Forensic Science and Technology Commons^™

Analysis Of Data Erasure Capability On Sshd Drives For Data Recovery, Andrew Blyth

Annual ADFSL Conference on Digital Forensics, Security and Law

Data Protection and Computer Forensics/Anti-Forensics has now become a critical area of concern for organizations. A key element to this is how data is sanitized at end of life. In this paper we explore Hybrid Solid State Hybrid Drives (SSHD) and the impact that various Computer Forensics and Data Recovery techniques have when performing data erasure upon a SSHD.

Knowledge Expiration In Security Awareness Training, Tianjian Zhang

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Positive Identification Of Lsb Image Steganography Using Cover Image Comparisons, Michael Pelosi, Nimesh Poudel, Pratap Lamichhane, Devon Lam, Gary Kessler, Joshua Macmonagle

Annual ADFSL Conference on Digital Forensics, Security and Law

In this paper we introduce a new software concept specifically designed to allow the digital forensics professional to clearly identify and attribute instances of LSB image steganography by using the original cover image in side-by-side comparison with a suspected steganographic payload image. The “CounterSteg” software allows detailed analysis and comparison of both the original cover image and any modified image, using sophisticated bit- and color-channel visual depiction graphics. In certain cases, the steganographic software used for message transmission can be identified by the forensic analysis of LSB and other changes in the payload image. The paper demonstrates usage and typical …

Exploring The Use Of Graph Databases To Catalog Artifacts For Client Forensics, Rose Shumba

Annual ADFSL Conference on Digital Forensics, Security and Law

Cloud computing has revolutionized the methods by which digital data is stored, processed, and transmitted. It is providing users with data storage and processing services, enabling access to resources through multiple devices. Although organizations continue to embrace the advantages of flexibility and scalability offered by cloud computing, insider threats are becoming a serious concern as cited by security researchers. Insiders can use authorized access to steal sensitive information, calling for the need for an investigation. This concept paper describes research in progress towards developing a Neo4j graph database tool to enhance client forensics. The tool, with a Python interface, allows …

Precognition: Automated Digital Forensic Readiness System For Mobile Computing Devices In Enterprises, Jayaprakash Govindaraj, Robin Verma, Gaurav Gupta

Annual ADFSL Conference on Digital Forensics, Security and Law

Enterprises are facing an unprecedented risk of security incidents due to the influx of emerging technologies, like smartphones and wearables. Most of the current Mobile security systems are not maturing in pace with technological advances. They lack the ability to learn and adapt from the past knowledge base. In the case of a security incident, enterprises find themselves underprepared for the lack of evidence and data. The systems are not designed to be forensic ready. There is a need for automated security analysis and forensically ready solution, which can learn and continuously adapt to new challenges, improve efficiency and productivity …

Non-Use Of A Mobile Phone During Conducting Crime Can Also Be Evidential, Vinod Polpaya Bhattathiripad Ph D

Annual ADFSL Conference on Digital Forensics, Security and Law

Cyber-clever criminals who are aware of the consequence of using mobile phones during conducting crimes often stay away from their phones while involved in crimes. Some of them even change their handset and SIM card, subsequently. This article looks into how, intentional disassociation (and even unintentional non-use) of mobile phone in (non-cyber) crimes, can become evidential clues of the perpetrators’ involvement in criminal acts. With the help of a recent judicial episode, this article reveals how extremely careful and masterful handling of extensive and voluminous Call Details Records and tower dumps by a cyber-savvy investigating official can unearth evidential clues …

Forensic Analysis Of The Exfat Artifacts, Yves Vandermeer, An Lekhac, Tahar Kechadi, Joe Carthy

Annual ADFSL Conference on Digital Forensics, Security and Law

Although keeping some basic concepts inherited from FAT32, the exFAT file system introduces many differences, such as the new mapping scheme of directory entries. The combination of exFAT mapping scheme with the allocation of bitmap files and the use of FAT leads to new forensic possibilities. The recovery of deleted files, including fragmented ones and carving becomes more accurate compared with former forensic processes. Nowadays, the accurate and sound forensic analysis is more than ever needed, as there is a high risk of erroneous interpretation. Indeed, most of the related work in the literature on exFAT structure and forensics, is …

Live Gpu Forensics: The Process Of Recovering Video Frames From Nvidia Gpu, Yazeed M. Albabtain, Baijian Yang

Annual ADFSL Conference on Digital Forensics, Security and Law

The purpose of this research is to apply a graphics processing unit (GPU) forensics method to recover video artifacts from NVIDIA GPU. The tested video specs are 512 x 512 in resolution for video 1 and 800 x 600 in resolution for video 2. Both videos are mpeg4 video codec. A VLC player was used in the experiment. A special program has been developed using OpenCL to recover 1) patterns that are frames consist of pixel values and 2) dump data from the GPU global memory. The dump data that represent the video frame were located using simple steps. The …

Unmanned Aerial Vehicle Forensic Investigation Process: Dji Phantom 3 Drone As A Case Study, Alan Roder, Kim-Kwang Raymond Choo, Nhien-A Le-Khac

Annual ADFSL Conference on Digital Forensics, Security and Law

Drones (also known as Unmanned Aerial Vehicles – UAVs) are a potential source of evidence in a digital investigation, partly due to their increasing popularity in our society. However, existing UAV/drone forensics generally rely on conventional digital forensic investigation guidelines such as those of ACPO and NIST, which may not be entirely fit-for-purpose. In this paper, we identify the challenges associated with UAV/drone forensics. We then explore and evaluate existing forensic guidelines, in terms of their effectiveness for UAV/drone forensic investigations. Next, we present our set of guidelines for UAV/drone investigations. Finally, we demonstrate how the proposed guidelines can be …

Detection And Recovery Of Anti-Forensic (Vault) Applications On Android Devices, Michaila Duncan, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Significant number of mobile device users currently employ anti-forensics applications, also known as vault or locker applications, on their mobile devices in order to hide files such as photos. Because of this, investigators are required to spend a large portion of their time manually looking at the applications installed on the device. Currently, there is no automated method of detecting these anti-forensics applications on an Android device. This work presents the creation and testing of a vault application detection system to be used on Android devices. The main goal of this work is twofold: (i) Detecting and reporting the presence …

Automated Man-In-The-Middle Attack Against Wi‑Fi Networks, Martin Vondráček, Jan Pluskal, Ondřej Ryšavý

Journal of Digital Forensics, Security and Law

Currently used wireless communication technologies suffer security weaknesses that can be exploited allowing to eavesdrop or to spoof network communication. In this paper, we present a practical tool that can automate the attack on wireless security. The developed package called wifimitm provides functionality for the automation of MitM attacks in the wireless environment. The package combines several existing tools and attack strategies to bypass the wireless security mechanisms, such as WEP, WPA, and WPS. The presented tool can be integrated into a solution for automated penetration testing. Also, a popularization of the fact that such attacks can be easily automated …

Back Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Front Matter, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

Contents, Adfsl

Annual ADFSL Conference on Digital Forensics, Security and Law

No abstract provided.

An Overview Of The Usage Of Default Passwords, Brandon Knierem, Xiaolu Zhang, Philip Levine, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The recent Mirai botnet attack demonstrated the danger of using default passwords and showed it is still a major problem. In this study we investigated several common applications and their password policies. Specifically, we analyzed if these applications: (1) have default passwords or (2) allow the user to set a weak password (i.e., they do not properly enforce a password policy). Our study shows that default passwords are still a significant problem: 61% of applications inspected initially used a default or blank password. When changing the password, 58% allowed a blank password, 35% allowed a weak password of 1 character.

Introduction: Symposium On “Forensics, Statistics, And Law”, Brandon L. Garrett

Faculty Scholarship

No abstract provided.

Oil Dries: A New Absorbent Material For Collection Of Ignitable Liquids From Semi-Porous Material, Jessica Sosa

Online Theses and Dissertations

Extraction of an ignitable liquid sample from a semi-porous surface such as concrete is especially difficult. For this purpose, two different solid oil dry absorbent materials, Instazorb and MAXXAbsorb, were researched for use of collection of ignitable liquid samples at a fire scene. These oil dries were spiked with different ignitable liquids (Coleman fuel, gasoline, kerosene, and diesel). Isolation of the ignitable liquid from the oil dry absorbent was accomplished by passive headspace isolation. Data was obtained by gas chromatography coupled with flame ionization detection (GC-FID) and gas chromatography coupled with mass spectrometry (GC-MS). Chromatograms obtained from both oil dries …

Program And Proceedings: Nebraska Academy Of Sciences 1880–2018, 138th Anniversary Year, One Hundred-Twenty-Eighth Annual Meeting

Nebraska Academy of Sciences: Programs and Proceedings

Program

Aeronautics and Space Science

Collegiate Academy: Biology

Biological and Medical Sciences

Chemistry and Physics>/p>

Collegiate Academy: Chemistry and Physics

Learn to Print 3-D Models for Your Classroom Workshop

Aeronautics and Space Science Poster Session

Maiben Memorial Lecture: Thomas Clemente

Anthropology

Applied Science and Technology

Earth Science

Environmental Sciences

Teaching of Science and Mathematics

Friend of Science Award: Mary Kalen Romjue and Michael Sibbernsen

Qualitative And Quantitative Elemental Composition Analysis Of The Surrounding Pollen Coating Via Icp-Ms, Brandy Voyer

Electronic Theses and Dissertations

Pollen evidence has proven to be a powerful forensic tool to trace a suspect or item to a victim or a crime scene. This is possible because it is microscopic, abundant in nature, resistant to degradation and decay; it presents dispersal patterns that can be used to generate a 'fingerprint' within specific areas, and has illustrated a unique morphology that can be used to classify species. While the pollen grain morphology has been extensively used to characterize the specific species, not much has been investigated as pertains to the coating that surrounds the pollen grain aside from it being categorized …

If I Had A Million Cryptos: Cryptowallet Application Analysis And A Trojan Proof-Of-Concept, Trevor Haigh, Frank Breitinger, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

Cryptocurrencies have gained wide adoption by enthusiasts and investors. In this work, we examine seven different Android cryptowallet applications for forensic artifacts, but we also assess their security against tampering and reverse engineering. Some of the biggest benefits of cryptocurrency is its security and relative anonymity. For this reason it is vital that wallet applications share the same properties. Our work, however, indicates that this is not the case. Five of the seven applications we tested do not implement basic security measures against reverse engineering. Three of the applications stored sensitive information, like wallet private keys, insecurely and one was …

Digital Forensic Readiness In Organizations: Issues And Challenges, Nickson Menza Karie, Simon Maina Karume Dr.

Journal of Digital Forensics, Security and Law

With the evolution in digital technologies, organizations have been forced to change the way they plan, develop, and enact their information technology strategies. This is because modern digital technologies do not only present new opportunities to business organizations but also a different set of issues and challenges that need to be resolved. With the rising threats of cybercrimes, for example, which have been accelerated by the emergence of new digital technologies, many organizations as well as law enforcement agencies globally are now erecting proactive measures as a way to increase their ability to respond to security incidents as well as …

Informing Responders Using Gis And Gps, Deidre Mccarthy

CHAR

Hurricane Katrina devastated the Gulf Coast in August 2005 and created the single largest disaster for cultural resources that the United States has witnessed since the inception of the National Historic Preservation Act (NHPA) in 1966. Notably, the NHPA created the National Register of Historic Places, our nation’s catalog of important cultural resources. The NHPA also stipulates that any federal undertaking which may adversely affect National Register eligible resources be mitigated. For the Federal Emergency Management Agency (FEMA), Katrina created the largest compliance project ever under Section 106 of the NHPA.

Although causing a great deal of damage, Katrina also …

Keynote Address: Climate Change: From Global To New York Scale, Christopher D. Thorncroft

CHAR

This talk is concerned with the science and impacts of climate change from global to New York scales. It will provide an assessment of how the climate has changed over the past Century based on a purely observational perspective. The scientific basis for anthroprogenic climate change will be explained and discussed including a description of the “greenhouse effect” and why it is important for life on this planet. We will briefly discuss global and local consequences of a warmer climate and what we need to be prepared for going forward in the coming decades.

Legislative Requirements For Cyber Peacekeeping, Nikolay Akatyev, Joshua I. James

Journal of Digital Forensics, Security and Law

Cyber Peacekeeping strives for the prevention, mitigation and cessation of cyber and physical conflicts. The creation of a Cyber Peacekeeping organization, however, has major legal and political implications. In this work we review current international legislation applicable for functions of Cyber Peacekeeping. Specifically, we analyze prominent works which contribute to definitions, law and ethics regulating cyber conflicts from the perspective of the creation of a CPK organization. Legislative and terminological foundations are analyzed and adopted from current practice. Further, this work analyzes guiding principles of global organizations such as ITU IMPACT, INTERPOL and regional organizations such as NATO and the …

Forensic State Acquisition From Internet Of Things (Fsaiot): A General Framework And Practical Approach For Iot Forensics Through Iot Device State Acquisition, Christopher S. Meffert, Devon R. Clark, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

IoT device forensics is a difficult problem given that manufactured IoT devices are not standardized, many store little to no historical data, and are always connected; making them extremely volatile. The goal of this paper was to address these challenges by presenting a primary account for a general framework and practical approach we term Forensic State Acquisition from Internet of Things (FSAIoT). We argue that by leveraging the acquisition of the state of IoT devices (e.g. if an IoT lock is open or locked), it becomes possible to paint a clear picture of events that have occurred. To this end, …

Breaking Into The Vault: Privacy, Security And Forensic Analysis Of Android Vault Applications, Xiaolu Zhang, Ibrahim Baggili, Frank Breitinger

Electrical & Computer Engineering and Computer Science Faculty Publications

In this work we share the first account for the forensic analysis, security and privacy of Android vault applications. Vaults are designed to be privacy enhancing as they allow users to hide personal data but may also be misused to hide incriminating files. Our work has already helped law enforcement in the state of Connecticut to reconstruct 66 incriminating images and 18 videos in a single criminal case. We present case studies and results from analyzing 18 Android vault applications (accounting for nearly 220 million downloads from the Google Play store) by reverse engineering them and examining the forensic artifacts …

Digital Anti-Forensics: An Implementation And Examination, Stephanie Dachs

Student Theses

The rise of computer use and technical adeptness by the general public in the last two decades are undeniable. With greater use comes a greater possibility for misuse, evidenced by today’s incredible number of crimes involving computers as well as the growth in severity from that of cyber hooliganism to cyber warfare. Although frequently utilized for privacy and security purposes, the vast range of anti-forensic techniques has contributed to the ability for hackers and criminals to obstruct computer forensic investigations.

Understanding how anti-forensics may alter important and relevant data on an electronic device will prove useful for the success and …

Species Identification Of Necrophagous Insect Eggs Based On Amino Acid Profile Differences Revealed By Direct Analysis In Real Time-High Resolution Mass Spectrometry, Justine E. Giffen, Jennifer Y. Rosati, Cameron M. Longo, Rabi A. Musah

Publications and Research

The colonization of decomposing remains by necrophagous insects such as blow flies is of forensic importance because the progression through the various stages of insect development can be correlated to time of death. The ability to infer this information hinges on accurate determination of the fly species that are associated with the entomological evidence collected. This evidence can include eggs, larvae, pupae, and puparial casings. Determination of the egg’s identity is particularly challenging because the eggs of multiple species are morphologically very similar. We report here that the species identity of fly eggs can be determined from their chemical fingerprint …

The Advanced Spectroscopic Analysis Of Organic Gunshot Residue And Explosives, Jennifer M. Leonard

Dissertations, Theses, and Capstone Projects

With the prevalence of shooting cases and terrorist attacks/or threats that plague the current state of the criminal justice system, it is of paramount importance to be able to detect, identify and interpret the presence of gunshot residue or explosives material. This concern is seen in law enforcement agencies and the media throughout the United States and abroad.

Currently, the typical method of analyzing gunshot residue in most crime laboratories serves to identify the inorganic constituents of the primer residue, namely lead, barium and antimony. However, it is possible that the organic matter from the propellant could provide different information …

Detection Of Cathinone And Mephedrone In Plasma By Lc-Ms/Ms Using Standard Addition Quantification Technique, Theron W. Ng-A-Qui

Student Theses

Designer drugs are structural analogs of Drug Enforcement Agency (DEA) Schedule I and II substances. They are synthesized to mimic the effects of illegal drugs of abuse and to bypass the provisions of drug regulations. Despite the increased availability of designer drugs, few studies have focused on specific analytical extraction techniques for their detection and quantification in biological samples. Solid phase extraction (SPE) is the most commonly used technique for sample preparation. The purpose of this study is to evaluate the extraction efficiency of the various SPE columns with different sorbent materials for two designer drugs, cathinone and mephedrone in …