Roadmap of Digital Forensics Investigation Process with Discovery of Tools

Patil, Anita; Banerjee, Soumi; Jadhav, Dipti; Borkar, Gautam M.

doi:10.1002/9781119795667.ch11

Cited by 9 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Also, the need for enhancements of the already existing frameworks. This research highlights the importance of forensic analysis in the newly emerging fields such as cloud-based systems, IoT Systems, and big data as well as with the already existing infrastructure as database servers, storage devices, OS, and mobile [25].…”

Section: Literature Reviewmentioning

confidence: 93%

Digital Forensics Analysis of IoT Nodes using Machine Learning

Arshad

Tariq

Riaz

et al. 2022

JCBI

View full text Add to dashboard Cite

With the versatility and exponential growth of IoT solutions, the probability of being attacked has increased. Resource constraint IoT devices raised a challenge for the security handler to track logs of different variety of attacks generated on them while performing the forensic analysis. Commonly forensic analysis is performed on the devices that calculate how much loss has occurred to the device due to the diversity of attacks. The main objective of this paper to develop a framework through which secueity can perfrom the forensic analysis on resource contraint IoT devices. In this paper, we have proposed a framework that intelligently performs forensic analysis and detects the different types of attacks performed on the endpoint (IoT device) using a node to node (N2N) framework. Furthermore, this proposed solution is a blend of different forensic tools and Machine learning techniques to identify different types of attacks. Using a third-party log server, the problem of evidence recovery from the endpoint under attack is addressed. To determine the nature and effect of the attack we have used the logs by using the security onion (forensic server). Additionally, this framework is equipped to automatically detect attacks by using the different machine learning algorithms. The efficiency of machine learning models is measured upon the values of (1) Accuracy, (2) Precision, (3) Recall, and (4) F-Measure. The results show that the decision tree algorithm stands out with the optimum performance compared to other ML models. Overall this framework can be used for the secuirty of IoT devices as well as the evidence collection from the IoT endpoint. For the validation of the proposed framework more detailed results and performance, analysis is presented in this paper.

show abstract

Section: Literature Reviewmentioning

confidence: 93%

Digital Forensics Analysis of IoT Nodes using Machine Learning

Arshad

Tariq

Riaz

et al. 2022

JCBI

View full text Add to dashboard Cite

show abstract

“…Many forensics investigation process models are used for the Internet of Things (IoTs) such as CIPM for IoTFs [19], the proposed model assists IoTF users in facilitating, managing, and organizing the investigation tasks, it consists of four common investigation processes, preparation process, collection process, analysis process, Patiland report process. The roadmap of DFIP discovery of tools [20] discussed in detail the challenges and opportunities of the digital forensics process concerning different fields such as networks, IoT, cloud computing, database systems, big data, mobile and handheld devices, disk and different storage media, and operating system. As seen from the literature, there is a necessity for adopting a robust model to carry out mobile forensic investigations efficiently.…”

Section: ) Mobile Forensics Models and Phasesmentioning

confidence: 99%

A Novel Framework for Mobile Forensics Investigation Process

Moreb,

Salah,

Amro

2024

IJCDS

View full text Add to dashboard Cite

Investigating digital evidence by gathering, examining, and maintaining evidence that was stored in smartphones has attracted tremendous attention and become a key part of digital forensics. The mobile forensics process aims to recover digital evidence from a mobile device in a way that will preserve the evidence in a forensically sound condition. This evidence might be used to prove being a cybercriminal or a cybercrime victim. To do this, the mobile forensics process lifecycle must establish clear guidelines for safely capturing, isolating, transporting, storing, and proving digital evidence originating from mobile devices. There are unique aspects of the mobile forensics procedure that must be considered. It is imperative to adhere to proper techniques and norms for the testing of mobile devices to produce reliable results. In this paper, we develop a novel methodology for the mobile forensics process model lifecycle named Mobile Forensics Investigation Process Framework (MFIPF) which encompasses all the necessary stages and data sources used to construct the crime case. The developed framework contributes to identifying common concepts of mobile forensics through the development of the mobile forensics model that simplifies the examination process and enables forensics teams to capture and reuse specialized forensic knowledge. Furthermore, the paper provides a list of the most commonly used forensics tools and where we can use them in our proposed mobile forensic process model.

show abstract

“…The proposed CIPM. The roadmap of DFIP discovery of tools [17] discussed in detail the challenges and opportunities for the digital forensics process concerning different elds such as networks, IoT, cloud computing, database system, big data, mobile and handheld devices, disk and different storage media, and operating system…”

Section: Mobile Forensics Models and Phasesmentioning

confidence: 99%

A Novel Framework for Mobile Forensics Investigation Process

Moreb

Salah

Amro

2023

Preprint

View full text Add to dashboard Cite

Investigating digital evidence by gathering, examining, and maintaining evidence that was stored in smartphones has attracted tremendous attention and become a key part of digital forensics. The mobile forensics process aims to recover digital evidence from a mobile device in a way that will preserve the evidence in a forensically sound condition, this evidence might be used to prove to be a cybercriminal or a cybercrime victim. To do this, the mobile forensics process lifecycle must establish clear guidelines for safely capturing, isolating, transporting, storing, and proving digital evidence originating from mobile devices. There are unique aspects of the mobile forensics procedure that must be taken into account. It is imperative to adhere to proper techniques and norms in order for the testing of mobile devices to produce reliable results. In this paper, we develop a novel methodology for the mobile forensics process model lifecycle named Mobile Forensics Investigation Process Framework (MFIPF) which encompasses all the necessary stages and data sources used to construct the crime case. The developed framework contributes to identifying common concepts of mobile forensics through the development of the mobile forensics model that simplifies the examination process and enables forensics teams to capture and reuse specialized forensic knowledge. Furthermore, the paper provides a list of the most commonly used forensics tools and where can we use them in our proposed mobile forensic process model.

show abstract

Roadmap of Digital Forensics Investigation Process with Discovery of Tools

Cited by 9 publications

References 11 publications

Digital Forensics Analysis of IoT Nodes using Machine Learning

Digital Forensics Analysis of IoT Nodes using Machine Learning

A Novel Framework for Mobile Forensics Investigation Process

A Novel Framework for Mobile Forensics Investigation Process

Contact Info

Product

Resources

About