Computer Engineering Commons^™

Relating Admissibility Standards For Digital Evidence To Attack Scenario Reconstruction, Changwei Liu, Anoop Singhal, Duminda Wijesekera

Journal of Digital Forensics, Security and Law

Attackers tend to use complex techniques such as combining multi-step, multi-stage attack with anti-forensic tools to make it difficult to find incriminating evidence and reconstruct attack scenarios that can stand up to the expected level of evidence admissibility in a court of law. As a solution, we propose to integrate the legal aspects of evidence correlation into a Prolog based reasoner to address the admissibility requirements by creating most probable attack scenarios that satisfy admissibility standards for substantiating evidence. Using a prototype implementation, we show how evidence extracted by using forensic tools can be integrated with legal reasoning to reconstruct …

Audit: Automated Disk Investigation Toolkit, Umit Karabiyik, Sudhir Aggarwal

Journal of Digital Forensics, Security and Law

Software tools designed for disk analysis play a critical role today in forensics investigations. However, these digital forensics tools are often difficult to use, usually task specific, and generally require professionally trained users with IT backgrounds. The relevant tools are also often open source requiring additional technical knowledge and proper configuration. This makes it difficult for investigators without some computer science background to easily conduct the needed disk analysis. In this paper, we present AUDIT, a novel automated disk investigation toolkit that supports investigations conducted by non-expert (in IT and disk technology) and expert investigators. Our proof of concept design …

Evidentiary Power And Propriety Of Digital Identifiers And The Impact On Privacy Rights In The United States, Michael Losavio, Deborah Keeling

Journal of Digital Forensics, Security and Law

Media and network systems capture and store data about electronic activity in new, sometimes unprecedented ways; computational systems make for new means of analysis and knowledge development. These new forms offer new, powerful tactical tools for investigations of electronic malfeasance under traditional legal regulation of state power, particular that of Fourth Amendment limitations on police searches and seizures under the U.S. Constitution. But autonomy, identity and authenticity concerns with electronic data raise issues of public policy, privacy and proper police oversight of civil society. We examine those issues and their implications for digital and computational forensics

Effects Of The Factory Reset On Mobile Devices, Riqui Schwamm, Neil C. Rowe

Journal of Digital Forensics, Security and Law

Mobile devices usually provide a “factory-reset” tool to erase user-specific data from the main secondary storage. 9 Apple iPhones, 10 Android devices, and 2 BlackBerry devices were tested in the first systematic evaluation of the effectiveness of factory resets. Tests used the Cellebrite UME-36 Pro with the UFED Physical Analyzer, the Bulk Extractor open-source tool, and our own programs for extracting metadata, classifying file paths, and comparing them between images. Two phones were subjected to more detailed analysis. Results showed that many kinds of data were removed by the resets, but much user-specific configuration data was left. Android devices did …

Testing Framework For Mobile Device Forensics Tools, Maxwell Anobah, Shahzad Saleem, Oliver Popov

Journal of Digital Forensics, Security and Law

The proliferation of mobile communication and computing devices, in particular smart mobile phones, is almost paralleled with the increasing number of mobile device forensics tools in the market. Each mobile forensics tool vendor, on one hand claims to have a tool that is best in terms of performance, while on the other hand each tool vendor seems to be using different standards for testing their tools and thereby defining what support means differently. To overcome this problem, a testing framework based on a series of tests ranging from basic forensics tasks such as file system reconstruction up to more complex …

Technical Soddi Defenses: The Trojan Horse Defense Revisited, Chad M. Steel

Journal of Digital Forensics, Security and Law

In 2004, the Trojan horse defense was at a crossroads, having been successfully employed in two child pornography cases in the United Kingdom, resulting in acquittals. Despite the early successes, the Trojan horse defense has failed to become a regularly employed strategy. The original Trojan horse defense has now become part of the more general technical SODDI (Some Other Dude Did It) defense, which includes the possibility of unknown actors using unsecured Wi-Fi connections or having physical access to a computer to perform criminal acts. In the past ten years, it has not been effective in the United States for …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

A State-Of-The-Art Review Of Cloud Forensics, Sameera Almulla, Youssef Iraqi, Andrew Jones

Journal of Digital Forensics, Security and Law

Cloud computing and digital forensics are emerging fields of technology. Unlike traditional digital forensics where the target environment can be almost completely isolated, acquired and can be under the investigators control; in cloud environments, the distribution of computation and storage poses unique and complex challenges to the investigators. Recently, the term “cloud forensics” has an increasing presence in the field of digital forensics. In this state-of-the-art review, we included the most recent research efforts that used “cloud forensics” as a keyword and then classify the literature into three dimensions: (1) survey-based, (2) technology-based and (3) forensics-procedural-based. We discuss widely accepted …

Understanding Computer Forensics Requirements In China Via The “Panda Burning Incense” Virus Case, Frank Law, K. P. Chow, Y. H. Mai

Journal of Digital Forensics, Security and Law

In March 2012, Mainland China has amended its Criminal Procedure Law, which includes the introduction of a new type of evidence, i.e., digital evidence, to the court of law. To better understand the development of computer forensics and digital evidence in Mainland China, this paper discusses the Chinese legal system in relation to digital investigation and how the current legal requirements affect the existing legal and technical usage of digital evidence at legal proceedings. Through studying the famous “Panda Burning Incense (Worm.WhBoy.cw)” virus case that happened in 2007, this paper aims to provide a better understanding of how to properly …

Forensics Of Software Copyright Infringement Crimes: The Modern Posar Test Juxtaposed With The Dated Afc Test, Vinod P. Bhattathiripad

Journal of Digital Forensics, Security and Law

This paper presents a new development in the forensics of software copyright through a juxtaposed comparison between the proven AFC test and the recent POSAR test, the two forensic procedures for establishing software copyright infringement cases. First, the paper separately overviews the 3-stage, linear sequential AFC test and then the 5-phase, cyclic POSAR test (as AFC’s logical extension). The paper then compares the processes involved in each of the 5 phases of the POSAR test with the processes involved in the 3 stages in the AFC test, for the benefit of forensic practitioners and researchers. Finally, the paper discusses some …

Fighting Child Pornography: A Review Of Legal And Technological Developments, Jasmine V. Eggestein, Kenneth J. Knapp

Journal of Digital Forensics, Security and Law

In our digitally connected world, the law is arguably behind the technological developments of the Internet age. While this causes many issues for law enforcement, it is of particular concern in the area of child pornography in the United States. With the wide availability of technologies such as digital cameras, peer-to-peer file sharing, strong encryption, Internet anonymizers and cloud computing, the creation and distribution of child pornography has become more widespread. Simultaneously, fighting the growth of this crime has become more difficult. This paper explores the development of both the legal and technological environments surrounding digital child pornography. In doing …

A Study Of Forensic Imaging In The Absence Of Write-Blockers, Gary C. Kessler, Gregory H. Carlton

Journal of Digital Forensics, Security and Law

Best practices in digital forensics demand the use of write-blockers when creating forensic images of digital media, and this has been a core tenet of computer forensics training for decades. The practice is so ingrained that the integrity of images created without a write-blocker are immediately suspect. This paper describes a research framework that compares forensic images acquired with and without utilizing write-blockers in order to understand the extent of the differences, if any, in the resultant forensic copies. We specifically address whether differences are superficial or evidentiary, and we discuss the impact of admitting evidence acquired without write blocking. …

Automated Evaluation Of Approximate Matching Algorithms On Real Data, Frank Breitinger, Vassil Roussev

Electrical & Computer Engineering and Computer Science Faculty Publications

Bytewise approximate matching is a relatively new area within digital forensics, but its importance is growing quickly as practitioners are looking for fast methods to screen and analyze the increasing amounts of data in forensic investigations. The essential idea is to complement the use of cryptographic hash functions to detect data objects with bytewise identical representation with the capability to find objects with bytewise similarrepresentations.

Unlike cryptographic hash functions, which have been studied and tested for a long time, approximate matching ones are still in their early development stages and evaluation methodology is still evolving. Broadly, prior approaches have …

Situational Awareness/Triage Tool For Use In A Chemical, Biological, Radiological Nuclear Explosive (Cbrne) Environment, John N. Scarlett, Heather L. Gallup, David A. Smith

AFIT Patents

A method of managing patient care and emergency response following a Chemical, Biological, Radiological, or Nuclear Explosive (CBRNE) attack and maintaining compliance with the Health Insurance Portability and Accountability Act (HIPAA). The method including identifying each patient with a unique patient identifier, the identifier based upon the geospatial location of the patient, the geospatial location including at least the latitude and longitude of the patient when first treated, the unique patient identifier being part of patient data. Providing a collection point of patient data to form a patient data database where in the patient location data may be used to …

Attitudes And Behaviors In Online Communities: Empirical Studies Of The Effects Of Social, Community, And Individual Characteristics, Richard Kumi

Graduate Theses and Dissertations

Online communities and communities of practice bring people together to promote and support shared goals and exchange information. Personal interactions are important to many of these communities and one of the important outcomes of personal interactions in online communities and communities of practice is user-generated content. The three essays in the current study examines behavior motivation in online communities and communities of practice to understand how Social and personal psychological factors, and user-generated influence attitudes, intentions and behaviors in online communities.

The first essay addresses two research questions. First, how does Social capital influence exchange and combination behaviors in online …

Identifying Emerging Researchers Using Social Network Analysis, Syed Masum Billah

Graduate Theses and Dissertations

Finding rising stars in academia early in their careers has many implications when hiring new faculty, applying for promotion, and/or requesting grants. Typically, the impact and productivity of a researcher are assessed by a popular measurement called the h-index that grows linearly with the academic age of a researcher. Therefore, h-indices of researchers in the early stages of their careers are almost uniformly low, making it difficult to identify those who will, in future, emerge as influential leaders in their field. To overcome this problem, we make use of Social network analysis to identify young researchers most likely to become …

Improving Deaf Accessibility To Web-Based Multimedia, Brent N. Shiver

College of Computing and Digital Media Dissertations

Internet technologies have expanded rapidly over the past two decades, making information of all sorts more readily available. Not only are they more cost-effective than traditional media, these new media have contributed to quality and convenience. However, proliferation of video and audio media on the internet creates an inadvertent disadvantage for deaf Internet users. Despite technological and legislative milestones in recent decades in making television and movies more accessible, there has been little progress with online access. A major obstacle to providing captions for internet media is the high cost of captioning and transcribing services.

To respond to this problem, …

Social Listening For Customer Acquisition, Juan Du, Biying Tan, Feida Zhu, Ee-Peng Lim

Research Collection School Of Computing and Information Systems

Social network analysis has received much attention from corporations recently. Corporations are trying to utilize social media platforms such as Twitter, Facebook and Sina Weibo to expand their own markets. Our system is an online tool to assist these corporations to 1) find potential customers, and 2) track a list of users by specific events from social networks. We employ both textual and network information, and thus produce a keyword-based relevance score for each user in pre-defined dimensions, which indicates the probability of the adoption of a product. Based on the score and its trend, out tool is able to …

Dust To Digital: Electronic Document & Record Management For The Broome County Department Of Public Works- Engineering Divison, Scott R. Mastin

MPA Capstone Projects 2006 - 2015

The Broome County Department of Public Works- Engineering Division is currently preparing to implement an Electronic Document and Records Management System (EDRMS) to store their increasing number of digital records and to manage existing paper records as they are digitized. This study examines Division integrate electronic document and record management into their organization.

Money Laundering Detection Framework To Link The Disparate And Evolving Schemes, Murad Mehmet, Duminda Wijesekera, Miguel F. Buchholtz

Journal of Digital Forensics, Security and Law

Money launderers hide traces of their transactions with the involvement of entities that participate in sophisticated schemes. Money laundering detection requires unraveling concealed connections among multiple but seemingly unrelated human money laundering networks, ties among actors of those schemes, and amounts of funds transferred among those entities. The link among small networks, either financial or social, is the primary factor that facilitates money laundering. Hence, the analysis of relations among money laundering networks is required to present the full structure of complex schemes. We propose a framework that uses sequence matching, case-based analysis, social network analysis, and complex event processing …

Trust-But-Verify: Guaranteeing The Integrity Of User-Generated Content In Online Applications, Akshay Dua

Dissertations and Theses

Online applications that are open to participation lack reliable methods to establish the integrity of user-generated information. Users may unknowingly own compromised devices, or intentionally publish forged information. In these scenarios, applications need some way to determine the "correctness" of autonomously generated information. Towards that end, this thesis presents a "trust-but-verify" approach that enables open online applications to independently verify the information generated by each participant. In addition to enabling independent verification, our framework allows an application to verify less information from more trustworthy users and verify more information from less trustworthy ones. Thus, an application can trade-off performance for …

Using Meta-Ethnography To Synthesize Research: A Worked Example Of The Relations Between Personality On Software Team Processes, Fabio Q. B. Silva Dr., Shirley S. J. O. Cruz, Tatiana B. Gouveia, Luiz Fernando Capretz

Electrical and Computer Engineering Publications

Context: The increase in the number of qualitative and mixed-methods research published in software engineering has created an opportunity for further knowledge generation through the synthesis of studies with similar aims. This is particularly true in the research on human aspects because the phenomena of interest are often better understood using qualitative research. However, the use of qualitative synthesis methods is not widespread and worked examples of their consistent application in software engineering are needed. Objective: To explore the use of meta-ethnography in the synthesis of empirical studies in software engineering through an example using studies about the relations between …

The Mayaarch3d Project: A 3d Webgis For Analyzing Ancient Architecture And Landscapes, Jennifer Von Schwerin, Heather Richards-Rissetto, Fabio Remondino, Giorgio Agugario, Gabrio Girardi

Department of Anthropology: Faculty Publications

There is a need in the humanities for a 3D WebGIS with analytical tools that allow researchers to analyze 3D models linked to spatially referenced data. Geographic Information Systems (GIS) allow for complex spatial analysis of 2.5D data. For example, they offer bird’s eye views of landscapes with extruded building footprints, but one cannot ‘get on the ground’ and interact with true 3D models from a pedestrian perspective. Meanwhile, 3D models and virtual environments visualize data in 3D space, but analytical tools are simple rotation or lighting effects. The MayaArch3D Project is developing a 3D WebGIS—called QueryArch3D—to allow these two …

An End To End V.M.T Framework With Controlled V.M.T Tax Rate Using Optimal Feedback Control Technique, Pratik Verma

UNLV Theses, Dissertations, Professional Papers, and Capstones

Vehicle Mile Travel (VMT) is a study related to available alternatives for the road

revenue collection system. As per the demand, the existing Gas/Fuel tax based revenue

collection system is not found an appropriate option in the longer run. Due

to existing system constraints like: no eective tax process for vehicles based on alternative

fuel (e.g. electric vehicles), no eective changes in tax due to economical

ination, and more highway expenditure than generated revenue, an alternative revenue

collection mechanism is required. Hence, the objective is to study an alternative

option in detail, which can address the gaps between required revenue …

Factors Leading To Decentralization Of Ict Companies: The Case Of Multimedia Super Corridor, Malaysia, Muhammad Asim Tufail, Abu Hassan Abu Bakar, Wiwied Virgiyanti, Faisal Manzoor Arain

Business Review

Technological development in the information and communication technologies (ICT) sector is essential to attain sustainability in today’s era. Cities have developed satellite towns at the periphery with hi-fidelity digital and physical infrastructure which converts a single cantered city into a multi cantered one. In case of Kuala Lumpur Metropolitan Area (KLMA) the shift of civic services to Putrajaya and development of Multimedia Super Corridor (MSC) which offers incentives to local and foreign companies to develop a super block of research and development based economic sector. This development spearheaded the Malaysian Vision 2020 of knowledge based economy and society and has …

A Forensic Study Of The Effectiveness Of Selected Anti-Virus Products Against Ssdt Hooking Rootkits, Sami Al-Shaheri, Dale Lindskog, Pavol Zavarsky, Ron Ruhl

Annual ADFSL Conference on Digital Forensics, Security and Law

For Microsoft Windows Operating Systems, both anti-virus products and kernel rootkits often hook the System Service Dispatch Table (SSDT). This research paper investigates the interaction between these two in terms of the SSDT. To investigate these matters, we extracted digital evidence from volatile memory, and studied that evidence using the Volatility framework. Due to the diversity in detection techniques used by the anti-virus products, and the diversity of infection techniques used by rootkits, our investigation produced diverse results, results that helped us to understand several SSDT hooking strategies, and the interaction between the selected anti-virus products and the rootkit samples. …

An Ontology-Based Forensic Analysis Tool, Mohammed Alzaabi, Andy Jones, Thomas A. Martin

Annual ADFSL Conference on Digital Forensics, Security and Law

The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in …

First Glance: An Introductory Analysis Of Network Forensics Of Tor, Raymond Hansen

Annual ADFSL Conference on Digital Forensics, Security and Law

The Tor network is a low-latency overlay network for TCP flows that is designed to provide privacy and anonymity to its users. It is currently in use by many as a means to avoid censorship of both information to be shared and information to be retrieved. This paper details the architecture of the Tor network as a platform for evaluating the current state of forensic analysis of the Tor network. Specific attempts to block access to the Tor network are examined to identify (a) the processes utilized to identify Tor nodes, and (b) the resulting exposure of potentially inculpatory evidence. …

A Thematic Review Of User Compliance With Information Security Policies Literature, David Sikolia

Annual ADFSL Conference on Digital Forensics, Security and Law

The adoption of computer and internet technology has greatly improved the way businesses operate. However the risk to the confidentiality, integrity and availability of organizational data and systems has greatly increased too. Information security is an ever present concern for all organizations. Financial estimates of the impact of security breaches to information and technology resources range from hundreds of billions to over one trillion dollars each year worldwide (D'Arcy et al., 2011b). Organizations have therefore developed a combination of technical, administrative, and physical controls to reduce this risk (D'Arcy et al., 2011a). Administrative measures include the development of information security …

Journey Into Windows 8 Recovery Artifacts, W. K. Johnson

Annual ADFSL Conference on Digital Forensics, Security and Law

One of the most difficult processes of digital forensics is to understand how new technology interacts with current technology and how digital forensic analysts can utilize current Digital Forensics technologies and processes to recover and find information hidden. Microsoft has released their new operating system Windows 8, with this new release Microsoft has added some features to the operating system that will present some interesting complications to digital forensics. Since the initial release of the Windows 8 Release Candidates there have been some research released that focus primarily on the new user created artifacts and a few artifacts that have …