Advances in Digital Forensics XV

Name: Advances in Digital Forensics XV | 15th IFIP WG 11.9 International Conference, Orlando, FL, USA, January 28-29, 2019, Revised Selected Papers
Brand: Springer
Price: 53.49 EUR
Availability: OnlineOnly

15th IFIP WG 11.9 International Conference, Orlando, FL, USA, January 28-29, 2019, Revised Selected Papers

Gilbert Peterson Sujeet Shenoi(Herausgeber*in)

Springer (Verlag)

Erschienen am 6. August 2019

XVIII, 272 Seiten

E-Book

PDF mit Wasserzeichen-DRM

Systemvoraussetzungen

978-3-030-28752-8 (ISBN)

53,49 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Wasserzeichen-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Contents
Contributing Authors
Preface
I FORENSIC MODELS
1 A HOLISTIC FORENSIC MODEL FOR THE INTERNET OF THINGS
1. Introduction
2. Related Work
3. Proposed Holistic Forensic Model
3.1 Forensic Readiness (Proactive) Phase
3.2 Forensic Initialization (Incident) Phase
3.3 Forensic Investigation (Reactive) Phase
4. Forensic Technologies
4.1 Fog/Edge Computing
4.2 Blockchains
5. Research Challenges
6. Conclusions
References
2 IMPLEMENTING THE HARMONIZED MODEL FOR DIGITAL EVIDENCE ADMISSIBILITY ASSESSMENT
1. Introduction
2. Background and Related Work
3. Validation Survey Methodology and Findings
4. Proposed Algorithm
5. Evidential Weight Determination
6. Results and Discussion
7. Conclusions
References
II MOBILE AND EMBEDDEDDEVICE FORENSICS
3 CLASSIFYING THE AUTHENTICITY OF EVALUATED SMARTPHONE DATA
1. Introduction
2. Background
2.1 Authentic Smartphone Data
2.2 Requirements for Authentic Data
2.3 Smartphone Data Evaluation Model
3. Classification Model
3.1 Categorization of the Requirements
3.2 Authenticity Score
3.3 Authenticity Grading Scale
3.4 Completeness
3.5 Authenticity Classification
4. Authenticity Classification Tool
4.1 Tool Description
4.2 Experimental Results
5. Conclusions
References
4 RETROFITTING MOBILE DEVICES FOR CAPTURING MEMORY-RESIDENT
1. Introduction
2. Malware Categorization
2.1 Stagefright
2.2 Live Memory Analysis
3. Automated Memory Acquisition
3.1 Design Requirements
3.2 Implementation and Testing
3.3 Android Modification Results
4. Hardware Enhancements
4.1 Design Process and Requirements
4.2 Implementation Details
4.3 Experimental Results
5. Conclusions
References
5 A TARGETED DATA EXTRACTION SYSTEM FOR MOBILE DEVICES
1. Introduction
2. Related Work
3. System Overview
4. Targeted Data Extraction
4.1 On-Device Metadata-Based Filtering
4.2 On-Device Content-Based Filtering
4.3 Off-Device Backup-Based Filtering
4.4 TDES Communications
4.5 User Interface
4.6 Reporting and Forensic Integrity
5. Experiments and Results
6. Conclusions
Acknowledgements
References
6 EXPLOITING VENDOR-DEFINED MESSAGES IN THE USB POWER DELIVERY PROTOCOL
1. Introduction
2. Related Work
3. USB Power Delivery Protocol
4. Methodology
5. Experimental Results
6. Conclusions
Acknowledgement
References
7 DETECTING ANOMALIES IN PROGRAMMABLE LOGIC CONTROLLERS USING UNSUPERVISED MACHINE LEARNING
1. Introduction
2. Related Work
3. Anomaly Detection Case Study
3.1 Experimental Setup
3.2 Anomaly Detection Methodology
4. Discussion
5. Conclusions
References
III FILESYSTEM FORENSICS
8 CREATING A MAP OF USER DATA IN NTFS TO IMPROVE FILE CARVING
1. Introduction
2. Related Work
2.1 File Fragment Carving
2.2 Hash-Based Carving
2.3 Data Persistence
2.4 Data Reduction
2.5 Data Mapping
3. Proposed Method
4. Experimental Setup
4.1 Data Collection
4.2 Implementation
4.3 Evaluation
5. Experimental Results
6. Discussion
7. Conclusions
Acknowledgement
References
9 ANALYZING WINDOWS SUBSYSTEM FOR LINUX METADATA TO DETECT TIMESTAMP FORGERY
1. Introduction
2. Filesystem Timestamps
2.1 NTFS Timestamps and Time Resolutions
2.2 Ext4 Timestamps and Time Resolutions
3. Experiments and Results
3.1 Stand-Alone NTFS Filesystems
3.2 Stand-Alone Ext4 Filesystems
3.3 NTFS-Ext4 File Transfers
3.4 Timestomping Tool Capabilities
4. Discussion
5. Conclusions
References
IV IMAGE FORENSICS
10 QUICK RESPONSE ENCODING OF HUMAN FACIAL IMAGES FOR IDENTITY FRAUD DETECTION
1. Introduction
2. Related Work
3. Proposed Method
3.1 Document Generation
3.2 Document Authentication
4. Experiments and Results
4.1 Performance Evaluation
4.2 Image-to-Image Verification
4.3 Real-Time Person Verification
5. Conclusions
References
11 USING NEURAL NETWORKS FOR FAKE COLORIZED IMAGE DETECTION
1. Introduction
2. Background
3. Detection Methodology
3.1 Statistical Analysis and Testing
3.2 Feature Extraction
3.3 Neural Network Construction
4. Experiments and Results
4.1 Datasets
4.2 Measurements
4.3 Performance Evaluation
5. Conclusions
References
V FORENSIC TECHNIQUES
12 DIGITAL FORENSIC ATOMIC FORCE MICROSCOPY OF SEMICONDUCTOR MEMORY ARRAYS
1. Introduction
2. Background
2.1 Probe Microscopy
2.2 Security and Forensics
3. Atomic Force Microscopy
4. Memory Chip Layout and Structure
5. Prior Art
6. Vintage EPROM Chip Experiments
7. Conclusions
References
13 TIMELINE VISUALIZATION OF KEYWORDS
1. Introduction
2. Related Work
3. Proposed Technique
4. Topic Extraction and Preprocessing
5. Visualization
5.1 Finding and Ranking
5.2 Clustering
5.3 Rendering
6. Results
7. Conclusions
Acknowledgement
References
14 DETERMINING THE FORENSIC DATA REQUIREMENTS FOR INVESTIGATING HYPERVISOR ATTACKS
1. Introduction
2. Background and Related Work
2.1 Hypervisors
2.2 Related Work
3. Deriving Hypervisor Attack Profiles
3.1 NIST-NVD Vulnerabilities
3.2 Hypervisor Functionality
3.3 Deriving Attack Profiles
4. Sample Attacks and Forensic Implications
4.1 Sample Attacks
4.2 Identifying Evidence Coverage
4.3 Using Virtual Machine Introspection
5. Conclusions
References

Systemvoraussetzungen

Als PDF speichern Als Link merken