Digital Forensics and Cyber Investigation

Crimes committed within electronic or digital domains, particularly within cyberspace, have become extremely common these days. Criminals are using technology to a great extent in committing various digital offences and creating new challenges for law enforcement agents, attorneys, judges, military, and security professionals. Digital forensics has become an incredible useful and invaluable tool in the detection of criminal activities, identifying and solving computer-based and computer-assisted crimes. This paper provides a brief introduction to digital forensics.

The computer is being used by majority of the people living today. There are linked to the computer either directly or indirectly. The computer systems are gaining their implementations in different departments. Either it is education or the military, the computers are to be found everywhere. The computers are being used for performing different operations in different fields. It has produced much easier ways of performing different tasks easing human being lives. In the past, when the computer was not commercial and there was very limited use of it, it was hard to manage time. With the implementation of computer systems everywhere, many tasks can be completed within short span of time. It is being used by the banks, businesses and other government organizations as well. They have been using the computer systems for record keeping and producing much easier ways for the customers and the people to use their services whenever they want to. The businesses rely on the storage of information about their customers and other related information.

Data mining technology is applied to fraud detection to establish the fraud detection model, describe the process of creating the fraud detection model, then establish data model with ID3 decision tree, and establish example of fraud detection model by using this model. As e-commerce sales continue to grow, the associated online fraud remains an attractive source of revenue for fraudsters. These fraudulent activities impose a considerable financial loss to merchants, making online fraud detection necessity. The problem of fraud detection is concerned with not only capturing the fraudulent activities, but also capturing them as quickly as possible. This timeliness is crucial to decrease financial losses.

The purpose of this study is to explore the evolving technology and systems to find a low cost, efficient and portable solution for hard disk drive forensic imaging.Hard Disk Drive Imaging is one of the most frequently used forensic process which finds its application in both traditional as well as digital crimes and has found massive implementation in detecting cyber-crime incidents leading to cyber warfare. An empirical research was conducted using combination of hardware's like Intel NUC, Raspberry Pi 3 Model B, Custom Forensic Workstation (CFW), write blockers etc. and software's like ENCASE and FTK imager to do forensic imaging using multiple hard drives. A comparative analysis of the imaging process using same identical media over various platforms was done.The research shows that Raspberry Pi 3 Model B is a cost effective solution when a small device is to be imaged. Intel NUC with its i3 processor performs better than custom forensic work station with i7 processor when imaging using FTK Imager. The process of imaging involves many intricacies in order to prove the authenticity of evidence in a court of law. Problem in this regard arose when imaging was done using FTK on Linux and analyzed using ENCASE. The format generated on Linux and that recognized by ENCASE is different. The integrity of evidence is thus put to question. It was observed that not all components of each system are needed consecutively for the task of imaging. Consequently if a system is assembled with necessary components, it can help in further reducing the cost drastically.

Many a times, it has been argued that over dependency on technology leads to deskilling, lack of innovation and creativity thus resulting in inferior or substandard work. With a field growing in both demand for personnel and market for forensic software, 'digital forensics' is certainly not spared. Lately, there has been an increase in the number of digital forensic tools being developed to aid the extraction, analysis and management of digital evidence. Various comparisons, opinions and debates on the effectiveness of digital forensic software tools and their forensic soundness continue to dominate forensic investigator networks, white papers and publications. Given this context, many digital forensic investigators have unfortunately placed an over reliance on 'push the button' tools whilst overlooking the importance of other skills attributes to the digital forensic process. This issue has been exacerbated by a number of digital forensic course providers who are placing an over-emphasis on computer forensic software tools at the expense of other skills in their curriculum. In this paper, the author will make the case that a digital forensic investigation is not solely dependent on software tools but is also affected by various other soft skills. In presenting this argument the author will first discuss the usefulness and shortcomings in the use of software tools. This will be followed by a study of other relevant digital forensic skills. The last section of the paper will present theoretical and field based findings leading to the proposed 'Digital Forensic Skills Framework' intended to act as a general guide for course providers, recruiters as well as practising and prospective digital forensic investigators in measuring skills maturity levels and optimal digital forensic skills set.

completely equipped to assimilate the detailed and complicated technical aspects of video forensics. Keywords Video forgery detection · Video tamper detection · Passive-blind video forensics · Video anti-forensics · Video content authentication · Video phylogeny detection · Video recapture detection · Video up-conversion detection

Forensics from volatile memory plays an important role in the investigation of cybercrime. The acquisition of RAM memory or other terms of RAM dump can assist forensic investigators in retrieving much of the information related to crime. Some commonly used tools for analyzing RAM include volatility. It has happened that many forensic investigators are thinking that they probably have malware in the RAM dump. And, if they do exist, they're still not very capable Malware Analysts, so it's hard for them to analyze the possibilities of malware in a RAM dump. The availability of tools such as volatility allows forensic investigators to identify and link the various components to conclude whether the crime was committed using malware or not. user tools such as volatility require command-based knowledge of text and malware analysis. This work is done to assist forensic investigators in detecting and analyzing possible malware from dump RAM. This work is based on the volatility framework and the result is a forensic tool for analyzing RAM dumps and detecting possible malware in it using machine learning algorithms in order to detect offline (not connected to the internet).

As we have seen several versions of Shamoon malware like 2 and 3
Generation , the fourth version has been spread, but it did not was
famous like version 3 . In this paper i will analyze the Shamoon 4
malware , which may be the next target in cyber conflict in middle
east.
Shamoon 3 gained fame in the media because the amount of damage
and the cost of recovery .Finally the virus overwrites the master boot
record of the infected computer, making it unusable.
It was later described as the "biggest hack
in history.
Several companies analyzed the third version, but
because the fourth 'version was not officially available,
no researcher analyzed it. In this paper i will analyze it.

Information security management (ISM) is an important endeavour in today’s world where data and information are now critical assets of businesses and government. The purpose of this study was to conduct an empirical exploration and appraisal of the current state of information security management within IHEs in Yola Nigeria through the set objectives and research questions. The study employed a documentary research and qualitative interview of three case study institutions of higher education within Yola metropolis to assess the state of their ISM.
The findings from the qualitative research shows that the IHEs were relatively aware of the threats such as social engineering, privilege misuse, and unauthorized modifications facing it. Majority of threats are from inside sources predominantly from students, while motives ranges from financial gains, academic gains and fun. The findings also revealed that all the case study institutions were still struggling with ISM as none of the institution had a documented and structured ISM program, an information security or cyber security unit charged with the responsibilities of information security. Information security awareness is still at the lowest level across the institutions. The top factors hindering ISM in the institutions are budgetary constraint, lack of top management support, lack of security professionals and internal politics while the top impact of a breach on IHEs are reputational damage, loss of public trust and financial loss.
The study based on the findings proposed an integrated ISM framework as recommendations for both the IHEs, government and regulatory bodies. The framework, which was derived from the primary data comprises of two main components (internal and external) with four iterative security objectives: prepare and assess, detect, defend and heal and recover.

Email merupakan salah satu fasilitas internet yang banyak digunakan untuk komunikasi dan bertukar informasi. Hal ini memungkinkan pihak ketiga menyalahgunakan email untuk mendapatkan informasi secara ilegal dengan mengubah identitas pengirim email dan menjadikannya seperti email yang berasal dari email yang sah (legitimate email), aktivitas tersebut biasa dikenal dengan istilah email spoofing. Untuk dapat mendeteksi adanya email spoofing, maka perlu adanya investigasi forensik email terhadap email spoofing. Salah satu teknik investigasi forensik email adalah menggunakan analisis header email (header analysis method). Teknik ini bekerja dengan memeriksa dan membandingkan value yang terdapat pada beberapa header email yang ditetapkan sebagai parameter deteksi email spoofing. Parameter yang digunakan dalam penelitian ini adalah header ‘From’, ‘Message-ID’, ‘Date’ dan ‘Received’. Jika value yang terdapat pada header tersebut identik, maka email tersebut adalah email yang sah (legitimate email), jika tidak maka email tersebut dikategorikan sebagai email spoofing.

There has been a wide usage of anti-computer forensics all over the world. This paper takes an overview of, and an analysis of the most widely used anti-forensic techniques in the world. Mostly, these techniques hide or make it unrecoverable digital tracks of a crime in any form of magnetic media. Computer forensics department holds the mandate of collecting as much information and documentation about a crime as possible, regardless of whether such information is computer related or not. As such, computer forensics identifies the discipline involved in the study of the techniques and methodologies necessary for collection, analysis and presentation of unequivocal evidence, necessary in legal proceedings. Innovatively, there are anti-investigation techniques, aimed at making information collected by automated tools as well as fresh-and-blood investigators. With the help of modern operating systems, especially by the nature of management of data, events, and information, it is easy to find these individuals. However, due to the different techniques applied by computer users, it is hard to find people who use anti-computer forensics.

In recent times, most of the data such as books, personal materials and genetic information digitally. This transformation gives rise to a field of Cyberspace. This newly created space, gave rise to a new set of crime Cybercrime, this lead to the development of securing the cyberspace and protecting against cybercrime. As more people started using cyberspace, more number of cybercrime were registered. As the number of crime increases, we are in need of help from Machine Learning. Machine Learning in the field of Cyber forensics, is a boon. In this paper we have an overview of Machine Learning in the field of Cyber Forensics and various method of it implementation. I. INTRODUCTION 1) Deep Learning and Machine Learning: The field of Artificial Intelligence and Machine Learning has been around since a long time but it is now that we have enough computational power to effectively develop strong artificial neural networks (ANN) in a reasonable time frame with the help of strong hardware and software support. The most important aspect of Cyber security involves protecting key data and devices from cyber threats. It's an important part of corporations that collect and maintain large databases of client data, social platforms wherever personal information were submitted and also the government organizations wherever secret, political and defence information comes into measure. Unlike the traditional machine learning algorithm that uses feature engineering and illustration ways. They will chose the best options by themselves. 2) Cyber Security: Cyber security is that the set of framework and processes designed to protect computers, networks, programs, and data from attack, unauthorized access, change, or destruction. These frameworks are consist of network security and host security systems, every of those has a minimum firewall, antivirus computer code, associated an intrusion detection system. 3) Deep Learning and Cyber Security: This survey summarizes the association of cyber security and Deep learning techniques (DL). Deep learning technique are being used by researchers in recent days. Deep learning can be used alongside the prevailing automation ways like rule and heuristics based and machine learning techniques. This survey helps is understand the benefits of deep learning algorithms to classify and tackle malicious activities that perceived from the varied sources like DNS, email, URLs etc. In recent days, non-public firms and public establishments are dealing with constant and complicated cyber threats and cyberattacks. As a precaution, organizations should build and develop a cybersecurity culture and awareness so as to defend against cyber criminals. 4) Shared Task: In this shared task conference, the train data set will be distributed among the participants and the train model will be evaluated based on the test data set. This is most common in NLP area recently shared task on identifying phishing email has been organized by. The details of the submitted runs are available throughout. Followed by shared task on detecting malicious domain organized intruders. These two shared tasks enables the participants to share their approach through working notes or system description paper. Each year there is one more shared task conducted by CDMC. But they don't provide us an option to submit system description papers. But recently they are giving an option to submit system description papers (CDMC 2018). One significant issue was that the available data sets are very old and each data set has their own limitations. The main issue we face now is due to the non-maintenance of Cybercrime data. To overcome such issues a brief investigative issue made to understand the need of Security domain, datasets and key feature of data sciences is discussed in for problems employing the data science towards cyber security. The need for such dataset in to be promoted.

La facilità tecnica ed economica di creare un deepfake rende opportuno modificare l'approccio alle regole che disciplinano l'efficacia probatoria dei documenti informatici. L'esame di alcune ipotesi di prova consistente in una registrazione audio utilizzata come prova in processo dimostra la necessità di una regola che applichi la digital forensics che diminuisca il rischio di alterazione dei files

With the increase in technology over the past 30 years, the digital and computer fields have been booming with new ways to harness data and organize someone’s life. Smart devices have become an everyday convenience for millions throughout the world. With the advent of technology, comes more crime and criminal undertaking in the digital realm. Home computers and smart devices have become a hub for criminal records, activity, and conducting business all at the comfort of a criminal’s fingers and behind a screen.

This is where digital forensics come in, the adaptability of law enforcement in today’s technological universe. As more people are becoming “wired,” so are law enforcement and forensics professionals. Digital evidence is characterized as “information stored or transmitted in binary form that may be relied on in court. It can be found on a computer hard drive, a mobile phone, a personal digital assistant (PDA), a CD, and a flash card in a digital camera, among other places” (National Institute of Justice, 2015).

Malware is currently growing rapidly, diverse and complex. But, human resources that can carry out malware analysis is limited, because special expertise is needed. Reverse engineering is one of many solution that can carry out malware analysis, because reverse engineering techniques can reveal malware code. On March 5, 2018, found spam email containing files, the file contained malware flawed ammyy. This flawed ammyy is a software that comes from Ammyy Admin version 3 and then misused by hackers TA505. This study aims to identify the malware, especially the Flawed Ammyy RAT malware. This research uses descriptive methodology, then to do malware analysis used dynamic analysis and reverse engineering methods. The results of the study show that the Flawed Ammyy RAT malware works by hiding in the Ammyy Admin application then connecting to the attacker with ip address 103.208.86.69. netname ip address 103.208.86.69 is zappie host. There are 50 registry changes that are carried out by malware on infected systems. After the attacker has been connected with the victim, the attacker can easily do the remote control without the victim's knowledge. Abstrak  Malware saat ini berkembang dengan pesat, beragam dan komplek. Namun kurangnya sumber daya manusia yang dapat melakukan analisis malware karena diperlukan keahlian khusus. Reverse engineering merupakan salah satu solusi untuk melakukan analisis malware karena menggunakan teknik reverse engineering kode pada malware dapat diketahui. 5 Maret 2018 ditemukan spam email yang berisi file, file tersebut terdapat malware flawed ammyy. Flawed ammyy ini merupakan software yang berasal dari Ammyy Admin versi 3 kemudian disalah gunakan oleh hacker TA505. Penelitian ini bertujuan untuk melakukan proses identikasi malware kususnya malware Flawed Ammyy RAT. Penelitian ini menggunakan metodologi deskriptif, kemudian untuk melakukan analisis malware digunakan metode analisis dinamis dan reverse engineering. Hasil dari penelitian menunjukan bahwa malware Flawed Ammyy RAT bekerja dengan bersembunyi pada aplikasi Ammyy Admin kemudian melakukan koneksi dengan attacker dengan ip address 103.208.86.69. netname ip address 103.208.86.69 adalah zappie host. Perubahan 50 registry yang dilakukan malware pada system yang terinfeksi. Setelah attacker terkonesi dengan korban maka attacker dengan mudah melakukan remote control tanpa sepengetahuan korban. Kata Kunci  Ammyy, Flawed, Engineering, Malware, Reverse I. PENDAHULUAN Internet telah menjadi bagian penting dari kehidupan sehari-hari bagi orang-orang. Internet dapat membantu seseorang memanfaatkan banyak layanan hanya dengan bantuan beberapa klik [1]. Tingginya penggunaan internet menciptakan kejahatan tak hanya terjadi dalam dunia nyata, tetapi merambah ke dunia maya yang sering disebut sebagai cybercrime [2]. Kejahatan di dunia cyber saat ini beragam. Teknik yang digunakan oleh penyerang semakin beragam dan kompleks. Berbagai serangan tersebut diantranya melibatkan malicious software atau yang biasa disebut malware yang merupakan suatu program jahat [3]. Beragam tujuan yang dimiliki para pelaku ini beberapa diantaranya adalah untuk mencari kesenangan dan mencari keuntungan [4]. Malware diciptakan dengan maksud tertentu yaitu melakukan aktifitas berbahaya yang berdampak sangat merugikan bagi para korbannya, antara lain seperti penyadapan serta pencurian informasi pribadi [5]. Malware dapat berisi kode berbahaya seperti Virus, Worm, Trojan Horse, juga bisa membuat Back Door yang dapat melakukan pencurian informasi pribadi atau mengambil kendali sistem seseorang [6]. Seringkali malware masuk ke sistem melalui file yang diunduh. Setelah malware memasuki sistem, malware melakukan aktivitas dan merusak seluruh sistem [7]. Kemampuan untuk melakukan analisa malware bagi seorang investigator menjadi tuntutan dalam setiap melakukan investigasi. Meningkatnya sejumlah malware serta evolusi dan mampu beradaptasinya terhadap perangkat analisis yang selama ini digunakan [8]. Analisa malware dengan menggunakan Reverse engineering merupakan salah satu solusi yang bisa digunakan saat ini. Reverse engineering dalam analisis malware berguna untuk ekstraksi data yang memuat informasi yang ada didalam malware [9]. Para analis Proofpoint telah menemukan Trojan akses jarak jauh yang sebelumnya tidak terdokumentasi yang disebut Flawed Ammyy RAT [10]. Malware Flawed ammyy dibangun diatas kode Ammyy adminversi versi 3 yang disalah gunakan. Ammyy admin merupakan perangkat lunak desktop jarak jauh yang digunakan diantara jutaan konsumen dan bisnis untuk menangani remote control dan diagnosis pada platfom Windows, ini bukan pertama kalinya Ammyy admindisalahgunakan, serangan Juli 2016 juga menggunakannya untuk menyembunyikan malware [11].

The probability of having sensitive information retrieved from secondhand IoT devices has increased, even though the previous user removed data and deleted apps in those IoT devices. Due to the increase in flash memory storage technology, the ability to store residual information from various applications has improved. There has been a lot of identity theft reported due to the data acquired from secondhand machines. Recovering the deleted or formatted files from a user's device is easy to get. This study investigates retrieving data from secondhand memory cards from such devices. This paper examines how residual data are left in used IoT devices memory chips via a combined approach. One can recover data from secondhand phones, and the best way to wipe out such devices is to utilize software tools to prevent data leakage. To experiment with the data retrieval, Samsung Galaxy devices and other IoT devices were considered for the various ways in which new users can retrieve the data. In our preliminary results showed that our combined approach recovered more deleted data from secondhand phones.

In the wake of widespread proliferation of inexpensive and easy-to-use digital content editing software, digital videos have lost the idealized reputation they once held as universal, objective and infallible evidence of occurrence of events. The pliability of digital content and its innate vulnerability to unobtrusive alterations causes us to become skeptical of its validity. However, in spite of the fact that digital videos may not always present a truthful picture of reality, their usefulness in today’s world is incontrovertible. Therefore, the need to verify the integrity and authenticity of the contents of a digital video becomes paramount, especially in critical scenarios such as defense planning and legal trials where reliance on untrustworthy evidence could have grievous ramifications. Inter-frame tampering, which involves insertion/removal/replication of sets of frames into/from/within a video sequence, is among the most un-convoluted and elusive video forgeries. In this paper, we propose a potent hybrid forensic system that detects inter-frame forgeries in compressed videos. The system encompasses two forensic techniques. The first is a novel optical flow analysis based frame-insertion and removal detection procedure, where we focus on the brightness gradient component of optical flow and detect irregularities caused therein by post-production frame-tampering. The second component is a prediction residual examination based scheme that expedites detection and localization of replicated frames in video sequences. Subjective and quantitative results of comprehensive tests on an elaborate dataset under diverse experimental set-ups substantiate the effectuality and robustness of the proposed system.

Digital vision technologies emerged exponentially in all living areas to watch, play, control, or track events. Security checkpoints have benefited also from those technologies by integrating dedicated cameras in studied locations. The aim is to manage the vehicles accessing the inspection security point and fetching for any suspected ones. However, the gathered data volume continuously increases each day, making their analysis very hard and time-consuming. This paper uses semantic-based techniques to model the data flow between the cameras, checkpoints, and administrators. It uses ontologies to deal with the increased data size and its automatic analysis. It considers forensics requirements throughout the creation of the ontology modules to ensure the records’ admissibility for any possible investigation purposes. Ontology-based data modeling will help in the automatic events search and correlation to track suspicious vehicles efficiently.

The old adage, "seeing is believing", no longer holds true in modern society. Digital media has paved the way for anyone to doctor images and for videos to misrepresent truth. The lines between fact, entertainment, advertising, fabrication and fiction are becoming increasingly blurred as what is termed 'fake news' increases in modern day society. A natural consequence of the increase in fake news is the outcry for investigations into misinformation (think Cambridge Analytica). Investigations need to be forensically sound in order for any evidence to hold up in court. This research aims to propose forensic guidelines for the investigation of fake news by researching current fact checking methodologies and determining whether what is currently in place can be aligned to the current ACPO Forensic Guidelines. In order to do this, it first attempts to establish how easily a non-professional fact checker can detect fake news by carrying out a rudimentary fake news quiz. This was then followed by a review of 41 fact checkers to understand their fact checking methodologies and concluded with a basic fact checking experiment to test the veracity of a subset of the reviewed tools. In concluding, fake news investigations can be aligned to the current ACPO forensic guidelines, however, they will need to be specifically adapted to the three main categories of fake news: images, text and video.

Pasal 35 : Setiap Orang dengan sengaja dan tanpa hak atau melawan hukum melakukan manipulasi, penciptaan, perubahan, penghilangan, pengrusakan Informasi Elektronik dan/atau Dokumen Elektronik dengan tujuan agar Informasi Elektronik dan/atau Dokumen Elektronik tersebut dianggap seolah-olah data yang otentik.

Over the years researchers have proposed and developed models for extraction of digital evidence in mobile devices but little has been done on standardization of these models hence leading to inconsistencies in the extraction process used since most of the models developed cater for specific needs or a group of interest. In this paper we propose a metric for specification of a consistent digital forensic evidence extraction process in mobile devices to address the inconsistencies in existing digital forensic evidence extraction models for mobile devices running on android, windows, Apple iOS and Blackberry operating system. The proposed metric is aligned with Digital forensic principles and standard operating procedures (SOP), forensic and legal requirements, digital evidence quality, extraction tools and digital evidence legal admissibility. The metric has an integration of several factors such as policy, extraction method, nature of data, device factors, forensic extraction tools and forensic documentation process with consideration of the mobile device operating systems platform. This metric is relevant to law enforcement officers and digital forensic practitioners as well forensic extraction tool developers.

This paper presents a robust signature verification and forgery detection system using Additive fuzzy and TS modeling technique. The features of various handwritten signatures are sampled with proper analysis and encapsulated to devise an effective verification system. Grid method was used to extract features angles for detection of forgeries and verification of genuine signatures. In financial Accounting, Auditing and Forensic Investigation, signature forgery could occur in various ways. This could be carried out on papers, sales documents such as invoices or inventory procurement requisition paper, title documents on landed property or other tangible assets. It is also perpetrated on payment authorization such as cheques, payment vouchers both in cash and on bills. During this exercise, the fraud perpetrators perfect their concentration on the surface paper, and trace the original signature from the mandate given earlier. It has been difficult to use accounting and auditing profes...

With the growing number of digital forensic tools and the increasing use of digital forensics in various contexts, including incident response and cyber threat intelligence, there is a pressing need for a widely accepted standard for representing and exchanging digital forensic information. Such a standard representation can support correlation between different data sources, enabling more effective and efficient querying and analysis of digital evidence. This work summarizes the strengths and weaknesses of existing schemas, and proposes the open-source CybOX schema as a foundation for storing and sharing digital forensic information. The suitability of CybOX for representing objects and relationships that are common in forensic investigations is demonstrated with examples involving digital evidence. The capability to represent provenance by leveraging CybOX is also demonstrated, including specifics of the tool used to process digital evidence and the resulting output. An example is provided of an ongoing project that uses CybOX to record the state of a system before and after an event in order to capture cause and effect information that can be useful for digital forensics. An additional open-source schema and associated ontology called Digital Forensic Analysis eXpression (DFAX) is proposed that provides a layer of domain specific information overlaid on CybOX. DFAX extends the capability of CybOX to represent more abstract forensic-relevant actions, including actions performed by subjects and by forensic examiners, which can be useful for sharing knowledge and supporting more advanced forensic analysis. DFAX can be used in combinationwith other existing schemas for representing identity information (CIQ), and location information (KML). This work also introduces and leverages initial steps of a Unified Cyber Ontology (UCO) effort to abstract and express concepts/constructs that are common across the cyber domain.

A common task in digital forensics investigations is to identify known contraband images. This is typically achieved by calculating a cryptographic digest, using hashing algorithms such as SHA256, for each image on a given media, comparing individual digests with a database of known contraband.
However, the large capacities of modern storage media, and increased time pressure on forensics examiners, necessitates that more efficient processing mechanisms be developed. This work describes a technique for creating signatures for images of the PNG format which only requires a tiny fraction of the file to effectively distinguish between a large number of images. Highly distinct, and compact, such analysis lays the foundation for future work in fast forensics filtering using subsets of evidential data.

In this digital day and age, we are becoming increasingly dependent on multimedia content, especially digital images and videos, to provide a reliable proof of occurrence of events. However, the availability of several sophisticated yet easy-to-use content editing software has led to great concern regarding the trustworthiness of such content. Consequently, over the past few years, visual media forensics has emerged as an indispensable research  eld, which basically deals with development of tools and techniques that help determine whether or not the digital content under consideration is authentic, i.e., an actual, unaltered representation of reality. Over the last two dec- ades, this research  eld has demonstrated tremendous growth and innovation. This paper presents a comprehen- sive and scrutinizing bibliography addressing the published literature in the  eld of passive-blind video content authen- tication, with primary focus on forgery/tamper detection, video re-capture and phylogeny detection, and video anti- forensics and counter anti-forensics. Moreover, the paper intimately analyzes the research gaps found in the litera- ture, provides worthy insight into the areas, where the con- temporary research is lacking, and suggests certain courses of action that could assist developers and future researchers explore new avenues in the domain of video forensics. Our objective is to provide an overview suitable for both the researchers and practitioners already working in the  eld of digital video forensics, and for those researchers and gen- eral enthusiasts who are new to this  eld and are not yet
completely equipped to assimilate the detailed and compli- cated technical aspects of video forensics.

Digital vision technologies emerged exponentially in all living areas to watch, play, control, or track events. Security checkpoints have benefited also from those technologies by integrating dedicated cameras in studied locations. The aim is to manage the vehicles accessing the inspection security point and fetching for any suspected ones. However, the gathered data volume continuously increases each day, making their analysis very hard and time-consuming. This paper uses semantic-based techniques to model the data flow between the cameras, checkpoints, and administrators. It uses ontologies to deal with the increased data size and its automatic analysis. It considers forensics requirements throughout the creation of the ontology modules to ensure the records' admissibility for any possible investigation purposes. Ontology-based data modeling will help in the automatic events search and correlation to track suspicious vehicles efficiently.

Abstrak Malware merupakan salah satu bentuk dari kejahatan komputer yang terjadi pada sebuah sistem jaringan komputer, malware Njrat termasuk jenis Trojan horse. Trojan adalah salah satu jenis malware yang ikut berkembang di dalamnya, yang memungkinkan attacker masuk ke dalam sistem tanpa diketahui oleh pemilik. Penggunaan trojan saat ini lebih ke arah kejahatan dunia maya (cyber crime), salah satu dari malware yang sangat berbahaya karena besarnya dampak kerugian yang ditimbulkan, mulai dari pencurian data penting sampai mengubah hak akses pada PC korban. Sasaran terbanyak penybaran trojan adalah pengguna sistem operasi windows. Penyebaran trojan ini dilakukan dengan metode social engineering, yaitu teknik yang menggunakan kelemahan manusia, sehingga user tanpa curiga langsung mengeksekusi sebuah program yang tidak dikenal. Aktivitas malware berkaitan erat dengan performa PC dan juga aktifitas network pada system computer. Penelitian ini bertujuan untuk mengetahui cara kerja malware Njrat dan melakukan investigasi terhadap performa pada system computer. Metodologi yang digunakan dynamic analysis dengan melakukan analisa malware pada suatu sistem dan melihat aktivitas atau proses yang diaktifkan oleh malware tersebut. Dampak perubahan yang terjadi pada PC Target terlihat pada performa masing-masing PC yang telah disisipkan malware. Kata kunci Malware, Njrat, System computer I. PENDAHULUAN Kejahatan dunia maya setiap tahunnya mengalami peningkatan yang sangat pesat, hal ini dikarenakan semakin berkembangnya teknologi komputer yang berdampak pada kehidupan manusia. Segala kemudahan yang didapat dari teknologi komputer pada kenyataannya tidak hanya berdampak baik bagi kehidupan manusia karena beberapa diantaranya ternyata juga ikut memberikan dampak yang buruk. Banyak orang yang memanfaatkan teknologi komputer sebagai media untuk melakukan tindak kejahatan yang bertentangan dengan hukum. Beragam tujuan yang dimiliki para pelaku ini beberapa diantaranya adalah untuk mencari kesenangan mencari keuntungan. Banyak cara yang dilakukan untuk mempermudah kegiatan kejahatan yang melibatkan teknologi komputer ini salah satunya adalah memanfaatkan kelemahan sistem jaringan komputer dengan menyusupkan program yang digunakan sebagai media untuk mencuri informasi dari sebuah sistem komputer, program ini disebut sebagai malware [1]. Malware didefinisikan sebagai semua perangkat lunak jahat, program komputer jahat, atau perangkat lunak jahat, seperti virus (komputer), trojans, spyware, dan worm. Virus komputer bekerja dengan cara menempel pada suatu file komputer yang biasanya berupa file executable, trojan bekerja dengan cara melakukan social engineering files berbahaya dengan menampilkannya seperti files yang terlihat tidak berbahaya, spyware adalah perangkat lunak yang disisipi kode untuk mendapatkan informasi penting dari pengguna seperti akun bank, password, dan informasi lainnya yang diinginkan oleh pembuatnya, sedangkan worm adalah perangkat lunak jahat yang dibuat dengan memanfaatkan celah lubang keamanan pada sistem operasi untuk tujuan tertentu [2]. Dampak yang terjadi apabila PC terinfeksi malware yaitu PC akan berjalan semakin lambat mesikpun menggunakan spesifikasi PC dengan processor bagus dan RAM dengan jumlah banyak, akan tetapi jika PC terinfeksi malware akan berjalan lambat dan pada performa network tidak stabil [3]. Solusi untuk penccegahan agar PC terhindar dari malware dapat menggunakan aniti virus dengan versi terbaru yang sangat bagus untuk mendeteksi berbagai jenis malware. II. KAJIAN PUSTAKA Malware (singkatan dari istilah Bahasa Inggris malicious software, yang berarti perangkat lunak yang mencurigakan) adalah program komputer yang diciptakan dengan maksud dan tujuan tertentu dari penciptanya dan merupakan program yang mencari kelemahan dari software. Umumnya malware diciptakan untuk membobol atau merusak suatu software atau sistem operasi melalui script yang disisipkan secara tersembunyi oleh pembuatnya [4]. Berikut ini berbagai jenis Malware yang dinilai paling dominan menginfeksi komputer [5] :

The eternal preoccupation with multimedia technology is the precursor of us becoming a civilization replete with astonishing miscellanea of digital audio-visual information. Not so long ago, this digital information (images and videos especially) savored the unique status of ‘definitive proof of occurrence of events’. However, given their susceptibility to malicious modifications, this status is rapidly depreciating. In sensitive areas like intelligence and surveillance, reliance on manipulated visual data could be detrimental. The disparity between the ever-growing importance of digital content and the suspicions regarding their vulnerability to alterations has made it necessary to determine whether or not the contents of a given digital image or video can be considered trustworthy.

Digital videos are prone to several kinds of tamper attacks, but on a broad scale these can be categorized as either inter-frame forgeries, where the arrangement of frames in a video is manipulated, or intra-frame forgeries, where the contents of the individual frames are altered. Intra-frame forgeries are simply digital image forgeries performed on individual frames of the video. Upscale-crop and splicing are two intra-frame forgeries, both of which are performed via an image processing operation known as resampling. While the challenge of resampling detection in digital images has remained at the receiving end of much innovation over the past two decades, detection of resampling in digital videos has been regarded with little attention. With the intent of ameliorating this situation, in this paper, we propose a forensic system capable of validating the authenticity of digital videos by establishing if any of its frames or regions of frames have undergone post-production resampling. The system integrates the outcomes of pixel-correlation inspection and noise-inconsistency analysis; the operation of the system as a whole overcomes the limitations usually faced by these individual analyses. The proposed system has been extensively tested on a large dataset consisting of digital videos and images compressed using different codecs at different bit-rates and scaling factors, by varying noise and tampered region sizes. Empirical evidence gathered over this dataset suggests good efficacy of the system in different forensic scenarios.

Roman playwright Plautus once said, “One eyewitness weights more than ten hearsays – seeing is believing, all the world over.” The tendency to trust the evidence of our eyes is a biological predilection, and it applies not only to the first–hand real time assimilation of actual world events but to the indirect ingestion of these events through their pictorial representations as well, and amongst all the pictorial representations, images and videos have been acknowledged as the most accurate ways of depicting and documenting people and objects. This is primarily because images and videos act as imitations of the real world and the events that occur therein; they present an ‘image of the world’, which affects our perception the same way real–world stimuli do. But the significance of the influence of images and videos on our perception increases manifolds when it is used as evidence to make sensitive and consequential decisions that have long–term effects on our society.

Gaurav, a petroleum engineer, worked for Green Oil (names have been changed to maintain confidentiality and privacy) and was in possession of highly classified and critical data relating to research carried out by the company. Gaurav suddenly informed Green Oil that this critical data was missing from his laptop and stated that the data had been deleted from his system by an unknown attacker and that he could not find it in his system's Recycle Bin. He did not think that any other data was missing from his laptop. Green Oil naturally suspected malicious intent and that Gaurav and/or an unknown subject had deleted and potentially copied this data. While a backup of most of this data existed, to have it fall into the hands of a rival would be disastrous for Green Oil. The company hired our firm to investigate this matter quickly and quietly, and provided us with the necessary authorisations and permissions. Gaurav often used his system to connect to the internet besides connecting to the company's networks. At the time that Gaurav claimed this data went missing, he was working on site and was staying at a hotel. Free internet was one of the facilities provided by the hotel and Gaurav availed of it. The ultimate aim of any investigation is to first establish that an incident has occurred and then the identity of the perpetrator and the methodology of his attack. Therefore, it is one of the best practices followed by investigators to treat every case as an incident unless and until we have sufficient evidence to suggest that it was either not an incident or was accidental. In keeping with this practice we treated this case as incident and carried on from there. Thus, as investigators we needed to (a) get possession of the laptop in question and all other electronic devices in Gaurav's possession at that time, (b) recover the deleted data, (c) establish the reason/s for the data deletion and finally (d) establish the identity of the individual who deleted the data. Possession of the laptop was obviously required as that was where the data resided and from where we needed to locate it. Also it was the primary scene of the crime. The other electronic devices that could potentially be found in such a situation would be internet data cards, pen drives, memory cards, external hard drives, CDs, DVDs, mobile phones etc. These devices could possibly be secondary crime scenes and might contain trace or supporting evidence.