The State of the Art Forensic Techniques in Mobile Cloud Environment

Faheem, Muhammad; Kechadi, Tahar; Le-Khac, Nhien An

doi:10.4018/978-1-4666-8751-6.ch092

Cited by 6 publications

(5 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This is a simple, secure, fast way of recovering data with a reduced risk of corruption of those data. We will also look at the feasibility of extending our approach in memory forensics [31] of mobile devices in smart phone investigations [32].…”

Section: Resultsmentioning

confidence: 99%

Forensic Analysis of Virtual Hard Drives

Tobin¹,

Le-Khac²,

Kechadi³

2017

JDFSL

View full text Add to dashboard Cite

The issue of the volatility of virtual machines is perhaps the most pressing concern in any digital investigation. Current digital forensics tools do not fully address the complexities of data recovery that are posed by virtual hard drives. It is necessary, for this reason, to explore ways to capture evidence other than those using current digital forensic methods. This should be done in the most efficient and secure manner, as quickly, and in a non-intrusive way as can be achieved. All data in a virtual machine is disposed of when that virtual machine is destroyed, it may not therefore be possible to extract and preserve evidence such as incriminating images prior to destruction. Recovering that evidence, or finding some way of associating that evidence with the virtual machine before its destruction, is therefore crucial. In this paper, we present a method of extracting evidence from a virtual hard disk drive in a quick, secure and verifiable manner, with a minimum impact on the drive thus preserving its integrity for further analysis.

show abstract

Section: Resultsmentioning

confidence: 99%

Forensic Analysis of Virtual Hard Drives

Tobin¹,

Le-Khac²,

Kechadi³

2017

JDFSL

View full text Add to dashboard Cite

show abstract

“…This chapter also provided elaborate and detailed answers relating to the forensically recoverable information for each web browser tested. The results of this research are useful to, and may be referenced by, forensic experts involved in investigations concerning web activity on both desktop and mobile platforms [17,18,19,20]. Each question posed in the problem statement was addressed and the underlying data presented in subsequent sections should help not only investigators looking for a better general understanding of web browser forensics, but also those seeking advanced techniques and methods for recovering, parsing and analysing web browser specific data.…”

Section: Discussionmentioning

confidence: 97%

Privacy Preserving Internet Browsers: Forensic Analysis of Browzar

Warren

El-Sheikh

Le-Khac

2017

Computer and Network Security Essentials

View full text Add to dashboard Cite

Abstract. With the advance of technology, Criminal Justice agencies are being confronted with an increased need to investigate crimes perpetuated partially or entirely over the Internet. These types of crime are known as cybercrimes. In order to conceal illegal online activity, criminals often use private browsing features or browsers designed to provide total browsing privacy. The use of private browsing is a common challenge faced in for example child exploitation investigations, which usually originate on the Internet. Although private browsing features are not designed specifically for criminal activity, they have become a valuable tool for criminals looking to conceal their online activity. As such, Technological Crime units often focus their forensic analysis on thoroughly examining the web history on a computer. Private browsing features and browsers often require a more in-depth, post mortem analysis. This often requires the use of multiple tools, as well as different forensic approaches to uncover incriminating evidence. This evidence may be required in a court of law, where analysts are often challenged both on their findings and on the tools and approaches used to recover evidence. However, there are very few research on evaluating of private browsing in terms of privacy preserving as well as forensic acquisition and analysis of privacy preserving internet browsers. Therefore in this chapter, we firstly review the private mode of popular internet browsers. Next, we describe the forensic acquisition and analysis of Browzar, a privacy preserving internet browser and compare it with other popular internet browsers.

show abstract

“…However, to make the most if it, the method metadata is stored within files and data repositories must be understood, tested, and shown to be to be reliable. Accessing and understanding device metadata can assist the investigators in examining digital artefacts from filesystems (Du et al, 2018), mobile apps (Faheem et al, 2015), and Internet of Things devices (Sayakkara et al, 2018). Sampson (2013) documented the necessity of understanding metadata and offered strategies to assist with this type of review.…”

Section: Related Workmentioning

confidence: 99%

“…Examining application generated databases is not only an important task for forensic analysis of the data generation software tools, e.g., desktop applications and web browsers (Buchholz and Spafford, 2004), mobile applications (Faheem et al, 2015), and cloud services (Farina et al, 2015), but has been identified for desktop metadata curators, such as desktop file search utilities. Turnbull and Slay (Turnbull and B.BSlay, 2006) emphasised the importance of conducting research into the databases used by Google Desktop Search technologies in order for tools to be designed to extract the data for digital forensic investigations.…”

Section: Related Workmentioning

confidence: 99%

Shining a light on Spotlight: Leveraging Apple's desktop search utility to recover deleted file metadata on macOS

Atwal

Scanlon

Le-Khac

2019

Digital Investigation

View full text Add to dashboard Cite

a b s t r a c tSpotlight is a proprietary desktop search technology released by Apple in 2004 for its Macintosh operating system Mac OS X 10.4 (Tiger) and remains as a feature in current releases of macOS. Spotlight allows users to search for files or information by querying databases populated with filesystem attributes, metadata, and indexed textual content. Existing forensic research into Spotlight has provided an understanding of the metadata attributes stored within the metadata store database. Current approaches in the literature have also enabled the extraction of metadata records for extant files, but not for deleted files. The objective of this paper is to research the persistence of records for deleted files within Spotlight's metadata store, identify if deleted database pages are recoverable from unallocated space on the volume, and to present a strategy for the processing of discovered records. In this paper, the structure of the metadata store database is outlined, and experimentation reveals that records persist for a period of time within the database but once deleted, are no longer recoverable. The experimentation also demonstrates that deleted pages from the database (containing metadata records) are recoverable from unused space on the filesystem.

show abstract

The State of the Art Forensic Techniques in Mobile Cloud Environment

Cited by 6 publications

References 42 publications

Forensic Analysis of Virtual Hard Drives

Forensic Analysis of Virtual Hard Drives

Privacy Preserving Internet Browsers: Forensic Analysis of Browzar

Shining a light on Spotlight: Leveraging Apple's desktop search utility to recover deleted file metadata on macOS

Contact Info

Product

Resources

About