Anti Forensics

On April 4, 2017 a Syrian government air-attack at Khan Sheikhoun, Syria was followed by reports, photographs, and video data that indicated a significant number of casualties from exposure to toxic gases associated with the attack. This event was immediately followed by allegations that the deaths and injuries were caused by nerve agent released from a small crater produced by an air-dropped bomb on an asphalt covered road. The crater's size, shape, depth, contained debris, and surroundings were extensively documented in numerous videos and photographs, but until now, there has been no clear, science-based explanation of how the crater was formed. In this paper, we have applied advanced techniques from computational mathematics and mechanics to perform a forensic reconstruction of the crime scene. Based on 3D image analysis, we first show that the alleged site of the chemical attack had been tampered with, and essentially all of the public reports about the scene around the crater depend on observations made after the tampering had occurred. Using mathematical modeling that utilizes the pertinent mechanics of fluids, solids, fracture and explosion based on LS-DYNA, our supercomputer simulation results have demonstrated the following: 1) We show that a bomb of cylindrical shape and high length-to-diameter (L/D) ratio that was attached to a metal tube arrived at a high speed and loft angle-in excess of 200 m/s and 45° respectively-and detonated at the surface of the asphalt road. The high L/D of the explosive charge and the attached metal tube indicates that the explosive charge was the warhead of a short-range rocket and the metal tube was the rocket's spent motor casing. 2) The cylindrical shape of the explosive charge, its loft angle, and its detonation at the asphalt surface completely explain the tear-shape (noncircular) of the crater rim and the location of deepest point in the crater-which is at the round forward edge the tear-shaped crater-perimeter (the crater is not deepest at its middle). Our calculations also reveal in detail how the empty rocket motor casing was carried forward by momentum after the crater was produced by the much faster action of the explosion of the warhead. The calculations show how the forward-moving casing then gets buried in the crater's forward wall and bent at a large angle by a violent torque, similar to that produced when a pole vaulter converts forward

A large number of image forensics methods are available which are capable of identifying image tampering. But these techniques are not capable of addressing the anti-forensics method which is able to hide the trace of image tampering. In this paper anti-forensics method for digital image compression has been proposed. This anti-forensics method is capable of removing the traces of image compression. Additionally, technique is also able to remove the traces of blocking artifact that are left by image compression algorithms that divide an image into segments during compression process. This method is targeted to remove the compression fingerprints of JPEG compression.

Technology concerning mobile devices has presented revolutionary growth during the last decade. Mobile phones do not serve only as a means of communication, but also as portable computers with advanced communication capabilities. Smartphones are able to store a rich set of personal information and at the same time provide powerful services, such as location-based services, Internet sharing via tethering, and intelligent voice, thus increasing the likelihood of a such devices being involved in a criminal activities. Mobile forensics is the science of recovering digital evidence from a mobile device under forensically sound conditions using accepted methods. During the last few years, a significant amount of research has been conducted, concerning various mobile device platforms forensics, data acquisition schemes, and information extraction methods. This paper provides a comprehensive overview of the field, by presenting a detailed assessment of methodologies regarding Android forensic and anti-forensic techniques.

This Document provide full details on blood spatter analysis. This document reveals information pertaining to the types of blood spatter which is a potential to be found at a crime scene which involved the spilling of blood. The reader of this document will also be educated on the rationale behind blood and blood spatter.

The purpose of this study is to explore the evolving technology and systems to find a low cost, efficient and portable solution for hard disk drive forensic imaging.Hard Disk Drive Imaging is one of the most frequently used forensic process which finds its application in both traditional as well as digital crimes and has found massive implementation in detecting cyber-crime incidents leading to cyber warfare. An empirical research was conducted using combination of hardware's like Intel NUC, Raspberry Pi 3 Model B, Custom Forensic Workstation (CFW), write blockers etc. and software's like ENCASE and FTK imager to do forensic imaging using multiple hard drives. A comparative analysis of the imaging process using same identical media over various platforms was done.The research shows that Raspberry Pi 3 Model B is a cost effective solution when a small device is to be imaged. Intel NUC with its i3 processor performs better than custom forensic work station with i7 processor when imaging using FTK Imager. The process of imaging involves many intricacies in order to prove the authenticity of evidence in a court of law. Problem in this regard arose when imaging was done using FTK on Linux and analyzed using ENCASE. The format generated on Linux and that recognized by ENCASE is different. The integrity of evidence is thus put to question. It was observed that not all components of each system are needed consecutively for the task of imaging. Consequently if a system is assembled with necessary components, it can help in further reducing the cost drastically.

Studies towards image forensics are about a decade old and various forms of research techniques have been presented till date towards image forgery detection. Majority of the existing techniques deals with identification of tampered regions using different forms of research methodologies. However, it is still an open-end question about the effectiveness of existing image forgery detection techniques as there is no reported benchmarked outcome till date about it. Therefore, the present manuscript discusses about the most frequently addressed image attacks e.g. image splicing and copy-move attack and elaborates the existing techniques presented by research community to resist it. The paper also contributes to explore the direction of present
research trend with respect to tool adoption, database adoption, and
technique adoption, and frequently used attack scenario. Finally, significant open research gap are explored after reviewing effectiveness of existing techniques.

Recent papers have urged the need for new forensic techniques and tools able to investigate anti-forensics methods, and have promoted automation of live investigation. Such techniques and tools are called proactive forensic approaches, i.e., approaches that can deal with digitally investigating an incident while it occurs. To come up with such an approach, a Systematic Literature Review (SLR) was undertaken to identify and map the processes in digital forensics investigation that exist in literature. According to the review, there is only one process that explicitly supports proactive forensics, the multi-component process [1]. However, this is a very high-level process and cannot be used to introduce automation and to build a proactive forensics system. As a result of our SLR, a derived functional process that can support the implementation of a proactive forensics system is proposed.

A trusted platform module (TPM) contains a unique identity and provides a range of security functions. This paper outlines a client-server system utilizing a TPM-enabled computer to hinder forensic examination. The system allows for data confidentiality, plausible deniability, and hiding of traces that incriminating data was present on the client. The server will attest the client before allowing it to submit / receive incriminating data, and encrypted incriminating data can only be decrypted 1) by the encrypting client, and 2) if and only if the encrypting client's platform configuration matches that during encryption. The client's state can always be established via measurement results, and they cannot be tampered to fake attestation.

A Trusted Platform Module (TPM) contains a unique identity and provides a range of security functions. This paper demonstrates a novel approach of using a TPM-enabled computer in a client-server system to hinder forensic examination. The prime motivation for this is to highlight the implications of such TPM-based approach in digital forensics for law enforcement agents. The system allows for data confidentiality, plausible deniability, and hiding of traces that data containing incriminating information was present on the client. The server will attest the client before allowing it to submit or receive encrypted data, and encrypted data containing incriminating information can only be decrypted 1) by the encrypting client, and 2) if and only if the encrypting client's platform configuration matches that during encryption. The client's state can always be established via measurement results, and they cannot be tampered to fake attestation.