The Enhanced Forensic Examination and Analysis for Mobile Cloud Platform by Applying Data Mining Methods

Investigating the mobile cloud environment is a challenging task due to the characteristics of voluminous data, dispersion of data, virtualization, and diverse data. Recent research works focus on applying the latest forensic methodologies to the mobile cloud investigation. This paper proposes an enhanced forensic examination and analysis model for the mobile cloud environment that incorporates timeline analysis, hash filtering, data carving, and data transformation sub-phases to improve the performance of the cloud evidence identification and overall forensic decision-making. It analyzes the timeline of events and filters the case-specific files based on the hash values and metadata using the data mining methods. The proposed forensic model performs the in-place carving on the filtered data to guide the investigation and integrates the heterogeneous file types and distributed pieces of evidence with the assistance of the data mining. Finally, the proposed approach employs LSTM based model that significantly improves the forensic decision making.

Identifikasi dan Recovery File JPEG dengan Metode Signature-Based Carving dalam Model Automata

Penggunaan format gambar JPEG semakin meningkat seiring dengan meningkatnya produksi foto digital yang dipicu oleh kemunculan smartphone dan perkembangan sosial media. Hal tersebut membuat file JPEG berperan penting dalam proses digital forensik, sehingga banyak metode identifikasi dan recovery file JPEG yang dikembangkan. Paper ini berusaha melihat proses data carving file JPEG dengan metode Signature-Based Carving, metode carving yang paling sederhana, dengan sebuah model diagram Finite State Automata, sebuah model algoritma dasar dalam teori komputasi.

File Carving Survey on Techniques, Tools and Areas of Use

In digital and computer forensics, file carving is a very hot research topic. That is the main reason why the research is needed to be focused on improving file carving techniques, so that digital investigation can obtain important data and evidence from damaged or corrupted storage media. In the digital forensic investigation, analyzing the unallocated space of storage media is necessary to extract the deleted or pre-written files when the file system metadata is missing or corrupted. Data carving can be defined as a method to recover the file from unallocated space based on different factors such as file type, information of the file (Header/Footer), or the contents of the file. Research in this area focuses on technological improvements in terms of tools and techniques over the past years. The studies examine different techniques of data carving, especially multimedia files (eg. images and videos). The work file carving is classified into three categories classic carving techniques, intelligent carving techniques and smart carving techniques. Moreover, there are seven popular multimedia carving tools that are mostly used and experimentally evaluated are presented. We conclude that proposing new advanced method for carving multimedia files still open and new direction for future research. This is because the fragmentations and compression are very commons used and useful for these kind of files.

The Forensic Curator: Digital Forensics as a Solution to Addressing the Curatorial Challenges Posed by Personal Digital Archives

The growth of computing technology during the previous three decades has resulted in a large amount of content being created in digital form. As their creators retire or pass away, an increasing number of personal data collections, in the form of digital media and complete computer systems, are being offered to the academic institutional archive. For the digital curator or archivist, the handling and processing of such digital material represents a considerable challenge, requiring development of new processes and procedures. This paper outlines how digital forensic methods, developed by the law enforcement and legal community, may be applied by academic digital archives. It goes on to describe the strategic and practical decisions that should be made to introduce forensic methods within an existing curatorial infrastructure and how different techniques, such as forensic hashing, timeline analysis and data carving, may be used to collect information of a greater breadth and scope than may be gathered through manual activities.