Search

Video streaming abuses range from copyright infringement and piracy to child sexual abuse and murder. This paper performs proactive forensics of Twitch video streaming activities on Android devices. We designed our experiments using a methodology based on black-box testing principles and conducted them on Android devices using a forensic framework. The results of our experiments suggest that forensic investigators can extract evidences of streams broadcast, shared, and watched by the user, and associate them with the Twitch account of the user. We detail all the recoverable artifacts of forensic significance, provide mechanisms to extract them based on the identified anchors, and interpret their significance in forensic investigations.

This paper investigates whether computer forensic tools (CFTs) can extract complete and credible digital evidence from digital crime scenes in the presence of file system anti-forensic (AF) attacks. The study uses a well-established six stage forensic tool testing methodology based on black-box testing principles to carry out experiments that evaluate four leading CFTs for their potential to combat eleven different file system AF attacks. Results suggest that only a few AF attacks are identified by all the evaluated CFTs, while as most of the attacks considered by the study go unnoticed. These AF attacks exploit basic file system features, can be executed using simple tools, and even attack CFTs to accomplish their task. These results imply that evidences collected by CFTs in digital investigations are not complete and credible in the presence of AF attacks. The study suggests that practitioners and academicians should not absolutely rely on CFTs for evidence extraction from a digital crime scene, highlights the implications of doing so, and makes many recommendations in this regard. The study also points towards immediate and aggressive research efforts that are required in the area of computer forensics to address the pitfalls of CFTs.

Forensics paved the way for the growth of anti-forensics, and the time has come for anti-forensics to return the favour. For that purpose, it is imperative that forensic investigators and practitioners are armed with the knowledge of contemporary anti-forensics types, techniques and tools. This article aims to provide technical information and a comprehensive understanding of file system anti-forensics types, techniques and tools so as to facilitate investigators' ability to collect technically credible and legally admissible digital evidence from crime scenes. Forensics paved the way for the growth of anti-forensics, which tries to prevent, hinder or corrupt the forensic process of evidence acquisition and analysis. The time has come for anti-forensics to return the favour. Mohamad Ahtisham Wani, Ali AlZahrani and Wasim Ahmad Bhat provide technical information and a comprehensive understanding of file system anti-forensics types, techniques and tools so as to facilitate investigators' ability to collect technically credible and legally admissible digital evidence from crime scenes.

This paper identifies forensically important artifacts of B-tree file system (Btrfs), analyses changes that they incur due to node-balancing during file and directory operations, and based on the observed file system state-change proposes an evidence-extraction procedure. The findings suggested that retrieving forensic evidence in a fresh B-tree file system is difficult, the probability of evidence-extraction increases as the file system ages, internal nodes are the richest sources of forensic data, degree of evidence-extraction depends upon whether nodes are merged or redistributed, files with size less than 1 KB and greater than 4 KB have highest chances of recovery, and files with size 3–4 KB have least chances of recovery.

In this digital age of mass surveillance and personal identity theft, data security and privacy is a major concern. Although sophisticated tools and software that guarantee privacy are easily available, users are increasingly becoming aware of their privacy concerns and look for solutions that enables them to secure data on their own, owing to its sensitivity and confidentiality. Anti-forensics has been at the forefront in data concealment by using novel data hiding and trail obfuscation techniques which promise great value when it comes to maintaining anonymity, privacy and confidentiality of data. This chapter takes a look at various anti-forensic techniques that promise value when it comes to data obscurity and discusses their potential in ensuring its security and privacy.

Anti-forensic techniques aim to prevent, hinder or corrupt the forensic process of evidence acquisition, its analysis, and/or its admissibility. File systems are at the spotlight of almost every fo...

The complex architecture and legal restrictions associated with cloud services make the acquisition of data from servers almost impossible in digital investigations involving cloud services. However, smartphones used to access these cloud services can serve as potential sources. In this paper, we investigate Sync.com and FlipDrive cloud client applications on Android platform for artefacts left behind by user activities. Our experiments demonstrate that rich information arising from user activities is left behind by these applications. This information includes installation details, login credentials, names and timestamps of files uploaded, downloaded, deleted and shared. The study also identifies mechanisms for extracting these artefacts from the devices. These findings assist forensic investigators in performing complete, credible and conclusive digital investigation by allowing them to create complete file management history of these applications. Finally, based on these findings, we make many recommendations relevant to the digital investigation involving these applications.