Journal of Digital Forensics, Security and Law

Data carving is a technique used in data recovery to isolate and extract files based on file content without any file system guidance. It is an important part of data recovery and digital forensics, but it is also useful in teaching computer science students about file structure and binary encoding of information especially within a digital forensics program. This work demonstrates how the authors teach data carving using a real world problem they encounter in digital forensics evidence processing involving the extracting of text messages from unstructured small device binary extractions. The authors have used this problem for instruction in digital forensics courses and in other computer science courses.

Gary Cantrell

The journal of digital forensics, security and law

Teaching Data Carving Using The Real World Problem of Text Message Extraction From Unstructured Mobile Device Data Dumps

使用从非结构化移动设备数据转储中提取短信的真实世界问题进行数据雕刻教学

When an application is uninstalled from a computer system, the application’s deleted file contents are overwritten over time, depending on factors such as operating system, available unallocated disk space, user activity, etc. As this content decays, the ability to infer the application’s prior presence, based on the remaining digital artifacts, becomes more difficult. Prior research inferring previously installed applications by matching sectors from a hard disk of interest to a previously constructed catalog of labeled sector hashes showed promising results. This prior work used a white list approach to identify relevant artifacts, resulting in no irrelevant artifacts but incurring the loss of some potentially useful artifacts. In this current work, we collect a more complete set of relevant artifacts by adapting the sequential snapshot file differencing method to identify and eliminate from the catalog file-system changes which are not due to application installation and use. The key contribution of our work is the building of a more complete catalog which ultimately results in more accurate prior application inference.

Oluwaseun Adegbehingbe

James Jones

Improved Decay Tolerant Inference of Previously Uninstalled Computer Applications

改进的已卸载计算机应用程序的衰减容忍推理

The current state of digital forensic investigation is continuously challenged by the rapid technological changes, the increase in the use of digital devices (both the heterogeneity and the count), and the sheer volume of data that these devices could contain. Although data privacy protection is not a performance measure, however, preventing privacy violations during the digital forensic investigation, is also a big challenge. With a perception that the completeness of investigation and the data privacy preservation are incompatible with each other, the researchers have provided solutions to address the above-stated challenges that either focus on the effectiveness of the investigation process or the data privacy preservation. However, a comprehensive approach that preserves data privacy without affecting the capabilities of the investigator or the overall efficiency of the investigation process is still an open problem. In the current work, the authors have proposed a digital forensic framework that uses case information, case profile data and expert knowledge for automation of the digital forensic analysis process; utilizes machine learning for finding most relevant pieces of evidence; and maintains data privacy of non-evidential private files. All these operations are coordinated in a way that the overall efficiency of the digital forensic investigation process increases while the integrity and admissibility of the evidence remain intact. The framework improves validation which boosts transparency in the investigation process. The framework also achieves a higher level of accountability by securely logging the investigation steps. As the proposed solution introduces notable enhancements to the current investigative practices more like the next version of Digital Forensics, the authors have named the framework `Digital Forensics 2.0', or `DF 2.0' in short.

Robin Verma

Jayaprakash Govindaraj

Saheb Chhabra

Gaurav Gupta

DF 2.0: An Automated, Privacy Preserving, and Efficient Digital Forensic Framework That Leverages Machine Learning for Evidence Prediction and Privacy Evaluation

DF 2.0：一种自动化、隐私保护且高效的数字取证框架，利用机器学习进行证据预测和隐私评估

Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.

John Minor

Forensic Cell Site Analysis: Mobile Network Operator Evidence Integrity Maintenance Research

法医基站分析：移动网络运营商证据完整性维护研究

Forensic accounting has been a fast-growing niche area within the accounting field for many years. While there has been dramatic growth in the number of courses and degrees in forensic accounting offered by universities, certain relevant topics receive little coverage, such as computer forensics. The purpose of this paper is to examine the views of accounting academics and practitioners pertaining to integrating computer forensics in the accounting curriculum, as well as to determine which forensic accounting certifications the respondents hold. Differences in opinions between the two groups are discussed, along with recommendations on how to improve the forensic accounting curriculum pertaining to computer forensics education.

Michael Seda

Bonita Kramer

D. Crumbley

An Examination of Computer Forensics and Related Certifications In The Accounting Curriculum

会计课程中计算机取证及相关认证的考察

Since the past few years, the complexity and heterogeneity of digital crimes has increased exponentially, which has made the digital evidence & digital forensics paramount for both criminal investigation and civil litigation cases. Some of the routine digital forensic analysis tasks are cumbersome and can increase the number of pending cases especially when there is a shortage of domain experts. While the work is not very complex, the sheer scale can be taxing. With the current scenarios and future predictions, crimes are only going to become more complex and the precedent of collecting and examining digital evidence is only going to increase. In this research, we propose an ML based Digital Forensics Software for Triage Analysis called Synthetic Forensic Omnituens (SynFO) that can automate evidence acquisition, extraction of relevant files, perform automated triage analysis and generate a basic report for the analyst. Results of this research show a promising future for automation with the help of Machine Learning.

Gaurav Gogia

Parag H Rughani

AN ML BASED DIGITAL FORENSICS SOFTWARE FOR TRIAGE ANALYSIS THROUGH FACE RECOGNITION

基于机器学习的面部识别数字取证软件用于快速分析

This study was carried out intending to identify the level and type of information that remained on portable devices that were purchased from the second-hand market in the UK over the last few years. The sample for this study consisted of 100 second hand mobile phones and tablets. The aim of the study was to determine the proportion of devices that still contained data and the type of data that they contained. Where data was identified, the study attempted to determine the level of personal identifiable information that is associated with the previous owner. The research showed that when sensitive and personal data was present on a mobile device, in most of the cases there had been no attempt to remove it. However, fifty two percent of the mobile devices had been reset to the factory settings or had had all of the data erased, which demonstrates the previous owner’s attempt to permanently remove personal identifiable information. Twenty eight percent of the devices that were sold were not functional or recognized by the software used in the research. Twenty percent of the devices that contained data contained data that gave away the identity of the previous owner.

Olga Angelopoulou

Andy Jones

Graeme Horsman

Seyedali Pourmoafi

A Study of the Data Remaining on Second-Hand Mobile Devices in the UK

英国二手移动设备上残留数据的研究

The boom of digital cameras, photography, and social media has drastically changed how humans live their day-to-day, but this normalization is accompanied by malicious agents finding new ways to forge and tamper with images for unlawful monetary (or other) gains. Disinformation in the photographic media realm is an urgent threat. The availability of a myriad of image editing tools renders it almost impossible to differentiate between photo-realistic and original images. The tools available for image forensics require a standard framework against which they can be evaluated. Such a standard framework can aid in evaluating the suitability of an image forensics tool for use in a criminal investigation, commercial operation, or academic research. This paper proposes an evaluation framework designed for image forensics tools based on the conformance methodology of testing that employs test assertions and test cases. It is then used to evaluate four image forensics tools namely FotoForensics, Ghiro, Imago Forensics, and Exif Reader. The comparative insight of test results produced by the framework provides a ground for ranking the tools from best to least comprehensive. The results also provide information necessary for users to make intelligent choices about tools and help vendors shortlist areas of improvement in their tools.

Zainab Khalid

Sana Qadir

An Evaluation Framework For Digital Image Forensics Tools

数字图像取证工具评估框架

An Analysis of Product Liability for AI Entities with special reference to the Consumer Protection Act, 2019

Dr. Priya Roy

Rituraj Bhowal

人工智能实体产品责任分析——特别参考2019年《消费者保护法》

At this cloud age, there is tremendous growth in business, services, resources, and cloud technology. This growth comes with a risk of unsafe, unordered, and uncertainty due to unauthorized access and theft of confidential propriety data. Our objective is to model around Read, Write and Execute to resolve these unordered, unsafe, and uncertain issues. We will develop a L-Shape pattern model matching UFS ACM to minimize the accessibilities based on RIGHT & ROLE of the resources and maximize the quality of services for safety and high availability. The preventive, detective, corrective (PDC) services are the major roles for all levels of management to coordinate, control the multiple technologies and resources which are working simultaneously. It will be more ordered, accountable, and actionable on real-time access control mechanism for scalabilities, reliability, performance, and high availability of computational services. We have to make safer, certain, unified, and step-by-step normalization by applying this UFS ACM mechanism on UNIX operating system. This proposed research paper covers a wide range of areas covering optimization, normalization, Fuzzy Low, and Risk assessment.

Abhishek Asthana

Padma Lochan Pradhan

Proposed L-Shape Pattern on UFS ACM For Risk Analysis

提出的L形模式在UFS ACM中的风险分析

短名	JDFSL
Journal Impact	0.42
国际分区	COMPUTER SCIENCE, INFORMATION SYSTEMS(Q4)

涉及主题	计算机科学操作系统计算机安全政治学法学程序设计语言万维网工程类生物数学业务心理学数字取证经济互联网隐私地理医学物理哲学历史人工智能社会学考古计算机网络
出版信息	出版商: ERAU Hunt Library - DIGITAL COMMONS JOURNALS，出版周期: ，期刊类型: journal，开源期刊: 是
基本数据	创刊年份: 2013，原创研究文献占比: 83.33%，自引率:0.00%， Gold OA占比: 0.00%
平均审稿周期	网友分享经验：10 Weeks

Journal of Digital Forensics, Security and Law

期刊引文格式

有 1 位以上作者的期刊

有 2 位作者的期刊

有 3 位作者的期刊

有 5 位以上作者的期刊

书籍引用格式

学位论文引用格式

网页引用格式

专利引用格式

手工熬夜修改参考文献？研飞自动匹配期刊，一键轻松成稿，支持 Word/WPS

投稿经验分享