When developing digital forensic capabilities, building a laboratory to securely acquire and handle digital evidence is a top priority. However, differences in organizational size and characteristics have led to a lack of standardization in budget acquisition and implementation, creating significant challenges. Therefore, this study aims to provide a practical baseline for establishing a composition plan and securing a budget by defining essential tools and equipment for laboratories of varying scales (one-person and five-person configurations). Rather than proposing a new standard, this study presents an implementation baseline that conforms to existing guidance, such as ISO/IEC 17025 and the INTERPOL Global Guidelines for Digital Forensics Laboratories. This study employed a mixed-methods approach. An initial equipment list was derived from focus group interviews with 12 experts, refined through site visits, and validated via a survey of 124 professionals. To ensure feasibility, 62 public requests for proposals were analyzed, and delivery records from ODA projects in five countries (2022–2025) were verified. This study provides practical implementation criteria that address the resource requirements of ISO/IEC 17025 (facilities, environmental conditions, and equipment) and effectively answers the question of how to build a digital forensics laboratory. Rather than rigid regulations, the study suggests a “common baseline configuration” that serves as a practical reference standard. This enables organizations to customize their tools and equipment according to their size and budget while supporting alignment with international standards.
As crime related to cryptocurrency continues to increase, such as money laundering, and darknet use, diverse wallet applications are involved in crimes. Different wallets use different key management methods, making it difficult to apply a common forensic framework. There is a gap in the forensic framework similar to that in key management. In order to bridge this gap, this research introduces a structured four-step forensic framework for hierarchical deterministic (HD) wallets, encompassing forensic readiness, data acquisition, results & analysis, and final report & documentation. The forensic applicability of this framework is evaluated using Exodus and Sparrow as representative examples of open-source and proprietary wallets, respectively, within a Windows 10 virtual machine using memory and disk images collected across four operational stages and an additional post-reboot memory acquisition. A designated recovery phase was included to simulate real-life scenarios for wallet unlocking and access restoration. The successful recovery of artifacts such as wallet addresses, seed phrases, extended public keys, TXIDs, and wallet files demonstrated the efficacy of the proposed framework. Although both wallets have been studied individually, this study examines both using a four-step forensic framework, specifically designed for proprietary and open-source HD wallets. This study offers fresh insights that may support cryptocurrency crime prevention and investigative practices.
Medical device software systems rely heavily on logging to support monitoring, debugging, regulatory activities, and post-incident investigation. However, existing logging practices often lack the structure, context, traceability, and integrity required for reliable forensic reconstruction. While forensic readiness frameworks emphasise evidence availability and preservation, they provide limited guidance on what constitutes a forensic-ready log or how such logging should be implemented as a software design feature. This research proposes the Forensic-Ready Logging Framework (FRLF), a technology-agnostic approach that formalises forensic-ready logging as explicit design input requirements covering specificity, traceability, integrity, ordering, interoperability, integrity mechanism selection, availability and retention, and privacy. These requirements are realised through a standardised log event schema and modular processing architecture. The framework is evaluated at proof-of-concept level across simulated heterogeneous medical device system components representing both full-feature and resource-constrained environments. Unit-level verification, integration testing, and scenario-based evaluation demonstrate the feasibility of implementing the defined forensic properties and producing consistent, verifiable, correlated, and interpretable records across these components. The FRLF demonstrates how forensic-ready logging can be treated as an explicit and verifiable software design feature rather than an operational by-product, providing a structured approach for integrating forensic readiness into medical device software development.
Flight logs from unmanned aerial vehicles (UAVs) running the PX4 autopilot provide operational evidence for forensic examination, yet successful parsing does not establish that a ULog is complete or internally consistent. We developed a retrospective method for assessing inconsistencies in PX4 ULogs acquired without pre-acquisition integrity protection. The method examines terminal state, logged data loss, temporal continuity, vertical position and velocity agreement, and attitude and angular velocity agreement. Nine decision thresholds were derived from physical flight logs representing 60 distinct vehicles and were fixed before evaluation. In a holdout cohort of 40 public flight logs without authenticity labels, seven records (17.5%; exact 95% confidence interval, 7.3–32.8%) activated at least one rule. Six controlled manipulation families were applied to logs from 15 additional vehicles, yielding 87 eligible source-manipulation pairs; all activated their prespecified target. PX4 estimator diagnostics were activated in 11 holdout records (five overlapping). Flight Review v2 reported findings in 5/40 (two overlapping). Comparator status did not change in any controlled vertical or rotational derivative. Target activation increased monotonically with manipulation magnitude over the sampled grid for every eligible source. In a coordinated vertical rewrite, position and vertical velocity were changed consistently. None of the 15 source logs acquired a new activation, defining a boundary of the tested vertical relation for that construction. Across 5000 post-hoc vehicle-bootstrap recalibrations, holdout activations had a median of 8/40 (central 95% range, 7–10), and new source-relative activations had a median of 86/87 (84–87). The method provides localized evidence of inconsistencies to guide forensic review of PX4 flight logs.
File carving recovers files from a disk image when filesystem metadata is not available. For Portable Document Format (PDF) files, the reference method is Cohen's semantic carver by Cohen (2007), which reads the crossreference table to find the objects of a PDF in the disk image. This carver reads only the plain-text table, so it cannot use the compressed cross-reference streams introduced in PDF 1.5, and it cannot repair a page when one compressed stream is split across two fragments. This paper presents SCAR, which extends Cohen's mapping-function method to close both gaps. SCAR decodes the cross-reference stream, and it repairs a split stream during reconstruction by searching only the interval between two consecutive anchors (known object offsets). It can re assemble some PDF files stored in several fragments, but its stream repair covers a single break in one compressed stream. A rebuilt file is accepted only if pikepdf can open it, and every tool's output is scored with MuPDF, so no file is judged by the code that rebuilt it. SCAR also records where every recovered byte came from, so a second examiner can check each file. Across 134 disk images and five baselines, SCAR recovered 31 of 39 document instances whose object offsets exist only in a cross-reference stream, in which Cohen's carver recovered none. The repair stage added seven recoveries in bi-fragmented document instances. On the DFRWS 2007 challenge, scored by exact MD5, Cohen's carver stayed one document ahead, but SCAR ran 15.3 times faster. These results cover synthetic fragmentation and two public benchmarks only.
