Social and Behavioral Sciences Commons^™

Forensic Artifact Finder (Forensicaf): An Approach & Tool For Leveraging Crowd-Sourced Curated Forensic Artifacts, Tyler Balon, Krikor Herlopian, Ibrahim Baggili, Cinthya Grajeda-Mendez

Electrical & Computer Engineering and Computer Science Faculty Publications

Current methods for artifact analysis and understanding depend on investigator expertise. Experienced and technically savvy examiners spend a lot of time reverse engineering applications while attempting to find crumbs they leave behind on systems. This takes away valuable time from the investigative process, and slows down forensic examination. Furthermore, when specific artifact knowledge is gained, it stays within the respective forensic units. To combat these challenges, we present ForensicAF, an approach for leveraging curated, crowd-sourced artifacts from the Artifact Genome Project (AGP). The approach has the overarching goal of uncovering forensically relevant artifacts from storage media. We explain our approach …

Forensicast: A Non-Intrusive Approach & Tool For Logical Forensic Acquisition & Analysis Of The Google Chromecast Tv, Alex Sitterer, Nicholas Dubois, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The era of traditional cable Television (TV) is swiftly coming to an end. People today subscribe to a multitude of streaming services. Smart TVs have enabled a new generation of entertainment, not only limited to constant on-demand streaming as they now offer other features such as web browsing, communication, gaming etc. These functions have recently been embedded into a small IoT device that can connect to any TV with High Definition Multimedia Interface (HDMI) input known as Google Chromecast TV. Its wide adoption makes it a treasure trove for potential digital evidence. Our work is the primary source on forensically …

Duck Hunt: Memory Forensics Of Usb Attack Platforms, Tyler Thomas, Mathew Piscitelli, Bhavik Ashok Nahar, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of the most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present two open source Volatility plugins, usbhunt and dhcphunt, which extract artifacts generated by these USB attacks from Windows 10 system memory images. Such artifacts include driver-related diagnostic events, unique device identifiers, and DHCP client logs. Our tools are capable of extracting metadata-rich Windows diagnostic events generated by any USB device. The device identifiers presented in this work may also be used to definitively detect device usage. Likewise, the DHCP logs …

Another Brick In The Wall: An Exploratory Analysis Of Digital Forensics Programs In The United States, Syria Mccullough, Stella Abudu, Ebere Onwubuariri, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present a comprehensive review of digital forensics programs offered by universities across the United States (U.S.). While numerous studies on digital forensics standards and curriculum exist, few, if any, have examined digital forensics courses offered across the nation. Since digital forensics courses vary from university to university, online course catalogs for academic institutions were evaluated to curate a dataset. Universities were selected based on online searches, similar to those that would be made by prospective students. Ninety-seven (n = 97) degree programs in the U.S. were evaluated. Overall, results showed that advanced technical courses are missing from curricula. We …

Click “Here” To Post A Comment: Legend Discussion And Transformation In Online Forums, Jeffrey S. Debies-Carl

Sociology Faculty Publications

The internet has become the predominant source of dissemination for dubious legends, ranging from medical misinformation to conspiracy theories and supernatural encounters. Building on previous work in this area, I examine contemporary legends as they are told and discussed in online forums. Drawing on Nancy Baym’s outline of the characteristics of the internet that distinguish it from other forms of communication, I analyze how the internet’s interactivity, temporal structure, social cues, storage, replicability, reach, and mobility affect the form and function of the legend process. I find that the internet subverts some of the traditional characteristics of the legend-telling process, …

Zooming Into The Pandemic! A Forensic Analysis Of The Zoom Application, Andrew Mahr, Meghan Cichon, Sophia Mateo, Cinthya Grajeda, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The global pandemic of COVID-19 has turned the spotlight on video conferencing applications like never before. In this critical time, applications such as Zoom have experienced a surge in its user base jump over the 300 million daily mark (ZoomBlog, 2020). The increase in use has led malicious actors to exploit the application, and in many cases perform Zoom Bombings. Therefore forensically examining Zoom is inevitable. Our work details the primary disk, network, and memory forensic analysis of the Zoom video conferencing application. Results demonstrate it is possible to find users' critical information in plain text and/or encrypted/encoded, such …

Memory Foreshadow: Memory Forensics Of Hardware Cryptocurrency Wallets – A Tool And Visualization Framework, Tyler Thomas, Mathew Piscitelli, Ilya Shavrov, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present Memory FORESHADOW: Memory FOREnSics of HArDware cryptOcurrency Wallets. To the best of our knowledge, this is the primary account of cryptocurrency hardware wallet client memory forensics. Our exploratory analysis revealed forensically relevant data in memory including transaction history, extended public keys, passphrases, and unique device identifiers. Data extracted with FORESHADOW can be used to associate a hardware wallet with a computer and allow an observer to deanonymize all past and future transactions due to hierarchical deterministic wallet address derivation. Additionally, our novel visualization framework enabled us to measure both the persistence and integrity of artifacts produced by the …

Exploring The Learning Efficacy Of Digital Forensics Concepts And Bagging & Tagging Of Digital Devices In Immersive Virtual Reality, Courtney Hassenfeldt, Jillian Jacques, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

This work presents the first account of evaluating learning inside a VR experience created to teach Digital Forensics (DF) concepts, and a hands-on laboratory exercise in Bagging & Tagging a crime scene with digital devices. First, we designed and developed an immersive VR experience which included a lecture and a lab. Next, we tested it with (n = 57) participants in a controlled experiment where they were randomly assigned to a VR group or a physical group. Both groups were subjected to the same lecture and lab, but one was in VR and the other was in the real world. …

Punk Legends: Cultural Representation And Ostension, Jeffrey S. Debies-Carl

Sociology Faculty Publications

This chapter analyzes two legendary images of punk that circulate prominently in popular media. Although the two images are mutually exclusive and only describe partial aspects of punk as a whole, their broad circulation and investment of audiences in either story have real-life consequences. The chapter therefore holds that researching the images of subcultures should be a central concern for subculture studies.

Investigating The Potential And Pitfalls Of Ev-Encapsulated Micrornas As Circulating Biomarkers Of Breast Cancer, Brian M. Moloney, Katie E. Gilligan, Doireann P. Joyce, Clodagh P. O'Neill, Killian P. O'Brien, Sonja Khan, Claire L. Glynn, Ronan M. Waldron, Ciarán M. Maguire, Emma Holian, Erin Naughton, Mohamed Elhadi, Andrea B. Grealish, Carmel Malone, Emma Mcdermott, Peter Dockery, Thomas Ritter, Adriele Prina-Mello, Michael J. Kerin, Róisín M. Dwyer

Forensic Science Publications

Extracellular vesicles (EVs) shuttle microRNA (miRNA) throughout the circulation and are believed to represent a fingerprint of the releasing cell. We isolated and characterized serum EVs of breast tumour-bearing animals, breast cancer (BC) patients, and healthy controls. EVs were characterized using transmission electron microscopy (TEM), protein quantification, western blotting, and nanoparticle tracking analysis (NTA). Absolute quantitative (AQ)-PCR was employed to analyse EV-miR-451a expression. Isolated EVs had the appropriate morphology and size. Patient sera contained significantly more EVs than did healthy controls. In tumour-bearing animals, a correlation between serum EV number and tumour burden was observed. There was no significant relationship …

Potential Applications Of Microrna Profiling To Forensic Investigations, Claire L. Glynn

Forensic Science Publications

Within the forensic science community, there is a continued push to develop novel tools to aid in criminal investigations. microRNA (miRNA) analysis has been the focus of many researcher’s attention in the biomedical field since its discovery in 1993; however, the forensic application of miRNA analysis has only been suggested within the last 10 years and has been gaining considerable traction recently. The primary focus of the forensic application of miRNA analysis has been on body fluid identification to provide confirmatory universal analysis of unknown biological stains obtained from crime scenes or evidence items. There are, however, other forensic applications …

Founding The Domain Of Ai Forensics, Ibrahim Baggili, Vahid Behzadan

Electrical & Computer Engineering and Computer Science Faculty Publications

With the widespread integration of AI in everyday and critical technologies, it seems inevitable to witness increasing instances of failure in AI systems. In such cases, there arises a need for technical investigations that produce legally acceptable and scientifically indisputable findings and conclusions on the causes of such failures. Inspired by the domain of cyber forensics, this paper introduces the need for the establishment of AI Forensics as a new discipline under AI safety. Furthermore, we propose a taxonomy of the subfields under this discipline, and present a discussion on the foundational challenges that lay ahead of this new research …

Haplotype Analysis For Irish Ancestry, Heather Miller Coyle, Robert Whiting

Forensic Science Publications

Forensic haplotype analysis of the male Y chromosome is currently used to establish the number of male donors in sexual assaults, the number of male bleeders in blood pattern analysis, and for ancestry correlation to genetic founder populations in biogeographic studies. In forensic laboratory applications, its primary use is for DNA profile generation with trace amounts of male DNA in the presence of excess female DNA (e.g. spermatozoa identification, male component of fingernail scrapings). Our study supports the potential use of the Y chromosome in a “dragnet” approach (most haplotypes are unique) similar to that described by Kayser in 2017 …

Reconciliation Potential Of Rwandans Convicted Of Genocide, Kevin Barnes-Ceeney, Laurie Leitch, Lior Gideon

Criminal Justice Faculty Publications

This study examines the reconciliation potential of Rwandans incarcerated for the crime of genocide. Utilising survey data from 302 male and female prisoners incar‐ cerated in the Rwandan Correctional System, this study explores genocide perpe‐ trators’ depression, anxiety, anger-hostility and somatic symptoms, levels of post‐ traumatic stress, degree of social support and attitudes towards unity and reconci‐ liation. The data demonstrate that engaging in killing can have deep psychological impacts for genocide perpetrators. The data indicate that although more than two decades have passed since the genocide, perpetrators are experiencing high levels of genocide-related posttraumatic suffering. Perpetrators are persistently re-experi‐ …

The "Great American Crime Decline": Possible Explanations, Maria Tcherni-Buzzeo

Criminal Justice Faculty Publications

This chapter examines the most important features of the crime decline in the United States during the 1990s-2010s but also takes a broader look at the violence declines of the last three centuries. The author argues that violent and property crime trends might have diverged in the 1990s, with property crimes increasingly happening in the online sphere and thus traditional property crime statistics not being reflective of the full picture. An important distinction is made between ‘contact crimes’ and crimes that do not require a victim and offender to be present in the same physical space. Contrary to the uncertainties …

Map My Murder: A Digital Forensic Study Of Mobile Health And Fitness Applications, Courtney Hassenfeldt, Shabana Baig, Ibrahim Baggili, Xiaolu Zhang

Electrical & Computer Engineering and Computer Science Faculty Publications

The ongoing popularity of health and fitness applications catalyzes

the need for exploring forensic artifacts produced by them. Sensitive

Personal Identifiable Information (PII) is requested by the applications

during account creation. Augmenting that with ongoing

user activities, such as the user’s walking paths, could potentially

create exculpatory or inculpatory digital evidence. We conducted

extensive manual analysis and explored forensic artifacts produced

by (n = 13) popular Android mobile health and fitness applications.

We also developed and implemented a tool that aided in the timely

acquisition and identification of artifacts from the examined applications.

Additionally, our work explored the type of …

Iot Ignorance Is Digital Forensics Research Bliss: A Survey To Understand Iot Forensics Definitions, Challenges And Future Research Directions, Tina Wu, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Interactions with IoT devices generates vast amounts of personal data that can be used as a source of evidence in digital investigations. Currently, there are many challenges in IoT forensics such as the difficulty in acquiring and analysing IoT data/devices and the lack IoT forensic tools. Besides technical challenges, there are many concepts in IoT forensics that have yet to be explored such as definitions, experience and capability in the analysis of IoT data/devices and current/future challenges. A deeper understanding of these various concepts will help progress the field. To achieve this goal, we conducted a survey which received 70 …

”Cyberworld” As A Theme For A University-Wide First-Year Common Course, Kristen Przyborski, Frank Breitinger, Lauren Beck, Ronald S. Harichandran

Engineering and Applied Science Education Faculty Publications

Nowadays we all live in a cyber world and use the internet for emailing, banking, streaming video, shopping, reading news, or other activities. Given all the time people spend online, it is important that all students (regardless of their major) learn some basics about living in a cyber world, e.g., strategies for online safety, impact of artificial intelligence, digital forensics or ancestry.com. To facilitate students from many majors to learn about important issues related to the internet, eight faculty from a variety of disciplines at the University of New Haven integrated the theme of Cyber World into our team-taught, first-year …

Recovery After Genocide: Understanding The Dimensions Of Recovery Capital Among Incarcerated Genocide Perpetrators In Rwanda, Kevin Barnes-Ceeney, Lior Gideon, Laurie Leitch, Kento Yasuhara

Criminal Justice Faculty Publications

Utilizing survey data from 302 men and women incarcerated in the Rwandan correctional system for the crime of genocide, and structured interviews with 75 prisoners, this mixed methods study draws on the concept of recovery capital to understand how individuals convicted of genocide navigate post-genocide healing. Genocide smashes physical and human capital and perverts social and cultural capital. Experiencing high levels of posttraumatic stress symptoms with more than two-thirds of the sample scoring above typical civilian cut-off levels, raised levels of depression, and high levels of anxiety, and failing physical health, the genocide perpetrators require multiple sources of recovery capital …

On Efficiency Of Artifact Lookup Strategies In Digital Forensics, Lorenz Liebler, Patrick Schmitt, Harald Baier, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In recent years different strategies have been proposed to handle the problem of ever-growing digital forensic databases. One concept to deal with this data overload is data reduction, which essentially means to separate the wheat from the chaff, e.g., to filter in forensically relevant data. A prominent technique in the context of data reduction are hash-based solutions. Data reduction is achieved because hash values (of possibly large data input) are much smaller than the original input. Today's approaches of storing hash-based data fragments reach from large scale multithreaded databases to simple Bloom filter representations. One main focus was put on …

Immersive Virtual Reality Attacks And The Human Joystick, Peter Casey, Ibrahim Baggili, Ananya Yarramreddy

Electrical & Computer Engineering and Computer Science Faculty Publications

This is one of the first accounts for the security analysis of consumer immersive Virtual Reality (VR) systems. This work breaks new ground, coins new terms, and constructs proof of concept implementations of attacks related to immersive VR. Our work used the two most widely adopted immersive VR systems, the HTC Vive, and the Oculus Rift. More specifically, we were able to create attacks that can potentially disorient users, turn their Head Mounted Display (HMD) camera on without their knowledge, overlay images in their field of vision, and modify VR environmental factors that force them into hitting physical objects and …

Framing And Immigration Through The Trump Era, Rudy Alamillo, Chris Haynes, Raul Madrid

Political Science Faculty Publications

For the last decade, undocumented or illegal immigration has been one of the most contested policy issues in the United States, with significant news attention on policies affecting the undocumented population, ranging from deportations to comprehensive immigration reform, the DREAM Act, and Deferred Action for Childhood Arrivals. Despite these prominent and multifaceted policy debates, scholarship on media framing and public opinion remain more focused on the portrayal of immigrants rather than policies affecting them. In general, we find that policy frames are far more consequential to public opinion than equivalency frames (variations in how news media describe unauthorized immigrants, either …

Polls And Elections: Is Loyalty A Powerful Thing? Republican Senate Campaign Strategy And Trump Coattails In The 2016 Election, Neilan S. Chaturvedi, Chris Haynes

Political Science Faculty Publications

Presidential candidates provide a boost to their congressional candidate counterparts, in which congressional candidates should ride the proverbial coattails into office (Campbell and Sumners 1990; Stewart 1989). The 2016 election, however, provides an instance in which the presidential coattails were less than desirable. In this article, we argue that state politics determines the optimal strategy for how candidates should position themselves vis‐à‐vis a controversial presidential candidate. Based on our findings, voters rewarded candidates at varying levels for distancing themselves from then candidate Trump. Specifically, the disloyal strategy, in which candidates completely disavowed Trump, worked best in swing states and among …

Frameup: An Incriminatory Attack On Storj: A Peer To Peer Blockchain Enabled Distributed Storage System, Xiaolu Zhang, Justin Grannis, Ibrahim Baggili, Nicole Lang Beebe

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we present a primary account of frameup, an incriminatory attack made possible because of existing implementations in distributed peer to peer storage. The frameup attack shows that an adversary has the ability to store unencrypted data on the hard drives of people renting out their hard drive space. This is important to forensic examiners as it opens the door for possibly framing an innocent victim. Our work employs Storj as an example technology, due to its popularity and market size. Storj is a blockchain enabled system that allows people to rent out their hard drive space …

The Potential Interference Of Body Products And Substrates To The Identification Of Ignitable Liquid Residues On Worn Clothing, Gina Guerrera, Erika Chen, Robert Powers, Brooke Weinger Kammrath

Forensic Science Publications

The question of whether deposits on clothing as well as their chemical composition are being mistaken for ignitable fluids is a concern for forensic analysts. Body products and oil secretions can have similar chemical profiles to ignitable liquid residues (ILRs) as a result of comparable chemical compounds that may be found in both sources. This study investigated whether substrates of unworn and worn clothing, with endogenous body secretions and body products could interfere with ILR analysis. Sample extraction was completed by passive headspace concentration with activated charcoal strips (ACS) and desorption with carbon disulfide followed by analysis with gas chromatography-mass …

A Practitioner Survey Exploring The Value Of Forensic Tools, Ai, Filtering, & Safer Presentation For Investigating Child Sexual Abuse Material, Laura Sanchez, Cinthya Grajeda, Ibrahim Baggili, Cory Hall

Electrical & Computer Engineering and Computer Science Faculty Publications

For those investigating cases of Child Sexual Abuse Material (CSAM), there is the potential harm of experiencing trauma after illicit content exposure over a period of time. Research has shown that those working on such cases can experience psychological distress. As a result, there has been a greater effort to create and implement technologies that reduce exposure to CSAM. However, not much work has explored gathering insight regarding the functionality, effectiveness, accuracy, and importance of digital forensic tools and data science technologies from practitioners who use them. This study focused specifically on examining the value practitioners give to the tools …

Evaluating Project Safe Neighborhoods In Connecticut: A Youth Opportunity Initiative, Sara A. Jeffries, David Myers, Jonathan A. Kringen, Ron Schack

Criminal Justice Faculty Publications

Despite containing numerous wealthy geographic areas, the state of Connecticut continues to struggle with social and economic distress, along with gun-related crime. Problem analysis in urban areas revealed a critical need for services aimed at deterring violent and gun-related crime in two target populations: serious juvenile offenders, aged 14–17 years, and at-risk youth, aged 11–13 years. Using a quasi-experimental design, this study aimed to evaluate the effect of Project Safe Neighborhoods (PSN) on youth in two cities in Connecticut. Implementation resulted in 133 young people receiving a variety of services in New Haven and Bridgeport. Evaluation research assessed intervention efforts …

Inception: Virtual Space In Memory Space In Real Space, Peter Casey, Rebecca Lindsay-Decusati, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional “dead” analysis. Following the trend of antiforensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable …

I Know What You Did Last Summer: Your Smart Home Internet Of Things And Your Iphone Forensically Ratting You Out, Gokila Dorai, Shiva Houshmand, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The adoption of smart home Internet of Things (IoT) devices continues to grow. What if your devices can snitch on you and let us know where you are at any given point in time? In this work we examined the forensic artifacts produced by Nest devices, and in specific, we examined the logical backup structure of an iPhone used to control a Nest thermostat, Nest Indoor Camera and a Nest Outdoor Camera. We also integrated the Google Home Mini as another method of controlling the studied Smart Home devices. Our work is the primary account for the examination of Nest …

Digital Forensics In The Next Five Years, Laoise Luciano, Ibrahim Baggili, Mateusz Topor, Peter Casey, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. This paper presents data that was obtained during the National Workshop on Redefining Cyber Forensics (NWRCF) on May 23-24, 2017 supported by the National Science Foundation and organized by the University of New Haven. Qualitative and quantitative data were analyzed from twenty-four cyber forensics expert panel members. This work identified important themes that need to be addressed by the community, focusing on (1) where the domain currently is; (2) where it needs to go and; (3) steps needed to improve it. Furthermore, based on the …