Search

In an era in which social media platforms are proliferating and becoming primary communication channels, the identification of evidence for crimes from such platforms is crucial for digital forensics and legal proceedings. This paper presents a novel approach for systematically structuring and categorising digital attributes that are interlinked across social media platforms using digital ontologies, as well as a method for user profiling using domain-specific digital artefacts. The ontology models consist of classes with subclass distinctions for text, image, and video types of evidence. These models are flexible and can be expanded to include various social media platforms and evidence categories. Simultaneously, the user profiling method employs mathematical formulas and visual representations to develop comprehensive profiles of individuals based on extracted social media data. This methodology evaluates the relevance of a set of digital artefacts and related attributes, such as interests, location, and activities, using their weights. Additionally, the research addresses the legal and ethical considerations pertinent to the collection of data from social media. Despite the approaches’ immense potential for expediting evidence collection and developing insightful profiles, obstacles such as scalability, legal complexities, and data noise are identified. This work makes a substantial contribution to the development of digital forensics and cybercrime investigations involving social media platforms.

Rapid growth in technological criminal activities has drawn worldwide attention to cyber forensics. The objective of a cyber forensics is to provide situation awareness in terms of identification and preservation of digital evidence, extraction of information, and analysis of extracted information to facilitate time-critical decision making. However, Cyber Forensic Investigations (CFIs) still lack significant structure to provide reliable insight into major cyberattack patterns. Data from the Global Cyber Security Index (GCI) show that Pakistan lags far behind in technological and organizational initiatives, posing a threat to its national security. This article focuses on state coordinated CFI infrastructure to mitigate the occurrence of cybercrime challenges. Moreover, a conceptual model is established to address the infrastructure of CFI using policy approach, legal, technical, organizational, capacity building, and cooperative venture. This conceptual model is structured in pillars to simplify the CFI infrastructure. The goal of the study is to provide an empirical foundation for policymakers to develop a comprehensive framework for CFI in the country, and to offer insights and recommendations for improving the infrastructure to better combat cybercrime in Pakistan.

Cybercrime investigations rely heavily on digital evidence to establish links between suspects and the criminal conduct they are allegedly involved in. As a result, digital evidence must be protected since it is complex, volatile, and susceptible to alteration. In the digital evidence method, the chain of custody (CoC) is essential. As a result of the CoC, it is possible to establish that the evidence was never tampered with. Due to the inherent uncertainty of digital evidence, the trustworthiness of the CoC cannot be judged at this time. It is the duty of forensic examiners to challenge this inclination and publicly admit the inherent ambiguity in whatever evidence they use to make their decisions. This article suggests a new paradigm for maintaining the integrity of digital evidence in order to overcome these challenges. To handle the uncertainty generated by error-prone technologies while dealing with CoC documents, the new paradigm used a fuzzy hash inside the blockchain data structure. Traditional hashing methods are only able to tell whether two inputs are precisely the same or not because they are sensitive to even the smallest input changes. Using fuzzy hash functions, we can figure out how dissimilar two images are by comparing their similarities. As an example of how this paradigm may be applied to computer systems and make digital investigations more successful, we utilize image forensics as the focus of an in-depth look at how it works.

While Korean financial companies are currently providing electronic financial services by establishing the high-level information technology and security system in accordance with the Electronic Financial Supervision Regulations (EFSR), they are rarely equipped with digital forensic readiness (DFR) to maximize the capability to collect critical digital evidence (DE). So, there is a limit to identifying the root cause of financial incidents and securing admissible DE. In this paper, we present Financial Forensic Readiness as a Service in Korea (K-FFRaaS), as DFR of financial companies to acquire an admissible DE. Based on ISO/IEC 27043:2015 international standard, K-FFRaaS consists of 3 main processes groups, namely: Planning processes group, Implementation processes group, and Assessment processes group. The purpose of planning processes group is to prepare the organization to be forensically ready before potential incidents happen. The main task of implementation processes group is to carry out the processes defined in the planning processes group. The goal of assessment processes group is to evaluate whether the result of the implementation processes group is consistent with the objective of K-FFRaaS. The contribution of this research is to present that financial companies can adopt the systematic management procedure for identifying causes of incidents, storing potential DE, and presenting scientific evidence to a court of law through K-FFRaaS.

Digital evidence is increasingly used in juridical proceedings. In some recent legal cases, the verdict has been strongly influenced by the digital evidence proffered by the defense. Digital traces can be left on computers, phones, digital cameras, and also on remote machines belonging to ISPs, telephone providers, companies that provide services via Internet such as YouTube, Facebook, Gmail, and so on. This paper presents a methodology for the automated production of predetermined digital evidence, which can be leveraged to forge a digital alibi. It is based on the use of an automation, a program meant to simulate any common user activity. In addition to wanted traces, the automation may produce a number of unwanted traces, which may be disclosed upon a digital forensic analysis. These include data remanence of suspicious files, as well as any kind of logs generated by the operating system modules and services. The proposed methodology describes a process to design, implement, and execute the automation on a target system, and to properly handle both wanted and unwanted evidence. Many experiments with different combinations of automation tools and operating systems are conducted. This paper presents an implementation of the methodology through VBScript on Windows 7. A forensic analysis on the target system is not sufficient to reveal that the alibi is forged by automation. These considerations emphasize the difference between digital and traditional evidence. Digital evidence is always circumstantial, and therefore it should be considered relevant only if supported by stronger evidence collected through traditional investigation techniques. Thus, a Court verdict should not be based solely on digital evidence.