Digital forensic methods and tools play a vital role in the handling of digital evidence within criminal proceedings. To apply these methods and tools in a satisfactorily manner, both digital forensic experts and legal professionals need to understand the scope, the potential and the limitations of these instruments from the viewpoint of their respective side, thus creating a shared understanding on which interdisciplinary collaboration can prosper and which is often lacking in practice. We address this challenge by formulating the creation of a common understanding as a problem of usability. Inspired by usable security approaches, we argue that applying usability to digital forensics in criminal proceedings can bridge the gap between the digital forensics and the legal domain by considering human, organizational, and technical factors.

Covert channels, such as the timing behavior of a process or the lowest order bit in a network protocol nonce, can be used to exchange information in a stealthy manner. Storage covert channels are a class of covert channels that modulate data onto unused or redundant protocol fields of existing network communication. Because of this restriction, but also because of the ubiquity of encrypted communication, such channels usually suffer from severe bandwidth limitations. We propose a novel storage-based covert channel that enables the transmission of data inside encrypted network traffic, thus both drastically increasing bandwidth and stealth. In contrast to prior work, we assume the availability of encryption keys on the sender side, a condition usually met by strong attackers applying key extraction from memory. In this way, we are able to embed information into encrypted network traffic, experimentally increasing covert bandwidth by a factor of 11. We demonstrate the practical feasibility of our approach targeting the Android app Signal on a real-world smartphone.

We investigate the problem of Secure Multiparty Computation (SMC) in a synchronous system with Byzantine failures where processes have access to trusted hardware. While previous solutions needed a majority of well-behaving processes to solve SMC, we construct an algorithm that solves SMC for an arbitrary number of Byzantine processes. We do this by refining and combining multiple established concepts from the literature: (1) We introduce a dynamic association between processes and trusted hardware modules in the hybrid system model of Fort et al. (TrustedPals model), (2) we utilize the primitive of Uniform Reliable Broadcast for information dissemination between trusted hardware modules, and (3) we use (and slightly adapt) the concept of Sealed Computation as an abstraction of trusted hardware modules.

Geolocation data recorded by consumer electronics is usually considered very helpful in criminal investigations: Every few steps, every few seconds, the location of a suspect, victim, witness, or others can be pinpointed as it was automatically recorded in the background. Compared to the commonly used cell tower location data, device-local data from a global navigation satellite system (GNSS) has far higher precision (both spatial and temporal), but suffers from a lack of trust, because data provenance is under potential control of the user. In this article, we propose two approaches of validating and analyzing such data with high confidence. The first approach formulates and checks internal consistency criteria of GNSS data, while the second approach also takes external data sources about the surrounding environment in the form of OpenStreetMap data into account. In both approaches, we formalize the concept of a data anomaly and argue that an absence of anomalies implies more trustworthy data and thus higher evidential value. This way, the vast information contained in high-density location data may actually lead to more detailed insights instead of only increasing data noise in investigations.

Main memory contains valuable information for criminal investigations, e.g., process information or keys for disk encryption. Taking snapshots of memory is therefore common practice during a digital forensic examination. Inconsistencies in such memory dumps can, however, hamper their analysis. In this article, we perform a systematic assessment of causal inconsistencies in memory dumps taken on a Windows 10 machine using the kernel-level acquisition tool WinPmem. We use two approaches to measure the quantity of inconsistencies in Windows 10: (1) causal inconsistencies within self-injected memory data structures using a known methodology transferred from the Linux operating system, and (2) inconsistencies in the memory management data structures of the Windows kernel using a novel measurement technique based on properties of the virtual address descriptor (VAD) tree. Our evaluation is based on a dataset of more than 180 memory dumps. As a central result, both types of inconsistency measurement reveal that a high number of inconsistencies is the norm rather than the exception. We also correlate workload and execution time of the memory acquisition tool to the number of inconsistencies in the respective memory snapshot. By controlling these factors it is possible to (somewhat) control the level of inconsistencies in Windows memory dumps.

Modern eBike on-board computers are basically small PCs that not only offer motor control, navigation, and performance monitoring, but also store lots of sensitive user data. The Bosch Nyon series of board computers are cutting-edge devices from one of the market leaders in the eBike business, which is why they are especially interesting for forensics. Therefore, we conducted an in-depth forensic analysis of the two available Nyon models released in 2014 and 2021. On a first-generation Nyon device, Telnet access could be established by abusing a design flaw in the update procedure, which allowed the acquisition of relevant data without risking damage to the hardware. Besides the user's personal information, the data analysis revealed databases containing user activities, including timestamps and GPS coordinates. Furthermore, it was possible to forge the data on the device and transfer it to Bosch's servers to be persisted across their online service and smartphone app. On a current second-generation Nyon device, no software-based access could be obtained. For this reason, more intrusive hardware-based options were considered, and the data could be extracted via chip-off eventually. Despite encryption, the user data could be accessed and evaluated. Besides location and user information, the newer model holds even more forensically relevant data, such as nearby Bluetooth devices.

Due to legal and privacy-related restrictions, the generation of synthetic data is recommended for creating datasets for digital forensic education and training. One challenge when synthesizing scenario-based forensic data is the creation of coherent background activity besides evidential actions. This work leverages the creative writing abilities of large language models (LLMs) to generate personas and actions that describe the background usage of a device consistent with the created persona. These actions are subsequently converted into a machine-readable format and executed on a virtualized device using VM control automation. We introduce Re-imagen, a framework that combines state-of-the-art LLMs and a recent unintrusive GUI automation tool to produce synthetic disk images that contain arguably coherent “wear-and-tear” artifacts that current synthesis platforms lack. While, for now, the focus is on the coherence of the generated background activity, we believe that the proposed approach is a step toward more realistic synthetic disk image generation.

The rise of end-to-end encryption has enabled end-users to protect their data to a point that classical techniques of lawful access (seizure of devices, wiretaps) are futile. While there is a heated discussion about regulating the access primitive to end-user devices for law enforcement, little attention is given to the technical design of how evidence should be collected. This is especially critical during remote surveillance, as law enforcement may have unrestricted access to end-user devices over longer periods of time. In this paper, we propose the novel category of key extraction-based lawful interception (KEX-LI), meaning that instead of directly accessing plaintext data, law enforcement only extracts the necessary key material from end-user devices, thus minimizing the requirements of data extraction on end-user devices. When subsequently collecting encrypted data (e.g., via wiretapping), law enforcement can use these keys for decryption. We structure and survey the state-of-the-art of key extraction techniques, thus embedding KEX-LI in the broader context of device forensics. Furthermore, we describe specific requirements for a practical solution to conduct KEX-LI and evaluate currently available technical implementations. Our results are intended to help practitioners select the most suitable techniques as well as to identify research gaps.

Data remanence in the physical memory of computers, i.e., the fact that data remains temporarily in memory even after power is cut, is a well-known issue which can be exploited for recovering cryptographic keys and other data in forensic investigations. Since virtual machines in many aspects mimic their physical counterparts, we investigate whether data remanence is also observable in virtual machines. Using KVM as an example of virtualization technology, we experimentally show that it is common for a substantial amount of volatile data to remain in the memory of virtual machines after a reboot. In digital forensic analysis scenarios such as malware analysis using virtual machines, our observations imply high risks of evidence contamination if no precautions are taken. So while the symptoms of data remanence in virtual machines are similar to physical machines, the implications for digital forensic analysis appear very different.

Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads).

Due to the increasing security standards of modern smartphones, forensic data acquisition from such devices is a growing challenge. One rather generic way to access data on smartphones in practice is to use the local backup mechanism offered by the mobile operating systems. We study the suitability of such mechanisms for forensic data acquisition by performing a thorough evaluation of iOS's and Android's local backup mechanisms on two mobile devices. Based on a systematic and generic evaluation procedure comparing the contents of local backup to the original storage, we show that in our exemplary practical evaluations, in most cases (but not all) local backup actually yields a correct copy of the original data from storage. Our study also highlights corner cases, such as database files with pending changes, that need to be considered when assessing the integrity and authenticity of evidence acquired through local backup.

To break end-to-end encryption used by apps (e.g., messengers) today, attackers must obtain code execution directly on an end device to access data before it is encrypted, resulting in Man-At-The-End (MATE) attacks. The effectiveness of such attacks rises with the privilege level the code is executed on, e.g., the system or hypervisor level employing techniques such as virtual machine introspection (VMI). Another option to perform MATE attacks is to place software in trusted execution environments (TEEs), as on many platforms, these have the highest privilege while also providing security guarantees. However, unlike hypervisors, TEEs were primarily built to achieve isolation and not introspection. For this reason, TEEs usually lack technical means like hardware breakpoints, apparently limiting the possibilities of fine-grained system monitoring. By presenting IlluminaTEE, a sophisticated TEE-based introspection tool, we show that TEE-based introspection is as powerful as VMI. By applying a novel technique which we call state-change trapping, we show that IlluminaTEE can extract highly ephemeral personal data from arbitrary applications. We implement IlluminaTEE as an extension to the TEE firmware of real hardware with a stock version of Android and demonstrate that we can extract the encryption keys of the Signal messenger, one of the most highly ephemeral and privacy-critical bits of data existing on personal devices today. This highlights the need to implement better software protection mechanisms to mitigate the risks of powerful MATE attackers.

Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical “flat” timeline is thereby extended into a “rich” partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.

Fitness trackers, smart watches, wearables and everything in between have evolved from being highly specialized sports technology and cyber gadgets of early adopters into being similarly ubiquitous devices like smartphones. Unsurprisingly, the data collected by these devices has entered the scope of forensic investigations, providing user-centered and extensive measurements that may prove very valuable as complementary or perhaps even essential evidence in criminal cases. While there exists a body of work focused on the analysis of data from individual devices, the area still appears fragmented. To counter this, we provide a definition and taxonomy of fitness trackers and integrate existing work into a universal model for forensic analysis of such devices that also takes legal requirements into account.

Remote forensic investigations, i.e., the covert lawful infiltration of computing devices, are a generic method to acquire evidence in the presence of strong defensive security. A precondition for such investigations is the ability to execute software with sufficient privileges on target devices. The standard way to achieve such remote access is by exploiting yet unpatched software vulnerabilities. This in turn puts other users at risk, resulting in a dilemma for state authorities that aim to protect the general public (by patching such vulnerabilities) and those that need remote access in criminal investigations. As a partial solution, we present a framework that enables privileged remote forensic access without using privileged exploits. The idea is to separate the remote forensic software into two parts: a Forensic Software, designed by law enforcement agencies to execute investigative actions, and a (privileged) Control Software, provided by the device vendor to selectively grant privileges to the Forensic Software based on a court warrant within the rules of criminal procedure. By leveraging trusted execution environments for running the Control Software in a tamper-proof manner, we enable trustful deployment and operation of remote forensic software. We provide a proof-of-concept implementation of InvesTEE that is based on ARMv8-A TrustZone.

Modern vehicles such as cars, trucks and motorcycles contain an increasing number of embedded computers that continuously exchange telemetry data like current mileage, tire pressure, expected range and geolocation to the manufacturer's cloud. Vehicle owners can access this data via Vehicle Assistant Apps (VAA). Naturally, this data is of increasing interest to law enforcement in criminal investigations. While manufacturers must comply with local laws requiring them to hand over the data of suspects upon the issuance of a warrant, this process can be time-consuming and cause an additional delay in a case. Making use of novel API-based access methods in cloud forensic investigations, we present a method to get permanent access to a vehicle's cloud data by directly accessing cloud servers given suspects' credentials. We analysed a set of 23 different VAAs and pointed out the potentially accessible data categories. With our proof of concept tool gta.py in combination with six provided vehicles from BMW, Dacia, Ford, Hyundai, Mercedes and Tesla, we verified the accessibility of the data categories. Our findings demonstrate that the API-based forensic acquisition and analysis of vehicle cloud data provides important insights to be considered in future digital forensic investigations of vehicles.

Unmanned Aerial Vehicles (also known as drones) are an increasingly important source of forensic evidence, especially for commercial drones offered by the market leader DJI. The forensic analysis of this type of evidence, however, is still in its infancy. We present the design and implementation of an open-source tool that supports the visualization and analysis of log data acquired in the DATv3 format, which is the standard log format used by DJI. In our evaluation we not only show the usefulness of the interactive visualization of our tool, but also give an empirical overview over the log message types and other artefacts that can be used for anomaly and manipulation detection, an extensible feature also offered by our tool.