Digital Forensics: Review of Issues in Scientific Validation of Digital Evidence
1
조회
0
다운로드
10
인용
0
참고문헌
키워드
초록
Digital forensics is a vital part of almost every criminal investigation given the amount of informationavailable and the opportunities offered by electronic data to investigate and evidence a crime. However, incriminal justice proceedings, these electronic pieces of evidence are often considered with the utmostsuspicion and uncertainty, although, on occasions are justifiable. Presently, the use of scientifically unprovenforensic techniques are highly criticized in legal proceedings. Nevertheless, the exceedingly distinct anddynamic characteristics of electronic data, in addition to the current legislation and privacy laws remain aschallenging aspects for systematically attesting evidence in a court of law. This article presents acomprehensive study to examine the issues that are considered essential to discuss and resolve, for the properacceptance of evidence based on scientific grounds. Moreover, the article explains the state of forensics inemerging sub-fields of digital technology such as, cloud computing, social media, and the Internet ofThings (IoT), and reviewing the challenges which may complicate the process of systematic validation ofelectronic evidence. The study further explores various solutions previously proposed, by researchers andacademics, regarding their appropriateness based on their experimental evaluation. Additionally, thisarticle suggests open research areas, highlighting many of the issues and problems associated with theempirical evaluation of these solutions for immediate attention by researchers and practitioners. Notably,academics must react to these challenges with appropriate emphasis on methodical verification. Therefore,for this purpose, the issues in the experiential validation of practices currently available are reviewed in thisstudy. The review also discusses the struggle involved in demonstrating the reliability and validity of theseapproaches with contemporary evaluation methods. Furthermore, the development of best practices,reliable tools and the formulation of formal testing methods for digital forensic techniques are highlightedwhich could be extremely useful and of immense value to improve the trustworthiness of electronicevidence in legal proceedings.
Abstract
Digital forensics is a vital part of almost every criminal investigation given the amount of informationavailable and the opportunities offered by electronic data to investigate and evidence a crime. However, incriminal justice proceedings, these electronic pieces of evidence are often considered with the utmostsuspicion and uncertainty, although, on occasions are justifiable. Presently, the use of scientifically unprovenforensic techniques are highly criticized in legal proceedings. Nevertheless, the exceedingly distinct anddynamic characteristics of electronic data, in addition to the current legislation and privacy laws remain aschallenging aspects for systematically attesting evidence in a court of law. This article presents acomprehensive study to examine the issues that are considered essential to discuss and resolve, for the properacceptance of evidence based on scientific grounds. Moreover, the article explains the state of forensics inemerging sub-fields of digital technology such as, cloud computing, social media, and the Internet ofThings (IoT), and reviewing the challenges which may complicate the process of systematic validation ofelectronic evidence. The study further explores various solutions previously proposed, by researchers andacademics, regarding their appropriateness based on their experimental evaluation. Additionally, thisarticle suggests open research areas, highlighting many of the issues and problems associated with theempirical evaluation of these solutions for immediate attention by researchers and practitioners. Notably,academics must react to these challenges with appropriate emphasis on methodical verification. Therefore,for this purpose, the issues in the experiential validation of practices currently available are reviewed in thisstudy. The review also discusses the struggle involved in demonstrating the reliability and validity of theseapproaches with contemporary evaluation methods. Furthermore, the development of best practices,reliable tools and the formulation of formal testing methods for digital forensic techniques are highlightedwhich could be extremely useful and of immense value to improve the trustworthiness of electronicevidence in legal proceedings.
참고문헌 (108)
- National Research Council, "Strengthening Forensic Science in the United States: A Path Forward" (2009), National Academies Press
- President's Council of Advisors on Science and Technology, Report to the President Forensic Science in Criminal Courts: Ensuring Scientific Validity of Feature-Comparison Methods, , Executive Office of the President, ~ (2016)
- D. M. Risinger, "The Daubert", Kumho implications of observer effects in forensic science: hidden problems of expectation and suggestion, 2002, pp.90(1), ~
- P. Roberts, "Paradigms of forensic science and legal process: a critical diagnosis", Philosophical Transactions of the Royal Society B, 370(1674) (2015)
- M. Meyers, "Digital forensics: meeting the challenges of scientific evidence", IFIP International Conference on Digital Forensics, pp.43~50 (2005)
- E. Van Buskirk, "Digital evidence: challenging the presumption of reliability", Journal of Digital Forensic Practice, 1(1), pp.19~26 (2006)[DOI]
- G. Edmond, "Trashing junk science", Stanford Technology Law Review, (3) (1998)
- R. G. Behrents, "Lucy fell from a tree and plunged 40 feet to her death", American Journal of Orthodontics and Dentofacial Orthopedics, 150(5), pp.719~722 (2016)[DOI]
- H. F. Fradella, "The impact of Daubert on the admissibility of behavioral science testimony", Pepperdine Law Review, 30(3), pp.403~444 (2002)
- "Legal aspects of digital forensics" (2002)[URL]
- D. B. Garrie, "Digital forensic evidence in the courtroom: understanding content and quality", Northwestern Journal of Technology and Intellectual Property, 12(2) (2014)
- "An introduction to Daubert v. Merrell Dow" (2008)[URL]
- Best Practice Manual for the forensic examination of handwriting, "European Network of Forensic Science Institutes", ~, pp.Report No. ENFSI-BPM-FHX-01 (2015)
- S. Garfinkel, "Bringing science to digital forensics with standardized forensic corpora", Digital Investigation, 6, pp.S2~S11 (2009)[DOI]
- I. Baggili, "Data sources for advancing cyber forensics: what the social world has to offer", Proceedings of the 2015 AAAI Spring Symposium Series (2015)
- R. Bekkerman, "Automatic categorization of email into folders: benchmark experiments on Enron and SRI corpora" (2004), University of Massachusetts Amherst
- "MAWI Working Group Traffic Archive"[URL]
- "ForGe: computer forensic test image generator" (2013)[URL]
- "The canterbury corpus" (2001)[URL]
- "UMass Trace Repository" (2009)[URL]
- C. Grajeda, "Availability of datasets for digital forensics: and what is missing", Digital Investigation, 22, pp.S94~S105 (2017)[DOI]
- "Hacking Case" (2007)[URL]
- Y. Yannikos, "Data corpora for digital forensics education and research", IFIP International Conference on Digital Forensics, pp.309~325 (2014)
- K. Roberts, "EmpaTweet: annotating and detecting emotions on Twitter", Proceedings of the 8th International Conference on Language Resources and Evaluation, pp.3806~3813 (2012)
- K. A. Cole, "A review of recent case law related to digital forensics: the current issues", Proceedings of the Conference on Digital Forensics, Security and Law, pp.95~103 (2015)
- "Technical review of the trial testimony State of Connecticut vs. Julie Amero" (2007)[URL]
- SWGDE establishing confidence in digital forensic results by error mitigation analysis, "Scientific Working Group on Digital Evidence", Scientific Working Group on Digital Evidence, ~ (2017)
- S. L. Garfinkel, "Digital forensics research: the next 10 years", Digital Investigation, 7, pp.S64~S73 (2010)[DOI]
- "Challenges with automation in digital forensic investigations" (2013)[URL]
- J. Slay, "Towards a formalization of digital forensics", IFIP International Conference on Digital Forensics, pp.37~47 (2009)
- "Computer Forensic Tool Testing Program (CFTT)" (2017)[URL]
- D. Bennett, "The challenges facing computer forensics investigators in obtaining information from mobile devices for use in criminal investigations", Information Security Journal: A Global Perspective, 21(3), pp.159~168 (2012)[DOI]
- L. Pan, "Reproducibility of digital evidence in forensic investigations", Proceedings of the 5th Annual Digital Forensic Research Workshop, pp.1~8 (2005)
- G. Palmer, "A road map for digital forensic research", Proceedings of the 1st Digital Forensic Research Workshop, pp.27~30 (2001)
- M. Reith, "An examination of digital forensic models", International Journal of Digital Evidence, 1(3), pp.1~12 (2002)
- W. A. Jansen, "Mobile Forensic Reference Materials: A Methodology and Reification", US Department of Commerce, National Institute of Standards and Technology, ~ (2009)
- "What is WAC" (2015)[URL]
- "Scientific Working Group on Digital Evidence"[URL]
- Forensic Science Regulator's Annual Report 2014-2015, "G. Tully", The Forensic Science Regulator, ~ (2015)
- Forensic Science Regulator, "Draft Guidance : Digital Forensics Method Validation", Crown Prosecution Service, ~ (2014)
- "State of North Carolina v. Bradley Graham Cooper (No. COA12-926)"[URL]
- "United States v. Suarez, 2010 WL 4226524 (D.N.J. Oct. 21, 2010)" (2010)[URL]
- R. Harris, "Arriving at an anti-forensics consensus: examining how to define and control the anti-forensics problem", Digital Investigation, 3, pp.44~49 (2006)[DOI]
- C. S. J. Peron, "Digital anti-forensics: emerging trends in data transformation techniques", Proceedings of E-crime and Computer Evidence Conference (2005)
- S. L. Garfinkel, "Carving contiguous and fragmented files with fast object validation", Digital Investigation, 4, pp.2~12 (2007)[DOI]
- M. C. Stamm, "Temporal forensics and anti-forensics for motion compensated video", IEEE Transactions on Information Forensics and Security, 7(4), pp.1315~1329 (2012)[DOI]
- "Breaking forensics software: weaknesses in critical evidence collection" (2007)[URL]
- I. Baggili, "Research trends in digital forensic science: an empirical analysis of published research", International Conference on Digital Forensics and Cyber Crime, pp.144~157 (2013)
- M. Wundram, "Anti-forensics: the next step in digital forensics tool testing", Proceedings of the 7th International Conference on IT Security Incident Management and IT Forensics, pp.83~97 (2013)
- M. Anobah, "Testing framework for mobile device forensics tools", The Journal of Digital Forensics, Security and Law, 9(2), pp.221~234 (2014)
- "Anti-forensics and the digital investigator" (2007)[URL]
- K. Hausknecht, "Anti-computer forensics", Proceedings of the 40th International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO), pp.1233~1240 (2017)
- M. Rogers, "Anti-forensics: the coming wave in digital forensics", Proceedings of the Center for Education and Research in Information Assurance and Security (2006)
- K. Conlan, "Anti-forensics: furthering digital forensic science through a new extended, granular taxonomy", Digital Investigation, 18, pp.S66~S75 (2016)[DOI]
- R. Bohme, "Digital Image Forensics", pp.327~366 (2013), Springer
- M. K. Rogers, "The future of computer forensics: a needs analysis survey", Computers & Security, 23(1), pp.12~16 (2014)
- S. Biggs, "Cloud computing: the impact on digital forensic investigations", Proceedings of the International Conference for Internet Technology and Secured Transactions, pp.1~6 (2009)
- G. Al Sadi, "Cloud computing architecture and forensic investigation challenges", International Journal of Computer Applications, 124(7), pp.20~25 (2015)
- D. Lillis, "Current challenges and future research areas for digital forensic investigation", Proceedings of the 11th ADFSL Conference on Digital Forensics, Security and Law (2016)
- K. Curran, "Mobile phone forensic analysis", International Journal of Digital Crime and Forensics, 2(3), pp.15~27 (2012)
- S. Schjolberg, "A Global Treaty on Cybersecurity and Cybercrime" (2011), Cybercrimedata
- K. Nance, "Digital forensics: defining a research agenda", Proceedings of the 42nd Hawaii International Conference on System Sciences, pp.1~6 (2009)
- S. Raghavan, "Digital forensic research: current state of the art", CSI Transactions on ICT, 1(1), pp.91~114 (2013)[DOI]
- N. M. Karie, "Taxonomy of challenges for digital forensics", Journal of Forensic Sciences, 60(4), pp.885~893 (2015)[DOI]
- M. Damshenas, "A survey on digital forensics trends", International Journal of CyberSecurity and Digital Forensics, 3(4), pp.209~235 (2014)
- "X1 Social Discovery"[URL]
- "2015 mid-year e-Discovery update"[URL]
- "Hundreds of thousands of legal cases estimated to address social media in 2016" (2016)[URL]
- "State of Louisiana v. Demontre Smith (No. 2015-K-1359)"[URL]
- M. Bader, "iPhone 3GS forensics: logical analysis using apple iTunes backup utility", Small Scale Digital Device Forensics Journal, 4(1), pp.1~15 (2010)
- J. Lessard, "Android forensics: simplifying cell phone examinations", Small Scale Digital Device Forensics Journal, 4(1), pp.1~12 (2010)
- D. Walnycky, "Network and device forensic analysis of android social-messaging applications", Digital Investigation, 14, pp.S77~S84 (2015)[DOI]
- M. Huber, "Social snapshots: digital forensics for online social networks", Proceedings of the 27th Annual Computer Security Applications Conference, pp.113~122 (2011)
- M. Mulazzani, "Social network forensics: tapping the data pool of social networks", Proceedings of the 8th Annual IFIP Working Group, pp.1~20 (2012)
- H. Chung, "Digital forensic investigation of cloud storage services", Digital Investigation, 9(2), pp.81~95 (2012)[DOI]
- V. Roussev, "Forensic analysis of cloud-native artifacts", Digital Investigation, 16, pp.S104~S113 (2016)[DOI]
- N. H. Ab Rahman, "Cloud incident handling and forensic-by-design: cloud storage as a case study", Concurrency and Computation: Practice and Experience, 29(14) (2017)
- D. Quick, "Forensic collection of cloud storage data: does the act of collection result in changes to the data or its metadata?", Digital Investigation, 10(3), pp.266~277 (2013)[DOI]
- B. Martini, "Cloud forensic technical challenges and solutions: a snapshot", IEEE Cloud Computing, 1(4), pp.20~25 (2014)
- S. Simou, "A survey on cloud forensics challenges and solutions", Security and Communication Networks, 9(18), pp.6285~6314 (2016)[DOI]
- X. Jin, "Model-checking of merging events for digital forensics", International Journal of Digital Content Technology and its Applications, 6(22), pp.785~793 (2012)[DOI]
- Y. Wen, "Forensics-as-a-service (faas): computer forensic workflow management and processing using cloud", Proceedings of the 4th International Conferences on Clouding Computing, GRIDs, and Virtualization, pp.208~214 (2013)
- "Cloud forensics: a meta-study of challenges, approaches, and open problems" (2013)[URL]
- A. M. Balogun, "Privacy impacts of data encryption on the efficiency of digital forensics technology", International Journal of Advanced Computer Science and Applications, 4(5), pp.36~40 (2013)
- "The effect of file and disk encryption on computer forensics" (2010)[URL]
- In re grand jury subpoena to Sebastien Boucher, "United States District Court for the District of Vermont", ~, pp.No. 2:06-mj-91, 2009 WL 424718 (2009)
- "Apple iOS and Google Android smartphone market share flattening: IDC" (2015)[URL]
- "IDC: Smartphone OS Market Share" (2017)[URL]
- C. I. Wong, "Design of a crawler for online social networks analysis", WSEAS Transactions on Communications, 13, pp.263~274 (2014)
- "Compromise needed on smartphone encryption" (2014)[URL]
- "Human Rights Council holds panel discussion on the right to privacy in the digital age" (2014)[URL]
- "James Comey, F.B.I. Director, hints at action as cellphone data is locked" (2014)[URL]
- "The NSA's split-key encryption proposal is not serious" (2015)[URL]
- "Encryption techniques and access they give" (2015)[URL]
- P. Swire, "Encryption and Globalization", Columbia Science and Technology Law Review, 13, pp.416~481 (2012)
- "The revolutionary quantum computer that may not be quantum at all" (2014)[URL]
- "IBM says it's 'on the cusp' of building a quantum computer" (2012)[URL]
- "Digital summit: Microsoft's quantum search for the 'next transistor" (2014)[URL]
- "Quantum computing is about to overturn cybersecurity's balance of power" (2015)[URL]
- C. S. Brown, "Investigating and prosecuting cyber crime: forensic dependencies and barriers to justice", International Journal of Cyber Criminology, 9(1), pp.55~119 (2015)
- "A brief history and philosophy of physics" (1994)[URL]
- "History of chemistry"[URL]
- "Fingerprint analysis"[URL]
- "History of DNA research" (2012)[URL]
- P. A. Collier, "A forensic methodology for countering computer crime", Artificial Intelligence Review, 6(2), pp.203~215 (1992)[DOI]
- "brief history of smartphones"[URL]
- "Psychologist Michelle Theer, her Internet affair with John Diamond, and the murder of air force captain Marty Theer" (2017)[URL]
- M. Pollitt, "A history of digital forensics", IFIP International Conference on Digital Forensics, pp.3~15 (2010)
