Digital Forensic Science: Issues, Methods, and Challenges

Abstract

e Synthesis Lectures Series on Information Security, Privacy, and Trust publishes 50-to 100-page publications on topics pertaining to all aspects of the theory and practice of Information Security, Privacy, and Trust. e scope largely follows the purview of premier computer security research journals such as ACM Transactions on Information and System Security, IEEE Transactions on Dependable and Secure Computing and Journal of Cryptology, and premier research conferences, such as ACM CCS, ACM SACMAT, ACM AsiaCCS, ACM CODASPY, IEEE Security and Privacy, IEEE Computer Security Foundations, ACSAC, ESORICS, Crypto, EuroCrypt and AsiaCrypt. In addition to the research topics typically covered in such journals and conferences, the series also solicits lectures on legal, policy, social, business, and economic issues addressed to a technical audience of scientists and engineers. Lectures on significant industry developments by leading practitioners are also solicited.

A Python Library for Forensic File System Analysis

“…The File Allocation The latest version, called FAT32, had support for up to 2 TiB volume sizes, 4 GiB (-1 byte) maximum file sizes and, through the VFAT extension, could handle long file names 2 .…”

“…The VBR works as the filesystem's header, and stores metadata, values and pointers that guide the OS into loading the rest of the filesystem. The FAT is an array that, for every cluster in the filesystem, tells whether it is free or allocated, 2 T hough without it, it only supports 8.3 file names. and if allocated, which is the following cluster that makes up the file that it is part of.…”

“…Almost every digital forensic analysis involves the analysis of storage media, and consequently a filesystem of some kind. Filesystem forensic analysis requires searching fo r information, files, metadata, or remnants of these in the content of blocks, or the relevant structures [1,2].…”

Automated Waterloo Rubric for Concept Map Grading

“…The dataset has 20 concept maps on SCADA security covering topics on SCADA network protocols, ladder logic programming of programming logic controllers, cyberattacks on SCADA systems, and case studies on smart cities and power grid stations. 2) Digital Forensics -defined as the application of scientific tools and methods to identify, collect, and analyze digital artifacts in support of legal proceedings [25]. The dataset has 19 concept maps on digital forensics covering topics on evidence acquisition, file system analysis, sleuthkit and volatility frameworks, forensic analysis of web browsers and Windows registry.…”

Quantifying the Association Between Discrete Event Time Series with Applications to Digital Forensics

“…These general characteristics pose some challenges from the perspective of developing appropriate statistical models. Nonetheless, despite the challenges, there is a growing need for quantitative statistical approaches in digital forensics, given that existing forensic tools for digital evidence focus primarily on supporting the process of extraction of information from digital devices followed by exploratory analysis (for example see Casey (2011), Roussev (2016) and Årnes ( 2017)), with little support for statistical quantification.…”