An Insight into Digital Forensics: History, Frameworks, Types and Tools

Jones, G. Maria; Winster, S. Godfrey

doi:10.1002/9781119795667.ch6

Cited by 9 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Multimedia forensics involves the attempts to explore, analyze, and retrieve information about multimedia such as images, audio, video, and text. Specifically, it is the analysis of digital multimedia content to produce evidence in the forensics domain [34]. Image forensics as an aspect of multimedia forensics investigates images by analyzing the authenticity and integrity of data to detect forgeries or manipulations as well as trace the history of the image.…”

Section: ) Multimedia Forensicsmentioning

confidence: 99%

See 1 more Smart Citation

Cryptographic Techniques for Data Privacy in Digital Forensics

Ogunseyi,

Adedayo

2023

IEEE Access

View full text Add to dashboard Cite

The acquisition and analysis of data in digital forensics raise different data privacy challenges. Many existing works on digital forensic readiness discuss what information should be stored and how to collect relevant data to facilitate investigations. However, the cost of this readiness often directly impacts the privacy of innocent third parties and suspects if the collected information is irrelevant. Approaches that have been suggested for privacy-preserving digital forensics focus on the use of policy, non-cryptography-based, and cryptography-based solutions. Cryptographic techniques have been proposed to address issues of data privacy during data analysis. As the utilization of some of these cryptographic techniques continues to increase, it is important to evaluate their applicability and challenges in relation to digital forensics processes. This study provides digital forensics investigators and researchers with a roadmap to understanding the data privacy challenges in digital forensics and examines the various privacy techniques that can be utilized to tackle these challenges. Specifically, we review the cryptographic techniques applied for privacy protection in digital forensics and categorize them within the context of whether they support trusted third parties, multiple investigators, and multi-keyword searches. We highlight some of the drawbacks of utilizing cryptography-based methods in privacy-preserving digital forensics and suggest potential solutions to the identified shortcomings. In addition, we propose a conceptual privacypreserving digital forensics (PPDF) model that is based on the use of cryptographic techniques and analyze the model within the context of the above-mentioned factors. An evaluation of the model is provided through a consideration of identified factors that may affect an investigation. Lastly, we provide an analysis of how existing principles for preserving privacy in digital forensics are addressed in our PPDF model. Our evaluation shows that the model aligns with many of the existing privacy principles recommended for privacy protection in digital forensics.

show abstract

Section: ) Multimedia Forensicsmentioning

confidence: 99%

“…Computer forensics focuses on the procedure of obtaining and analyzing computer-related information including data files, hard disk, file storage, hard disk, etc. [34]. Some aspects of computer forensics include disk forensics, memory forensics, and file system forensics.…”

Section: ) Computer Forensicsmentioning

confidence: 99%

Cryptographic Techniques for Data Privacy in Digital Forensics

Ogunseyi,

Adedayo

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Choosing the appropriate tools for the acquisition and analysis of memory forensics depends upon the compatibility between digital devices and operating systems, which may pose challenges to investigators [11]. Therefore, many existing studies have attempted to understand the strengths and weaknesses of memory acquisition tools.…”

Section: Related Workmentioning

confidence: 99%

The Influence of Virtual Secure Mode (VSM) on Memory Acquisition

Cahyani¹,

Jadied²,

Rahman³

et al. 2022

IJACSA

View full text Add to dashboard Cite

Recently, acquiring the Random Access Memory (RAM) full memory and access data is gaining significant interest in digital forensics. However, a security feature on the Windows operating system -Virtual Secure Mode (VSM) -presents challenges to the acquisition process by causing a system crash known as a Blue Screen of Death (BSoD). The crash is likely to occur when memory acquisition tools are being used. Subsequently, it disrupts the goal of memory acquisition since the system must be restarted, and the RAM content is no longer available. This study analyzes the implications of VSM on memory acquisition tools as well as examines to what extent its impact on the acquisition process. Two memory acquisition tools, namely FTK Imager and Belkasoft RAM Capturer, were used to conduct the acquisition process. Static and dynamic code analyses were performed by using reverse engineering techniques that are disassembler and debugger. The results were compared based on the percentage of unreadable memory between active and inactive VSM. Static analysis showed that there is no difference between all applications' functions for both active and inactive VSM. Further Bugcheck analysis of the MEMORY.DMP is pointed to the ad_driver.sys module in FTK Imager that causes the system to crash. The percentage of unreadable memory while running on active VSM and inactive VSM for Belkasoft is about 0.6% and 0.0021%, respectively. These results are significant as a reference to digital investigators as consistent with the importance of RAM dump in live forensics.

show abstract