Digital Forensics through Application Behavior Analysis

Abstract

The field of digital forensic analysis has emerged in the past two decades to counter the digital crimes and investigate the modus operandi of the culprits to secure the computer systems. With the advances in technologies and pervasive nature of the computing devices, the digital forensic analysis is becoming a challenging task. Due to ease of digital equipment and popularity of Internet, criminals have been enticed to carry out digital crimes. Digital forensic is aimed to investigate the criminal activity and bring the culprits to justice. Traditionally the static analysis is used to investigate about an incident but due to a lot of issues related the accuracy and authenticity of the static analysis, the live digital forensic analysis shows an investigator a more complete picture of memory dump. In this paper, we introduce a module for profiling behavior of application programs. Profiling of application is helpful in forensic analysis as one can easily analyze the compromised system. Profiling is also helpful to the investigator in conducting malware analysis as well as debugging a system. The concept of our model is to trace the unique process name, loaded services and called modules of the target system and store it in a database for future forensic and malware analysis. We used VMware workstation version 9.0 on Windows 7 platform so that we can get the detailed and clean image of the current state of the system. The profile of the target application includes the process name, modules and services which are specific to an application program.

Behavioural Evidence Analysis

“…Thus, there is a need for a forensic investigation process that examines digital information in the form of digital evidence and identifies actors within an exchange, determines intent and behaviours, and ascertain a timeline of events (Al Mutawa, Bryce, Franqueira, Marrington, & Read, 2019). As the technological complexity and storage capabilities of digital devices is increasing (Rahman & N. A. Khan, 2016), the forensic digital investigations involving such systems would include a more intricate digital evidence procurement and analysis (Holt et al, 2018a;MacDermott et al, 2020).…”

“…The evidence in many cases is not sufficient to narrow down suspects. The difficulties can be overcome through a hybrid digital forensic task process (Rahman & N. A. Khan, 2016) that incorporates other dimensions like behavioural clues of the offender into the traditional DF process.…”

Detection of Suspicious Timestamps in NTFS using Volume Shadow Copies

“…Other crimes, such as those classified as cybercrimes, require that the digital forensic and the incident response teams take the lead in the digital investigation to interpret the digital evidences. The latter can be in different shapes including a recovered file fragments from browser history, email or application document [1] and can be retrieved from unusual components such as images, cookies, log files, time and frequency of user visiting the page [2]. In both cases, leading or helping to solve the crime, the digital investigator emits an expert opinion and hypotheses to answer the Five-W questions (Who, What, When, Where, Why) that may identify the perpetrator and link him/her to the victim in a digital manner using Digital Forensic tools [3].…”

Use of Electronic Evidence in Criminal Proceedings in Ukraine

“…Problematic issues of the use of electronic evidence in criminal proceedings have been the subject of research by foreign authors Kim H., Lee S., Mason S., Seng D. and others [13][14][15][16][17].…”