Search

AAAS (the publisher of Science ) recently launched [www.forceforscience.org][1], a new website to facilitate science advocacy. The site offers news, resources, and information about upcoming events for both scientists and the public. By way of introduction, we asked these questions: Why is science

The university attempts to meet two basic needs for society: education and research. In most cases these roles are separated. Undergraduate (Bachelor) and graduate (Masters) students are focused more on education while the research is designated for post-graduate students. This paper shows how education and research can be interconnected through students' engagement in research carried out at the university. Such activity can be funded by various national, EU and non-EU grants that support international partnership and encourage universities to improve student competencies through student research. The paper discusses the gap between research and education in the universities, and provides a case study showing how this issue can be tackled using student research teams participating in scientific projects. The study is demonstrated with the joint IoT research project realized by two universities in the Czech Republic and South Korea from 2016 to 2018.

Many systems rely on reliable timestamps to determine the time of a particular action or event. This is especially true in digital investigations where investigators are attempting to determine when a suspect actually committed an action. The challenge, however, is that objects are not updated at the exact moment that an event occurs, but within some time-span after the actual event. In this work we define a simple model of digital systems with objects that have associated timestamps. The model is used to predict object update patterns for objects with associated timestamps, and make predictions about these update time-spans. Through empirical studies of digital systems, we show that timestamp update patterns are not instantaneous. We then provide a method for calculating the distribution of timestamp updates on a particular system to determine more accurate action instance times., Comment: 13 pages, 7 figures

Inspired by the work of the AAAS Science and Human Rights Coalition (AAAS is the publisher of Science ), we asked young scientists this question: Describe how applications of knowledge in your field (information, methodologies, services, and/or products) could support civil, political, economic

This work focuses on two studies: a survey of digital forensic investigators' investigation and decision processes, and a study of the accuracy of decisions to exclude an exhibit from receiving further in-depth analysis based on an enhanced preview. This study describes the surveyed investigators' generalized investigation process model in terms of the investigators' decisions, including social considerations. It is shown that decision-making based on a less in-depth enhanced preview of exhibits helped to accurately exclude unrelated exhibits before receiving an in-depth analysis while always including exhibits that contained relevant suspect data in child exploitation material investigations.

This paper describes a methodology for the reconstruction of digital events by comparing states captured in time. Microsoft Windows Restore Point data is used to illustrate how to organize captured state information into a useful timeline of user and system events. It is shown that by comparing consecutive states, events can be uncovered that would otherwise be unknown by analysis of the current system state alone.

An area presenting new opportunities for both legitimate business, as well as criminal organizations, is Cloud computing. This work gives a strong background in current digital forensic science, as well as a basic understanding of the goal of Law Enforcement when conducting digital forensic investigations. These concepts are then applied to digital forensic investigation of cloud environments in both theory and practice, and supplemented with current literature on the subject. Finally, legal challenges with digital forensic investigations in cloud environments are discussed., 7 pages

Imagine the following scenario: an inexperienced law enforcement officer enters a crime scene and – on finding a USB key on a potential suspect – inserts it into a nearby Windows desktop computer hoping to find some information which may help an ongoing investigation. The desktop crashes and all data on the USB key and on the Windows desktop has now been potentially compromised. However, the law enforcement officer in question is using a Virtual Crime Scene Simulator and has just learned a valuable lesson. This paper discusses the development and initial user evaluation of a Virtual Crime Scene Simulator that includes the ability to interact with and perform live triage of commonly-found digital devices. Based on our experience of teaching digital evidence handling, we aimed to create a realistic virtual environment that integrates many different aspects of the digital and physical crime scene processing, such as physical search activities, triage of digital devices, note taking and form filling, interaction with suspects at the scene, as well as search team training.

As more businesses and users adopt cloud computing services, security vulnerabilities will be increasingly found and exploited. There are many technological and political challenges where investigation of potentially criminal incidents in the cloud are concerned. Security experts, however, must still be able to acquire and analyze data in a methodical, rigorous and forensically sound manner. This work applies the STRIDE asset-based risk assessment method to cloud computing infrastructure for the purpose of identifying and assessing an organization's ability to respond to and investigate breaches in cloud computing environments. An extension to the STRIDE risk assessment model is proposed to help organizations quickly respond to incidents while ensuring acquisition and integrity of the largest amount of digital evidence possible. Further, the proposed model allows organizations to assess the needs and capacity of their incident responders before an incident occurs.

This work proposes a method for the measurement of a country’s digital investigation capacity and saturation for the assessment of future capacity expansion. The focus is on external, or international, partners being a factor that could negatively affect the return on investment when attempting to expand investigation capacity nationally. This work concludes with the argument that when dealing with digital crime, target international partners should be a consideration in expansion, and could potentially be a bottleneck of investigation requests.

This work presents a method for the measurement of the accuracy of evidential artifact extraction and categorization tasks in digital forensic investigations. Instead of focusing on the measurement of accuracy and errors in the functions of digital forensic tools, this work proposes the application of information retrieval measurement techniques that allow the incorporation of errors introduced by tools and analysis processes. This method uses a ‘gold standard’ that is the collection of evidential objects determined by a digital investigator from suspect data with an unknown ground truth. This work proposes that the accuracy of tools and investigation processes can be evaluated compared to the derived gold standard using common precision and recall values. Two example case studies are presented showing the measurement of the accuracy of automated analysis tools as compared to an in-depth analysis by an expert. It is shown that such measurement can allow investigators to determine changes in accuracy of their processes over time, and determine if such a change is caused by their tools or knowledge.