Bytewise Approximate Matching: The Good, The Bad, And The Unknown,
2016
University of New Haven
Bytewise Approximate Matching: The Good, The Bad, And The Unknown, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili
Electrical & Computer Engineering and Computer Science Faculty Publications
Hash functions are established and well-known in digital forensics, where they are commonly used for proving integrity and file identification (i.e., hash all files on a seized device and compare the fingerprints against a reference database). However, with respect to the latter operation, an active adversary can easily overcome this approach because traditional hashes are designed to be sensitive to altering an input; output will significantly change if a single bit is flipped. Therefore, researchers developed approximate matching, which is a rather new, less prominent area but was conceived as a more robust counterpart to traditional hashing. Since the conception …
A Study Of The Fepac Accredited Graduate Forensic Science Programs' Curricula,
2016
Marshall University
A Study Of The Fepac Accredited Graduate Forensic Science Programs' Curricula, Catherine Genice Rushton
Theses, Dissertations and Capstones
The National Institute of Justice (1999) and the National Academy of Sciences (2009) recommended that forensic science training shift from on-the-job training to formal education. However, the reports cited inconsistencies in the curricula of the forensic science degree programs as an impediment to this. The Forensic Science Education Programs Accreditation Commission (FEPAC) Standards were created to address this issue; however, no studies have been conducted to determine how the accreditation standards have been implemented by the FEPAC accredited graduate programs. This study evaluated the self-study responses (n=11) and website information (n=17) specific to FEPAC’s Graduate Curriculum Standards to determine how …
Exploring Deviant Hacker Networks (Dhm) On Social Media Platforms,
2016
University of Arkansas, Little Rock
Exploring Deviant Hacker Networks (Dhm) On Social Media Platforms, Samer Al-Khateeb, Kevin J. Conlan, Nitin Agarwal, Ibrahim Baggili, Frank Breitinger
Journal of Digital Forensics, Security and Law
Online Social Networks (OSNs) have grown exponentially over the past decade. The initial use of social media for benign purposes (e.g., to socialize with friends, browse pictures and photographs, and communicate with family members overseas) has now transitioned to include malicious activities (e.g., cybercrime, cyberterrorism, and cyberwarfare). These nefarious uses of OSNs poses a significant threat to society, and thus requires research attention. In this exploratory work, we study activities of one deviant groups: hacker groups on social media, which we term Deviant Hacker Networks (DHN). We investigated the connection between different DHNs on Twitter: how they are connected, identified …
Log Analysis Using Temporal Logic And Reconstruction Approach: Web Server Case,
2016
Security Department Gumushane
Log Analysis Using Temporal Logic And Reconstruction Approach: Web Server Case, Murat Gunestas, Zeki Bilgin
Journal of Digital Forensics, Security and Law
We present a post-mortem log analysis method based on Temporal Logic (TL), Event Processing Language (EPL), and reconstruction approach. After showing that the proposed method could be adapted to any misuse event or attack, we specifically investigate the case of web server misuses. To this end, we examine 5 different misuses on Wordpress web servers, and generate corresponding log files of these attacks for forensic analysis. Then we establish attack patterns and formalize them by means of a special case of temporal logic, i.e. many sorted first order metric temporal logic (MSFOMTL). Later on, we implement these attack patterns in …
Development Of Molecularly Imprinted Polymers For Forensic Applications,
2016
University of Central Florida
Development Of Molecularly Imprinted Polymers For Forensic Applications, Sara Martinez
Electronic Theses and Dissertations
In some forensic disciplines various methods of extraction are used to perform analysis. Among these methods, solid phase extraction (SPE) and solid phase microextraction (SPME) are used in fields such as toxicology and explosives analysis. To enhance extraction efficiency in SPE and SPME, molecularly imprinted polymers (MIPs), which are designer polymers, can be more selective for the binding of an analyte or group of analytes that are similarly structured. Separation of analytes from complex mixtures is possible by utilizing these polymers. This may be especially useful in forensic applications where sample sizes may be small and composition may be complex. …
Mongodb Incidence Response,
2016
University of Central Florida
Mongodb Incidence Response, Cory Morales
Electronic Theses and Dissertations
NoSQL (Not only SQL) databases have been gaining some popularity over the last few years. Such big companies as Expedia, Shutterfly, MetLife, and Forbes use NoSQL databases to manage data on different projects. These databases can contain a variety of information ranging from nonproprietary data to personally identifiable information like social security numbers. Databases run the risk of cyber intrusion at all times. This paper gives a brief explanation of NoSQL and thoroughly explains a method of Incidence Response with MongoDB, a NoSQL database provider. This method involves an automated process with a new self-built software tool that analyzing MongoDB …
Low Budget Forensic Drive Imaging Using Arm Based Single Board Computers,
2016
Sam Houston State University
Low Budget Forensic Drive Imaging Using Arm Based Single Board Computers, Eric Olson, Narasimha Shashidhar
Journal of Digital Forensics, Security and Law
Traditional forensic analysis of hard disks and external media typically involves a powered down machine and “dead analysis” of these devices. Forensic acquisition of hard drives and external media has traditionally been by one of several means: standalone forensic duplicator; using a hardware write-blocker or dock attached to a laptop, computer, workstation, etc., forensic operating systems that live boot from a USB, CD/DVD or virtual machines with preinstalled operating systems. Standalone forensics acquisition and imaging devices generally cost thousands of dollars. In this paper, we propose the use of single board computers as forensic imaging devices. Single board computers can …
In-The-Wild Residual Data Research And Privacy,
2016
University of South Alabama
In-The-Wild Residual Data Research And Privacy, William B. Glisson, Tim Storer, Andrew Blyth, George Grispos, Matt Campbell
Journal of Digital Forensics, Security and Law
As the world becomes increasingly dependent on technology, researchers in both industry and academia endeavor to understand how technology is used, the impact it has on everyday life, the artifact life-cycle and overall integrations of digital information. In doing so, researchers are increasingly gathering 'real-world' or 'in-the-wild' residual data, obtained from a variety of sources, without the explicit consent of the original owners. This data gathering raises significant concerns regarding privacy, ethics and legislation, as well as practical considerations concerning investigator training, data storage, overall security and data disposal. This research surveys recent studies of residual data gathered in-the-wild and …
Bytewise Approximate Matching: The Good, The Bad, And The Unknown,
2016
University of New Haven
Bytewise Approximate Matching: The Good, The Bad, And The Unknown, Vikram S. Harichandran, Frank Breitinger, Ibrahim Baggili
Journal of Digital Forensics, Security and Law
Hash functions are established and well-known in digital forensics, where they are commonly used for proving integrity and file identification (i.e., hash all files on a seized device and compare the fingerprints against a reference database). However, with respect to the latter operation, an active adversary can easily overcome this approach because traditional hashes are designed to be sensitive to altering an input; output will significantly change if a single bit is flipped. Therefore, researchers developed approximate matching, which is a rather new, less prominent area but was conceived as a more robust counterpart to traditional hashing. Since the conception …
Security Analysis Of Mvhash-B Similarity Hashing,
2016
Indraprastha Institute of Information Technology Delhi
Security Analysis Of Mvhash-B Similarity Hashing, Donghoon Chang, Somitra Sanadhya, Monika Singh
Journal of Digital Forensics, Security and Law
In the era of big data, the volume of digital data is increasing rapidly, causing new challenges for investigators to examine the same in a reasonable amount of time. A major requirement of modern forensic investigation is the ability to perform automatic filtering of correlated data, and thereby reducing and focusing the manual effort of the investigator. Approximate matching is a technique to find “closeness” between two digital artifacts. mvHash-B is a well-known approximate matching scheme used for finding similarity between two digital objects and produces a ‘score of similarity’ on a scale of 0 to 100. However, no security …
An Automated Approach For Digital Forensic Analysis Of Heterogeneous Big Data,
2016
School of Computing, Electronics and Mathematics, Plymouth
An Automated Approach For Digital Forensic Analysis Of Heterogeneous Big Data, Hussam Mohammed, Nathan Clarke, Fudong Li
Journal of Digital Forensics, Security and Law
The major challenges with big data examination and analysis are volume, complex interdependence across content, and heterogeneity. The examination and analysis phases are considered essential to a digital forensics process. However, traditional techniques for the forensic investigation use one or more forensic tools to examine and analyse each resource. In addition, when multiple resources are included in one case, there is an inability to cross-correlate findings which often leads to inefficiencies in processing and identifying evidence. Furthermore, most current forensics tools cannot cope with large volumes of data. This paper develops a novel framework for digital forensic analysis of heterogeneous …
On Efficiency Of Distributed Password Recovery,
2016
Brno University of Technology
On Efficiency Of Distributed Password Recovery, Radek Hranický, Martin Holkovič, Petr Matoušek
Journal of Digital Forensics, Security and Law
One of the major challenges in digital forensics today is data encryption. Due to the leaked information about unlawful sniffing, many users decided to protect their data by encryption. In case of criminal activities, forensic experts are challenged how to decipher suspect's data that are subject to investigation. A common method how to overcome password-based protection is a brute force password recovery using GPU-accelerated hardware. This approach seems to be expensive. This paper presents an alternative approach using task distribution based on BOINC platform. The cost, time and energy efficiency of this approach is discussed and compared to the GPU-based …
Towards Syntactic Approximate Matching - A Pre-Processing Experiment,
2016
Korea University
Towards Syntactic Approximate Matching - A Pre-Processing Experiment, Doowon Jeong, Frank Breitinger, Hari Kang, Sangjin Lee
Journal of Digital Forensics, Security and Law
Over the past few years the popularity of approximate matching algorithms (a.k.a. fuzzy hashing) has increased. Especially within the area of bytewise approximate matching, several algorithms were published, tested and improved. It has been shown that these algorithms are powerful, however they are sometimes too precise for real world investigations. That is, even very small commonalities (e.g., in the header of a le) can cause a match. While this is a desired property, it may also lead to unwanted results. In this paper we show that by using simple pre-processing, we signicantly can in uence the outcome. Although our test …
Classification Of Silicone-Based Personal And Condom Lubricants Using Dart-Tofms,
2016
University of Central Florida
Classification Of Silicone-Based Personal And Condom Lubricants Using Dart-Tofms, Lauren Harvey
Electronic Theses and Dissertations
Sexual lubricants are used to enable sexual encounters. There are different types of sexual lubricants such as water-based, oil-based, and silicone-based. They come pre-applied to condoms and separately in bottles as personal lubricants. Although sexual lubricants are intended for consensual use, they are also unfortunately used during the commission of sexual assaults. The analysis of sexual lubricants facilitates sexual assault investigations. With the increased usage of condoms in sexual assault cases, the potential of collected DNA evidence in each case is reduced. In the absence of biological evidence, the presence of sexual lubricants after a sexual assault can provide an …
Characterization Of Post-Fire Priming Cup Residue Using Scanning Electron Microscopy Coupled With Energy Dispersive X-Ray Spectrometry,
2016
University of Central Florida
Characterization Of Post-Fire Priming Cup Residue Using Scanning Electron Microscopy Coupled With Energy Dispersive X-Ray Spectrometry, Molly Terry
Electronic Theses and Dissertations
Ammunition is most often comprised of a lead-based priming mixture which contributes to the traditional characteristics of gunshot residue (GSR). Due to the health risks often associated with lead, lead-free primer alternatives are becoming increasingly more popular. Thus, it is becoming more difficult to determine the presence of GSR based on traditional means, i.e. the presence of lead (Pb), barium (Ba), and antimony (Sb). Eight different ammunitions were purchased which consisted of one lead-based and one lead-free from four different manufacturers, including Winchester, Federal, Liberty, and Sellier & Bellot. Half of the rounds from each manufacturer and chemical composition (i.e. …
The Estimation Of Germ Line De Novo Mutation Rates Of Extended Sets Of Y-Str Haplotypes To Aid In The Differentiation Of Male Biological Relatives In Criminal Investigations,
2016
University of Central Florida
The Estimation Of Germ Line De Novo Mutation Rates Of Extended Sets Of Y-Str Haplotypes To Aid In The Differentiation Of Male Biological Relatives In Criminal Investigations, Nicole Masker
Electronic Theses and Dissertations
An important forensic application for Y-chromosome short tandem repeats (Y-STRs) is the identification of male DNA. Since the Y-chromosome is non-recombining and most Y-STRs have slippage mutation rates on the order of 1x10-3 or lower, Y-STR commercial multiplex systems do not yet allow personal individualization. This is problematic in criminal investigations where the persons of interest include males of the same paternal line. In order to obtain discrimination among paternal male relatives, it would be necessary to use a larger number of Y-STRs or a selection of Y-loci with higher slippage mutations with the hope of encountering a germline meiotic …
Digital Forensics In Law Enforcement: A Needs Based Analysis Of Indiana Agencies,
2016
Purdue University
Digital Forensics In Law Enforcement: A Needs Based Analysis Of Indiana Agencies, Teri A. Cummins Flory
Journal of Digital Forensics, Security and Law
Cyber crime is a growing problem, with the impact to society increasing exponentially, but the ability of local law enforcement agencies to investigate and successfully prosecute criminals for these crimes is unclear. Many national needs assessments have previously been conducted, and all indicated that state and local law enforcement did not have the training, tools, or staff to effectively conduct digital investigations, but very few have been completed recently. This study provided a current and localized assessment of the ability of Indiana law enforcement agencies to effectively investigate crimes involving digital evidence, the availability of training for both law enforcement …
Verification Of Recovered Digital Evidence On The Amazon Kindle,
2016
Purdue University
Verification Of Recovered Digital Evidence On The Amazon Kindle, Marcus Thompson, Raymond Hansen
Journal of Digital Forensics, Security and Law
The Amazon Kindle is a popular e-book reader. This popularity will lead criminals to use the Kindle as an accessory to their crime. Very few Kindle publications in the digital forensics domain exist at the time of this writing. Various blogs on the Internet currently provide some of the foundation for Kindle forensics. For this research each fifth generation Kindle was populated with various types of files a typical user may introduce using one method, the USB interface. The Kindle was forensically imaged with AccessData’s Forensic Toolkit Imager before and after each Kindle was populated. Each file was deleted through …
Making Sense Of Email Addresses On Drives,
2016
U.S. Naval Postgraduate School
Making Sense Of Email Addresses On Drives, Neil C. Rowe, Riqui Schwamm, Michael R. Mccarrin, Ralucca Gera
Journal of Digital Forensics, Security and Law
Drives found during investigations often have useful information in the form of email addresses which can be acquired by search in the raw drive data independent of the file system. Using this data we can build a picture of the social networks that a drive owner participated in, even perhaps better than investigating their online profiles maintained by social-networking services because drives contain much data that users have not approved for public display. However, many addresses found on drives are not forensically interesting, such as sales and support links. We developed a program to filter these out using a Naïve …
Countering Noise-Based Splicing Detection Using Noise Density Transfer,
2016
Université Paris-Est
Countering Noise-Based Splicing Detection Using Noise Density Transfer, Thibault Julliand, Vincent Nozick, Hugues Talbot
Journal of Digital Forensics, Security and Law
Image splicing is a common and widespread type of manipulation, which is defined as pasting a portion of an image onto a second image. Several forensic methods have been developed to detect splicing, using various image properties. Some of these methods exploit the noise statistics of the image to try and find discrepancies. In this paper, we propose a new counter-forensic approach to eliminate the noise differences that can appear in a spliced image. This approach can also be used when creating computer graphics images, in order to endow them with a realistic noise. This is performed by changing the …
