Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.
(english) This thesis deals with cybercriminality in area of cryptocurrencies. The thesis first of all describes basic terms, sources of law and issues of jurisdictions in area. Furthermore it deals with delineation of selected crimes commited in connection with cryptocurrencies. Part of the thesis focuses on issues with anonymity and proving. Key words Cybercriminality, Cryptocurrencies, Computer Criminality
Joseph A. Ricci, Ibrahim Baggili, Frank Breitinger
The current state of the art in digital forensics has primarily focused on the acquisition of data from cloud storage. Here, we present a new challenge in digital forensics: blockchain-based distributed cloud storage, using STORJ as a technology example.
Digital and Cyber Forensics
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Yijun Yu, Danny Barthaud, Blaine Price, Arosha K. Bandara · 6 authors
Unmanned Aerial Vehicles (UAVs), or drones, are increasingly expected to operate in spaces populated by humans while avoiding injury to people or damaging property. However, incidents and accidents can, and increasingly do, happen. Traditional investigations of aircraft incidents require on-board flight data recorders (FDRs); however, these physical FDRs only work if the drone can be recovered. A further complication is that physical FDRs are too heavy to mount on light drones, hence not suitable for forensic digital investigations of drone flights. In this paper, we propose a self-adaptive software architecture, LiveBox, to make drones both forensic-ready and regulation compliant. We studied the feasibility of using distributed technologies for implementing the LiveBox reference architecture. In particular, we found that updates and queries of drone flight data and constraints can be treated as transactions using decentralised ledger technology (DLT), rather than a generic time-series database, to satisfy forensic tamper-proof requirements. However, DLTs such as Ethereum, have limits on throughput (i.e. transactions-per-second), making it harder to achieve regulation-compliance at runtime. To overcome this limitation, we present a self-adaptive reporting algorithm to dynamically reduce the precision of flight data without sacrificing the accuracy of runtime verification. Using a real-life scenario of drone delivery, we show that our proposed algorithm achieves a 46% reduction in bandwidth without losing accuracy in satisfying both tamper-proof and regulation-compliant requirements.
This paper proposes the use of a blockchainbased structure in order to store evidences in a digital forensics investigation. The traditional chain of evidence is augmented with properties of immutability and traceability, thanks to a cryptographic process. The blockchain is constructed by forensics experts by adding evidences through the process. Since the blockchain is immutable, it can be shared among the different parties involved in a prosecution in order to review the chain of evidence and build their case. Furthermore, the blockchain structure can be applied to other forensics fields, like drugs, firearms, NDA. This blockchain is called a Digital Evidence Inventory (DEI) and is part of a wider framework encompassing a Forensics Confidence Rating (FCR) structure, in order to give experts the ability to rate the level of confidence for each evidence and a Global Digital Timeline (GDT) to order evidence through time. The whole framework is called ‘Aldiana’.
Cloud forensics is an intelligent evolution of digital forensics that defends against cyber-crimes. However, centralized evidence collection and preservation minimizes the reliability of digital evidence. To resolve this severe problem, this paper proposes a novel digital forensic architecture using fast-growing Software-Defined Networking (SDN) and Blockchain technology for Infrastructure-as-a-Service (IaaS) cloud. In this proposed forensic architecture, the evidence is collected and preserved in the blockchain that is distributed among multiple peers. To protect the system from unauthorized users, Secure Ring Verification based Authentication (SRVA) scheme is proposed. To strengthen the cloud environment, secret keys are generated optimally by using Harmony Search Optimization (HSO) algorithm. All data are encrypted based on the sensitivity level and stored in the cloud server. For encryption, Sensitivity Aware Deep Elliptic Curve Cryptography (SA-DECC) algorithm is presented. For every data stored in the cloud, a block is created in the SDN controller and the history of data is recorded as metadata. In each block, the Merkle hash tree is built by using Secure Hashing Algorithm-3 (SHA-3). Our system allows users to trace their data by deploying Fuzzy based Smart Contracts (FCS). Finally, evidence analysis is enabled by constructing Logical Graph of Evidence (LGoE) collected from the blockchain. Experiments are conducted in an integrated environment of java (for cloud and blockchain) and network simulator-3.26 (for SDN). The extensive analysis shows that proposed forensic architecture shows promising results in Response time, Evidence insertion time, Evidence verification time, Communication overhead, Hash computation time, Key generation time, Encryption time, Decryption time and total change rate.
Stephan Zöllner, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac
Bitcoin is popular not only with consumers, but also with cybercriminals (e.g., in ransomware and online extortion, and commercial online child exploitation). Given the potential of Bitcoin to be involved in a criminal investigation, the need to have an up-to-date and in-depth understanding on the forensic acquisition and analysis of Bitcoins is crucial. However, there has been limited forensic research of Bitcoin in the literature. The general focus of existing research is on postmortem analysis of specific locations (e.g. wallets on mobile devices), rather than a forensic approach that combines live data forensics and postmortem analysis to facilitate the identification, acquisition, and analysis of forensic traces relating to the use of Bitcoins on a system. Hence, the latter is the focus of this paper where we present an open source tool for live forensic and postmortem analysing automatically. Using this open source tool, we describe a list of target artifacts that can be obtained from a forensic investigation of popular Bitcoin clients and Web Wallets on different web browsers installed on Windows 7 and Windows 10 platforms.
Data manipulation is often named as a serious threat to data integrity. Data can be tampered with, and malicious actors could use this to their advantage. Data users in various application domains want to be ensured that the data they are consuming are accurate and have not been tampered with. To validate the integrity of these data, we describe a blockchain-based hash validation method. The method assumes that the actual data is stored separately from the blockchain, and then allows a data identifier and a hash of these data to be submitted to the blockchain. The actual data can be validated against the hash on the blockchain at any time. Several use cases are described for blockchain-based hash validation, and to validate the method it is implemented inside an application audit trail to validate the audit trail data. This implementation shows that blockchain-based hash validation is able to detect malicious and accidental changes that were made to the data.
Presented here is a functional implementation of Distributed Ledger Technology applied to the task of cataloguing CCTV video evidence. We describe and demonstrate a prototype camera that participates in blockchain creation in real time, and the system designed to manage and coordinate its distribution and use. This application is of specific interest to law enforcement agencies charged with the management of high volumes of CCTV evidence. We discuss applicability and scalability with reference to simulation results and real-world testing. The combination of blockchain technology with a novel digital watermarking application is demonstrated here providing immediate benefit against an existing real-world problem of trustworthy evidence protection in distributed network environments.
Open access
Advanced Steganography and Watermarking Techniques
Duc-Phong Le, Mark Huasong Meng, Le Su, Sze Ling Yeo · 5 authors
The ubiquitous deployment of Internet of Things (IoT) devices enhances connectivity and communication, and benefits almost every aspect of our lives from manufacturing to retail to smart homes. However, low levels of security protection in these devices due to their limited resources open opportunities for malicious users. An IoT forensics system collecting, processing, analyzing and reporting evidence of attack is required to mitigate the IoT security issues. Although such system has been studied over the past decade and solutions such as cloud-based IoT forensic were proposed, limitation still exist. In this paper, leveraging on the blockchain technology, we propose a per-missioned blockchain-based IoT forensics framework to enhance the integrity, authenticity and non-repudiation properties for the collected evidence. We formally define the system architecture, provide framework details, and propose a cryptographic-based approach to mitigate identity privacy concern.
John Collomosse, Tu Bui, Alan Brown, John Sheridan · 9 authors
We present ARCHANGEL; a decentralised platform for ensuring the long-term integrity of digital documents stored within public archives. Document integrity is fundamental to public trust in archives. Yet currently that trust is built upon institutional reputation --- trust at face value in a centralised authority, like a national government archive or University. ARCHANGEL proposes a shift to a technological underscoring of that trust, using distributed ledger technology (DLT) to cryptographically guarantee the provenance, immutability and so the integrity of archived documents. We describe the ARCHANGEL architecture, and report on a prototype of that architecture build over the Ethereum infrastructure. We report early evaluation and feedback of ARCHANGEL from stakeholders in the research data archives space.
Smart contracts are a new paradigm that emerged with the rise of the blockchain technology. They allow untrusting parties to arrange agreements. These agreements are encoded as a programming language code and deployed on a blockchain platform, where all participants execute them and maintain their state. Smart contracts are promising since they are automated and decentralized, thus limiting the involvement of third trusted parties, and can contain monetary transfers. Due to these features, many people believe that smart contracts will revolutionize the way we think of distributed applications, information sharing, financial services, and infrastructures. To release the potential of smart contracts, it is necessary to connect the contracts with the outside world, such that they can understand and use information from other infrastructures. For instance, smart contracts would greatly benefit when they have access to web content. However, there are many challenges associated with realizing such a system, and despite the existence of many proposals, no solution is secure, provides easily-parsable data, introduces small overheads, and is easy to deploy. In this paper we propose PDFS, a practical system for data feeds that combines the advantages of the previous schemes and introduces new functionalities. PDFS extends content providers by including new features for data transparency and consistency validations. This combination provides multiple benefits like content which is easy to parse and efficient authenticity verification without breaking natural trust chains. PDFS keeps content providers auditable, mitigates their malicious activities (like data modification or censorship), and allows them to create a new business model. We show how PDFS is integrated with existing web services, report on a PDFS implementation and present results from conducted case studies and experiments.
One of the main issues in digital forensics is the management of evidences. From the time of evidence collection until the time of their exploitation in a legal court, evidences may be accessed by multiple parties involved in the investigation that take temporary their ownership. This process, called Chain of Custody (CoC), must ensure that evidences are not altered during the investigation, despite multiple entities owned them, in order to be admissible in a legal court. Currently digital evidences CoC is managed entirely manually with entities involved in the chain required to fill in documents accompanying the evidence. In this paper, we propose a Blockchain-based Chain of Custody (B-CoC) to dematerialize the CoC process guaranteeing auditable integrity of the collected evidences and traceability of owners. We developed a prototype of B-CoC based on Ethereum and we evaluated its performance.
The increased deployment of Internet of Things (IoT) devices will make them targets for attacks. IoT devices can also be used as tools for committing crimes. In this regard, we propose FIF-IoT - a forensic investigation framework using a public digital ledger to find facts in criminal incidents in IoT-based systems. FIF-IoT collects interactions that take place among various IoT entities (clouds, users, and IoT devices) as evidence and store them securely as transactions in a public, distributed and decentralized blockchain network which is similar to the Bitcoin network. Hence, FIF-IoT eliminates a single entity's control over the evidence storage, avoids single-point-offailure on the storage media, and ensures high availability of evidence. FIF-IoT presents a framework that ensures integrity, confidentiality, anonymity, and non-repudiation of the evidence stored in the public digital ledger. Furthermore, FIF-IoT provides a mechanism to acquire evidence from the ledger and to verify the integrity of the obtained evidence. We present a case study of a forensic investigation to demonstrate that FIF-IoT is secure against evidence tampering. We also implement a prototype to evaluate the performance of FIF-IoT.
Purpose The purpose of this paper is to highlight the intelligence and investigatory challenges experienced by law enforcement agencies in discovering the identity of illicit Bitcoin users and the transactions that they perform. This paper proposes solutions to assist law enforcement agencies in piecing together the disparate and complex technical, behavioural and criminological elements that make up cybercriminal offending. Design/methodology/approach A literature review was conducted to highlight the main law enforcement challenges and discussions and examine current discourse in the areas of anonymity and attribution. The paper also looked at other research and projects that aim to identify illicit transactions involving cryptocurrencies and the darknet. Findings An optimal solution would be one which has a predictive capability and a machine learning architecture which automatically collects and analyses data from the Bitcoin blockchain and other external data sources and applies search criteria matching, indexing and clustering to identify suspicious behaviours. The implementation of a machine learning architecture would help improve results over time and would be less manpower intensive. Cyber investigators would also receive intelligence in a format and language that they understand and it would allow for intelligence-led and predictive policing rather than reactive policing. The optimal solution would be one which allows for intelligence-led, predictive policing and enables and encourages information sharing between multiple stakeholders from the law enforcement, financial intelligence units, cyber security organisations and fintech industry. This would enable the creation of red flags and behaviour models and the provision of up-to-date intelligence on the threat landscape to form a viable intelligence product for law enforcement agencies so that they can more easily get to the who, what, when and where. Originality/value The development of a functional software architecture that, in theory, could be used to detected suspicious illicit transactions on the Bitcoin network.
Development of secure methods for storing log files is of tremendous importance for cyber security. One of the first actions by a hacker upon penetrating a machine is editing the log files to remove evidence of their presence. We propose to improve the security of these log files through a blockchain based solution. We show how our solution can be used to help organizations to mutually protect their sensitive log data even if some of them are compromised. Our solution allows data confidentiality between the collaborative parties.
When digital evidence is presented in front of a court of law, it is seldom associated with a scientific evaluation of its relevance, or significance. When experts are challenged about the validity of the digital evidence, the general answer is "yes, to a reasonable degree of scientific certainty". Which means all and nothing at the same time, since no scientific metric is volunteered. In this paper we aim at providing courts of law with weighted digital evidence. Each digital evidence is assigned with a confidence rating that eventually helps juries and magistrates in their endeavor. This paper presents a novel methodology in order to: