Digital behavioral-fingerprint for user attribution in digital forensics: Are we there yet?

Ikuesan, Richard Adeyemi; Venter, Hein S.

doi:10.1016/j.diin.2019.07.003

Cited by 25 publications

(11 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Bria [27] proposed five investigation processes, which are database identification, investigation, artefacts collection, analysis, and documentation. These processes have been widely explored in other domains of digital forensics, and have been proven to indeed demonstrate some tendency of overlap [2,3]. Therefore, clearly, all DBFI processes, activities, and tasks, are required to be specific, redundant and non-overlapping.…”

Section: Background and Related Workmentioning

confidence: 99%

“…A unique terminology along with an explicit definition is usually required to inform the reader on what each term in the process model meant [2]. This is particularly useful in digital forensics where the ambiguity of terms could result in litigation failure [3]. Otherwise, the reader may be in the dark about what the author is thinking and studying.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Categorization and Organization of Database Forensic Investigation Processes

et al. 2020

View full text Add to dashboard Cite

Database forensic investigation (DBFI) is an important area of research within digital forensics. It's importance is growing as digital data becomes more extensive and commonplace. The challenges associated with DBFI are numerous, and one of the challenges is the lack of a harmonized DBFI process for investigators to follow. In this paper, therefore, we conduct a survey of existing literature with the hope of understanding the body of work already accomplished. Furthermore, we build on the existing literature to present a harmonized DBFI process using design science research methodology. This harmonized DBFI process has been developed based on three key categories (i.e. planning, preparation and pre-response, acquisition and preservation, and analysis and reconstruction). Furthermore, the DBFI has been designed to avoid confusion or ambiguity, as well as providing practitioners with a systematic method of performing DBFI with a higher degree of certainty. INDEX TERMS Database forensics, database forensic investigation, digital forensics, investigation process model.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Categorization and Organization of Database Forensic Investigation Processes

et al. 2020

View full text Add to dashboard Cite

show abstract

“…This challenge can be attributed to the complexity of editing software, which has also evolved to enable inexperienced users to manipulate the content of digital data (with little effort) with a high-quality output. As a consequence, questions regarding media authenticity are of growing significance, particularly in litigation where important decisions might be based on the reliability of the digital evidence [6]. A proper chain of custody, as well as a chain of evidence are also required to ensure the repeatability and possible expert presentation of a digital artefact [6][7][8].…”

Section: Introductionmentioning

confidence: 99%

“…As a consequence, questions regarding media authenticity are of growing significance, particularly in litigation where important decisions might be based on the reliability of the digital evidence [6]. A proper chain of custody, as well as a chain of evidence are also required to ensure the repeatability and possible expert presentation of a digital artefact [6][7][8].…”

Section: Introductionmentioning

confidence: 99%

Realising a Push Button Modality for Video-Based Forensics

et al. 2021

View full text Add to dashboard Cite

Complexity and sophistication among multimedia-based tools have made it easy for perpetrators to conduct digital crimes such as counterfeiting, modification, and alteration without being detected. It may not be easy to verify the integrity of video content that, for example, has been manipulated digitally. To address this perennial investigative challenge, this paper proposes the integration of a forensically sound push button forensic modality (PBFM) model for the investigation of the MP4 video file format as a step towards automated video forensic investigation. An open-source multimedia forensic tool was developed based on the proposed PBFM model. A comprehensive evaluation of the efficiency of the tool against file alteration showed that the tool was capable of identifying falsified files, which satisfied the underlying assertion of the PBFM model. Furthermore, the outcome can be used as a complementary process for enhancing the evidence admissibility of MP4 video for forensic investigation.

show abstract

“…The rapid decline in traditional digital forensics (DF) practice has enabled the field of cloud forensics to have numerous advances and most importantly, digital investigation in the cloud resources, which has been at the center of these advances. This has been influenced by the increased complexity of attack tools, and cyber‐attack techniques, improved anti‐forensic strategies and the quest for attribution (Alruban, Clarke, Li, & Furnell, ; Ikuesan & Venter, , ). Often, the cloud forensics discipline, which is an amalgamation of DF and cloud computing, relies on purely extracting evidentiary digital artifacts from the cloud environment, which in real cases is open and distributed in nature.…”

Section: Introductionmentioning

confidence: 99%

Ontology‐driven perspective of CFRaaS

Kebande

Karie

Ikuesan

et al. 2020

WIREs Forensic Science

Self Cite

View full text Add to dashboard Cite

A Cloud Forensic Readiness as a Service (CFRaaS) model allows an environment to preemptively accumulate relevant potential digital evidence (PDE) which may be needed during a post‐event response process. The benefit of applying a CFRaaS model in a cloud environment, is that, it is designed to prevent the modification/tampering of the cloud architectures or the infrastructure during the reactive process, which if it could, may end up having far‐reaching implications. The authors of this article present the reactive process as a very costly exercise when the infrastructure must be reprogrammed every time the process is conducted. This may hamper successful investigation from the forensic experts and law enforcement agencies perspectives. The CFRaaS model, in its current state, has not been presented in a way that can help to classify or visualize the different types of potential evidence in all the cloud deployable models, and this may limit the expectations of what or how the required PDE may be collected. To address this problem, the article presents the CFRaaS from a holistic ontology‐driven perspective, which allows the forensic experts to be able to apply the CFRaaS based on its simplicity of the concepts, relationship or semantics between different form of potential evidence, as well as how the security of a digital environment being investigated could be upheld. The CFRaaS in this context follows a fundamental ontology engineering approach that is based on the classical Resource Description Framework. The proposed ontology‐driven approach to CFRaaS is, therefore, a knowledge‐base that uses layer‐dependencies, which could be an essential toolkit for digital forensic examiners and other stakeholders in cloud‐security. The implementation of this approach could further provide a platform to develop other knowledge base components for cloud forensics and security. This article is categorized under: Digital and Multimedia Science > Cloud Forensics Digital and Multimedia Science > Cyber Threat Intelligence Digital and Multimedia Science > Multimedia Forensics

show abstract

Digital behavioral-fingerprint for user attribution in digital forensics: Are we there yet?

Cited by 25 publications

References 25 publications

Categorization and Organization of Database Forensic Investigation Processes

Categorization and Organization of Database Forensic Investigation Processes

Realising a Push Button Modality for Video-Based Forensics

Ontology‐driven perspective of CFRaaS

Contact Info

Product

Resources

About