Cyber Crime Investigation: Landscape, Challenges, and Future Research Directions

Abstract

As technology has become pivotal a part of life, it has also become a part of criminal life. Criminals use new technology developments to commit crimes, and investigators must adapt to these changes. Many people have, and will become, victims of cybercrime, making it even more important for investigators to understand current methods used in cyber investigations. The two general categories of cyber investigations are digital forensics and open-source intelligence. Cyber investigations are affecting more than just the investigators. They must determine what tools they need to use based on the information that the tools provide and how effectively the tools and methods work. Tools are any application or device used by investigators, while methods are the process or technique of using a tool. This survey compares the most common methods available to investigators to determine what kind of evidence the methods provide, and which of them are the most effective. To accomplish this, the survey establishes criteria for comparison and conducts an analysis of the tools in both mobile digital forensic and open-source intelligence investigations. We found that there is no single tool or method that can gather all the evidence that investigators require. Many of the tools must be combined to be most effective. However, there are some tools that are more useful than others. Out of all the methods used in mobile digital forensics, logical extraction and hex dumps are the most effective and least likely to cause damage to the data. Among those tools used in open-source intelligence, natural language processing has more applications and uses than any of the other options.

Computer Forensics Framework for Efficient and Lawful Privacy-Preserved Investigation

“…Privacy in DF and DF imaging are two different topics but related. Making a bit-by-bit forensic image for the whole storage device has already been proven to be an undesirable solution, especially when investigating large disk volumes, shared server, or distributed storage [5,13,17,22]. In DF labs, many cases are pending due to the huge volume of relevant data [23].…”

“…Recently, the privacy issue in DF stills widely discussed in the literature both from legal and technical sides. In [5,[12][13][14], the issue is reviewed and, as a result, more efforts are still required to address these issue.…”

“…For example, to enforce privacy protection acts while dealing with forensic data. Digital forensics examiners have to consider the relevant laws as the investigation result will end up in court [5]. Additionally, collected forensic data may contain files irrelevant to the crime and/or relevant to other unrelated users.…”

“…Another issue relevant to the privacy is the data volume. The forensic data is increased over the time which leads to increasing the investigation cost in terms of resources and time [5,13]. By the way, PP in DF mainly uses cryptography techniques which make the investigation cost, especially in terms of time, worse.…”

NLP-Based Digital Forensic Analysis for Online Social Network Based on System Security

“…The artifacts of DF identify the critical sources for social media evidence [ 40 , 41 ]. Thus, lots of research materials focus on the attainment of forensic evidence; the extraction of forensic information from social media concentrates on the identification of specific devices and detects the traces found by the device from the web browsers or media applications [ 42 , 43 , 44 , 45 ]. To collect the forensic data, the requirements are defined as relevant data collection from multiple websites, metadata collection from social media information, and certifying the data integration in the forensic collection [ 46 , 47 ].…”