Search

Digital forensic practitioners will encounter digital traces during their examinations which they must take steps to understand. This may involve trying to attribute an ‘activity’ to a trace (what created it) or determine where it came from (its ‘source’) – Trace-to-Activity/Source interpretation. Alternatively, they may need to determine if an activity has taken place on a system by identifying traces denoting it – Activity-to-Trace interpretation. In both instances, practitioners may need to conduct tests and/or identify research which will help them understand a trace, and compare any results of their testing/research to the traces in their casework. This work describes both the Trace-to-Activity/Source and Activity-to-Trace interpretive journeys, as well as the steps contained in both. In addition, six ‘trace comparison criteria’ are proposed and discussed to help those carrying out a trace comparison, notably: ‘trace location’, ‘trace structure’, ‘trace examination method’, ‘trace metadata’, ‘trace content’, and ‘trace context’. [ABSTRACT FROM AUTHOR]

In England and Wales, Management of Sexual or Violent Offenders (MOSOVO) teams are often tasked with managing offenders that are subject to Sexual Harm Prevention Orders SHPOs. These orders are put in place to protect the public and contain a series of prohibitions that allow for an offender’s conduct to be regulated and reviewed. SHPOs can be used to govern how offenders use their digital devices, particularly with regard to accessing the internet and the sending of electronic communications. To ensure SHPO compliance, officers frequently conduct reviews of any offender’s devices, sometimes manually by traversing a device’s menus and screens. These device manual reviews are not easy to conduct, often done under time pressures and in the knowledge that any missed evidence of misconduct may facilitate an offender to continue any wrongdoing and potentially increase the risk of harm to members of the public. Further, it is not always technical specialists undertaking this role. This work outlines a manual review strategy for devices running the operating system iOS (Apple products) to support officers in this role. Guided by commonly included SHPO prohibitions, relevant digital traces for evaluating SHPO compliance are highlighted, and limitations surrounding determining user behaviour are also discussed. [ABSTRACT FROM AUTHOR]

The requirement to identify the cause of an incident, following the trail of events preceding an incident, as well as proving the consistency of the potential evidence recovered from the alleged incident, ultimately demand a proactive approach towards the design of digital forensic (DF) applications. Adding legal and scientific processes capable of absorbing the constant upgrade and update of digital devices that are accessory to the perpetration of digital crimes, complements the existing DF processes and standards. However, there is the need for such processes to be clearly defined in order to accommodate the non-technical stakeholders involved in digital crime investigations and decisions. To overcome the identified challenges, the current study proposes a digital forensic application requirements specification (DFARS) process. The DFARS process shows an easy-to-follow process that is comprehensible to both technical and non-technical stakeholders of digital forensics, while ensuring an easy-to-adopt design process when an updated component of a digital device is up for development. The applicability of the DFARS process is further demonstrated using an online neighbourhood watch (ONW) system as a case scenario. The ONW system is a DF application that crowd-sources for potential digital evidence (PDE) of neigbourhood crime. Using the DFARS process enhances the modifiability, pluggability and reliability features of the ONW system and any DF application. [ABSTRACT FROM AUTHOR]

This paper examines the design and implementation of a feasible technique for performing Digital Forensic Readiness (DFR) in cloud computing environments. The approach employs a modified obfuscated Non-Malicious Botnet (NMB) whose functionality operates as a distributed forensic Agent-Based Solution (ABS) in a cloud environment with capabilities of performing forensic logging for DFR purposes. Under basic Service Level Agreements (SLAs), this proactive technique allows any organization to perform DFR in the cloud without interfering with operations and functionalities of the existing cloud architecture or infrastructure and the collected file metadata. Based on the evaluation discussed, the effectiveness of our approach is presented as the easiest way of conducting DFR in the cloud environment as stipulated in the ISO/IEC 27043: 2015 international standard, which is a standard of information technology, security techniques and incident investigation principles and processes. Through this technique, digital forensic analysts are able to maximize the potential use of digital evidence while minimizing the cost of conducting DFR. As a result of this process, the time and cost needed to conduct a Digital Forensic Investigation (DFI) is saved. As a consequence, the technique helps the law enforcement, forensic analysts and Digital Forensic Investigators (DFIs) during post-event response and in a court of law to develop a hypothesis in order to prove or disprove a fact during an investigative process, if there is an occurrence of a security incident. Experimental results of the developed prototype are described which conclude that the technique is effective in improving the planning and preparation of pre-incident detection during digital crime investigations. In spite of that, a comparison with other existing forensic readiness models has been conducted to show the effectiveness of the previously proposed Cloud Forensic Readiness as a Service (CFRaaS) model. [ABSTRACT FROM AUTHOR]

In their 2009 report entitled ‘Strengthening forensic science in the United States: a path forward,’ the National Research Council (NRC) provided an assessment of the past, present, and future state of forensic science – especially related to impression evidence. The NRC described the need for further advances in some forensic science disciplines in order to improve criminal investigations, reduce the possibility of wrongful convictions, and to enhance national security. Recent events in international and domestic terrorism and the identification of dozens of wrongful convictions have further demonstrated the need for forensic science to address new challenges. From the bioterrorism events within the United States related to the anthrax mailings, to the seemingly endless stream of improvised explosive devices in the Iraq/Afghanistan wars, forensic science has new demands and an increasingly important opportunity to play a vital role in the world’s major events. With this demand comes a requirement to enhance the very foundations on which many disciplines in forensic science rest. The need for objective, scientifically-based criteria for determining identifications has never been more important and it will take researchers and practitioners working together to move forensic science in the proper direction. [ABSTRACT FROM PUBLISHER]

Courtroom environments, which have been one of the last bastions of the oral tradition, are slowly morphing into cinematic display environments1. The persuasive oral rhetoric of lawyers is increasingly being replaced by compelling visual media displays presenting a range of digital evidence in a convincing and credible manner2. The digital age has brought a plethora of novel evidence forms, evidence detection methods, and new means of evidence presentation. In particular, three-dimensional reconstructions of evidence offer great potential in the field of forensic science, they can potentially help in the presentation of complex scientific, spatial and temporal data to a non-technical audience3. This paper outlines the forensic process in terms of the tasks and phases involved, specifically relating to the presentation of evidence represented in a digital media form. A range of examples of where evidence has been presented in courtrooms using digital media (particularly forensic animation and virtual reconstruction technology) are described. a There are a number of fundamental implications inherent in the shift from oral to visual mediation, and a number of facets of this modern evidence presentation technology need to be investigated and analysed. [ABSTRACT FROM AUTHOR]