Search

Most current research in cloud forensics is focused on tackling the challenges encountered by forensic investigators in identifying and recovering artifacts from cloud devices. These challenges arise from the diverse array of cloud service providers as each has its distinct rules, guidelines, and requirements. This research proposes an investigation technique for identifying and locating data remnants in two main stages: artefact collection and evidence identification. In the artefacts collection stage, the proposed technique determines the location of the artefacts in cloud storage and collects them for further investigation in the next stage. In the evidence identification stage, the collected artefacts are investigated to identify the evidence relevant to the cybercrime currently being investigated. These two stages perform an integrated process for mitigating the difficulty of locating the artefacts and reducing the time of identifying the relevant evidence. The proposed technique is implemented and tested by applying a forensics investigation algorithm on Sync.com cloud storage using the Microsoft Windows 10 operating system. [ABSTRACT FROM AUTHOR]

The possession of smart devices has ingrained itself into daily life. Therefore, smart devices, such as IoT and smartphones, are crucial sources of evidence in instances where criminal activity occurs. Due to the challenges in traditional digital forensic techniques involving smart devices, it has been recently proposed in the literature to leverage electromagnetic side-channel analysis (EM-SCA) for the purpose. This paper identifies and discusses an important barrier that exists in the application of EM-SCA for digital forensics that hinders its successful use, namely, the issue of cross-device portability of machine learning (ML) models that are used for EM-SCA. Firstly, the paper empirically evaluates the possibility of using trained ML models to extract forensic insights from EM radiation data of IoT devices. During this empirical study, the inability to reuse a trained ML model across different devices is identified. Secondly, the paper surveys the literature in search of related work that has studied the use of EM-SCA to gather information from smart devices. The purpose of the survey is to identify whether any existing work has been able to introduce potential approaches to enable cross-device portability of ML models in EM-SCA. The findings of this survey point to the fact that the identified problem still exists and requires further studies opening the door to future research.

The protection of intellectual property rights in the digital realm is of utmost importance, particularly in developing countries like India. This paper conducts a thorough investigation into the role of digital forensics in preserving and enforcing intellectual property rights, specifically within the Indian context. Through an extensive review of relevant literature, we identify gaps in current research and propose a comprehensive methodology for examining and addressing intellectual property infringements in the digital domain. The paper incorporates certain examples and cases where digital forensics may be used to counter infringement. By exploring the intersection of digital forensics and intellectual property rights in India, this study contributes valuable insights to the existing body of knowledge, offering practical implications for policymakers, law enforcement agencies, and intellectual property rights holders operating in similar contexts. [ABSTRACT FROM AUTHOR]

Collecting digital evidence in Linux can be said to be an important research field because it is possible to collect and analyze evidence from a digital forensics perspective in the event of an infringement accident in Linux. However, in general, digital forensics performs digital forensics based on Windows, and because of the nature of Linux, each type of Linux operates slightly differently, there are many difficulties in collecting evidence. Even if evidence is collected, software problems that are not trusted from a digital forensics perspective arise. Based on this, the digital forensics technique in Linux has been studied, but when the studied results are confirmed, the possibility of modulation cannot but be ruled out due to the nature of digital data in order to use the built-in tool. Therefore, this paper proposes an effective digital evidence collection method in a Linux-based system by extending the digital forensics technique of Linux studied above. [ABSTRACT FROM AUTHOR]

Metadata provides a wealth of information that is invaluable for digital forensic investigations, but it also poses significant privacy risks. The varying degrees of metadata retention across social media platforms have significant implications for digital forensic investigations. Metadata plays a crucial role in constructing timelines, verifying data authenticity, and providing evidence of interactions. In this research, we investigate the handling of EXIF metadata by various social media platforms and assess the implications for user privacy and digital forensic investigations. Our findings underscore the critical need for specialized software to manage and remove metadata from images uploaded to social media, preserving user privacy while retaining necessary data for legal and forensic purposes. To address these concerns, we implement a framework for encrypting and decrypting metadata, ensuring that sensitive information can be protected before images are uploaded to social media platforms. This research aims to encapsulate the findings and emphasize the need for balanced solutions that respect user privacy while supporting forensic investigations. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) is a powerful technology adopted in various industries. Applications of the IoT aim to enhance automation, productivity, and user comfort in a cloud and distributive computing environment. Cloud computing automatically stores and analyzes the large amounts of data generated by IoT-based applications. Cloud computing has become a crucial component of the information age through easier data administration and storage. Currently, government agencies, commercial enterprises, and end users are rapidly migrating their data to cloud environments. This may require end-user authentication, greater safety, and data recovery in the event of an attack. A few issues were discovered by authors after analysis and assessments of various aspects of the published research papers. The research analysis reveals that the existing methods need to be further improved to address the contemporary dangers related to data security and privacy. Based on the research reports, it can be stated that safe end-to-end data transmission in a cloud-IoT environment requires modifications and advancements in the design of reliable protocols. Upcoming technologies like blockchain, machine learning, fog, and edge computing mitigate data over the cloud to some level. The study provides a thorough analysis of security threats including their categorization, and potential countermeasures to safeguard our cloud-IoT data. Additionally, the authors have summarized cutting-edge approaches like machine learning and blockchain technologies being used in the data security privacy areas. Further, this paper discusses the existing problems related to data privacy and security in the cloud-IoT environment in today’s world and their possible future directions. [ABSTRACT FROM AUTHOR]

Over the past decade, law enforcement organizations have been dealing with the development of cybercrime. To address this growing problem, law enforcement organizations apply various digital forensic (DF) tools and techniques to investigate crimes involving digital devices. This ensures that evidence is admissible in legal proceedings. Consequently, DF analysts may need to invest more in proprietary DF hardware and software to maintain the viability of the DF lab, which will burden budget-constrained organizations. As an alternative, the open source DF tool is considered a cost-saving option. However, the admissibility of digital evidence obtained from these tools has yet to be tested in courts, especially in Malaysia. Therefore, this study aimed to explore the admissibility of digital evidence obtained through open source DF tools. By reviewing the existing literature, the factors that affect the admissibility of the evidence produced by these tools in courts were identified. Further, based on the findings, a conceptual framework was developed to ensure the admissibility of the evidence so that it will be accepted in the court of law. This conceptual framework was formed to outline the factors affecting the admissibility of digital evidence from open source DF tools, which include; 1) The Availability and Capability of open source DF tools, 2) the Reliability and Integrity of the digital evidence obtained from open source DF tools, 3) the Transparency of the open source DF tools, and 4) the Lack of Reference and Standard of open source DF tools. This study provides valuable insights into the digital forensic field, and the conceptual framework can be used to integrate open source DF tools into digital forensic investigations. [ABSTRACT FROM AUTHOR]

In the current digital era, images have become one of the key channels for communication and information. There are multiple platforms where digital images are used as an essential identity, like social media platforms, chat applications, electronic and print media, medical science, forensics and criminal investigation, the court of law, and many more. Alternation of digital images becomes easy because multiple image editing software applications are accessible freely on the internet. These modified images can create severe problems in the field where the correctness of the image is essential. In such situations, the authenticity of the digital images from the bare eye is almost impossible. To prove the validity of the digital images, we have only one option: Digital Image Forensics (DIF). This study reviewed various image forgery and image forgery detection methods based on blind forgery detection techniques mainly. We describe the essential components of these approaches, as well as the datasets used to train and verify them. Performance analysis of these methods on various metrics is also discussed here. [ABSTRACT FROM AUTHOR]

Various smart home companies are adding displays to smart home control devices and are also releasing smart home control functions for devices with displays. Since smart home management devices with displays are multifunctional, they can store more digital evidence than traditional management devices. Therefore, we propose a smart home environment forensic methodology focused on wallpads, which are smart home management devices with displays. And we validate the proposed methodology by building a smart home environment centered around wallpads and conducting tests with three vendors (Samsung, Kocom, and Commax). Following the proposed methodology, we identified the software and hardware specifications of devices within the testbed, particularly the wallpads. Based on this, we were able to extract network packets, disk images, and individual files stored internally using methods such as packet capture, vulnerability exploits, serial ports, and chip-off. Through analysis, we confirmed that significant user-related information and videos are stored in these control devices. The digital evidence obtained through the proposed methodology can be used as critical legal evidence, and this study contributes to efficiently analyzing important security issues and evidential data in various smart home IoT environments. [ABSTRACT FROM AUTHOR]

The identification of the tampered images is the research area of digital forensics, which defines the manipulation in the image. This is easily performed by forgers without the permission of the owners of the images. The misuse of these images in digital content is a significant problem for privacy. There are some studies on the detection of the forgery images, in the literature. However, effective and robust solutions are needed to detect them. In this motivation, a deep learning based architecture is proposed to solve the tampered image detection. It includes feature extraction with transfer learning architecture, selection of features with particle swarm optimization, and multi-classification of images with a deep learning architecture that is designed with Gated Recurrent Units. The proposed architecture is validated with the modified CASIA dataset. Various noisy tampered images are also included in the dataset of the study to demonstrate the robustness of the method. Despite this, tampered and noisy tampered images can even be detected quite accurately. As a result of the experiments, 96.25% accuracy is achieved with the proposed method. An accuracy of 80.5% was achieved in images with Gaussian and salt & pepper noises together. It has been proven through experiments that these results are significantly higher than the SVM classifier. This achievement is capable of supporting the detection of the original image combined with different images by experts working in the field of digital forensics. [ABSTRACT FROM AUTHOR]

Thanks to the MAC addresses, determinations can be made to the manufacturer of a device, up to which country it is sold to. MAC addresses of the devices can be determined with forensic software. However, despite the continuous development of operating systems, the progress of forensic software remains insufficient in terms of Mac operating system (macOS). The aim of this study is to analyze the MAC address records of the phones connected to a computer with macOS, to detect the problems which occured during the analysis and to offer solutions to these problems. In order to achieve this goal, this article suggests a methodology consisting of the preparation of the working environment, the collection of data, the analysis of the data and the evaluation of the results. In accordance with this methodology, a total of ten different applications were used by phones with iOS and ANDROID operating systems. Obtained results showed that the MAC address records falling to the operating system did not work correctly every time, the connection type affects the results, and there are multiple MAC address records for one phone. [ABSTRACT FROM AUTHOR]

Forensics investigation of WordPress applications hosted on containerized cloud environment is critically important due to their increased adaptation and an exponential increase in cybercrimes. Investigation of containerized environments is complex due to their volatile nature and dynamic allocation. This paper explores the forensic analysis of WordPress applications deployed inside a containerized environment. In this paper, we have used a log analysis approach to perform the digital forensics investigation of different attacks on WordPress applications running over Kubernetes. To investigate these events, we collected a large number of operational logs generated by these applications. Log filtrations techniques are applied to analyze only the relevant logs for a specific event to perform the forensic investigation efficiently. The experimental results confirm the proposed approach's effectiveness as we could trace all the malicious events to conduct the digital investigation on the WordPress applications running inside Kubernetes. The scheme successfully identified the attacker's information like incident time, incident source, duration of attack etc. Moreover, the proposed solution also provided forensics readiness for the WordPress applications running in a container-based cloud. [ABSTRACT FROM AUTHOR]

Copyright of Forensic Science & Technology is the property of Institute of Forensic Science, Ministry of Public Security and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

This paper proposes an image linking scheme, where the plain zones of the image under analysis are used, which are detected using the Discrete Cosine Transform. Then, a Block Matching 3D denoising filter is used to reduce the additive noise such that the residual error of the plain zones. The Peak to Correlation Energy is applied to compare the enhanced residual noise patterns. Experimental results show that the proposed methodology compared to conventional techniques is better due to the emphasis on plain zones, because the detailed and edge areas introduce distortions that can significantly affect the extracted residual noise patterns. [ABSTRACT FROM AUTHOR]

To address challenges in digital evidence collection and responsibility determination for industrial safety accidents involving industrial Internet of Things (IIoT) device nodes, this paper proposes a blockchain-based digital forensic scheme within the IIoT communication architecture. The scheme utilizes a decentralized blockchain storage mechanism to enable remote storage of digital forensic data. Additionally, it leverages smart contract mechanisms to facilitate efficient retrieval and tracing of related evidence chains. To enhance data security of IIoT device nodes, a token mechanism is implemented for access control. Moreover, to meet real-time evidence acquisition requirements in IIoT, an efficient batch consensus mechanism is proposed. Experimental simulations demonstrate the superiority of the novel consensus algorithm compared to the traditional Delegated Proof-of-Stake (DPOS) consensus in the proposed scheme for the IIoT environment. It meets speed requirements for evidence collection, ensuring tamper-proof, non-repudiable, and permanent storage of digital forensic data. Consequently, the application of blockchain technology for judicial access and evidence storage has made significant contributions to digital forensics within the IIoT context.

The subject of the research refers to the aspect of digital forensics and computer crime and the latter is one of the reasons for the evolution of crime in general. Based on the growing trend of technology development and the increase in the number of digital crimes, a special emphasis is given to the statistical aspect of computer crime as well as measures to reduce the impact of computer crime, including the ethical and legal aspects in the Republic of North Macedonia (RNM).

The rise of portable electronic devices and social media has led to new criminal activities, necessitating advancements in digital forensics. This paper introduces Small-Scale Digital Device Forensics (SSDDF), focusing on the forensic examination of miniature digital devices often used in crimes. SSDDF addresses the challenges posed by these devices, particularly in extracting and analyzing data from them. A key aspect of this research is exploring ontology in social media forensics, particularly within the Android operating system. This involves extracting digital evidence like user accounts, messages, and images from social media platforms. While the paper primarily focuses on social media data, it acknowledges the importance of the devices used in crimes. The integration of SSDDF and the analysis of Android system structures are highlighted as key advancements in digital forensic methodologies. These enhancements are expected to improve the process of collecting and analyzing digital evidence from both compact electronic devices and social media platforms. The study offers significant contributions to the field of digital forensics. It provides new strategies for more efficient and effective forensic investigations, especially in the context of extracting and analyzing digital evidence from small electronic devices and social media, thus paving the way for more robust digital evidence handling in future forensic inquiries.

To address challenges in digital evidence collection and responsibility determination for industrial safety accidents involving industrial Internet of Things (IIoT) device nodes, this paper proposes a blockchain-based digital forensic scheme within the IIoT communication architecture. The scheme utilizes a decentralized blockchain storage mechanism to enable remote storage of digital forensic data. Additionally, it leverages smart contract mechanisms to facilitate efficient retrieval and tracing of related evidence chains. To enhance data security of IIoT device nodes, a token mechanism is implemented for access control. Moreover, to meet real-time evidence acquisition requirements in IIoT, an efficient batch consensus mechanism is proposed. Experimental simulations demonstrate the superiority of the novel consensus algorithm compared to the traditional Delegated Proof-of-Stake (DPOS) consensus in the proposed scheme for the IIoT environment. It meets speed requirements for evidence collection, ensuring tamper-proof, non-repudiable, and permanent storage of digital forensic data. Consequently, the application of blockchain technology for judicial access and evidence storage has made significant contributions to digital forensics within the IIoT context. [ABSTRACT FROM AUTHOR]

Cloud storage provides convenience for data owners. But it faces serious challenges from data tampering and abuse. Flexible access control method is an effective way to protect shared data security. Existing attribute-based access control methods attempt to improve the access flexibility and security of shared data. But there are some problems for resource-limited lightweight devices as performance and security to be solved. Blockchain can construct a trusted network for data owner to deal with data validity and digital forensics. This paper proposes a novel blockchain-based lightweight access control scheme. The proposed scheme uses blockchain to construct a trusted sharing network by consensus mechanism. The lightweight attribute-based sharing scheme is used to support fine-grained access control of data. In this scheme, it obfuscates the access control policy with fuzzy attribute set to improve system security, and reduces the computing complexity of system users by outsourcing complex operations to semi-trusted proxy servers. The security analysis shows that the scheme is S , ρ , n - 1 , ε -secure against collusion attack between users and attribute authorities. The performance analysis results show that the proposed scheme reduces the computational complexity of user devices and provides faster response time compared with benchmark and state-of-the-art technologies. [ABSTRACT FROM AUTHOR]

Many people carry out social media activities which are not only positive activities but also activities that have a negative impact, such as crimes in cyberspace. especially forensics mobile in assisting the resolution of crime cases through social media Instagram with media access smartphone. The biggest problem in the data retrieval process is that the perpetrator deletes or tries to eliminate digital evidence on a smartphone so this research aims to implement the framework National Institute of Standards and Technology to investigate data forensic evidence on social media Instagram accessed via smartphone Android by using tools mobile Edit forensic in data extraction on a smartphone with workflow stages collection, - reporting. This study uses a conversation scenario on the Instagram feature direct message (DM) with conditions including deleting data on the Instagram application. The method used in handling cybercrime with media evidence smartphones is the method National Institute of Standards and Technology (NIST). The results of this study are in collecting data in the form of 25 conversations (chat), 206 images, 86 videos, 5 audio, and 4 call logs on smartphones. However tools MOBILEdit Forensic in returning digital evidence are unable to recover conversations and call logs as a whole. [ABSTRACT FROM AUTHOR]

Context. A feature of the modern digital world is that crime is often committed thanks to the latest computer technologies, and the work of law enforcement agencies faces a number of complex challenges in the digital environment. The development of information technology and Internet communications creates new opportunities for criminals who use digital traces and evidence to commit crimes, which complicates the process of identifying and tracking them. Objective. Development of an applied ontology for a system for analyzing a digital criminal offense, which will effectively analyze, process and interpret a large amount of digital data. It will help to cope with the complex task of processing digital data, and will also help automate the process of discovering new knowledge. Methods. To build an ontological model as a means of reflecting knowledge about digital crime, information was collected on existing international and domestic classifications. The needs and requirements that must be satisfied by the developed ontology were also analyzed. The creation of an ontological model that reflects the basic concepts, relationships in the field of digital criminal offense was carried out in accordance with a recognized ontological analysis of a specialized subject area. Results. An applied ontology contains the definition of entities, properties, classes, subclasses, etc., as well as the creation of semantic relationships between them. At the center of the semantics is the Digital Crime class, the problem area of which is complemented by the interrelated classes Intruder, Digital evidence, Types of Crime, and Criminal liability. Such characteristics as motive, type of crime, method of commission, classification signs of digital traces and types of crime, as well as other individual information were assigned to the attributes of the corresponding classes. An ontological model was implemented in OWL using the Protégé software tool. A feature of the implementation of the applied ontology was the creation of SWRL rules for automatically filling in additional links between a class instance. Manual and automatic verification of the ontology showed the integrity, consistency, a high degree of correctness and adequacy of the model. The bugs found were usually related to technical aspects and semantic inconsistencies, which were corrected during further development iterations. Conclusions. The research confirmed the effectiveness of the developed applied ontology for the analysis of digital criminality, providing more accurate and faster results compared to traditional approaches. [ABSTRACT FROM AUTHOR]

Instant Messaging (IM) is a popular and widely used communication application. MiChat is a multi-platform instant chat service with several features that can attract various segments of the population to use it as a tool for committing cybercrimes. A forensic framework and several forensic tools are needed to carry out physical evidence investigation procedures. This study focuses on analyzing and comparing the forensic tools used during the research, based on defined digital evidence parameters and applying a specific mobile forensic framework. The results show that Final Mobile Forensic has the highest ability to obtain digital evidence and can recover deleted data, while Oxygen Forensic Detective has advantages in terms of audio, images, and video but cannot recover data. The best framework is DFRWS, which has the most complete stages so that it can support the investigation process. The best digital evidence is text chat and contacts, which can be used to support valid legal claims.

Modern legal proceedings heavily rely on digital evidence as a basis for decisions in a variety of contexts, including criminal investigations and civil lawsuits. However, factors like data alteration, unauthorised access, or flaws in centralised storage can threaten the security and integrity of digital evidence. We suggest a decentralised methodology for using smart contracts to safeguard digital evidence in order to overcome these issues. The decentralised model makes use of smart contracts and blockchain technology to guarantee the integrity, transparency, and immutability of digital evidence. The approach does not require a centralised authority because it makes use of a distributed ledger, which lowers the possibility of data loss or manipulation. Multiple parties participating in the evidence lifecycle can build confidence and accountability thanks to smart contracts’ programmable rules and automated enforcement mechanisms. In our study, we show the decentralised model’s architecture and describe its essential elements, such as the blockchain network, smart contracts, and decentralised storage. We go over the advantages of employing this architecture, including enhanced auditability, decreased dependency on centralised institutions, and increased data security. Additionally, we discuss potential difficulties and constraints, like scalability and interoperability. We run a few simulations and experiments to test the suggested model’s viability and effectiveness while comparing it to conventional centralised methods. The outcomes show that our decentralised paradigm offers improved security for digital evidence, guaranteeing its reliability, usability, and tamper-proofness. We also go through how the model is used in actual legal systems, law enforcement organisations, and digital forensics investigations.

Traditional image recovery from corrupted file systems plays a significant role in Digital Forensics investigation. The images are mainly considered objective court evidence. Since the JPEG image format is less structured than other image formats (e.g., BMP, PNG, GIF, and TIFF), its recovery is more challenging. The paper’s main objective is to apply a metaheuristic optimization algorithm with similarity metric to recover Bifragmented intertwined JPEG images. We propose a new method known as Meta-Heuristic Reassemble Images (MHRI) for forensic recovery of Bifragmented intertwined JPEG images in the scan area, where all the fragments are in a linear order. The contribution of this paper lies in the following key components composing the MHRI method: 1) restart marker to remove some strange blocks from the scan area; 2) coherence of Euclidean Distance metric (CoEDm) to detect the fragmentation point of intertwined JPEG image; and 3) genetic Algorithm with cost function to predict if every two blocks are sequenced in the same image that searches for the best reassembly solution among the existing solutions. The MHRI method is implemented using MATLAB and tested using public datasets of 25 JPEG images and private dataset of 6 JPEG images. The MHRI process can fully recover all the Bifragmented intertwined JPEG images and 48.4% of all the JPEG images, which comparably performs better than similar methods.

As evidenced in the trial, between 2015 and the second quarter of 2022, there were 54 cases involving secure digital high capacity (SDHC) storage hardware as evidenced in trials. In 2021 there will be an increase in cases involving SDHC. The three cases with the highest number are corruption cases, special crimes, and ITE. SDHC is an advanced technology development of Secure Digital (SD) card hardware which functions as storage. SD Card only has a capacity of up to 2 gigabytes, while the largest SDHC capacity is 32 gigabytes. As a storage device that is small, thin, and has a fairly large capacity. this research needs to be done because of the increasingly widespread increase in cases involving SDHC. This study aims to perform digital forensic analysis on SDHC evidence using forensic applications that run on Linux, namely foremost and DC3DD. This study uses the DFRWS method to retrieve valid evidence in court. Based on the research conducted, it was found that the number of files that can be restored at the examination stage using foremost is 77%, and the accuracy of recovered files is 50% with string file hash validation. From this research, it can be concluded that the processing results of DC3DD and Foremost can be used as valid evidence.

The Metaverse is currently becoming a massive technology platform and is considered to be the next significant development in global technology and business landscapes. The Metaverse is a digital platform that people can enter or transport virtual items with a device as a medium, implemented as virtual but very similar to the real world through the concept of the digital twin as used in smart cities. The Metaverse is currently in its infancy but is developing gradually. However, the potential threat of crime in this new world already has become a concern. As the Metaverse becomes more similar to the real world, the events that occur in it can affect the real world as well. Therefore, digital forensic research on the Metaverse is necessary to investigate crimes occurring in the Metaverse, such as money laundering, virtual burglaries, virtual theft, and fraud. In this paper, we present the conceptual architecture of the Metaverse and discuss what are termed metacrimes, crimes that may occur within the Metaverse, and address the need for research on digital forensic investigations of the Metaverse. Furthermore, we propose a Metaverse forensic framework for the first time; it consists of four phases based on the digital forensic guidance of NIST. These are data collection, examination and retrieval of evidence, analysis, and reporting. In the framework, we provide three different procedures in the data collection phase and examination phase by dividing them into three categories: user, service, and the Metaverse platform. Finally, we discuss the challenge of digital forensic investigations in the Metaverse from three standpoints: data possession, anti-forensics, and privacy. [ABSTRACT FROM AUTHOR]

It is extremely difficult to track down the original source of sensitive data from a variety of sources in the cloud during transit and processing. For instance, data provenance, which records the origins of data, and the record of data usage, update and processing can be introduced to trace malicious vulnerabilities. Thus, data provenance process makes it easy to monitor the sources and causes of any problems in cloud computing. However, data provenance is one of the most prominent drawbacks in cloud storage. Despite many studies, a full assessment of data provenance in cloud forensics is still missing from the literature, especially in wireless sensor networks, blockchain, Internet of Things (IoT), security and privacy. Importantly, one of the major challenges in data provenance is “how to reduce the complexity of evidence.“ That is, ensuring volatile data is captured before being overwritten. Hence, this study presents a survey of recent data provenance problems in cloud computing, provenance taxonomy, and security issues. It also, discusses how volatile data can be captured before being overwritten and then helps identify current provenance limitations and future directions for further study. More also, it examined how data is collected as evidence for digital crime in a real-world scenario. Furthermore, future work in digital provenance for cloud forensics, wireless sensor network, IoT, and blockchain is recommended.

Recently, digital forensics has become increasingly important as it is used by investigation agencies, corporate, and private sector. To supplement the limitations of evidence capacity and be recognized in court, it is essential to establish an environment that ensures the integrity of the entire process ranging from collecting and analyzing to submitting digital evidence to court. In this study, common elements were extracted by comparing and analyzing ISO/IEC 17025, 27001 standards and Interpol and Council of Europe (CoE) guidelines to derive the necessary components for building a digital forensic laboratory. Subsequently, based on 21 digital forensic experts in the field, Delphi survey and verifications were conducted in three rounds. As a result, 40 components from seven areas were derived. The research results are based on the establishment, operation, management, and authentication of a digital forensics laboratory suitable for the domestic environment, with added credibility through collection of the opinions of 21 experts in the field of digital forensics in Korea. This study can be referred to in establishing digital forensic laboratories in national, public, and private digital forensic organizations as well as for employing as competency measurement criteria in courts to evaluate the reliability of the analysis results. [ABSTRACT FROM AUTHOR]

Programmable Logic Controllers (PLCs), as specialized task-oriented embedded field devices, play a vital role in current industrial control systems (ICSs), which are composed of critical infrastructure. In order to meet increasing demands on cost-effectiveness while improving production efficiency, commercial-off-the-shelf software and hardware, and external networks such as the Internet, are integrated into the PLC-based control systems. However, it also provides opportunities for adversaries to launch malicious, targeted, and sophisticated cyberattacks. To that end, there is an urgent need to summarize ongoing work in PLC-based control systems on vulnerabilities, attacks, and security detection schemes for researchers and practitioners. Although surveys on similar topics exist, they are less involved in three key aspects, as follows: First and foremost, previous work focused more on system-level vulnerability analysis than PLC itself. Subsequently, it was not clear whether their work applied to the current systems or future ones, especially for security detection schemes. Finally, the prior surveys lacked a digital forensic research review of PLC-based control systems, which was significant for security analysis at different stages. As a result, we highlight vulnerability analysis at both a core component level and a system level, as well as attack models against availability, integrity, and confidentiality. Meanwhile, reviews of security detection schemes and digital forensic research for the current PLC-based systems are provided. Finally, we discuss future work for the next-generation systems. [ABSTRACT FROM AUTHOR]

This paper proposes an image linking scheme, where the plain zones of the image under analysis are used, which are detected using the Discrete Cosine Transform. Then, a Block Matching 3D denoising filter is used to reduce the additive noise such that the residual error of the plain zones. The Peak to Correlation Energy is applied to compare the enhanced residual noise patterns. Experimental results show that the proposed methodology compared to conventional techniques is better due to the emphasis on plain zones, because the detailed and edge areas introduce distortions that can significantly affect the extracted residual noise patterns.

Information Technology usage and development has improved the efficiency and the flexibility of service provision among a number of institutions. While the process of computerization is taking place at a very high speed, the security surrounding the critical asset of IT is a major growing concern for the top management. The application of the digital forensic concept can therefore be helpful in curbing problems associated with cybercrime. The use of concepts relating to digital forensic investigation of criminal activities and digital forensics will, therefore, tackle the problem with finding digital evidence in cybercrimes. Hex editor is one of the various digital forensic investigation tools that allow the use of Hash Sets for identifying known safe files in program and operating system files. The tool is essential for identifying suspected files like Trojans, viruses, and hacker scripts. The paper seeks to establish the effectiveness of Hex editor in information technology security risk management. That is, the capabilities of Hex editor and the accuracy of Hex editor with regards to retrieving and analyzing data from a hard disc or drive in order to investigate and curb information technology security risk at the workplace. The researcher performed investigation on a Mozilla FxOS running on a phone released by Peak group in which case the researcher aimed to retrieve previous images that had been sent through the phone. In overall, Hex editor was able to identify the images and content of information that had been shared via the phone. Therefore, Hex editor is vital in identification, extraction, analysis, and presentation of digital evidence contained in digital devices. It is an effective tool that can be used by organizations for Forensic information technology security risk management. Keywords: Hex editor; Cybercrime; Digital Forensic; Investigation; technology, security, risk

Software-Defined Networking (SDN) is an evolutionary networking paradigm that offers simplified and agile network configuration and management capabilities. However, embracing this new and futuristic paradigm requires the understanding of Digital Forensics (DF) limitations that it presents. Studies show that the dynamism of SDN architecture impedes the preservation of Potential Digital Evidence (PDE) during a Digital Forensic Readiness (DFR) process. Therefore, the identification and acquisition of viable PDE in SDN platforms largely depends on the thorough understanding of the issues and challenges affecting the application of DFR in SDN platforms. For this reason, this study leverages a case study research methodology to empirically underline the forensic limitations and provide level of specificity with which these limitations affect the DFR process. The results of the case study combined with existing literature are used to expose the issues and challenges in a typical SDN testbed. The knowledge acquired from the state-of-the-art with respect to conducting DFR in an SDN platform addresses the knowledge gap of understanding these limitations. [ABSTRACT FROM AUTHOR]

The Internet of Things (IoT) Investigation of Forensics (IoTFI) is one of the subdomains of Digital Forensics that aims to record and evaluate incidents involving the Internet of Things (IoT). Because of the many different standards, operating systems, and infrastructure-based aspects that make up the Internet of Things industry, this sector is extremely varied, ambiguate, and complicated. Many distinct IoTFI models and frameworks were developed, each one based on a unique set of investigation procedures and activities tailored to a particular IoT scenario. Because of these models, the domain becomes increasingly complicated and disorganized among those who perform domain forensics. As a result, the IoTFI domain does not have a general model for managing, sharing, and reusing the processes and activities that it offers. With the use of the metamodeling development process, this work aims to create an Internet of Things Forensic Investigation Metamodel (IoTFIM) for the IoTFI domain. Utilizing the metamodeling development process allows for the construction and validation of a metamodel and the verification that the metamodel is both comprehensive and consistent. The IoTFIM is divided into two phases: the first phase identifies the problem, and the second phase develops the IoTFIM. It is utilized to structure and organize IoTFI domain knowledge, which makes it easier for domain forensic practitioners to manage, organize, share, and reuse IoTFI domain knowledge. The purpose of this is to detect, recognize, extract, and match various IoTFI processes, concepts, activities, and tasks from various IoTFI models in an IoTFIM that was established, facilitating the process of deriving and instantiating solution models for domain practitioners. Utilizing several metamodeling methodologies, we were able to validate the generated IoTFMI's consistency as well as its applicability (comparison against other models, frequency-based selection). Based on the findings, it can be concluded that the built IoTFIM is consistent and coherent. This makes it possible for domain forensic practitioners to simply instantiate new solution models by picking and combining concept elements (attribute and operations) based on the requirements of their models. [ABSTRACT FROM AUTHOR]

The advancement of new technology is quickening. Because of the features and applications available on mobile devices, smartphones are gradually taking over the role of computers. One of them is a multi-platform instant messaging application with various features that can bring people together, but the negative aspect is that it is used to commit digital crimes. Digital evidence is required in the investigation of digital crimes, In order to obtain digital evidence, a set of forensic tools is required to carry out the forensic process of physical evidence. The goal of this research is to describe and contrast the forensic process. These tools are currently based on digital evidence obtained through the stages of the Digital Forensic Research Workshop. MEF, DB4S, OFD, and FMF are the forensic tools used in this study. According to the findings, FMF has the highest extraction capability for obtaining digital evidence, OFD has advantages in terms of data acquisition features, and MFE has advantages in identification, physical evidence preservation, and cloning. [ABSTRACT FROM AUTHOR]

Android is the world's most popular system of operation. In the Android system, communication applications can be installed, for example, Facebook Messenger, which is one of the most popular communication applications with 988 million active users. As a medium for communication and data exchange, the Facebook Messenger application may be misused by unauthorized parties for cybercrime. This action is usually done to obtain a one-sided profit for unauthorized parties. After doing cybercrime, cybercriminals will delete all of the data to remove digital evidence. Digital forensics serves the challenge of uncovering evidence in investigations. Digital forensics on the Facebook Messenger application is needed to help the authorities organize digital evidence when the disclosure process is performed. The data revealed through the digital forensics process can reinforce existing evidence in a court. In this research, digital forensics on the Facebook Messenger application was conducted with data deletion scenarios and application uninstall scenarios. The results are digital evidence in the form of Facebook Messenger application information , photo, and video sent by the cybercriminal. The conversation and audio evidence could not be located because there was no rooting process, or the smartphone was in an untied state. When the uninstall process was carried out, the smartphone automatically deleted all the data including thumbnails. However, the digital forensics process in an unrooted state on the Facebook Messenger application can still produce digital evidence that can be used in the court. [ABSTRACT FROM AUTHOR]

Video forgery can be defined as the modification of the video contents. The alteration of the video by deletion and modification in the sequence of frames is a trivial task, which has made the authentication and originality detection more important. Frame insertion and deletion are the most common type of video forgery. The proposed method can identify these types of forgery along with its forged location, which makes this unique method. It defines the relationship between the adjacent frames using the correlation coefficient, finds the inter-frame correlation distance between the frames, calculates the minimum distance score, statistical features, and computes upper-bound, lower-bound threshold and sigma coefficient for the identification of forgery location. The proposed method defines insertion and deletion type forgery by using threshold controlled parameters and it is validated on the VIFFD dataset. The proposed method has also identified forgery with 97% accuracy at the frame level and 83% accuracy at the video level. The result analysis shows the superiority of the proposed method over the existing methods. This method is very effective in identifying the forgery type with its frame location. [ABSTRACT FROM AUTHOR]