Open Access. Powered by Scholars. Published by Universities.®

Forensic Science and Technology Commons™

Open Access. Powered by Scholars. Published by Universities.®

Journal of Digital Forensics, Security and Law

Articles 61 - 90 of 294

Full-Text Articles in Forensic Science and Technology

Plc Forensics Based On Control Program Logic Change Detection, Ken Yau, Kam-Pui Chow Jan 2015

Plc Forensics Based On Control Program Logic Change Detection, Ken Yau, Kam-Pui Chow

Journal of Digital Forensics, Security and Law

Supervisory Control and Data Acquisition (SCADA) system is an industrial control automated system. It is built with multiple Programmable Logic Controllers (PLCs). PLC is a special form of microprocessor-based controller with proprietary operating system. Due to the unique architecture of PLC, traditional digital forensic tools are difficult to be applied. In this paper, we propose a program called Control Program Logic Change Detector (CPLCD), it works with a set of Detection Rules (DRs) to detect and record undesired incidents on interfering normal operations of PLC. In order to prove the feasibility of our solution, we set up two experiments for …

Go to article

Factors Influencing Digital Forensic Investigations: Empirical Evaluation Of 12 Years Of Dubai Police Cases, Ibtesam Alawadhi, Janet C. Read, Andrew Marrington, Virginia N. L. Franqueira Jan 2015

Factors Influencing Digital Forensic Investigations: Empirical Evaluation Of 12 Years Of Dubai Police Cases, Ibtesam Alawadhi, Janet C. Read, Andrew Marrington, Virginia N. L. Franqueira

Journal of Digital Forensics, Security and Law

In Digital Forensics, the number of person-hours spent on investigation is a key factor which needs to be kept to a minimum whilst also paying close attention to the authenticity of the evidence. The literature describes challenges behind increasing person-hours and identifies several factors which contribute to this phenomenon. This paper reviews these factors and demonstrates that they do not wholly account for increases in investigation time. Using real case records from the Dubai Police, an extensive study explains the contribution of other factors to the increase in person-hours. We conclude this work by emphasizing on several factors affecting the …

Go to article

Cyber Black Box/Event Data Recorder: Legal And Ethical Perspectives And Challenges With Digital Forensics, Michael Losavio, Pavel Pastukov, Svetlana Polyakova Jan 2015

Cyber Black Box/Event Data Recorder: Legal And Ethical Perspectives And Challenges With Digital Forensics, Michael Losavio, Pavel Pastukov, Svetlana Polyakova

Journal of Digital Forensics, Security and Law

With ubiquitous computing and the growth of the Internet of Things, there is vast expansion in the deployment and use of event data recording systems in a variety of environments. From the ships’ logs of antiquity through the evolution of personal devices for recording personal and environmental activities, these devices offer rich forensic and evidentiary opportunities that smash against rights of privacy and personality. The technical configurations of these devices provide for greater scope of sensing, interconnection options for local, near, and cloud storage of data, and the possibility of powerful analytics. This creates the unique situation of near-total data …

Go to article

Two Challenges Of Stealthy Hypervisors Detection: Time Cheating And Data Fluctuations, Igor Korkin Jan 2015

Two Challenges Of Stealthy Hypervisors Detection: Time Cheating And Data Fluctuations, Igor Korkin

Journal of Digital Forensics, Security and Law

Hardware virtualization technologies play a significant role in cyber security. On the one hand these technologies enhance security levels, by designing a trusted operating system. On the other hand these technologies can be taken up into modern malware which is rather hard to detect. None of the existing methods is able to efficiently detect a hypervisor in the face of countermeasures such as time cheating, temporary self uninstalling, memory hiding etc. New hypervisor detection methods which will be described in this paper can detect a hypervisor under these countermeasures and even count several nested ones. These novel approaches rely on …

Go to article

Data Extraction On Mtk-Based Android Mobile Phone Forensics, Joe Kong Jan 2015

Data Extraction On Mtk-Based Android Mobile Phone Forensics, Joe Kong

Journal of Digital Forensics, Security and Law

In conducting criminal investigations it is quite common that forensic examiners need to recover evidentiary data from smartphones used by offenders. However, examiners encountered difficulties in acquiring complete memory dump from MTK Android phones, a popular brand of smartphones, due to a lack of technical knowledge on the phone architecture and that system manuals are not always available. This research will perform tests to capture data from MTK Android phone by applying selected forensic tools and compare their effectiveness by analyzing the extracted results. It is anticipated that a generic extraction tool, once identified, can be used on different brands …

Go to article

Exploring The Use Of Plc Debugging Tools For Digital Forensic Investigations On Scada Systems, Tina Wu, Jason R.C. Nurse Jan 2015

Exploring The Use Of Plc Debugging Tools For Digital Forensic Investigations On Scada Systems, Tina Wu, Jason R.C. Nurse

Journal of Digital Forensics, Security and Law

The Stuxnet malware attack has provided strong evidence for the development of a forensic capability to aid in thorough post-incident investigations. Current live forensic tools are typically used to acquire and examine memory from computers running either Windows or Unix. This makes them incompatible with embedded devices found on SCADA systems that have their own bespoke operating system. Currently, only a limited number of forensics tools have been developed for SCADA systems, with no development of tools to acquire the program code from PLCs. In this paper, we explore this problem with two main hypotheses in mind. Our first hypothesis …

Go to article

Forensic Acquisition Of Imvu: A Case Study, Robert Van Voorst, M-Tahar Kechadi, Nhien-An Le-Khac Jan 2015

Forensic Acquisition Of Imvu: A Case Study, Robert Van Voorst, M-Tahar Kechadi, Nhien-An Le-Khac

Journal of Digital Forensics, Security and Law

There are many applications available for personal computers and mobile devices that facilitate users in meeting potential partners. There is, however, a risk associated with the level of anonymity on using instant message applications, because there exists the potential for predators to attract and lure vulnerable users. Today Instant Messaging within a Virtual Universe (IMVU) combines custom avatars, chat or instant message (IM), community, content creation, commerce, and anonymity. IMVU is also being exploited by criminals to commit a wide variety of offenses. However, there are very few researches on digital forensic acquisition of IMVU applications. In this paper, we …

Go to article

Tracking And Taxonomy Of Cyberlocker Link Sharers Based On Behavior Analysis, Xiao-Xi Fan, Kam-Pui Chow Jan 2015

Tracking And Taxonomy Of Cyberlocker Link Sharers Based On Behavior Analysis, Xiao-Xi Fan, Kam-Pui Chow

Journal of Digital Forensics, Security and Law

The growing popularity of cyberlocker service has led to significant impact on the Internet that it is considered as one of the biggest contributors to the global Internet traffic estimated to be illegally traded content. Due to the anonymity property of cyberlocker, it is difficult for investigators to track user identity directly on cyberlocker site. In order to find the potential relationships between cyberlocker users, we propose a framework to collect cyberlocker related data from public forums where cyberlocker users usually distribute cyberlocker links for others to download and identity information can be gathered easily. Different kinds of sharing behaviors …

Go to article

A Survey Of Botnet Detection Techniques By Command And Control Infrastructure, Thomas S. Hyslip, Jason M. Pittman Jan 2015

A Survey Of Botnet Detection Techniques By Command And Control Infrastructure, Thomas S. Hyslip, Jason M. Pittman

Journal of Digital Forensics, Security and Law

Botnets have evolved to become one of the most serious threats to the Internet and there is substantial research on both botnets and botnet detection techniques. This survey reviewed the history of botnets and botnet detection techniques. The survey showed traditional botnet detection techniques rely on passive techniques, primarily honeypots, and that honeypots are not effective at detecting peer-to-peer and other decentralized botnets. Furthermore, the detection techniques aimed at decentralized and peer-to-peer botnets focus on detecting communications between the infected bots. Recent research has shown hierarchical clustering of flow data and machine learning are effective techniques for detecting botnet peer-to-peer …

Go to article

From The Editor-In-Chief, Ibrahim A. Baggili Jun 2014

From The Editor-In-Chief, Ibrahim A. Baggili

Journal of Digital Forensics, Security and Law

We are proud to share with you this special edition issue of the JDFSL. This year, JDFSL partnered with both the 6th International Conference on Digital Forensics and Cyber Crime (ICDF2C) and Systematic Approaches to Digital Forensic Engineering (SADFE)–two prominent conferences in our field that were co-hosted. Fifty-three papers were submitted, and the Technical Program Committee accepted only 17 after a rigorous review process.

Go to article

Using Internet Artifacts To Profile A Child Pornography Suspect, Marcus K. Rogers, Kathryn C. Seigfried-Spellar Jan 2014

Using Internet Artifacts To Profile A Child Pornography Suspect, Marcus K. Rogers, Kathryn C. Seigfried-Spellar

Journal of Digital Forensics, Security and Law

Digital evidence plays a crucial role in child pornography investigations. However, in the following case study, the authors argue that the behavioral analysis or “profiling” of digital evidence can also play a vital role in child pornography investigations. The following case study assessed the Internet Browsing History (Internet Explorer Bookmarks, Mozilla Bookmarks, and Mozilla History) from a suspected child pornography user’s computer. The suspect in this case claimed to be conducting an ad hoc law enforcement investigation. After the URLs were classified (Neutral; Adult Porn; Child Porn; Adult Dating sites; Pictures from Social Networking Profiles; Chat Sessions; Bestiality; Data Cleaning; …

Go to article

On Cyber Attacks And Signature Based Intrusion Detection For Modbus Based Industrial Control Systems, Wei Gao, Thomas H. Morris Jan 2014

On Cyber Attacks And Signature Based Intrusion Detection For Modbus Based Industrial Control Systems, Wei Gao, Thomas H. Morris

Journal of Digital Forensics, Security and Law

Industrial control system communication networks are vulnerable to reconnaissance, response injection, command injection, and denial of service attacks. Such attacks can lead to an inability to monitor and control industrial control systems and can ultimately lead to system failure. This can result in financial loss for control system operators and economic and safety issues for the citizens who use these services. This paper describes a set of 28 cyber attacks against industrial control systems which use the MODBUS application layer network protocol. The paper also describes a set of standalone and state based intrusion detection system rules which can be …

Go to article

Idiographic Digital Profiling: Behavioral Analysis Based On Digital Forensics, Chad M. Steel Jan 2014

Idiographic Digital Profiling: Behavioral Analysis Based On Digital Forensics, Chad M. Steel

Journal of Digital Forensics, Security and Law

Idiographic digital profiling (IDP) is the application of behavioral analysis to the field of digital forensics. Previous work in this field takes a nomothetic approach to behavioral analysis by attempting to understand the aggregate behaviors of cybercriminals. This work is the first to take an idiographic approach by examining a particular subject's digital footprints for immediate use in an ongoing investigation. IDP provides a framework for investigators to analyze digital behavioral evidence for the purposes of case planning, subject identification, lead generation, obtaining and executing warrants, and prosecuting offenders.

Go to article

On Identities In Modern Networks, Libor Polcak, Radek Hranick, Tomas Martınek Jan 2014

On Identities In Modern Networks, Libor Polcak, Radek Hranick, Tomas Martınek

Journal of Digital Forensics, Security and Law

Communicating parties inside computer networks use different kind of identifiers. Some of these identifiers are stable, e.g., logins used to access a specific service, some are only temporary, e.g., dynamically assigned IP addresses. This paper tackles several challenges of lawful interception that emerged in modern networks. The main contribution is the graph model that links identities learnt from various sources distributed in a network. The inferred identities result into an interception of more detailed data in conformance with the issued court order. The approach deals with network address translation, short-lived identifiers and simultaneous usage of different identities. The approach was …

Go to article

Exploring Forensic Implications Of The Fusion Drive, Shruti Gupta, Marcus Rogers Jan 2014

Exploring Forensic Implications Of The Fusion Drive, Shruti Gupta, Marcus Rogers

Journal of Digital Forensics, Security and Law

This paper explores the forensic implications of Apple’s Fusion Drive. The Fusion Drive is an example of auto-tiered storage. It uses a combination of a flash drive and a magnetic drive. Data is moved between the drives automatically to maximize system performance. This is different from traditional caches because data is moved and not simply copied. The research included understanding the drive structure, populating the drive, and then accessing data in a controlled setting to observe data migration strategies. It was observed that all the data is first written to the flash drive with 4 GB of free space always …

Go to article

Multi-Stakeholder Case Prioritization In Digital Investigations, Joshua I. James Jan 2014

Multi-Stakeholder Case Prioritization In Digital Investigations, Joshua I. James

Journal of Digital Forensics, Security and Law

This work examines the problem of case prioritization in digital investigations for better utilization of limited criminal investigation resources. Current methods of case prioritization, as well as observed prioritization methods used in digital forensic investigation laboratories are examined. After, a multi-stakeholder approach to case prioritization is given that may help reduce reputational risk to digital forensic laboratories while improving resource allocation. A survey is given that shows differing opinions of investigation priority between Law Enforcement and the public that is used in the development of a prioritization model. Finally, an example case is given to demonstrate the practicality of the …

Go to article

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach, Frank Breitinger, Christian Rathgeb, Harald Baier Jan 2014

An Efficient Similarity Digests Database Lookup – A Logarithmic Divide & Conquer Approach, Frank Breitinger, Christian Rathgeb, Harald Baier

Journal of Digital Forensics, Security and Law

Investigating seized devices within digital forensics represents a challenging task due to the increasing amount of data. Common procedures utilize automated file identification, which reduces the amount of data an investigator has to examine manually. In the past years the research field of approximate matching arises to detect similar data. However, if n denotes the number of similarity digests in a database, then the lookup for a single similarity digest is of complexity of O(n). This paper presents a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(n) to O(log(n)). Our proposed approach is based …

Go to article

Table Of Contents Jan 2014

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Go to article

From The Editor, Ibrahim Baggili Jan 2014

From The Editor, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

In this issue we have three papers that have made the cut. The first paper titled “The Cost of Privacy: Riley v. California’s Impact on Cell Phone Searches” is timely. In 2014 there was a unanimous decision that requires a warrant for all cell phone searches. This has some strong implications on the forensic analysis of mobile phones, and to that end, this article discusses and summarizes this legal precedent with its practical implications.

Go to article

Leveraging Decentralization To Extend The Digital Evidence Acquisition Window: Case Study On Bittorrent Sync, Mark Scanlon, Jason Farina, Nhien A. Khac, Tahar Kechadi Jan 2014

Leveraging Decentralization To Extend The Digital Evidence Acquisition Window: Case Study On Bittorrent Sync, Mark Scanlon, Jason Farina, Nhien A. Khac, Tahar Kechadi

Journal of Digital Forensics, Security and Law

File synchronization services such as Dropbox, Google Drive, Microsoft OneDrive, Apple iCloud, etc., are becoming increasingly popular in today’s always-connected world. A popular alternative to the aforementioned services is BitTorrent Sync. This is a decentralized/cloudless file synchronization service and is gaining significant popularity among Internet users with privacy concerns over where their data is stored and who has the ability to access it. The focus of this paper is the remote recovery of digital evidence pertaining to files identified as being accessed or stored on a suspect’s computer or mobile device. A methodology for the identification, investigation, recovery and verification …

Go to article

Book Review: The X-Ways Forensics Practitioner's Guide, Linda Lau Jan 2014

Book Review: The X-Ways Forensics Practitioner's Guide, Linda Lau

Journal of Digital Forensics, Security and Law

Brett Shavers is a former law enforcement officer, a digital forensics examiner, an adjunct instructor, and a frequent speaker at many conferences. After writing his first book, titled Placing the Suspect Behind the Keyboard: Using Digital Forensics and Investigative Techniques to Identify Cybercrime Suspects, he co-wrote his 2nd book with Eric Zimmerman and Jimmy Weg, who is a knowledgeable technical editor. Both Brett and Eric are experts in cyber forensics, with many years of law enforcement experience at both the state and federal levels.

Go to article

The Cost Of Privacy: Riley V. California’S Impact On Cell Phone Searches, Jennifer L. Moore, Jonathan Langton, Joseph Pochron Jan 2014

The Cost Of Privacy: Riley V. California’S Impact On Cell Phone Searches, Jennifer L. Moore, Jonathan Langton, Joseph Pochron

Journal of Digital Forensics, Security and Law

Riley v. California is the United States Supreme Court’s first attempt to regulate the searches of cell phones by law enforcement. The 2014 unanimous decision requires a warrant for all cell phone searches incident to arrest absent an emergency. This work summarizes the legal precedent and analyzes the limitations and practical implications of the ruling. General guidelines for members of the criminal justice system at all levels consistent with the Supreme Court’s decision are provided.

Go to article

Quantifying Relevance Of Mobile Digital Evidence As They Relate To Case Types: A Survey And A Guide For Best Practice, Shahzad Saleem, Ibrahim Baggili, Oliver Popov Jan 2014

Quantifying Relevance Of Mobile Digital Evidence As They Relate To Case Types: A Survey And A Guide For Best Practice, Shahzad Saleem, Ibrahim Baggili, Oliver Popov

Journal of Digital Forensics, Security and Law

In this work, a survey was conducted to help quantify the relevance of nineteen types of evidence (such as SMS) to seven types of digital investigations associated with mobile devices (MD) (such as child pornography). 97 % of the respondents agreed that every type of digital evidence has a different level of relevance to further or solve a particular investigation. From 55 serious participants, a dataset of 5,772 responses regarding the relevance of nineteen types of digital evidence for all the seven types of digital investigations was obtained. The results showed that (i) SMS belongs to the most relevant type …

Go to article

Table Of Contents Jan 2014

Table Of Contents

Journal of Digital Forensics, Security and Law

No abstract provided.

Go to article

Developing A Conceptual Framework For Modeling Deviant Cyber Flash Mob: A Socio-Computational Approach Leveraging Hypergraph Constructs, Samer Al-Khateeb, Nitin Agarwal Jan 2014

Developing A Conceptual Framework For Modeling Deviant Cyber Flash Mob: A Socio-Computational Approach Leveraging Hypergraph Constructs, Samer Al-Khateeb, Nitin Agarwal

Journal of Digital Forensics, Security and Law

In a Flash Mob (FM) a group of people get together in the physical world perform an unpredicted act and disperse quickly. Cyber Flash Mob (CFM) is the cyber manifestation of flash mob coordinated primarily using social media. Deviant Cyber Flash Mob (or, DCFM) is a special case of CFM, which is categorized as the new face of transnational crime organizations (TCOs). The DCFM phenomenon can be considered as a form of a cyber-collective action that is defined as an action aiming to improve group’s conditions (such as, status or power). In this paper, we conduct a conceptual analysis of …

Go to article

Book Review: The Basics Of Digital Forensics: The Primer For Getting Started In Digital Forensics, Stephen Larson Jan 2014

Book Review: The Basics Of Digital Forensics: The Primer For Getting Started In Digital Forensics, Stephen Larson

Journal of Digital Forensics, Security and Law

The Basics of Digital Forensics: The Primer for Getting Started in Digital Forensics is well-named–it really is very basic. And it should be, as the book’s intended audience includes entry-level digital forensics professionals and complimentary fields such as law enforcement, legal, and general information security. Though the copyright is 2012, some of the data is from 2009, and there is mention of estimates for 2010.

Go to article

“Time For Some Traffic Problems”: Enhancing E-Discovery And Big Data Processing Tools With Linguistic Methods For Deception Detection, Erin S. Crabb Jan 2014

“Time For Some Traffic Problems”: Enhancing E-Discovery And Big Data Processing Tools With Linguistic Methods For Deception Detection, Erin S. Crabb

Journal of Digital Forensics, Security and Law

Linguistic deception theory provides methods to discover potentially deceptive texts to make them accessible to clerical review. This paper proposes the integration of these linguistic methods with traditional e-discovery techniques to identify deceptive texts within a given author’s larger body of written work, such as their sent email box. First, a set of linguistic features associated with deception are identified and a prototype classifier is constructed to analyze texts and describe the features’ distributions, while avoiding topic-specific features to improve recall of relevant documents. The tool is then applied to a portion of the Enron Email Dataset to illustrate how …

Go to article

Hot Zone Identification: Analyzing Effects Of Data Sampling On Spam Clustering, Rasib Khan, Mainul Mizan, Ragib Hasan, Alan Sprague Jan 2014

Hot Zone Identification: Analyzing Effects Of Data Sampling On Spam Clustering, Rasib Khan, Mainul Mizan, Ragib Hasan, Alan Sprague

Journal of Digital Forensics, Security and Law

Email is the most common and comparatively the most efficient means of exchanging information in today's world. However, given the widespread use of emails in all sectors, they have been the target of spammers since the beginning. Filtering spam emails has now led to critical actions such as forensic activities based on mining spam email. The data mine for spam emails at the University of Alabama at Birmingham is considered to be one of the most prominent resources for mining and identifying spam sources. It is a widely researched repository used by researchers from different global organizations. The usual process …

Go to article

Accurate Modeling Of The Siemens S7 Scada Protocol For Intrusion Detection And Digital Forensics, Amit Kleinmann, Avishai Wool Jan 2014

Accurate Modeling Of The Siemens S7 Scada Protocol For Intrusion Detection And Digital Forensics, Amit Kleinmann, Avishai Wool

Journal of Digital Forensics, Security and Law

The Siemens S7 protocol is commonly used in SCADA systems for communications between a Human Machine Interface (HMI) and the Programmable Logic Controllers (PLCs). This paper presents a model-based Intrusion Detection Systems (IDS) designed for S7 networks. The approach is based on the key observation that S7 traffic to and from a specific PLC is highly periodic; as a result, each HMI-PLC channel can be modeled using its own unique Deterministic Finite Automaton (DFA). The resulting DFA-based IDS is very sensitive and is able to flag anomalies such as a message appearing out of its position in the normal sequence …

Go to article

From The Editor-In-Chief, Ibrahim Baggili Jan 2014

From The Editor-In-Chief, Ibrahim Baggili

Journal of Digital Forensics, Security and Law

Welcome to JDFSL’s fourth and final issue for 2014! First, I would like to thank our editorial board, reviewers, and the JDFSL team for bringing this issue to life. It has been a big year for JDFSL as the journal continues to progress. I would like to highlight our critical achievements for 2014 before touching on the papers that were accepted in this issue: 1. JDFSL has gone to a fully open access model without author payment through support from academic institutions. 2. JDFSL has formed and continues to form partnerships with various conferences that relate to cyber security and …

Go to article

First Prev Next Last