Proof of Concept of the Online Neighbourhood Watch System

Omeleze, Stacey; Venter, Hein S.

doi:10.1007/978-3-319-43696-8_9

Cited by 6 publications

(5 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For digital evidence to be forensically sound and to be held admissible in a court of law, its collection, storing, and analysis must be documented in a legally acceptable manner [16], [17], [31]. Therefore, assurance is needed to prove that the evidence has not been corrupted or destroyed during the investigation process, whether by accident or intentionally.…”

Section: B Forensic Soundness Assurance Processmentioning

confidence: 99%

Secure Storage Model for Digital Forensic Readiness

2022

View full text Add to dashboard Cite

Securing digital evidence is a key factor that contributes to evidence admissibility during digital forensic investigations, particularly in establishing the chain of custody of digital evidence. However, not enough is done to ensure that the environment and access to the evidence are secure. Attackers can go to extreme lengths to cover up their tracks, which is a serious concern to digital forensics particularly digital forensic readiness. If an attacker gains access to the location where evidence is stored, they could easily alter the evidence (if not remove it altogether). Even though integrity checks can be performed to ensure that the evidence is sound, the collected evidence may contain sensitive information that an attacker can easily use for other forms of attack. To this end, this paper proposes a model for securely storing digital evidence captured pre-and post-incident to achieve reactive forensics. Various components were considered, such as integrity checks, environment sandboxing, strong encryption, twofactor authentication, as well as unique random file naming. A proof-of-concept tool was developed to realize this model and to prove its validity. A series of tests were conducted to check for system security, performance, and requirements validation, Overall, the results obtained showed that, with minimal effort, securing forensic artefacts is a relatively inexpensive and reliable feat. This paper aims to standardize evidence storage, practice high security standards, as well as remove the need to create new systems that achieve the same purpose.

show abstract

Section: B Forensic Soundness Assurance Processmentioning

confidence: 99%

Secure Storage Model for Digital Forensic Readiness

2022

View full text Add to dashboard Cite

show abstract

“…Furthermore, the National Institute of Standards and Technology (NIST) 2 and McKemmish 19 suggest that carrying out digital forensic investigations or preparing an environment to be ready for a potential digital evidence collection or investigation in a cloud computing domain still poses some challenges. However, the DFR framework proposed in the current study attempts to address these challenges in the cloud computing domain while adhering to the preservation of digital evidence integrity, maintaining a chain of custody, obtaining appropriate authorizations and ensuring forensic soundness [20][21][22] . This is achieved by the integration of NLP techniques into public cloud forensics.…”

Section: Digital Forensicsmentioning

confidence: 99%

“…Although the DFI is an end-user of the cloud, they are tasked with the investigation of crimes post-mortem. The digital forensic investigations employ a chain of custody and evidence validation and also ensure the preservation of digital evidence integrity, adhering to legal requirements, while obtaining proper authorization 13,21,37,38 . Therefore, the NL trigger component of the DFR framework provides an incident scene detection for a DFI.…”

Section: Digital Forensic Investigatormentioning

confidence: 99%

“…According to the ISO/IEC 27043 15,16,21,22 , digital investigation is the use of scientifically derived and proven methods for the identification, collection, transportation, storage, analysis, interpretation or presentation of digital evidence derived from digital sources. In the process, authorization must be obtained for all activities to properly document activities, interact with the physical investigation, preserve digital evidence and maintain the chain of custody.…”

Section: Begin Digital Forensic Investigationmentioning

confidence: 99%

See 1 more Smart Citation

A natural human language framework for digital forensic readiness in the public cloud

Baror

Venter

Adeyemi

2020

Australian Journal of Forensic Sciences

View full text Add to dashboard Cite

Currently, about half of all global enterprises are adopting and using some form of cloud computing services. In cloud computing, potential digital evidence is distributed across multiple isolated virtual machine instances. Investigating deleted or inactive virtual instances of a cloud is a challenge to digital forensics, and the traditional methods of digital forensics are inadequate to address such digital forensic investigation. Users of the public cloud (whether a potential victim of a cyberattack, a cybercriminal or a digital forensic investigator) inherently communicate using natural human language in the form of sentences and semantics in document messaging such as texts, emails or instant messages. Consequently, natural human language interaction provides a unique identifier for cloud users. This study leverages the natural human language as an identifier to develop a novel digital forensic readiness (DFR) framework for cloud computing to detect cybercrime. The DFR framework comprises the integration of natural language processing techniques in designing a process that mimics a near real-time approach towards cybercrime detection in a cloud environment. Natural language understanding techniques are used to analyse textdata of users in the public cloud and textdata of reported cybercrimes to develop a DFR framework. In the preliminary formation of the DFR framework, the output shows that cybercrime attacks that are in progress in the form of textdata such as online documents, instant messages or emails within an organizational cloud domain can be identified, and potentially investigated swiftly, using the unique signature of users as identifiers. When adopted, the proposed DFR framework can minimize the time lapses in incident identification and reduce the subsequent investigation time of cybercrimes in the public cloud domain.

show abstract

“…At this point the captured digital data is potential digital evidence (PDE). In a previous research 19 , 20 , the detailed processes employed to ensure forensic soundness of the crowd-sourced PDE captured using the ONW system was dealt with. It will be up to the judiciary and law enforcement agents to determine if the PDE is actual evidence that is admissible in court.…”

Section: End-users Requirementsmentioning

confidence: 99%

Digital forensic application requirements specification process

Omeleze

Venter

2017

Australian Journal of Forensic Sciences

View full text Add to dashboard Cite

The requirements to identify the cause of an incident, following the trail of events preceding the incident, as well as proving the consistency of the potential evidence recovered from the alleged incident, ultimately demand a proactive approach towards the design of digital forensics (DF) applications. Success in the use of digital evidence for analysis or validation in digital forensic investigations depends on established processes, scientific methods, guidelines and standards that are used in the DF application designs and developments.Adding legal and scientific processes capable of absorbing the constant upgrades and updates in the design of DF applications is a boost to the already existing DF processes and standards. However, there is need for such processes to be clearly defined, so that non-technical audience involved in crime investigations and decisions, can easily comprehend the DF application designs and development processes.To proactively overcome this challenge, this paper proposes the digital forensic application requirements specifications (DFARS) process. The proposed DFARS process outlines an easy-to-apply design process for designing any DF application. It further demonstrates in a case scenario, how to apply the DFARS process using the online neighbourhood watch (ONW) system. The ONW system is a DF application that crowd-source potential digital evidence (PDE). One of the objectives of the ONW system is to increase the volume of available PDE to enhance success in prosecution of neighbourhood crime.Therefore using the DFARS process with the ONW system as a case scenario, the result shows that the DFARS process ensures an easy application of modifiability, pluggability and reliability features at any point in the life-cycle of a DF application. This thereby accommodates the constant upgrades and changes associated with electronic devices, operating systems, hardware and other requirements. It further shows an easy-to-follow process that is understandable to both technical and non-technical audiences in the field of digital forensics.

show abstract

Proof of Concept of the Online Neighbourhood Watch System

Cited by 6 publications

References 4 publications

Secure Storage Model for Digital Forensic Readiness

Secure Storage Model for Digital Forensic Readiness

A natural human language framework for digital forensic readiness in the public cloud

Digital forensic application requirements specification process

Contact Info

Product

Resources

About