Digital evidence obfuscation: recovery techniques

Software issues in digital forensics

“…We note also that the new super set of circuits under consideration (C3−1−9) is composed of circuits with larger total gate size than the original P (which was size 8). As indicated in the figure, the new family of |3| − |1| − [9] circuits has 99,157 members (assuming a NAND-only circuit basis Ω and assuming we create the set by fully enumerating all possible gate combinations up to the given total size bound). As program and input size grow, the number of possible program replacements also grows superexponentially.…”

“…However, the adversarial use of counter-forensic software and purposed tampering [9,10] give impetus for more robust integration between forensic software and operating system. Future operating systems need the ability to support integrated tools with capability for secure static (and live) system/hardware collection.…”

A methodology for the repeatable forensic analysis of encrypted drives

“…It must also be noted that in the case of encryption applied to files (as opposed to whole media) detecting that a file is encrypted, and not simple gibberish, obtaining the keys, and obtaining an appropriate decryption tool is everything that a forensic analyst needs to do, and this case has already been examined by a number of authors [21,7,13] which all offer more or less the same suggestions. In some cases these procedures have been intuitively extended to encrypted partitions or drives [9,8], but without considering the additional questions on the integrity of the evidence that this shift entails. For this reason we set out to create a sound and documented methodology for obtaining a plaintext version of the disk, which was evidently missing in literature.…”

Modelagem de ameaças antiforenses aplicada ao processo forense digital

“…Por meio dela é possível:  Prover sigilo na troca de dados em redes de computadores: o tráfego de rede pode ser cifrado utilizando protocolos padrões como SSL (Secure Sockets Layer), SSH (Secure Shell) ou TLS (Transport Layer Security)(BEER, STANDER e BELLE, 2014).A criptografia é usada legalmente e legitimamente em negócios, indústria, governos, instituições militares e indivíduos para garantir a privacidade das informações. Infelizmente, ela também pode ser usada por criminosos para esconder o fruto de seus crimes(CRAIGER, POLLITT e SWAUGER, 2005). Nesse contexto, a criptografia é uma ferramenta extremamente poderosa para frustrar ações periciais (BEER, STANDER e BELLE, 2014), sendo considerada por peritos como o método antiforense mais preocupante, conforme pesquisa realizada (apêndice I).DetecçãoA criptografia pode ser detectada visivelmente em algumas situações e em outras com o uso de ferramentas forenses.…”