Computer Law Commons^™

Measuring Inconsistency Methods For Evidentiary Value, Fred Cohen

Journal of Digital Forensics, Security and Law

Many inconsistency analysis methods may be used to detect altered records or statements. But for admission as evidence, the reliability of the method has to be determined and measured. For example, in China, for evidence to be admitted, it has to have 95% certainty of being correct,1 and that certainty must be shown to the court, while in the US, evidence is admitted if it is more probative than prejudicial (a >50% standard).2 In either case, it is necessary to provide a measurement of some sort in order to pass muster under challenges from the other side. And in most …

Technology Corner Visualising Forensic Data: Evidence (Part 1), Damian Schofield, Ken Fowle

Journal of Digital Forensics, Security and Law

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example: network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an …

How Often Is Employee Anger An Insider Risk I? Detecting And Measuring Negative Sentiment Versus Insider Risk In Digital Communications, Eric Shaw, Maria Payri, Michael Cohn, Ilene R. Shaw

Journal of Digital Forensics, Security and Law

This research introduced two new scales for the identification and measurement of negative sentiment and insider risk in communications in order to examine the unexplored relationship between these two constructs. The inter-rater reliability and criterion validity of the Scale of Negativity in Texts (SNIT) and the Scale of Insider Risk in Digital Communications (SIRDC) were established with a random sample of email from the Enron archive and criterion measures from established insiders, disgruntled employees, suicidal, depressed, angry, anxious, and other sampled groups. In addition, the sensitivity of the scales to changes over time as the risk of digital attack increased …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Technology Corner: Visualising Forensic Data: Evidence Guidelines (Part 2), Damian Schofield, Ken Fowle

Journal of Digital Forensics, Security and Law

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example, network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an …

How Often Is Employee Anger An Insider Risk Ii? Detecting And Measuring Negative Sentiment Versus Insider Risk In Digital Communications–Comparison Between Human Raters And Psycholinguistic Software, Eric Shaw, Maria Payri, Michael Cohn, Ilene R. Shaw

Journal of Digital Forensics, Security and Law

This research uses two recently introduced observer rating scales, (Shaw et al., 2013) for the identification and measurement of negative sentiment (the Scale for Negativity in Text or SNIT) and insider risk (Scale of Indicators of Risk in Digital Communication or SIRDC) in communications to test the performance of psycholinguistic software designed to detect indicators of these risk factors. The psycholinguistic software program, WarmTouch (WT), previously used for investigations, appeared to be an effective means for locating communications scored High or Medium in negative sentiment by the SNIT or High in insider risk by the SIRDC within a randomly selected …

Trends In Android Malware Detection, Kaveh Shaerpour, Ali Dehghantanha, Ramlan Mahmod

Journal of Digital Forensics, Security and Law

This paper analyzes different Android malware detection techniques from several research papers, some of these techniques are novel while others bring a new perspective to the research work done in the past. The techniques are of various kinds ranging from detection using host based frameworks and static analysis of executable to feature extraction and behavioral patterns. Each paper is reviewed extensively and the core features of each technique are highlighted and contrasted with the others. The challenges faced during the development of such techniques are also discussed along with the future prospects for Android malware detection. The findings of the …

Risk Management Of Email And Internet Use In The Workplace, John Ruhnka, Windham E. Loopesko

Journal of Digital Forensics, Security and Law

The article surveys the changing risk environment for corporations from their employees’ electronic communications. It identifies the types of liabilities that corporations can incur from such employee communications. It discusses the objectives of corporate internet use policies and the types of provisions such policies should contain. It suggests an alternative risk-based approach to corporate acceptable use policies instead of a traditional “laundry list” of internet use prohibitions.

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Analysis Of A Second Hand Google Mini Search Appliance, Stephen Larson

Journal of Digital Forensics, Security and Law

Information and the technological advancements for which mankind develops with regards to its storage has increased tremendously over the past few decades. As the total amount of data stored rapidly increases in conjunction with the amount of widely available computer-driven devices being used, solutions are being developed to better harness this data (LaTulippe, 2011). One of these solutions is commonly known as a search appliance. Search appliances have been used in e-discovery for several years. The Google Mini Search Appliance (Mini) has not only been used for e-discovery, but for indexing and searching internal documents. To accomplish these tasks, search …

System-Generated Digital Forensic Evidence In Graphic Design Applications, Enos Mabuto, Hein Venter

Journal of Digital Forensics, Security and Law

Graphic design applications are often used for the editing and design of digital art. The same applications can be used for creating counterfeit documents such as identity documents (IDs), driver’s licences, passports, etc. However, the use of any graphic design application leaves behind traces of digital information that can be used during a digital forensic investigation. Current digital forensic tools examine a system to find digital evidence, but they do not examine a system specifically for the creating of counterfeit documents created through the use of graphic design applications. The paper in hand reviews the system-generated digital forensic evidence gathered …

Book Review: Placing The Suspect Behind The Keyboard: Using Digital Forensics And Investigative Techniques To Identify Cybercrime Suspects, Thomas Nash

Journal of Digital Forensics, Security and Law

In this must read for any aspiring novice cybercrime investigator as well as the seasoned professional computer guru alike, Brett Shaver takes the reader into the ever changing and dynamic world of Cybercrime investigation. Shaver, an experienced criminal investigator, lays out the details and intricacies of a computer related crime investigation in a clear and concise manner in his new easy to read publication, Placing the Suspect behind the Keyboard. Using Digital Forensics and Investigative techniques to Identify Cybercrime Suspects. Shaver takes the reader from start to finish through each step of the investigative process in well organized …

Automating Vendor Fraud Detection In Enterprise Systems, Kishore Singh, Peter Best, Joseph Mula

Journal of Digital Forensics, Security and Law

Fraud is a multi-billion dollar industry that continues to grow annually. Many organizations are poorly prepared to prevent and detect fraud. Fraud detection strategies are intended to quickly and efficiently identify fraudulent activities that circumvent preventative measures. In this paper, we adopt a DesignScience methodological framework to develop a model for detection of vendor fraud based on analysis of patterns or signatures identified in enterprise system audit trails. The concept is demonstrated by developing prototype software. Verification of the prototype is achieved by performing a series of experiments. Validation is achieved by independent reviews from auditing practitioners. Key findings of …

Book Review: Professional Penetration Testing: Creating And Learning In A Hacking Lab 2e, Joshua Bartolomie

Journal of Digital Forensics, Security and Law

Organizations often strive for proactive information security programs in an effort to limit occurrence and impact of security breaches. However, traditional security programs run the risk of being unable to provide adequate insight and proactive awareness into real attack vectors that may exist within their organizations. With attack methods and efforts becoming increasingly aggressive, and effective, organizations must take equally assertive measures to protect their critical information and assets. Penetration testing is one of those tools that is often misunderstood, overlooked, and undervalued. A true adversary would not hesitate to exploit every potential to gain entry or cause a disruption …

Technology Corner: Calculating The Number Of Android Lock Patterns: An Unfinished Study In Number Theory, Gary C. Kessler

Journal of Digital Forensics, Security and Law

Although one is unlikely to ever want to brute-force an Android lock pattern, many do wonder about the relative strength of the lock pattern versus a multidigit personal identification number (PIN). It becomes obvious pretty quickly that there are many more lock patterns than the 10,000 possible four-digit PINs.

Science Column: Reconstruction: The Experimental Side Of Digital Forensics, Fred Cohen

Journal of Digital Forensics, Security and Law

Many in digital forensics seem to forget that the science part of digital forensics means experimentation and that implies a whole lot of things that most practitioners never learned.

Book Review: Iphone And Ios Forensic: Investigation, Analysis And Mobile Security For Apple Iphone, Ipad And Ios Devices, Simson Garfinkel

Journal of Digital Forensics, Security and Law

In April 2011 news outlets around the world revealed shocking news about Apple’s iPhone: for reasons that were not apparently clear, every iPhone contained a small SQLite database that logged where and when the user had been whenever the phone was turned on, and those records went back for pretty much as long as the user had owned their phone. Apple eventually declared that the data cache was the result of a bug and issued a software update to prune the database (it had previously grown without limit). Privacy activists rejoiced that their beloved iPhones were once again trustworthy. But …

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Identifying And Attributing Similar Traces With Greatest Common Factor Analysis, Fred Cohen

Journal of Digital Forensics, Security and Law

This paper presents an algorithm for comparing large numbers of traces to each other and identifying and presenting groups of traces with similar features. It is applied to forensic analysis in which groups of similar traces are automatically identified and presented so that attribution and other related claims may be asserted, and independently confirmed or refuted. The approach of this paper is to identify an approximate algorithm that will find a large subset of greatest common factor similar groups of arbitrary factors in far less time and space than an exact algorithm using examiner-provided selection criteria for factor definition.

Real World Computer Forensics, Jessica Riccio

Liberal Arts and Engineering Studies

No abstract provided.

Digital Evidence Education In Schools Of Law, Aaron Alva, Barbara Endicott-Popovsky

Annual ADFSL Conference on Digital Forensics, Security and Law

An examination of State of Connecticut v. Julie Amero provides insight into how a general lack of understanding of digital evidence can cause an innocent defendant to be wrongfully convicted. By contrast, the 101-page opinion in Lorraine v. Markel American Insurance Co. provides legal precedence and a detailed consideration for the admission of digital evidence. An analysis of both cases leads the authors to recommend additions to Law School curricula designed to raise the awareness of the legal community to ensure such travesties of justice, as in the Amero case, don’t occur in the future. Work underway at the University …

A Case Study Of The Challenges Of Cyber Forensics Analysis Of Digital Evidence In A Child Pornography Trial, Richard Boddington

Annual ADFSL Conference on Digital Forensics, Security and Law

Perfunctory case analysis, lack of evidence validation, and an inability or unwillingness to present understandable analysis reports adversely affect the outcome course of legal trials reliant on digital evidence. These issues have serious consequences for defendants facing heavy penalties or imprisonment yet expect their defence counsel to have clear understanding of the evidence. Poorly reasoned, validated and presented digital evidence can result in conviction of the innocent as well as acquittal of the guilty. A possession of child pornography Case Study highlights the issues that appear to plague case analysis and presentation of digital evidence relied on in these odious …

After Five Years Of E-Discovery Missteps: Sanctions Or Safe Harbor?, Milton Luoma, Vicki Luoma

Annual ADFSL Conference on Digital Forensics, Security and Law

In 2003 the Zubulake case became the catalyst of change in the world of e-discovery. In that case Judge Shira Scheindlin of the United States District Court for the Southern District of New York set guidelines for e-discovery that served as the basis for amending the Federal Rules of Civil Procedure (FRCP) in December 2006. The amendments incorporated a number of concepts that were described by Judge Scheindlin in the Zubulake case. ( Zubulake v. UBS Warburg LLC, 2003) Since the Zubulake case and the FRCP amendments, numerous cases have interpreted these rules changes, but one of the main points …

Facilitating Forensics In The Mobile Millennium Through Proactive Enterprise Security, Andrew R. Scholnick

Annual ADFSL Conference on Digital Forensics, Security and Law

This work explores the impact of the emerging mobile communication device paradigm on the security-conscious enterprise, with regard to providing insights for proactive Information Assurance and facilitation of eventual Forensic analysis. Attention is given to technology evolution in the areas of best practices, attack vectors, software and hardware performance, access and activity monitoring, and architectural models.

Keywords: Forensics, enterprise security, mobile communication, best practices, attack vectors.

Multi-Parameter Sensitivity Analysis Of A Bayesian Network From A Digital Forensic Investigation, Richard E. Overill, Echo P. Zhang, Kam-Pui Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

A multi-parameter sensitivity analysis of a Bayesian network (BN) used in the digital forensic investigation of the Yahoo! email case has been performed using the principle of ‘steepest gradient’ in the parameter space of the conditional probabilities. This procedure delivers a more reliable result for the dependence of the posterior probability of the BN on the values used to populate the conditional probability tables (CPTs) of the BN. As such, this work extends our previous studies using singleparameter sensitivity analyses of BNs, with the overall aim of more deeply understanding the indicative use of BNs within the digital forensic and …

Cloud Forensics Investigation: Tracing Infringing Sharing Of Copyrighted Content In Cloud, Yi-Jun He, Echo P. Zhang, Lucas C.K. Hui, Siu Ming Yiu, K.P. Chow

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud Computing is becoming a significant technology trend nowadays, but its abrupt rise also creates a brand new front for cybercrime investigation with various challenges. One of the challenges is to track down infringing sharing of copyrighted content in cloud. To solve this problem, we study a typical type of content sharing technologies in cloud computing, analyze the challenges that the new technologies bring to forensics, formalize a procedure to get digital evidences and obtain analytical results based on the evidences to track down illegal uploader. Furthermore, we propose a reasoning model based on the probability distribution in a Bayesian …

Ipad2 Logical Acquisition: Automated Or Manual Examination?, Somaya Ali, Sumaya Alhosani, Farah Alzarooni, Ibrahim Baggili

Annual ADFSL Conference on Digital Forensics, Security and Law

Due to their usage increase worldwide, iPads are on the path of becoming key sources of digital evidence in criminal investigations. This research investigated the logical backup acquisition and examination of the iPad2 device using the Apple iTunes backup utility while manually examining the backup data (manual examination) and automatically parsing the backup data (Lantern software - automated examination). The results indicate that a manual examination of the logical backup structure from iTunes reveals more digital evidence, especially if installed application data is required for an investigation. However, the researchers note that if a quick triage is needed of an …

A Fuzzy Hashing Approach Based On Random Sequences And Hamming Distance, Frank Breitinger, Harald Baier

Annual ADFSL Conference on Digital Forensics, Security and Law

Hash functions are well-known methods in computer science to map arbitrary large input to bit strings of a fixed length that serve as unique input identifier/fingerprints. A key property of cryptographic hash functions is that even if only one bit of the input is changed the output behaves pseudo randomly and therefore similar files cannot be identified. However, in the area of computer forensics it is also necessary to find similar files (e.g. different versions of a file), wherefore we need a similarity preserving hash function also called fuzzy hash function. In this paper we present a new approach for …

The Xbox 360 And Steganography: How Criminals And Terrorists Could Be "Going Dark", Ashley Podhradsky, Rob D’Ovidio, Cindy Casey

Annual ADFSL Conference on Digital Forensics, Security and Law

Video game consoles have evolved from single-player embedded systems with rudimentary processing and graphics capabilities to multipurpose devices that provide users with parallel functionality to contemporary desktop and laptop computers. Besides offering video games with rich graphics and multiuser network play, today's gaming consoles give users the ability to communicate via email, video and text chat; transfer pictures, videos, and file;, and surf the World-Wide-Web. These communication capabilities have, unfortunately, been exploited by people to plan and commit a variety of criminal activities. In an attempt to cover the digital tracks of these unlawful undertakings, anti-forensic techniques, such as steganography, …

Double-Compressed Jpeg Detection In A Steganalysis System, Jennifer L. Davidson, Pooja Parajape

Annual ADFSL Conference on Digital Forensics, Security and Law

The detection of hidden messages in JPEG images is a growing concern. Current detection of JPEG stego images must include detection of double compression: a JPEG image is double compressed if it has been compressed with one quality factor, uncompressed, and then re-compressed with a different quality factor. When detection of double compression is not included, erroneous detection rates are very high. The main contribution of this paper is to present an efficient double-compression detection algorithm that has relatively lower dimensionality of features and relatively lower computational time for the detection part, than current comparative classifiers. We use a model-based …