Intrusion Investigation

Casey, Eoghan; Daywalt, Christopher; Johnston, Andy

doi:10.1016/b978-0-12-374267-4.00004-5

Cited by 32 publications

(9 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Instead, SPN can represent a very valuable source of information during the ‘investigation’ phase, during which multiple hypotheses are formulated and validated. According to the scientific method applied to the digital forensics methodology [34], the investigation phase precedes the production of evidence and consists of the following steps: Data gathering and observation. Hypotheses formation. Hypotheses evaluation. Conclusions and reporting. Picture‐to‐identity linking results can conveniently be used during (2) and (3), that is, the formation of the hypotheses and their evaluation. In particular, it can be exploited to narrow the set of suspect identities in which the investigators concentrate their efforts to ultimately identify the culprit.…”

Section: Discussionmentioning

confidence: 99%

Sensor pattern noise and image similarity for picture‐to‐identity linking

Satta

Ciardulli

2015

IET Computer Vision

View full text Add to dashboard Cite

Picture sharing through social networks has become a prominent phenomenon, producing a large amount of data that law enforcers may be entitled to use, under the proper legal framework, as a source of information for investigating a crime. In this work, the authors exploit digital camera 'fingerprinting' based on noise residuals (sensor pattern noise or SPN) to achieve a novel forensic task, named picture-to-identity linking. It consists of finding social network accounts that possibly belong to the author of a certain photo (e.g. showing illegal content). The rationale is that the author of the offending photo has likely used the same camera for taking other (legal) pictures, and posted them in a social network account. The authors extend a previous work on the topic by coupling SPN with visual image similarity, a useful cue when pictures have been taken in the same environment (e.g. a room). The authors also improve the framework by allowing for multiple-image queries, and thoroughly evaluate the performance on two corpora of images from social network accounts, including the impact of image modifications. Reported results show a robust improvement with respect to the previous work, and prove the usefulness of picture-to-identity as an aid for digital forensic investigations. 2 Related work This section provides the necessary background on camera fingerprinting (Section 2.1) with particular regard to SPN, and briefly surveys known uses of CBIR techniques in image forensics (Section 2.2).

show abstract

Section: Discussionmentioning

confidence: 99%

Sensor pattern noise and image similarity for picture‐to‐identity linking

Satta

Ciardulli

2015

IET Computer Vision

View full text Add to dashboard Cite

show abstract

“…Specifically, a Tableau Forensic USB 3.0 Bridge (T8u) running firmware version 2.1.0.3 was used. This device prevents any new data from being written to the drive while allowing the data present to be read [40]. The write blocker was connected to a computer and using FTK Imager 4.5.0.3 a segmented bit by bit copy of the drive was created.…”

Section: Methodsmentioning

confidence: 99%

We are meeting on Microsoft Teams: Forensic analysis in Windows, Android, and iOS operating systems

Bowling

Seigfried‐Spellar

Karabiyik

et al. 2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

Microsoft released a new communication platform, Microsoft Teams, in 2017. Due in part to COVID-19, the popularity of communication platforms, like Microsoft Teams, increased exponentially. Given its user base and increased popularity, it seems likely that digital forensic investigators will encounter cases where Microsoft Teams is a relevant component. However, because Microsoft Teams is a relatively new application, there is limited forensic research on the application particularly focusing on mobile operating systems. To address this gap, an analysis of data stored at rest by Microsoft Teams was conducted on the Windows 10 operating system as well as on Android and Apple iOS mobile operating systems. Basic functionalities, such as messaging, sharing files, participating in video conferences, and other functionalities that Teams provides, were performed in an isolated testing environment. Cellebrite UFED Physical Analyzer and Magnet AXIOM Examine tools were used to analyze the mobile devices and the Windows device, respectively. Manual or non-automated investigation recovered, at least partially, the majority of artifacts across all three operating systems. In this study, a total of 77.6% of the populated artifacts were partially or fully recovered in the manual investigation. On the other hand, forensic tools used did not automatically recover many of the artifacts found with the manual investigation.Only 13.8% of artifacts were partially or fully recovered by the forensic tools across all three devices. These discovered artifacts and the results of the investigations are presented in order to aid digital forensic investigations.

show abstract

“…The main focus is to measure the accuracy of discovering digital evidence related to the prevalent issue of defamation (Kusbiyanto, 2022). The static forensics method is used to identify and collect relevant evidence from Twitter accounts (Casey, 2009). Analysis tools such as Belkasoft Evidence Center X, Belkasoft Remote Acquisition, and Paraben's E3 Universal are applied in this study, with the hope of further uncovering cases of defamation on Twitter (Mukti, 2017).…”

Section: Introductionmentioning

confidence: 99%

Digital Forensic Evidence Analysis In Revealing Defamation On Social Media (Twitter) Using The Static Forensics Method

Reski Badillah,

Andi Yulia Muniar,

Abd. Rahman

et al. 2023

ceddi j. inf. syst. technol.

View full text Add to dashboard Cite

This research addresses the persistent challenge of defamation, notably prevalent on the Twitter platform, where the discovery of digital evidence is hampered by robust privacy protections. The study aims to investigate and identify digital evidence in defamation cases on Twitter, focusing on optimizing the evidence discovery process. Employing static forensics to prevent data alterations during acquisition from devices associated with defamation, the research successfully uncovered various digital evidence, including text from deleted comments, usernames, emails, and deleted image files linked to defamation. Out of the initial 28 reported data instances, 22 pieces of evidence were identified, resulting in an impressive 79% accuracy rate. The investigative procedures align with the chain of custody, ensuring the reliability of the collected evidence. This study not only contributes valuable insights into digital evidence discovery in online defamation cases but also highlights the efficacy of static forensics as a method. These findings provide a foundation for robust digital forensic practices, crucial for addressing challenges posed by online defamation on social media platforms.

show abstract

Intrusion Investigation

Cited by 32 publications

References 2 publications

Sensor pattern noise and image similarity for picture‐to‐identity linking

Sensor pattern noise and image similarity for picture‐to‐identity linking

We are meeting on Microsoft Teams: Forensic analysis in Windows, Android, and iOS operating systems

Digital Forensic Evidence Analysis In Revealing Defamation On Social Media (Twitter) Using The Static Forensics Method

Contact Info

Product

Resources

About