Limewire examinations

Lewthwaite, Joseph; Smith, Victoria

doi:10.1016/j.diin.2008.05.017

Cited by 13 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the case of Gnutella, finding a matching GUID is considered extremely strong evidence tying the computer to network traffic, as the probability of a randomly generated GUID on this computer d i g i t a l i n v e s t i g a t i o n 7 ( 2 0 1 0 ) S 9 5 eS 1 0 3 matching a specific GUID is 1=2 128 z2:94 Â 10 À39 . Recovering the GUID is a well understood (Lewthwaite and Smith, 2008) process. 4 Additionally, the investigator may look for a shared folder, and compare its contents against the recorded browse results.…”

Section: Evidence Use and Validationmentioning

confidence: 99%

Forensic investigation of peer-to-peer file sharing networks

Liberatore

Erdely

Kerle

et al. 2010

Digital Investigation

View full text Add to dashboard Cite

a b s t r a c tThe investigation of peer-to-peer (p2p) file sharing networks is now of critical interest to law enforcement. P2P networks are extensively used for sharing and distribution of contraband. We detail the functionality of two p2p protocols, Gnutella and BitTorrent, and describe the legal issues pertaining to investigating such networks. We present an analysis of the protocols focused on the items of particular interest to investigators, such as the value of evidence given its provenance on the network. We also report our development of RoundUp, a tool for Gnutella investigations that follows the principles and techniques we detail for networking investigations. RoundUp has experienced rapid acceptance and deployment: it is currently used by 52 Internet Crimes Against Children (ICAC) Task Forces, who each share data from investigations in a central database. Using RoundUp, since October 2009, over 300,000 unique installations of Gnutella have been observed by law enforcement sharing known contraband in the the U.S. Using leads and evidence from RoundUp, a total of 558 search warrants have been issued and executed during that time.

show abstract

Section: Evidence Use and Validationmentioning

confidence: 99%

Forensic investigation of peer-to-peer file sharing networks

Liberatore

Erdely

Kerle

et al. 2010

Digital Investigation

View full text Add to dashboard Cite

show abstract

“…Cybercrimes are the crimes that are done using a phone or a computer. Abhijeet Ramani [5] provided various details and artifacts to help on tracing the illegal access of files from a system using an external USB flash drive and Swasti Bhushan Deb [3] highlights the timestamps and artifacts left by insertion and removal of USB devices in the Windows 8 registry, and to the best of our knowledge, there are no existing papers about artifacts left by the insertion and removal of USB devices in Windows 10 registry.…”

Section: Problem Backgroundmentioning

confidence: 99%

Case Based Interpretation of Windows 10 Registry Forensics

Binjuraid

Din

2018

Int J Innov Comp

View full text Add to dashboard Cite

With the advancement in computer technologies, cybercrimes advanced too. As in today’s world, the technology knowledge to attack a computer is less than ever, with the help of advanced tools that does most of the work. Digital forensic investigations are crucial in solving this type of crimes, and it must be done professionally. Computer registries play a big part in the digital forensic investigation, it can help find artifacts that are left by the cybercrimes, dates of the crimes on the computer system and the user at the time of the crime. In this research, interpretation of these artifacts is the main focus, committees and jurors are the focus of the interpretations of the registries. Two types of cases are subject to investigation in this research. BitTorrent clients’ use for downloading illegal o copyrighted content, and three clients are chosen for this digital forensic investigation uTorrent, Vuze and BitComet. Theft using USB storage devices is the second type of case, where there are three types of USB devices Mass Storage Class, Picture Transfer Protocol and Media Transfer Protocol, each type of USB devices leaves different artifacts behind during insertion and removal. A web based dashboard will be developed to help with the process of interpretation the artifacts found in the registry of the computer system. A categorization process of each cybercrime case will be conduct to evaluate the severity of the case depending on the artifacts found in the digital forensics investigation process. The research methodology will consist of three phases. The first phase will be information gathering including literature review, requirements gathering and dataset gathering for the research. Performing digital forensics analysis will be the second phase and it includes planning, identification and reconnaissance. Last phase will include result analysis and discussion.

show abstract

“…A volume slack space can be defined as the unused space between the end of the file system and the end of the partition where the file resides. Faked bad clusters can also be used for data hiding (Lewthwaite & Smith, 2008). The NTFS file system identifies bad clusters ($BadClus) that have defects in it using the MAT (Master File Table).…”

Section: Data Hidingmentioning

confidence: 99%

Attack Graph Analysis for Network Anti-Forensics

Chandran

Yan

2014

International Journal of Digital Crime and Forensics

View full text Add to dashboard Cite

The development of technology in computer networks has boosted the percentage of cyber-attacks today. Hackers are now able to penetrate even the strongest IDS and firewalls. With the help of anti-forensic techniques, attackers defend themselves, from being tracked by destroying and distorting evidences. To detect and prevent network attacks, the main modus of operandi in network forensics is the successful implementation and analysis of attack graph from gathered evidences. This paper conveys the main concepts of attack graphs, requirements for modeling and implementation of graphs. It also contributes the aspect of incorporation of anti-forensic techniques in attack graph which will help in analysis of the diverse possibilities of attack path deviations and thus aids in recommendation of various defense strategies for better security. To the best of our knowledge, this is the first time network anti-forensics has been fully discussed and the attack graphs are employed to analyze the network attacks. The experimental analysis of anti-forensic techniques using attack graphs were conducted in the proposed test-bed which helped to evaluate the model proposed and suggests preventive measures for the improvement of security of the networks.

show abstract

Limewire examinations

Cited by 13 publications

References 0 publications

Forensic investigation of peer-to-peer file sharing networks

Forensic investigation of peer-to-peer file sharing networks

Case Based Interpretation of Windows 10 Registry Forensics

Attack Graph Analysis for Network Anti-Forensics

Contact Info

Product

Resources

About