Digital Forensic Readiness Framework for Ransomware Investigation

Singh, Avinash; Ikuesan, Richard Adeyemi; Venter, Hein S.

doi:10.1007/978-3-030-05487-8_5

Cited by 31 publications

(19 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To address the lack of an automated mechanism for preserving evidence and maintaining integrity, a model was developed targeting the various security and forensic aspects during the investigation lifecycle. This model is an improvement of the authors' previous work [29]. The SecureRS model ties in with some of the readiness processes addressed in ISO/IEC 27043 [14].…”

Section: Securers Process Modelmentioning

confidence: 98%

Secure Storage Model for Digital Forensic Readiness

2022

Self Cite

View full text Add to dashboard Cite

Securing digital evidence is a key factor that contributes to evidence admissibility during digital forensic investigations, particularly in establishing the chain of custody of digital evidence. However, not enough is done to ensure that the environment and access to the evidence are secure. Attackers can go to extreme lengths to cover up their tracks, which is a serious concern to digital forensics particularly digital forensic readiness. If an attacker gains access to the location where evidence is stored, they could easily alter the evidence (if not remove it altogether). Even though integrity checks can be performed to ensure that the evidence is sound, the collected evidence may contain sensitive information that an attacker can easily use for other forms of attack. To this end, this paper proposes a model for securely storing digital evidence captured pre-and post-incident to achieve reactive forensics. Various components were considered, such as integrity checks, environment sandboxing, strong encryption, twofactor authentication, as well as unique random file naming. A proof-of-concept tool was developed to realize this model and to prove its validity. A series of tests were conducted to check for system security, performance, and requirements validation, Overall, the results obtained showed that, with minimal effort, securing forensic artefacts is a relatively inexpensive and reliable feat. This paper aims to standardize evidence storage, practice high security standards, as well as remove the need to create new systems that achieve the same purpose.

show abstract

Section: Securers Process Modelmentioning

confidence: 98%

Secure Storage Model for Digital Forensic Readiness

2022

Self Cite

View full text Add to dashboard Cite

show abstract

“…Therefore, in the data preservation stage, we proposed the method for converting raw data to the logical image file more efficient for data recovery [118] and preserving them. The backup files cannot be tampered because hash signatures are attached to the file [119], thereby ensuring the integrity and identity of PDE.…”

Section: ) Pde Collection and Preservation Implementationmentioning

confidence: 99%

K-FFRaaS: A Generic Model for Financial Forensic Readiness as a Service in Korea

Lee

Kim

2021

IEEE Access

View full text Add to dashboard Cite

While Korean financial companies are currently providing electronic financial services by establishing the high-level information technology and security system in accordance with the Electronic Financial Supervision Regulations (EFSR), they are rarely equipped with digital forensic readiness (DFR) to maximize the capability to collect critical digital evidence (DE). So, there is a limit to identifying the root cause of financial incidents and securing admissible DE. In this paper, there, the authors present Financial Forensic Readiness as a Service in Korea (K-FFRaaS), as DFR of financial companies to secure the admissible DE. Based on ISO/IEC 27043:2015 international standard, K-FFRaaS consists of 3 processes groups, namely: Planning processes group, Implementation processes group, and Assessment processes group. Planning processes group is the processes group to prepare the organization to be forensically ready before potential incidents happen. Implementation processes group is the stage to carry out the processes defined in the planning group. Assessment processes group consists of activities that evaluate whether the result of the implementation process group is consistent with the objective of K-FFRaaS. The contribution of this research is to present that the financial company can adopt the systematic management procedure for mitigating the causes of incidents, store admissible DE, and present scientific evidence to a court of law through K-FFRaaS.

show abstract

“…Two supportive, yet distinctive subdomains; proactive forensics and behavioral biometrics are further considered in this study, as is shown in Figure 1. Studies on the proactive forensics approach have mainly explored forensic readiness within the context of the ISO/IEC 27043:2015 standard [3]- [9]. Proactive approaches towards enhancing digital forensics suggest that measures can be implemented within the system under consideration in such a way that relevant and potentially useful pieces of evidence can be collected in a forensically sound manner prior to the occurrence of a digital incident.…”

Section: Introductionmentioning

confidence: 99%

Digital Forensics Subdomains: The State of the Art and Future Directions

et al. 2021

Self Cite

View full text Add to dashboard Cite

For reliable and relevant scientific evidence to be admitted in a court of law, it is important to apply digital forensic investigation techniques to corroborate a suspected potential security incident. Mainly, traditional digital forensics techniques have focused on computer desktops and servers. However, recent advances in digital media and platforms have seen an increased need for the application of digital forensic investigation techniques to other subdomains including small and mobile devices, databases, networks, cloudbased platforms, and the Internet of Things (IoT). To assist forensic investigators, conduct investigations within these subdomains, academic researchers have attempted to develop a number of investigative processes. However, many of these processes are domain-specific or describe domain-specific investigative tools. Hence, we hypothesize that the literature is littered with potentially overlapping and contradicting investigative process for conducting investigations within these subdomains. To investigate this hypothesis, a digital forensic model-orientated Systematic Literature Review (SLR) within the above digital forensic subdomains was undertaken. The purpose of the SLR was to identify the different and heterogeneous practices that have emerged within the specific subdomains. A key finding from the SLR is that there is a potential information overload and a high-degree of ambiguity among investigative processes in the above subdomains. The outcome of this study proposes a high-level abstract metamodel called The Digital Forensic Metamodel (DFM), which combines common processes, activities, techniques, and tasks for the above subdomains.

show abstract

Digital Forensic Readiness Framework for Ransomware Investigation

Cited by 31 publications

References 24 publications

Secure Storage Model for Digital Forensic Readiness

Secure Storage Model for Digital Forensic Readiness

K-FFRaaS: A Generic Model for Financial Forensic Readiness as a Service in Korea

Digital Forensics Subdomains: The State of the Art and Future Directions

Contact Info

Product

Resources

About