Computer Forensics, Digital evidence acquisition

Electronic Evidence is “data or information of probative value that is stored or transmitted in the binary form”. This is a presentation made before 600 Prosecution officers from across India, it was hosted on BPRD platform and conducted by CAPT, MP. For better prosecution of crime against women, public prosecutors need to be equipped with latest case laws in Electronic Evidence and its appreciation

Some institutions provide online courses to students to ease the courses' workload. Online courses can also be convenient because the online course content management software conducts marking of tests and examinations. However, a few students could be willing to exploit such a system's weaknesses in a bid to cheat in online examinations because invigilators are absent. Proactive measures are needed and measures have to be implemented in order to thwart unacceptable behaviour in situations where there is little control of students' conduct. Digital Forensic Readiness (DFR) employs a proactive approach for an organisation to be forensically prepared for situations where there is little control over people. This can be achieved by gathering, storing and handling incident response data, with the aim of reducing the time and cost that would otherwise be spent in a post-event response process. The problem this paper addresses is that, at the time of writing this paper, there existed no known DFR architecture that can be used to collect relevant information for DFR purposes, specifically in the course of an online examination, as described in the standard published by the International Standards Organisation (ISO) and the International Electrotechnical Commission (IEC) (ISO/IEC 27043:2015) for incident investigation principles and processes. Due to the lack of DFR architecture, the authors propose an Online Examination Digital Forensic Readiness Architecture (OEDFRA) that can be used to achieve DFR when online examinations are conducted. This architecture employs already existing DFR techniques, discussed in the study, to help educational institutions achieve DFR in online examinations. This architecture, (OEDFRA), when implemented, will be tested in future research in order to confirm its contribution to the field of DFR.

El objetivo principal del presente artículo es proponer una guía metodológica que permita identificar la evidencia digital presente en los volcados de memoria de los sistemas operativos Microsoft Windows y GNU/Linux.
Para realizar este estudio es necesario precisar que se entiende por computación forense y cómo afecta esta definición el desarrollo específico de la guía metodológica. Este artículo examina la metodología que debe seguirse para garantizar que se cumplan estas condiciones al momento de analizar los volcados de memoria de los sistemas operativos.
En el desarrollo de la investigación se pretende profundizar en los conceptos de computación forense. Posteriormente, se propone una guía metodológica para realizar correctamente un análisis de los volcados de memoria. Finalmente, se busca identificar los rastros de virus y aplicaciones dañinas en los volcados de memoria. Se concluye estableciendo una comparación entre la información rescatada de los volcados de diferentes sistemas Operativos.

The primary focus of this article entitled ”Electronic and Computer Evidence in Proceedings before Courts and Labour Tribunals” is on evidence emanating from computers and other electronic devices, which account to a major share of evidence that is adduced before Courts and other Institutions administering Justice including Labour Tribunals. The article, is an offshoot of a handout I prepared for my lectures at the Sri Lanka Judges Institute for Judicial Officers which included Magistrates and District Judges as well as Presidents of Labour Tribunals. In the course of these lectures, I was asked to concentrate on the provisions of the Evidence (Special Provisions) Act of 1995 relating to (1) contemporaneous recordings made by the use of electronic or mechanical means and (2) computer evidence. I was also expected to deal with in some detail with the provisions of the Electronic Transactions Act of 2006, and the overlaps between these two pieces of legislation, in the context of certain principles embodied in our Evidence Ordinance of 1895, in particular the Best Evidence Rule and the Hearsay Rule. The task entrusted to me was somewhat challenging, and I had to engage in considerable research prior to delivering these lectures, and I considered it useful to publish a more simplified version of my lectures for the benefit of the members of the Bar and even others who conducted trial in the Labour Tribunals. The resulting publication appears in (2011) Bar Association law Journal Vol. XV at page 9.

The purpose of this study is to explore the evolving technology and systems to find a low cost, efficient and portable solution for hard disk drive forensic imaging.Hard Disk Drive Imaging is one of the most frequently used forensic process which finds its application in both traditional as well as digital crimes and has found massive implementation in detecting cyber-crime incidents leading to cyber warfare. An empirical research was conducted using combination of hardware's like Intel NUC, Raspberry Pi 3 Model B, Custom Forensic Workstation (CFW), write blockers etc. and software's like ENCASE and FTK imager to do forensic imaging using multiple hard drives. A comparative analysis of the imaging process using same identical media over various platforms was done.The research shows that Raspberry Pi 3 Model B is a cost effective solution when a small device is to be imaged. Intel NUC with its i3 processor performs better than custom forensic work station with i7 processor when imaging using FTK Imager. The process of imaging involves many intricacies in order to prove the authenticity of evidence in a court of law. Problem in this regard arose when imaging was done using FTK on Linux and analyzed using ENCASE. The format generated on Linux and that recognized by ENCASE is different. The integrity of evidence is thus put to question. It was observed that not all components of each system are needed consecutively for the task of imaging. Consequently if a system is assembled with necessary components, it can help in further reducing the cost drastically.

Many a times, it has been argued that over dependency on technology leads to deskilling, lack of innovation and creativity thus resulting in inferior or substandard work. With a field growing in both demand for personnel and market for forensic software, 'digital forensics' is certainly not spared. Lately, there has been an increase in the number of digital forensic tools being developed to aid the extraction, analysis and management of digital evidence. Various comparisons, opinions and debates on the effectiveness of digital forensic software tools and their forensic soundness continue to dominate forensic investigator networks, white papers and publications. Given this context, many digital forensic investigators have unfortunately placed an over reliance on 'push the button' tools whilst overlooking the importance of other skills attributes to the digital forensic process. This issue has been exacerbated by a number of digital forensic course providers who are placing an over-emphasis on computer forensic software tools at the expense of other skills in their curriculum. In this paper, the author will make the case that a digital forensic investigation is not solely dependent on software tools but is also affected by various other soft skills. In presenting this argument the author will first discuss the usefulness and shortcomings in the use of software tools. This will be followed by a study of other relevant digital forensic skills. The last section of the paper will present theoretical and field based findings leading to the proposed 'Digital Forensic Skills Framework' intended to act as a general guide for course providers, recruiters as well as practising and prospective digital forensic investigators in measuring skills maturity levels and optimal digital forensic skills set.

Mobile phone devices have become popular among every age and social grouping in every society and are utilised by lots of people for different purposes. As the design of Mobile phones are continually evolving due to advancement in present technologies, applications that run on them are also being updated to fully utilise features on new devices. Due to the flexibility and portability coupled with applications that make communication easy and accessible, these devices are now mostly used to perform e-transactions, social networking and even criminal activities. One of such applications is WhatsApp which over various versions have tried to maintain the confidentiality and integrity of messages sent and received using WhatsApp. Securing of data from Criminals or unauthorized users called for constant updating of the encryption scheme of the SQLite database which is usually saved on the memory of the device on which it is installed. Over many updates of WhatsApp, the encryption has been changed from db.crypt, db.crypt5, db.crypt7, db.crypt8 to db.crypt12. There is need for forensic expert to constantly update their knowledge so as to get the needed information from the database. This study presents a forensic process of extracting WhatsApp data from db.crypt12, which is the latest SQLite Database encryption used by WhatsApp to secure stored communication data. The steps involve using some open source tools that can be downloaded for free on the internet.

Forensic research into the data transferred from a hobby grade Unmanned Aerial Vehicle (UAV) commonly referred to as a
drone.

With drones decreasing in price and the increase in sophistication, leads to an increase in the use of drones for illegal
activities. As such this research project examines data that can be extracted and possible options to seek the launch
site and further information leading to the owner or owner’s location.

Özet—Usulüne uygun toplanmış ve analize tabi tutulmuş deliller,
suçun aydınlatılmasında soruşturma makamı için temel istihbarat
kaynağıdır. Delilin incelenmesi aşamasında kullanılan bilimsel
teknikler, doğru yer ve zamanda kullanıldığında doğruluğu
yüksek bilgi sağlayan temel kaynaklar arasında yer almaktadır.
Elektronik deliller günümüzde kolluk kuvvetlerinin en fazla
rastladığı deliller arasında bulunmaktadır. Elektronik delilleri;
kolaylıkla değiştirilebileceği, manipüle edilebileceği hatta fazla iz
bırakmadan silinebileceği ve yoktan var edilebileceği gerçekleri
karşısında, sayısal delillerin; toplanmasının, derlenmesinin,
nakledilmesinin ve analiz edilmesinin önemi bugün daha iyi
anlaşılmaktadır. Delili toplayan veya muhafaza altına alan
birimler delil bütünlüğünün korunarak ceza adalet sistemine
hukuki delil olarak girdi yapılmasından sorumludur. Bilgisayar,
bilgisayar kütükleri ve programlarında arama ve el koyma işlemi
CMK.’nın 134. maddesi ile Adlî ve Önleme Aramaları
Yönetmeliği’nin 17. maddesinde yer alan muğlâk ifadeler,
elektronik delillerin tespiti ve toplanması aşamasında art niyetli
kullanılmasına fırsat sağlamaktadır. Elektronik delillerin nasıl
kopyalandığından(imaj oluşturma) ziyade, bütünlüğünü
sağlayacak donanım ve yazılımların kullanılması ön plana
çıkmaktadır. Günümüzde adli kopyalama işlemlerinde yüksek
maliyetli adli kopyalama donanımlarının yanında açık kaynak
adli kopyalama yazılımları da kullanılmaktadır. Çalışmamızda
açık kaynak uygulamaların, adli kopyalamada güvenirliği konusu
ele alınmıştır.
Anahtar Kelimeler— Elektronik Delil, Adli Kopya (imaj), CMK
134, Açık Kaynak Uygulamaları, Delilin Toplanması, Bilgisayar
Adli İncelemesi, Yazma Koruma



Abstract—Duly collected and subjected to analysis according
evidence is basic intelligence source for the investigating
authorities to the elucidation of the crime. Scientific techniques
used in examining the evidence, the accuracy when used in the
right place and time, are among the main sources providing high
information. Electronic evidence today found that most of the
police force are among the evidence. Easy to replace the
electronic evidence, can be manipulated, even in the face of more
than a trace of can be deleted and the truth may be out of
nothing, the collection of digital evidence, the compilation, the
importance of transport for and analyzing is better understood
today. Collecting evidence or maintained under field units while
maintaining the integrity of the criminal justice system that is
responsible for making entries as legal evidence. Computers,
computer files and programs on the search confiscation cmk's
Article 134 of the Judicial and Prevention Searches Regulation
17. Located vague in substance, increase leads to malicious use of
the stage and collect detection of electronic evidence. Copied
rather than how to ensure the integrity of electronic evidence and
ISDFS 2015 Proceedings
forensic copies of the same party hardware and software ( image )
can be used in the creation. Today, besides the high cost forensic
duplication equipment for these processes are also used open
source software legal copy. In this study, we handled the integrity
and trustworthiness of open source acquisition tools.
Keywords — Electronic Evidence, Forensic images, CMK 134,
Open Source Applications, Evidence Collection, Computer
Forensics, Write Protection.

International criminal tribunals (ICTs) have found, almost consistently, that unlawfully and/or secretly obtained evidence is admissible. De facto, defendants in international criminal law (ICL) enjoy no privacy-related procedural safeguards under either the applicable domestic law or international human rights law (IHRL). Privacy violations are not confined to those impairing defendants' rights; they might result in premature acquittals or in misconducts vis-à-vis the victims, too. While this is practically unescapable a compromise due to the "high profile" of the accused and the complexity, length, momentousness, and "political charge" of these trials, over-relaxed admissibility rules become unsustainable as far as digital evidence is concerned, in that they add to the latter's inherently low reliability and heavy cognitive impact. Facing this issue, it is legit to wonder whether artificial intelligence (AI) might mitigate privacy violations or render them no longer necessary, thus improving the fairness record of the International Criminal Court (ICC) and other ICTs.

With the increase in technology over the past 30 years, the digital and computer fields have been booming with new ways to harness data and organize someone’s life. Smart devices have become an everyday convenience for millions throughout the world. With the advent of technology, comes more crime and criminal undertaking in the digital realm. Home computers and smart devices have become a hub for criminal records, activity, and conducting business all at the comfort of a criminal’s fingers and behind a screen.

This is where digital forensics come in, the adaptability of law enforcement in today’s technological universe. As more people are becoming “wired,” so are law enforcement and forensics professionals. Digital evidence is characterized as “information stored or transmitted in binary form that may be relied on in court. It can be found on a computer hard drive, a mobile phone, a personal digital assistant (PDA), a CD, and a flash card in a digital camera, among other places” (National Institute of Justice, 2015).

The advancement in technology especially the use of mobile devices has revolutionized the way of life in the 21st century. This ranges from the way people socialize to the modes of business that take place today. Consequently, mobile devices have become very vital part of life and thus contain substantial amounts of private data. Accordingly, in event of crime and/or security investigations, these gadgets carry with them crucial evidence that when adduced before any court of law can aid in resolving a number of undetermined cases and appeals. However, mobile digital forensics research is still faced with a number of challenges. One popular challenge is seeking a standard process model to make the digital forensic evidence extraction process accurate and consistent. Earlier process models proposed, present basic steps that can be categorized as: collection, Examination, Analysis and Reporting. This has sparked significant research and proposition of numerous process models to try and explain these steps further sophisticating the problem and creating more complexity and inconsistencies, for this reason, sporadic increase in the use of mobile devices and huge volumes of data they carry that can be adduced as potential evidence in the event of dispute or court proceedings has raised the need to develop standardized extraction process models and procedures for mobile devices running android operating system, in this paper we propose an algorithm and process flow model for the extraction of digital evidence in android devices that can be adapted to the latest release of android operating system especially given the ongoing rapid changing nature of mobile device. Using this algorithm and process flow model, a procedural experiment was done on the extraction of digital evidence from an android device. The results of this experiment highlights key steps that must be followed and carefully documented during evidence extraction from mobile devices in order to ensure consistency and reduction of the complexities in early proposed models.

The proliferation of mobile devices has revolutionized life in the 21 st century ranging from the way people socialize to the modes of doing business. Mobile devices contain substantial amounts of private data that in event of crime or security investigations when adduced before any court of law can aid in resolving a number of undetermined causes. However, mobile digital forensics research is still faced with several challenges. Most existing mobile devices digital forensic evidence extraction models are vendor-specific and thus anchored on specific device platforms such as Android, Windows, Apple iOS, and Blackberry. Additionally, these models contain various process inconsistencies and lack specified technical documentation. Further, the growing demand for mobile devices and crime-related occurrences affecting them has strained and exposed the existing models. A number of questions thus remain unanswered into the factors responsible for these inconsistencies and the lack of a unified model that can be applied across these four operating system platforms. A mixed-method approach involving a survey was used in this study where respondents were drawn from ICT practitioners, law enforcement agencies, researchers and the business community. This study highlights several factors that contribute to digital evidence extraction process model inconsistencies which include policy, extraction methods, nature of data, device type, data type, and extraction tools among others. The study proposes systematic documentation of every step followed during evidence extraction from mobile devices so as to avert the inconsistencies.

Over the years researchers have proposed and developed models for extraction of digital evidence in mobile devices but little has been done on standardization of these models hence leading to inconsistencies in the extraction process used since most of the models developed cater for specific needs or a group of interest. In this paper we propose a metric for specification of a consistent digital forensic evidence extraction process in mobile devices to address the inconsistencies in existing digital forensic evidence extraction models for mobile devices running on android, windows, Apple iOS and Blackberry operating system. The proposed metric is aligned with Digital forensic principles and standard operating procedures (SOP), forensic and legal requirements, digital evidence quality, extraction tools and digital evidence legal admissibility. The metric has an integration of several factors such as policy, extraction method, nature of data, device factors, forensic extraction tools and forensic documentation process with consideration of the mobile device operating systems platform. This metric is relevant to law enforcement officers and digital forensic practitioners as well forensic extraction tool developers.

jelen írás célja bemutatni az igazságügyi szakértői területet lefedő komplex keretrendszer egy elemét, amely a megalapozott szakértői véleményalkotást kívánja elektronikusan támogatni. A kutatások eredményeként kialakított lézerszkenneres felmérés segítségével pontos 3 dimenziós digitális modell készíthető a boncolásról, baleseti vagy bűnügyi helyszínről, mely utólag bármely pontból megtekinthető, körbejárható, elemezhető eredményterméket szolgáltat mind a Rendőrség, mind a szakértők, mind egyéb szervek részére a vizsgálat bármely szakaszában. A projekt, majd az ezt követően létrejövő komplex megoldás az igazságügyi szakértői intézetek, rendőrségi szervezetek, állami háttérintézmények, szakmai szolgáltatást végző vállalatok, egyetemek kutatólaborjai számára fog hatékony eszközt nyújtani folyamataik és költségeik optimalizálásához. The goal of the article is to present one module of the complex framework system covering the forensic processes, which supports electronically the preparation of a well-founded expert opinion. On the basis of the research results, an accurate three-dimensional digital model of the autopsy, accident or crime scene can be created with the laser scanning survey. Subsequently, the Police, experts and other bodies will be able to explore this result product from any point of view, walk it around or analyse at any stage of the investigation. The project and the emerging complex solution will give an effective tool to the forensic institutes, the Police, state background institutions, companies rendering professional services and university research laboratories to optimise their processes and costs.

Companies increasingly recur to digital communications and storage of documents. The change brought by digitalisation to the way in which companies operate creates opportunities but also a number of challenges for competition enforcement.
Competition authorities may adopt a number of digital tools and resources to strengthen their fight against cartels, which may allow them to search through high volumes of data in a swift manner and with a high degree of accuracy. However, the implementation of these tools may not always be straightforward. A few legal and practical challenges may arise in relation to the protection of the authenticity of the seized evidence and of the rights of defence of the company and its employees. In addition, internal coordination of resources and external co-operation may need to be implemented to ensure the full exploitation of the opportunities offered by these tools. This Issues Note will discuss some advantages and disadvantages of the most common digital tools for evidence gathering, and it will explore some of the legal and practical issues arising from their use, drawing from cases where competition authorities across the world dealt with the delicate phase of evidence gathering in cartel enforcement.

The importance of high quality, reliable forensic analysis-an issue that is central to the delivery of justice-has become a topic for marked debate with scientists, specialists and government bodies calling for improved standards and procedures. At the same time, Law Enforcement agencies are under pressure to cut the cost of criminal investigations. The detrimental impact that this has had on all forensic disciplines has been noted internationally, with the UK's House of Lords warning that if the trend continues, crimes could go unsolved and miscarriages of justice may increase. The pivotal role that digital forensics plays in investigating and solving modern crimes is widely acknowledged: in Britain, the police estimate it features in 90% of cases. In fact, today's law enforcement officers play a key part in the recovery, handling and automated processing of digital devices yet they are often poorly trained to do so. They are also left to interpret outputs, with the results being presented in court. This, it is argued, is a dangerous anomaly and points to a significant gap in the current, four-stage digital forensics process model (DFPM). This paper presents an extension to that model, the Digital Evidence Enhanced Process (DEEP), with the aim of fine-tuning the mechanism and ensuring that all digital evidence is scrutinised by a qualified digital forensics analyst. The consequence of adopting DEEP in actual criminal investigations will be to ensure that all digital evidence is analysed and evaluated to the highest professional and technical competency standards, resulting in the enhanced reliability of digital evidence presented in court which will serve the cause of justice in terms of reduced instances of associated unsafe convictions and/or unjustified exculpations.

Gaurav, a petroleum engineer, worked for Green Oil (names have been changed to maintain confidentiality and privacy) and was in possession of highly classified and critical data relating to research carried out by the company. Gaurav suddenly informed Green Oil that this critical data was missing from his laptop and stated that the data had been deleted from his system by an unknown attacker and that he could not find it in his system's Recycle Bin. He did not think that any other data was missing from his laptop. Green Oil naturally suspected malicious intent and that Gaurav and/or an unknown subject had deleted and potentially copied this data. While a backup of most of this data existed, to have it fall into the hands of a rival would be disastrous for Green Oil. The company hired our firm to investigate this matter quickly and quietly, and provided us with the necessary authorisations and permissions. Gaurav often used his system to connect to the internet besides connecting to the company's networks. At the time that Gaurav claimed this data went missing, he was working on site and was staying at a hotel. Free internet was one of the facilities provided by the hotel and Gaurav availed of it. The ultimate aim of any investigation is to first establish that an incident has occurred and then the identity of the perpetrator and the methodology of his attack. Therefore, it is one of the best practices followed by investigators to treat every case as an incident unless and until we have sufficient evidence to suggest that it was either not an incident or was accidental. In keeping with this practice we treated this case as incident and carried on from there. Thus, as investigators we needed to (a) get possession of the laptop in question and all other electronic devices in Gaurav's possession at that time, (b) recover the deleted data, (c) establish the reason/s for the data deletion and finally (d) establish the identity of the individual who deleted the data. Possession of the laptop was obviously required as that was where the data resided and from where we needed to locate it. Also it was the primary scene of the crime. The other electronic devices that could potentially be found in such a situation would be internet data cards, pen drives, memory cards, external hard drives, CDs, DVDs, mobile phones etc. These devices could possibly be secondary crime scenes and might contain trace or supporting evidence.