Forensic Science and Technology Commons^™

Digital Forensics For Mobility As A Service Platform: Analysis Of Uber Application On Iphone And Cloud, Nina Matulis, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Uber is a ride-hailing smartphone application (app) that allows users to order a ride in a highly efficient manner. The Uber app provides Mobility as a Service and allows users to easily order a ride in a private car with just a few clicks. Uber stores large amounts of data on both the mobile device the app is being used on, and in the cloud. Examples of this data include geolocation data, date/time, origin/destination addresses, departure/arrival times, and distance. Uber geolocation data has been previously researched to investigate the privacy of the Uber app; however, there is minimal research relating …

Smart Home Forensics: Identifying Ddos Attack Patterns On Iot Devices, Samuel Ho, Hope Greeson, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

Smart homes are becoming more common as more people integrate IoT devices into their home environment. As such, these devices have access to personal data on their homeowners’ networks. One of the advantages of IoT devices is that they are compact. However, this limits the incorporation of security measures in their hardware. Misconfigured IoT devices are commonly the target of malicious attacks. Additionally, distributed denial-of-service attacks are becoming more common due to applications and software that provides users with easy-to-use user interfaces. Since one vulnerable device is all an attacker needs to launch an attack on a network, in regards …

Microsoft Defender Will Be Defended: Memoryranger Prevents Blinding Windows Av, Denis Pogonin, Igor Korkin, Phd

Annual ADFSL Conference on Digital Forensics, Security and Law

Windows OS is facing a huge rise in kernel attacks. An overview of popular techniques that result in loading kernel drivers will be presented. One of the key targets of modern threats is disabling and blinding Microsoft Defender, a default Windows AV. The analysis of recent driver-based attacks will be given, the challenge is to block them. The survey of user- and kernel-level attacks on Microsoft Defender will be given. One of the recently published attackers’ techniques abuses Mandatory Integrity Control (MIC) and Security Reference Monitor (SRM) by modifying Integrity Level and Debug Privileges for the Microsoft Defender via syscalls. …

Detection Of Overlapping Passive Manipulation Techniques In Image Forensics, Gianna S. Lint, Umit Karabiyik

Annual ADFSL Conference on Digital Forensics, Security and Law

With a growing number of images uploaded daily to social media sites, it is essential to understand if an image can be used to trace its origin. Forensic investigations are focusing on analyzing images that are uploaded to social media sites resulting in an emphasis on building and validating tools. There has been a strong focus on understanding active manipulation or tampering techniques and building tools for analysis. However, research on manipulation is often studied in a vacuum, involving only one technique at a time. Additionally, less focus has been placed on passive manipulation, which can occur by simply uploading …

Integration Of Blockchain Technology Into Automobiles To Prevent And Study The Causes Of Accidents, John Kim

Electronic Theses, Projects, and Dissertations

Automobile collisions occur daily. We now live in an information-driven world, one where technology is quickly evolving. Blockchain technology can change the automotive industry, the safety of the motoring public and its surrounding environment by incorporating this vast array of information. It can place safety and efficiency at the forefront to pedestrians, public establishments, and provide public agencies with pertinent information securely and efficiently. Other industries where Blockchain technology has been effective in are as follows: supply chain management, logistics, and banking. This paper reviews some statistical information regarding automobile collisions, Blockchain technology, Smart Contracts, Smart Cities; assesses the feasibility …

Evaluation Of The Potential Of Automated Sem-Eds Analysis For The Discrimination Of Inorganic Soil Particles, Anna S. Duggar

Dissertations, Theses, and Capstone Projects

Soil, that complex mixture of minerals, organic particles, chemicals, and anthropogenic materials, is ubiquitous and easily transferred, which gives it forensic relevance. Forensic soil analysis has traditionally included the identification and comparison of both organic and inorganic components, the inorganic portion being most commonly examined by light microscopy and other instrumental techniques. Predominantly, the inorganic materials in soil are naturally-occurring minerals, contributed as grains from the surrounding bedrock, which gives a soil its regional character. That parent material then undergoes physical, chemical, and anthropogenic changes producing wide geographic variation within a single region. This variation forms the basis for potential …

Forensic Artifact Finder (Forensicaf): An Approach & Tool For Leveraging Crowd-Sourced Curated Forensic Artifacts, Tyler Balon, Krikor Herlopian, Ibrahim Baggili, Cinthya Grajeda-Mendez

Electrical & Computer Engineering and Computer Science Faculty Publications

Current methods for artifact analysis and understanding depend on investigator expertise. Experienced and technically savvy examiners spend a lot of time reverse engineering applications while attempting to find crumbs they leave behind on systems. This takes away valuable time from the investigative process, and slows down forensic examination. Furthermore, when specific artifact knowledge is gained, it stays within the respective forensic units. To combat these challenges, we present ForensicAF, an approach for leveraging curated, crowd-sourced artifacts from the Artifact Genome Project (AGP). The approach has the overarching goal of uncovering forensically relevant artifacts from storage media. We explain our approach …

Forensicast: A Non-Intrusive Approach & Tool For Logical Forensic Acquisition & Analysis Of The Google Chromecast Tv, Alex Sitterer, Nicholas Dubois, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The era of traditional cable Television (TV) is swiftly coming to an end. People today subscribe to a multitude of streaming services. Smart TVs have enabled a new generation of entertainment, not only limited to constant on-demand streaming as they now offer other features such as web browsing, communication, gaming etc. These functions have recently been embedded into a small IoT device that can connect to any TV with High Definition Multimedia Interface (HDMI) input known as Google Chromecast TV. Its wide adoption makes it a treasure trove for potential digital evidence. Our work is the primary source on forensically …

Duck Hunt: Memory Forensics Of Usb Attack Platforms, Tyler Thomas, Mathew Piscitelli, Bhavik Ashok Nahar, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

To explore the memory forensic artifacts generated by USB-based attack platforms, we analyzed two of the most popular commercially available devices, Hak5's USB Rubber Ducky and Bash Bunny. We present two open source Volatility plugins, usbhunt and dhcphunt, which extract artifacts generated by these USB attacks from Windows 10 system memory images. Such artifacts include driver-related diagnostic events, unique device identifiers, and DHCP client logs. Our tools are capable of extracting metadata-rich Windows diagnostic events generated by any USB device. The device identifiers presented in this work may also be used to definitively detect device usage. Likewise, the DHCP logs …

Another Brick In The Wall: An Exploratory Analysis Of Digital Forensics Programs In The United States, Syria Mccullough, Stella Abudu, Ebere Onwubuariri, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

We present a comprehensive review of digital forensics programs offered by universities across the United States (U.S.). While numerous studies on digital forensics standards and curriculum exist, few, if any, have examined digital forensics courses offered across the nation. Since digital forensics courses vary from university to university, online course catalogs for academic institutions were evaluated to curate a dataset. Universities were selected based on online searches, similar to those that would be made by prospective students. Ninety-seven (n = 97) degree programs in the U.S. were evaluated. Overall, results showed that advanced technical courses are missing from curricula. We …

Bullet Ricochet Of Polymer Coated Bullets, Stephen Daly

Student Theses

Polymer coated bullets were designed to limit a shooter’s exposure to lead. However, despite the advantages that these bullets give there are still difficulties which arise in a forensic firearms examination. Unlike in a typical metal coated bullet, individualizing striations will typically not be imparted to a polymer coated bullet making it unable to be linked to a specific firearm. Due to this difficulty any information that can be gained at the scene of the crime could be crucial. Some obtainable information includes the angle of ricochet and the angle of incidence of the discharged bullet as well as traces …

Editorial Introduction To The Special Issue: Supporting Future Scholarship On Cybercrime, Jaeyong Choi, Brandon Dulisse, Richard L. Wentling, Nathan Kruis

International Journal of Cybersecurity Intelligence & Cybercrime

This editorial introduction will present an overview of the three papers published in this special issue of the International Journal of Cybersecurity Intelligence and Cybercrime. The winners of the student paper competition during the 2021 Whitehat Conference have prepared their papers for this special issue. Their research directs our attention to key issues regarding cybercrime that have often been overlooked in the literature ranging from North Korean cyberterrorism to the relationship between COVID-19 and cybercrime and to fear of online victimization.

North Korean Cyber Attacks And Policy Responses: An Interdisciplinary Theoretical Framework, Jeeseon Hwang, Kyung-Shick Choi

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Malware Infections In The U.S. During The Covid-19 Pandemic: An Empirical Study, Sydney Gero, Sinchul Back, Jennifer Laprade, Joonggon Kim

International Journal of Cybersecurity Intelligence & Cybercrime

The COVID-19 pandemic has changed the world in many ways, especially in the landscape of cyber threats. The pandemic has pro-vided cybercriminals with more opportunities to commit crimes due to more people engaging in online activities, along with the increased use of computers for school, work, and social events. The current study seeks to explore cybercrime trends, in particular malware infections, during the COVID-19 pandemic. Thus, this study examines the relationship between the number of malware in-fections, COVID-19 positive cases, closed non-essential businesses, and closed K-12 public schools in the United States. Data utilized in this study derives from (1) …

Level Of Engagement With Social Networking Services And Fear Of Online Victimization: The Role Of Online Victimization Experiences, Yeonjae Park, Lynne M. Vieraitis

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Cyberbullying: Its Social And Psychological Harms Among Schoolers, Hyeyoung Lim, Hannarae Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Criminal justice around the world has prioritized the prevention and protection of bullying and its victims due to the rapid increases in peer violence. Nevertheless, relatively few studies have examined what treatments or assistance are effective for peer victims to reduce and recover from their social and psychological suffering, especially in cyberbullying cases. Using data derived from the National Crime Victimization Survey-School Crime Supplement data in 2011 and 2013 (N=823), the current study examined the impact of two emotional support groups (i.e., adult and peer groups) on cyberbullying victims' social and psychological harm. The findings indicated that both adult and …

Cyber-Victimization Trends In Trinidad & Tobago: The Results Of An Empirical Research, Troy Smith, Nikolaos Stamatakis

International Journal of Cybersecurity Intelligence & Cybercrime

Cybertechnology has brought benefits to the Caribbean in the form of new regional economic and social growth. In the last years, Caribbean countries have also become attractive targets for cybercrime due to increased economic success and online presence with a low level of cyber resilience. This study examines the online-related activities that affect cybercrime victimization by using the Routine Activity Theory (RAT). The present study seeks to identify activities that contribute to different forms of cybercrime victimization and develop risk models for these crimes, particularly the understudied cyber-dependent crimes of Hacking and Malware. It also aims to explore if there …

Assessing The Credibility Of Cyber Adversaries, Jenny A. Wells, Dana S. Lafon, Margaret Gratian

International Journal of Cybersecurity Intelligence & Cybercrime

Online communications are ever increasing, and we are constantly faced with the challenge of whether online information is credible or not. Being able to assess the credibility of others was once the work solely of intelligence agencies. In the current times of disinformation and misinformation, understanding what we are reading and to who we are paying attention to is essential for us to make considered, informed, and accurate decisions, and it has become everyone’s business. This paper employs a literature review to examine the empirical evidence across online credibility, trust, deception, and fraud detection in an effort to consolidate this …

Program And Proceedings: Nebraska Academy Of Sciences 1880–2021, 141st Anniversary Year, One Hundred-Thirty-First Annual Meeting, April 23-24, 2021

Nebraska Academy of Sciences: Programs and Proceedings

Program

Aeronautics and Space Science

Anthropology

Applied Science and Technology

Biological and Medical Sciences

Collegiate Academy: Biology

Collegiate Academy: Chemistry and Physics

Earth Sciences

Environmental Sciences

General Chemistry

General Physics

Teaching of Science and Mathematics

Friend of Science Award: Paul Karr

The Absence Or Misuse Of Statistics In Forensic Science As A Contributor To Wrongful Convictions: From Pattern Matching To Medical Opinions About Child Abuse, Keith A. Findley

Dickinson Law Review (2017-Present)

The new scrutiny that has been applied to the forensic sciences since the emergence of DNA profiling as the gold standard three decades ago has identified numerous concerns about the absence of a solid scientific footing for most disciplines. This article examines one of the lesser-considered problems that afflicts virtually all of the pattern-matching (or “individualization”) disciplines (largely apart from DNA), and even undermines the validity of other forensic disciplines like forensic pathology and medical determinations about child abuse, particularly Shaken Baby Syndrome/Abusive Head Trauma (SBS/AHT). That problem is the absence or misuse of statistics. This article begins by applying …

The Challenges Of Identifying Dangers Online And Predictors Of Victimization, Catherine D. Marcum

International Journal of Cybersecurity Intelligence & Cybercrime

This short paper will provide an overview of the impressive pieces included in this issue of the International Journal of Cybersecurity Intelligence and Cybercrime. This issue includes articles on the following pertinent topic, utilizing a range of approaches and methodologies: 1) online credibility; 2) cyberbullying; and 3) unauthorized access of information. An emphasis on the importance of policy development and better protection of potential victims is a common thread throughout the issue.

Zooming Into The Pandemic! A Forensic Analysis Of The Zoom Application, Andrew Mahr, Meghan Cichon, Sophia Mateo, Cinthya Grajeda, Ibrahim Baggili

Electrical & Computer Engineering and Computer Science Faculty Publications

The global pandemic of COVID-19 has turned the spotlight on video conferencing applications like never before. In this critical time, applications such as Zoom have experienced a surge in its user base jump over the 300 million daily mark (ZoomBlog, 2020). The increase in use has led malicious actors to exploit the application, and in many cases perform Zoom Bombings. Therefore forensically examining Zoom is inevitable. Our work details the primary disk, network, and memory forensic analysis of the Zoom video conferencing application. Results demonstrate it is possible to find users' critical information in plain text and/or encrypted/encoded, such …

Analysis Of Lubricants At Trace Levels Using Infrared Spectroscopy, Tanmai Bandarupalli

Honors Undergraduate Theses

Analysis of trace evidence involved in sexual assault investigations holds considerable potential as a newer avenue of identification when bulk, larger evidence is not found or unreliable. Trace analysis of forensic materials involves common findings such as strands of hair, residues left on clothing, shards of paint or glass, etc. In recent research focused on the analysis of trace materials found as evidence in a sexual assault, there has been promise in condom and bottled lubricant classification based on their chemical profiles that can provide an associative link in an investigation. Few studies have considered the examination of lubricant evidence …

Evaluating The Impact Of Sandbox Applications On Live Digital Forensics Investigation, Reem Bashir, Helge Janicke, Wen Zeng

Research outputs 2014 to 2021

Sandbox applications can be used as anti-forensics techniques to hide important evidence in the digital forensics investigation. There is limited research on sandboxing technologies, and the existing researches on sandboxing are focusing on the technology itself. The impact of sandbox applications on live digital forensics investigation has not been systematically analysed and documented. In this study, we proposed a methodology to analyse sandbox applications on Windows systems. The impact of having standalone sandbox applications on Windows operating systems image was evaluated. Experiments were conducted to examine the artefacts of three sandbox applications: Sandboxie, BufferZone and ToolWiz Time Freeze on Windows …

Digital Forensic Readiness Intelligence Crime Repository, Victor R. Kebande, Nickson M. Karie, Kim-Kwang R. Choo, Sadi Alawadi

Research outputs 2014 to 2021

It may not always be possible to conduct a digital (forensic) investigation post-event if there is no process in place to preserve potential digital evidence. This study posits the importance of digital forensic readiness, or forensic-by-design, and presents an approach that can be used to construct a Digital Forensic Readiness Intelligence Repository (DFRIR). Based on the concept of knowledge sharing, the authors leverage this premise to suggest an intelligence repository. Such a repository can be used to cross-reference potential digital evidence (PDE) sources that may help digital investigators during the process. This approach employs a technique of capturing PDE from …

Digital Forensic Readiness In Operational Cloud Leveraging Iso/Iec 27043 Guidelines On Security Monitoring, Sheunesu Makura, H. S. Venter, Victor R. Kebande, Nickson M. Karie, Richard A. Ikuesan, Sadi Alawadi

Research outputs 2014 to 2021

An increase in the use of cloud computing technologies by organizations has led to cybercriminals targeting cloud environments to orchestrate malicious attacks. Conversely, this has led to the need for proactive approaches through the use of digital forensic readiness (DFR). Existing studies have attempted to develop proactive prototypes using diverse agent-based solutions that are capable of extracting a forensically sound potential digital evidence. As a way to address this limitation and further evaluate the degree of PDE relevance in an operational platform, this study sought to develop a prototype in an operational cloud environment to achieve DFR in the cloud. …

Proposal For The Development And Addition Of A Cybersecurity Assessment Section Into Technology Involving Global Public Health, Stanley Mierzwa, Saumya Ramarao, Jung Ah Yun, Bok Gyo Jeong

International Journal of Cybersecurity Intelligence & Cybercrime

This paper discusses and proposes the inclusion of a cyber or security risk assessment section during the course of public health initiatives involving the use of information and communication computer technology. Over the last decade, many public health research efforts have included information technologies such as Mobile Health (mHealth), Electronic Health (eHealth), Telehealth, and Digital Health to assist with unmet global development health needs. This paper provides a background on the lack of documentation on cybersecurity risks or vulnerability assessments in global public health areas. This study suggests existing frameworks and policies be adopted for public health. We also propose …

Book Review: Computer Capers: Tales Of Electronic Thievery, Embezzlement, And Fraud. By Thomas Whiteside, Brian Nussbaum

International Journal of Cybersecurity Intelligence & Cybercrime

No abstract provided.

Toward Mitigating, Minimizing, And Preventing Cybercrimes And Cybersecurity Risks, Claire Seungeun Lee

International Journal of Cybersecurity Intelligence & Cybercrime

Cybercrime and cybersecurity are emerging fields of research, shaped by technological developments. Scholars in these interconnected fields have studied different types of cybercrimes as well as victimization and offending. Increasingly, some of these scholars have focused on the ways in which cybercrimes can be mitigated, minimized, and even prevented. However, such strategies are often difficult to achieve in reality due to the human and technical factors surrounding cybercrimes. In this issue of the International Journal of Cybersecurity Intelligence and Cybercrime, three papers adequately address such challenges using college student samples and nationally representative samples, as well as a framework through …

Cyber-Situational Crime Prevention And The Breadth Of Cybercrimes Among Higher Education Institutions, Sinchul Back, Jennifer Laprade

International Journal of Cybersecurity Intelligence & Cybercrime

Academic institutions house enormous amounts of critical information from social security numbers of students to proprietary research data. Thus, maintaining up to date cybersecurity practices to protect academic institutions’ information and facilities against cyber-perpetrators has become a top priority. The purpose of this study is to assess common cybersecurity measures through a situational crime prevention (SCP) theoretical framework. Using a national data set of academic institutions in the United States, this study investigates the link between common cybersecurity measures, crime prevention activities, and cybercrimes. By focusing on the conceptualization of cybersecurity measures as SCP techniques, this study also offers the …