Digital forensic practitioners are tasked with the identification, recovery, and analysis of Internet browser artefacts which may have been used in the pursuit of committing a civil or criminal offence. This research paper critically compares the most downloaded browser, Google Chrome, against an increasingly popular Chromium browser known as Brave, said to offer privacy-by-default. With increasing forensic caseloads, data complexity, and requirements for method validation to satisfy ISO 17025 accreditation, recognising the similarities and differences between the browsers, developed on the same underlying technology is essential. The paper describes a series of conducted experiments and subsequent analysis to identify artefacts created as part of normal user browsing activity. Analysis of the artefacts found that Brave and Chrome share almost identical data structures, with on-disk artefact recovery successful, even for deleted data. The outcome of this research, based upon the results, serves to enrich understanding and provide best practice for practitioners and software developers, respectively responsible for examining Chromium artefacts for use in evidence production and developing new forensic tools and techniques.
This study is a follow-up to Digital Evidence in Criminal Cases before the U.S. Courts of Appeal: Trends and Issues for Consideration - 2010 to 2015. The current study examines appeals of criminal cases before the United States Courts of Appeal from January 2016 through August 2020, where one or more appeal claims were related to digital evidence. The purpose of this research was to determine if the legal landscape has changed since 2015; examine the most relevant legal issues related to digital evidence; and analyze how precedential cases may have affected digital forensics as evidence.
The idiographic technical profiles of child sexual exploitation material (CSEM) offenders provide insight into their behaviours and context for their interactions with technology, but minimal quantitative work has been done to evaluate their sociability, technical ability and technophilia compared to non-offenders. This work used an online survey to compare an offender group consisting of English-speaking adults previously convicted of CSEM offenses (N = 78) with a reference population of non-offenders (N = 254). The survey assessed sociability, technical ability and technophilia through self-rating and information on occupation, level of education and device ownership. The study found that CSEM offenders had slightly lower sociability than non-offenders, though not at a level of clinical interest. Additionally, CSEM offenders had no statistically significant difference in technical ability and lower overall technophilia when compared to non-offenders. This study fails to support popular perceptions of CSEM offenders being technically savvy loners who are early adopters of new technologies.
This study was carried out intending to identify the level and type of information that remained on portable devices that were purchased from the second-hand market in the UK over the last few years. The sample for this study consisted of 100 second hand mobile phones and tablets. The aim of the study was to determine the proportion of devices that still contained data and the type of data that they contained. Where data was identified, the study attempted to determine the level of personal identifiable information that is associated with the previous owner. The research showed that when sensitive and personal data was present on a mobile device, in most of the cases there had been no attempt to remove it. However, fifty two percent of the mobile devices had been reset to the factory settings or had had all of the data erased, which demonstrates the previous owner’s attempt to permanently remove personal identifiable information. Twenty eight percent of the devices that were sold were not functional or recognized by the software used in the research. Twenty percent of the devices that contained data contained data that gave away the identity of the previous owner.
An Analysis of Product Liability for AI Entities with special reference to the Consumer Protection Act, 2019
The boom of digital cameras, photography, and social media has drastically changed how humans live their day-to-day, but this normalization is accompanied by malicious agents finding new ways to forge and tamper with images for unlawful monetary (or other) gains. Disinformation in the photographic media realm is an urgent threat. The availability of a myriad of image editing tools renders it almost impossible to differentiate between photo-realistic and original images. The tools available for image forensics require a standard framework against which they can be evaluated. Such a standard framework can aid in evaluating the suitability of an image forensics tool for use in a criminal investigation, commercial operation, or academic research. This paper proposes an evaluation framework designed for image forensics tools based on the conformance methodology of testing that employs test assertions and test cases. It is then used to evaluate four image forensics tools namely FotoForensics, Ghiro, Imago Forensics, and Exif Reader. The comparative insight of test results produced by the framework provides a ground for ranking the tools from best to least comprehensive. The results also provide information necessary for users to make intelligent choices about tools and help vendors shortlist areas of improvement in their tools.
Since the past few years, the complexity and heterogeneity of digital crimes have increased exponentially, making digital evidence & digital forensics paramount for criminal investigation and civil litigation cases. Some of the routine digital forensic analysis tasks are cumbersome and can increase the number of pending cases, especially when there is a shortage of domain experts. While the work is simple, the sheer scale can be taxing. With the current scenarios and future predictions, crimes will only become more complex, and the precedent of collecting and examining digital evidence will only increase. In this research, we propose an ML-based Digital Forensics Software for Triage Analysis called Synthetic Forensic Omnituens (SynFO) that can automate evidence acquisition, extraction of relevant files, perform automated triage analysis and generate a basic report for the analyst. This research shows a promising future for automation with the help of Machine Learning.
Vault Applications store potentially sensitive information on a smartphone; and are available on Android and iOS. Using these applications could be used to hide potential evidence or illicit photos. After comparing five iOS photo vaults, each vault left evidence and photos behind. However, of the three forensic toolkits used, each produced different results in their scans of the phone. The media left behind was due to the photo vaults not protecting their information as claimed and using basic obfuscation techniques in place of security controls. Future research will look at how newer security controls are implemented and if they are easily discoverable.
With the increasing usage of three-dimensional meshes in Computer-Aided Design (CAD), medical imaging, and entertainment fields like virtual reality, etc., the authentication problems and awareness of intellectual property protection have risen over the last decade. Numerous watermarking schemes have been suggested to protect ownership and prevent the threat of data piracy. This paper begins with the potential difficulties that arose when dealing with three-dimension entities in comparison to two-dimensional entities and also lists possible algorithms suggested hitherto and their comprehensive analysis. Attacks, also play a crucial role in deciding on a watermarking algorithm so an attack based analysis is also presented to analyze the resilience of watermarking algorithms under several attacks. In the end, some evaluation measures and potential solutions are brooded over to design robust and oblivious watermarking schemes in the future.
In this update to the 2015 study, the authors examine US state statutes and regulations relating to licensing and enforcement of Digital Examiner functions under each State's private investigator/detective statute. As with the prior studies, the authors find that very few state statutes explicitly distinguish between Private Investigators (PI) and Digital Examiners (DE), and when they do, they either explicitly require a license or exempt them from the licensing statute. As noted in the previous 2015 study, there is a minor trend in which some states are moving to exempt DE from PI licensing requirements. We examine this trend and look at some additional information in terms of exemptions, including those relating to practicing attorneys, employer/employee relationships, expert testimony, and penalties for violation of the PI statutes where it is believed a PI license is required. As with the previous studies (Lonardo et al., 2008, 2009, 2012, 2015), we reviewed all state statutes relating to PI licensing. Where statutory language did not explicitly address exemption or inclusion of Digital Examiners, we contacted the relevant state regulatory body (i.e., Secretary of State's office, State Police, regulatory agency) to assess the applicability of Digital Examiners under the respective state statutes. Based on this statutory review and regulatory feedback, we present the various state approaches to professional Digital Examiner licensing. Our recommendation remains the same: states must differentiate between Private Investigator and Digital Examiner licensing requirements and oversight.
In the last decade, the proliferation of machine learning (ML) algorithms and their application on big data sets have benefited many researchers and practitioners in different scientific areas. Consequently, the research in cybercrime and digital forensics has relied on ML techniques and methods for analyzing large quantities of data such as text, graphics, images, videos, and network traffic scans to support criminal investigations. Complete and accurate training data sets are indispensable for efficient and effective machine learning models. An essential part of creating complete and accurate data sets is annotating or labelling data. We present a method for law enforcement agency investigators to annotate and store specific dark web content. Using a design science strategy, we design and develop tools to enable and extend web content annotation. The annotation tool was implemented as a plugin for the Tor browser. It can store web content, thus automatically creating a dataset of dark web data pertinent to criminal investigations. Combined with a central storage management server, enabling annotation sharing and collaboration, and a web scraping program, the dataset becomes multifold, dynamic, and extensive while maintaining the forensic soundness of the data saved and transmitted. To manifest our toolset's fitness of purpose, we used our dataset as training data for ML based classification models. A five cross-fold validation technique was used to evaluate the classifiers, which reported an accuracy score of 85 - 96%. In the concluding sections, we discuss the possible use-cases of the proposed method in real-life cybercrime investigations, along with ethical concerns and future extensions.
At this cloud age, there is tremendous growth in business, services, resources, and cloud technology. This growth comes with risk of unsafe, unordered, and uncertainty due to unauthorized access and theft of confidential propriety data. Our objective is to model around Read, Write and Execute to resolve these unordered, unsafe, and uncertain issues. We will develop a L-Shape pattern model matching UFS ACM to minimize the accessibilities based on RIGHT & ROLE of the resources and maximize the quality of services for safety and high availability. The preventive, detective, corrective (PDC) services are the major roles for all levels of management to coordinate, control the multiple technologies and resources which are working simultaneously. It will be more ordered, accountable, and actionable on real-time access control mechanism for scalabilities, reliability, performance, and high availability of computational services. We have to make safer, certain, unified, and step-by-step normalization by applying this UFS ACM mechanism on UNIX operating system. This proposed research paper covers a wide range of areas covering optimization, normalization, Fuzzy Low, and Risk assessment.
Private indexing is a set of approaches for analyzing research data that are similar or resemble similar ones. This is used in the database to keep track of the keys and their values. The main subject of this research is private indexing in record linkage to secure the data. Because unique personal identification numbers or social security numbers are not accessible in most countries or databases, data linkage is limited to attributes such as date of birth and names to distinguish between the number of records and the real-life entities they represent. For security reasons, the encryption of these identifiers is required. Privacy-preserving record linkage, frequently used to link private data within several databases from different companies, prevents sensitive information from being exposed to other companies. This research used a combined method to evaluate the data, using classic and new indexing methods. A combined approach is more secure than typical standard indexing in terms of privacy. Multibit tree indexing, which groups comparable data in many ways, creates a scalable tree-like structure that is both space and time flexible, as it avoids the need for redundant block structures. Because the record pair numbers to compare are the Cartesian product of both the file record numbers, the work required grows with the number of records to compare in the files. The evaluation findings of this research showed that combined method is scalable in terms of the number of databases to be linked, the database size, and the time required.
The dynamics of warfare have changed from the conventional wars fought on the battlefield to virtual warfare as states have been involved in the cyber arms race. From simple distributed denial-of-service (DDoS) attacks to the potent Stuxnet and Flame the cyberweapons vary in their potential human cost. The Law of Armed Conflict (LOAC) is drafted flexibly to adapt to changing circumstances. This paper is primarily based upon the assumption that existing treaty law is sufficient in many aspects yet in some areas treaty-making is also needed. What is the foreseeable solution is the comprehensive state practice for interpreting the existing rules (lex lata) regulating the armed conflict in the cyber context. This is because armed conflicts in cyberspace differ from kinetic warfare in multiple dimensions. The world community is yet to reach a consensus on how LOAC protects at times of cyberwarfare. From defining the basic terms like attack and object to the attribution needs resolution. Given such ambiguity, international humanitarian law (IHL, interchangeably used with LOAC) will more frequently be violated in conflicts occurring in cyberspace than in physical space. Efforts by states in sincere exploitation of existing laws are the sine qua non for the evolution of IHL in the cyber context.
The use of social media has spread through many aspects of society, allowing millions of individuals, corporate as well as government entities to leverage the opportunities it affords. These opportunities often end up being exploited by a small percentage of the user community who use it for objectionable or unlawful activities; for example, trolling, cyber bullying, grooming, luring. In some cases, these unlawful activities result in investigations where the swift retrieval of critical evidence is required in order to save a life. This paper presents a proof of concept (PoC) framework for social media user attribution. The framework aims to provide digital evidence that can be used to substantiate user activity in live triage investigations. This paper highlights the use of live triage as a viable technique for the investigation of social media activity, contextualizing user activity and attributing actions to users. It discusses the reliability of artefacts other than the communication content as a means of drawing inferences about user social media activity, taking into account.
Steganography has long been used to counter forensic investigation. This use of steganography as an anti-forensics technique is becoming more widespread. This requires forensic examiners to have additional tools to more effectively detect steganography. In this paper we introduce a new software concept specifically designed to allow the digital forensics professional to clearly identify and attribute instances of LSB image steganography by using the original cover image in side-by-side comparison with a suspected steganographic payload image. This technique is embodied in a software implementation named CounterSteg. The CounterSteg software allows detailed analysis and comparison of both the original cover image and any modified image, using sophisticated bit- and color-channel visual depiction graphics. In certain cases, the steganographic software used for message transmission can be identified by the forensic analysis of LSB and other changes in the payload image. This paper demonstrates usage and typical forensic analysis with eight commonly available steganographic programs. Future work will attempt to automate the typical types of analysis and detection. This is important, as currently there is a steep rise in the use of image LSB steganographic techniques to hide the payload code used by malware and viruses, and for the purposes of data exfiltration. This results because of the fact that the hidden code and/or data can more easily bypass virus and malware signature detection in such a manner as being surreptitiously hidden in an otherwise innocuous image file.
Dynamic development of IT technology poses new challenges related to the cross-border collection of electronic evidence from the cloud. Many times investigators need to secure data stored on foreign servers directly and then look for solutions on how to turn the data into a legitimate source of evidence. To study the situation and propose solutions, I conducted a survey among Polish representatives of public prosecutors’ offices and courts. This paper presents information from digital evidence collection practices across multiple jurisdictions. I stated that representatives from the prosecution and the judiciary in Poland are aware of the issues associated with cross-border acquisition and preservation of cloudbased evidence. In their view, many of the problems are time-consuming and ineffective international cooperation, the voluntary nature of cooperation between foreign cloud service providers, lack of harmonized procedures and guidelines, the diversity of legal systems, and the lack of knowledge held by law enforcement officials and the judiciary. This work should be the beginning of an open discussion with practitioners about existing challenges and an invitation for further research with a larger sample of prosecutors and judges. There are no such studies in literature. The paper shows that it is possible to improve current procedures for the cross-border collection of cloud-based digital evidence.
The use of social media has spread through many aspects of society, allowing millions of individuals, corporate as well as government entities to leverage the opportunities it affords. These opportunities often end up being exploited by a small percentage of the user community who use it for objectionable or unlawful activities; for example, trolling, cyber bullying, grooming, luring. In some cases, these unlawful activities result in investigations where swift retrieval of critical evidence required in order to save a life.
Phishing is currently one of the severest cybersecurity challenges facing the emerging online community. With damages running into millions of dollars in financial and brand losses, the sad tale of phishing activities continues unabated. This led to an arms race between the con artists and online security community which demand a constant investigation to win the cyberwar. In this paper, a new approach to phishing is investigated based on the concept of minimal feature set on some selected remarkable machine learning algorithms. The goal of this is to select and determine the most efficient machine learning methodology without undue high computational requirement usually occasioned by non-minimal feature corpus. Using the frequency analysis approach, a 13-dimensional feature set consisting of 85% URL-based feature category and 15% non-URL-based feature category was generated. This is because the URL-based features are observed to be more regularly exploited by phishers in most zero-day attacks. The proposed minimal feature set is then trained on a number of classifiers consisting of Random Tree, Decision Tree, Artificial Neural Network, Support Vector Machine and Naïve Bayes. Using 10 fold-cross validation, the approach was experimented and evaluated with a dataset consisting of 10000 phishing instances. The results indicate that Random Tree outperforms other classifiers with significant accuracy of 96.1% and a Receiver’s Operating Curve (ROC) value of 98.7%. Thus, the approach provides the performance metrics of various state of art machine learning approaches popular with phishing detection which can stimulate further deeper research work in the evaluation of other ML techniques with the minimal feature set approach.
The never-before-seen proliferation of interconnected low-power computing devices, patently dubbed the Internet of Things (IoT), is revolutionizing how people, organizations, and malicious actors interact with one another and the Internet. Many of these devices collect data in different forms, be it audio, location data, or user commands. In civil or criminal nature investigations, the data collected can act as evidence for the prosecution or the defense. This data can also be used as a component of cybersecurity efforts. When data is extracted from these devices, investigators are expected to do so using proven methods. Still, unfortunately, given the heterogeneity in the types of devices that need to be examined, few widely agreed-upon standards exist. In this paper, we look at some of the architectures, current frameworks, and methods available to perform forensic analysis of IoT devices to provide a roadmap for investigators and researchers to form the basis of an investigation.
