a mixed methods approach for data collection and analysis, including qualitative and quantitative methods, reinforced using learning analytics generated from the students clicking through the interface and interacting with the system. Analysis of gathered data indicate that the virtual learning environment developed in this project is highly effective for teaching digital forensic knowledge, skills, and abilities that are directly applicable in the workplace. Furthermore, the strategies for gender inclusive STEM instruction implemented in CSSL are effective for engaging girls without being harmful to boys' engagement. Learning STEM through digital forensic science taps into girls' motivations to address real-world problems that have direct relevance to their lives, and to protect and serve their community. After participating in the educational program, girls expressed a significantly greater increase in interest, relative to boys, in learning more about careers related to digital forensics and cybersecurity. [ABSTRACT FROM AUTHOR]

The increasing volume, variety, velocity, distribution, structural intricacy, and complexity of use of digital evidence can make it difficult for practitioners to find and understand the most forensically useful information (Casey E. Digital evidence and computer crime: Forensic science, computers, and the Internet. Academic Press; 2011. p. 31; Pollitt M. The hermeneutics of the hard drive: Using narratology, natural language processing, and knowledge management to improve the effectiveness of the digital forensic process [PhD dissertation]. University of Central Florida; 2011). Digital forensic practitioners currently search for information and solutions in an ad hoc manner, leading to results that are unstructured, unverified, and sometimes incomplete. As a result, certain digital evidence is being missed or misinterpreted. To mitigate risks of knowledge gaps, there is a pressing need for a systematic mechanism that practitioners can use to codify and combine their collective knowledge. This work presents the design and development of a solution that catalogs crowdsourced knowledge of digital forensic artifacts in a well‐structured, easily searchable form to support efficient and automated extraction of pertinent information, improving availability and reliability of interpretation of artifacts (general acceptance). Technical implementation and artifact curation are discussed with illustrative examples and recommendations for future work. [ABSTRACT FROM AUTHOR]

The growing number of cases involving overlooked or misinterpreted digital evidence is raising concerns among factfinders and decision-makers about the reliability of digital forensic conclusions. To reduce the risk of mistakes and misinterpretations of forensic observations, including but not limited to digital evidence, there is a pressing need to standardize how evaluative opinions are formed and expressed. Responding to this need, the international community is drafting ISO-21043 and the UK Forensic Science Regulator is drafting an evaluative interpretation standard that promote a likelihood ratio approach. This approach is suitable for fully evaluative opinions in many forensic disciplines, but until more refined methods for evaluating digital evidence are developed, digital forensic practitioners require an interim solution to address immediate needs. More broadly, digital evidence is used in many non-judicial contexts that do not require fully evaluative opinions expressed as a likelihood ratio. This work proposes a standardized approach to formulating and expressing preliminary evaluative opinions in terms of strength of evidence in a manner that employs scientific reasoning within a logical Bayesian framework and can be understood by non-specialist factfinders. Illustrative case examples are presented that involve digital evidence tampering. In addition, this work presents a proof-of-concept database of cases involving tampering of digital evidence that could support assignment of strength of evidence in similar cases. [ABSTRACT FROM AUTHOR]

There is weak integration of digital forensics and forensic science, despite over a decade of effort to break down the borders between them. As more criminal investigations involve digital traces in increasing amounts and complexity, the quality of digital forensic results is decreasing and comprehension of cybercrime is diminishing. The consequences of errors and omissions in digital forensics include imprisoning innocent people, leaving dangerous criminals free to perpetrate additional crimes, and continuing victimization of the organizations and people targeted by offences. To mitigate these risks it is necessary to harmonize digital forensics and forensic science, and to strengthen knowledge management throughout decentralized forensic ecosystems. To drive the needed harmonization and knowledge management, there are two essential roles: the investigative advisor with operational experience, and the forensic advisor with scientific background. These advisors can negotiate the borders between police, digital forensic specialists, criminal intelligence analysts and attorneys to cultivate a criminal justice system that treats digital traces effectively, has visibility across criminal activities, and addresses crime and security more strategically. [ABSTRACT FROM AUTHOR]

The increasing number of IoT devices in personal environments such as smarthomes presents opportunities and risks from a forensic perspective. These devices generate traces that can be useful for investigative and forensic purposes in any type of offense. At the same time, newer IoT devices are not supported by existing digital forensic tools and methods, making it difficult for practitioners to extract data from them without the support of a forensic advisor with specialized knowledge in this area. In addition, these traces can present evaluation challenges for forensic scientists, and can contain vulnerabilities that pose privacy risks. Security vulnerabilities of IoT devices create opportunities for extracting traces but might also be used by criminals to undermine a device. The aim of this work is to increase familiarity with traces from various IoT devices in a smarthome, and demonstrate how traces from IoT devices in a smarthome can be useful for investigative and forensic purposes. This work presents a study of IoT devices and associated smartphone applications, providing approaches to extracting and analyzing digital traces. This research led to the discovery of vulnerabilities in multiple devices, and a scenario for the DFRWS IoT forensic challenge was developed. [ABSTRACT FROM AUTHOR]

It is difficult to overstate the importance of identity in the digital age, as well as the importance of digitized information for identity. In order to advance security, liberty, and privacy in modern society, it is crucial to understand the nuances of what identity means and how it is used and abused. This article defines identity, covering both physical and virtual entities, which is relevant in diverse contexts such as forensic science, cybersecurity, and national security. This article concentrates on the relevance of identity in forensic science, and provides illustrative examples. Approaches and challenges to evaluating and expressing confidence in identity-related conclusions are discussed. Privacy issues are considered along with the rising risks of identity usurpation and impersonation. Relationships between identification of physical and virtual entities are addressed, including the weaknesses and strengths of digital information alone, and the benefits of combining multiple forensic disciplines when assessing identity. This article concludes with a consideration of the benefits for forensic science specifically, and society generally, to take a pluridisciplinary approach to establishing identity. [ABSTRACT FROM AUTHOR]

Forensic science laboratories are being challenged by the expanding decentralization of forensic capabilities, particularly for digital traces. This study recommends laboratories undertake digital transformations to capitalize on the decentralization movement, develop a more comprehensive understanding of crime and security‐relevant problems, and play a more central role in problem‐solving collaboratively with law enforcement organizations and other stakeholders. A framework for the bilateral transfer of information and knowledge is proposed to magnify the impact of forensic science laboratories on abating crime, strengthening security, and reinforcing the criminal justice system. To accomplish digital transformations, laboratories require personnel with different expertise, including investigative reasoning, knowledge codification, data analytics, and forensic intelligence. Ultimately, this study encourages managers, educators, researchers, and policymakers to look beyond the usefulness of forensic results for solving individual investigations, and to realize the value of combined forensic knowledge and intelligence for developing broader strategies to deal with crime in digitalized society. [ABSTRACT FROM AUTHOR]

Abstract: This work introduces novel methods for conducting forensic analysis of file allocation traces, collectively called digital stratigraphy. These in‐depth forensic analysis methods can provide insight into the origin, composition, distribution, and time frame of strata within storage media. Using case examples and empirical studies, this paper illuminates the successes, challenges, and limitations of digital stratigraphy. This study also shows how understanding file allocation methods can provide insight into concealment activities and how real‐world computer usage can complicate digital stratigraphy. Furthermore, this work explains how forensic analysts have misinterpreted traces of normal file system behavior as indications of concealment activities. This work raises awareness of the value of taking the overall context into account when analyzing file system traces. This work calls for further research in this area and for forensic tools to provide necessary information for such contextual analysis, such as highlighting mass deletion, mass copying, and potential backdating. [ABSTRACT FROM AUTHOR]

When conducting a digital forensic examination, there is sometimes a need to salvage as much playable video as possible from available data sources. Although an ideal outcome might be to have all deleted and partially overwritten file fragments identified, reassembled, and repaired to provide playable videos, there are situations where this is not possible. In addition, there are complexities in real world datasets that can lead to false positives and false negatives. This paper captures practical lessons learned from extensive experiences in this problem space, and describes tradeoffs that developers must consider when creating file carving tools for salvaging and reassembling fragmented AVI, MPEG, and 3GP video files. Recommendations are provided for each tradeoff, concentrating on increasing the amount of playable video fragments that can be salvaged, with the potential for duplicate copies of some fragments being salvaged. Developers need to carefully consider how to handle the tradeoffs described in this paper when developing fragmented video carving tools. In addition, digital investigators need to consider the strengths and limitations of different fragmented video carving methods, and need to select those that are best suited to their given dataset. Another important outcome of this work is that the products of some carving methods may be playable in one video viewer but not others, making it necessary to view carved results using various methods, including storyboarding. This paper also includes discussion of current challenges and potential future work in fragmented file carving, with the aim of advancing research and development of automated methods for reassembling salvaged video fragments. [ABSTRACT FROM AUTHOR]

Abstract: The number of forensic examinations being performed by digital forensic laboratories is rising, and the amount of data received for each examination is increasing significantly. At the same time, because forensic investigations are results oriented, the demand for timely results has remained steady, and in some instances has increased. In order to keep up with these growing demands, digital forensic laboratories are being compelled to rethink the overall forensic process. This work dismantles the barriers between steps in prior digital investigation process models and concentrates on supporting key decision points. In addition to increasing efficiency of forensic processes, one of the primary goals of these efforts is to enhance the comprehensiveness and investigative usefulness of forensic results. The purpose of honing digital forensic processes is to empower the forensic examiner to focus on the unique and interesting aspects of their work, allowing them to spend more time addressing the probative questions in an investigation, enabling them to be decision makers rather than tool runners, and ultimately increase the quality of service to customers. This paper describes a method of evaluating the complete forensic process performed by examiners, and applying this approach to developing tools that recognize the interconnectivity of examiner tasks across a digital forensic laboratory. Illustrative examples are provided to demonstrate how this approach can be used to increase the overall efficiency and effectiveness of forensic examination of file systems, malware, and network traffic. [Copyright &y& Elsevier]

Abstract: The increasing use of full disk encryption (FDE) can significantly hamper digital investigations, potentially preventing access to all digital evidence in a case. The practice of shutting down an evidential computer is not an acceptable technique when dealing with FDE or even volume encryption because it may result in all data on the device being rendered inaccessible for forensic examination. To address this challenge, there is a pressing need for more effective on-scene capabilities to detect and preserve encryption prior to pulling the plug. In addition, to give digital investigators the best chance of obtaining decrypted data in the field, prosecutors need to prepare search warrants with FDE in mind. This paper describes how FDE has hampered past investigations, and how circumventing FDE has benefited certain cases. This paper goes on to provide guidance for gathering items at the crime scene that may be useful for accessing encrypted data, and for performing on-scene forensic acquisitions of live computer systems. These measures increase the chances of acquiring digital evidence in an unencrypted state or capturing an encryption key or passphrase. Some implications for drafting and executing search warrants to dealing with FDE are discussed. [Copyright &y& Elsevier]

There is an urgent need to reduce the growing backlog of forensic examinations in Digital Forensics Laboratories (DFLs). Currently, DFLs routinely create forensic duplicates and perform in-depth forensic examinations of all submitted media. This approach is rapidly becoming untenable as more cases involve increasing quantities of digital evidence. A more efficient and effective three-tiered strategy for performing forensic examinations will enable DFLs to produce useful results in a timely manner at different phases of an investigation, and will reduce unnecessary expenditure of resources on less serious matters. The three levels of forensic examination are described along with practical examples and suitable tools. Realizing that this is not simply a technical problem, we address the need to update training and establish thresholds in DFLs. Threshold considerations include the likelihood of missing exculpatory evidence and seriousness of the offense. We conclude with the implications of scaling forensic examinations to the investigation. [ABSTRACT FROM AUTHOR]

This paper presents strengths and shortcomings of WinHex Specialist Edition (version 11.25 SR-7) in the context of the overall digital forensics process, focusing on its ability to preserve and examine data on storage media. No serious problems were found during non-exhaustive testing of the tool''s ability to create a forensic image of a disk, and to verify the integrity of an image. Generally accepted data sets were used to test WinHex''s ability to reliably and accurately interpret file date–time stamps, recover deleted files, and search for keywords. The results of these tests are summarized in this paper. Certain advanced examination capabilities were also evaluated, including the creation of custom templates to interpret EXT2/EXT3 file systems. Based on this review, several enhancements are proposed. In addition to these results, this paper demonstrates a systematic approach to evaluating similar forensic tools. [Copyright &y& Elsevier]

Digital investigators require specialized knowledge and tools to process network traffic as a source of evidence. Existing open source tools can be used for basic tasks in simple cases but lack the functionality of commercial tools that are specifically designed to process network traffic as evidence. These commercial tools reduce the amount of time and specialized technical knowledge required to examine large quantities of network traffic but even these tools are lacking from a forensic standpoint. This paper discusses the strengths and shortcomings of existing tools in the context of the overall digital investigation process—specifically the collection, documentation, preservation, examination and analysis stages. In addition to highlighting the capabilities of different tools, this paper familiarizes digital investigators with different aspects of network traffic as a source of evidence. Based on this discussion, a set of requirements is proposed for tools used to process network traffic as evidence in the hope that existing developers will enhance the capabilities of their tools to address the weaknesses. [Copyright &y& Elsevier]

This work proposes a formalized model, grounded in forensic science, to support a unified understanding of the Trace across scientific disciplines. The model is precisely defined in mathematical terms that reflect the dynamics of an offense as expressed in Locard's Exchange principle. Specifically, this mathematical approach represents the Trace as the modification of a Scene, subsequently perceptible, resulting from the Event under investigation. Examples are provided to illustrate how this conceptualization applies to forensic science, including DNA and digital evidence. Broader implications of this model are presented in the context of COVID-19, emphasizing the value of cohesive scientific study of the Trace. The aim of this work is to stimulate more formalized study of the Trace, both from tangible and abstract perspectives, and to strengthen forensic science as a whole. [ABSTRACT FROM AUTHOR]

Automated systems allow forensic practitioners to perform analysis tasks that would otherwise be infeasible. However, unless the outputs of such systems are critically evaluated using a scientifically-based framework, there is a risk of undetected errors or bias resulting in wrong decisions. Furthermore, decisions based on automated system outputs that are not well understood or clearly explainable could violate fundamental human rights. These risks can apply to any automated system that supports forensic analysis, and are raised when machine learning is involved. This work presents a framework based on principles of scientific interpretation, and provides an evaluation hierarchy for automated systems, including machine learning approaches, to strengthen forensic conclusions. Specifically, three levels of evaluation are presented: performance, understandability and forensic evaluation. Approaches to clearly conveying the weight of forensic evaluations are discussed. Each level of evaluation is demonstrated in relation to actual automated systems. Finally, requirements for designing automated systems supporting forensic analysis are proposed, and future work is discussed. • Design requirements for automated systems supporting forensic analysis using a framework of scientific reasoning. • Hierarchy for evaluating outputs from automated systems, including AI approaches, to strengthen forensic conclusions. • Practical examples of how three levels of evaluation can be applied to the outputs of automated systems. [ABSTRACT FROM AUTHOR]

Abstract: Current memory forensic tools concentrate mainly on system-related information like processes and sockets. There is a need for more memory forensic techniques to extract user-entered data retained in various Microsoft Windows applications such as the Windows command prompt. The command history is a prime source of evidence in many intrusions and other computer crimes, revealing important details about an offender’s activities on the subject system. This paper dissects the data structures of the command prompt history and gives forensic practitioners a tool for reconstructing the Windows command history from a Windows XP memory capture. At the same time, this paper demonstrates a methodology that can be generalized to extract user-entered data on other versions of Windows. [ABSTRACT FROM AUTHOR]