2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)最新文献

UniTIME: Timestamp interpretation engine for developing unified timelines UniTIME:时间戳解释引擎，用于开发统一的时间线

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911546

S. Raghavan, H. Saran

{"title":"UniTIME: Timestamp interpretation engine for developing unified timelines","authors":"S. Raghavan, H. Saran","doi":"10.1109/SADFE.2013.6911546","DOIUrl":"https://doi.org/10.1109/SADFE.2013.6911546","url":null,"abstract":"A critical part of many computer forensic investigations requires developing a unified timeline of activity from the timestamps of the artifacts involved, often involving digital artifacts from across multiple heterogeneous sources of evidence. However, generating such a timeline comes with its own set of challenges, especially if the provenance of the timestamps is not accurately recorded and tracked during an investigation. When sufficient provenance information is not recorded, it can result in inconsistent or ambiguous timelines. In this paper, we propose the Provenance Information Model to address challenges related to timestamp interpretation across multiple time zones and present a provenance structure to accurately capture time zone information and validate time related assertions during analysis. We have developed a prototype implementation of the model, the UniTIME digital time-lining tool, which generates a unified timeline of events derived from across multiple sources. Our tool adjusts the timestamps obtained from multiple heterogeneous evidence sources using the provenance information to generate a unified timeline. We have validated our model and its prototype implementation using the dataset associated with the DFRWS 2008 challenge which included multiple heterogeneous sources of digital evidence with inherent timestamp interpretation challenges. Results have shown that the model is robust with respect to different time zones and varied timestamp representations. Additionally, the assertions recorded when using our PIM can be useful in identifying inconsistencies across artifacts during forensic analysis and digital time-lining.","PeriodicalId":287131,"journal":{"name":"2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115510816","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 2

Quantification of digital forensic hypotheses using probability theory 利用概率论量化数字法医假设

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911547

R. Overill, Jantje A. M. Silomon, K. Chow, Hayson Tse

引用次数: 6

Forensic artifacts of the ChatON Instant Messaging application ChatON即时消息应用程序的取证工件

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911538

Asif Iqbal, A. Marrington, I. Baggili

引用次数: 15

Seizure of digital data and “selective suppression” of digital evidence 扣押数字数据和“选择性压制”数字证据

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911545

N. Kuntze, C. Rudolph, Hellen Schilling, Aaron Alva, Brooke R. Brisbois, B. Endicott-Popovsky

引用次数: 0

AssocGEN: Engine for analyzing metadata based associations in digital evidence AssocGEN:用于分析数字证据中基于关联的元数据的引擎

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911541

S. Raghavan, S. Raghavan

{"title":"AssocGEN: Engine for analyzing metadata based associations in digital evidence","authors":"S. Raghavan, S. Raghavan","doi":"10.1109/SADFE.2013.6911541","DOIUrl":"https://doi.org/10.1109/SADFE.2013.6911541","url":null,"abstract":"Traditionally, sources of digital evidence are analyzed by individually examining the various artifacts contained therein and using the artifact metadata to validate authenticity and sequence them. However, when artifacts from forensic images, folders, log files, and network packet dumps have to be analyzed, the examination of the artifacts and the metadata in isolation presents a significant challenge. Ideally, when a source is examined, it is a valuable task to determine correlations between the artifacts and group the related artifacts. Such a grouping can simplify the task of analysis by minimizing the need for human intervention. By virtue of the value that metadata bring to an investigation and its ubiquitous nature, metadata based associations is the first step in realizing such correlations automatically during analysis. In this paper, we present the AssocGEN analysis engine which uses the metadata to determine associations between artifacts that belong to files, logs and network packet dumps, and identifies metadata associations to group the related artifacts. A metadata association can represent any type of value match1 or relationship that is deemed relevant in the context of an investigation. We have conducted preliminary evaluation of AssocGEN on the classical ownership problem to highlight the benefits of incorporating this approach in existing forensic tools.","PeriodicalId":287131,"journal":{"name":"2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134295549","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 18

On the application of digital forensics in different scenarios 浅谈数字取证在不同场景中的应用

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911550

Jingsha He, Xuejiao Wan, Gongzheng Liu, Na Huang, Bin Zhao

引用次数: 1

FishEYE: A Forensic Tool for the visualization of change-over-time in Windows VSS 用于可视化Windows VSS中随时间变化的取证工具

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911544

Jin-Ning Tioh, Y. Guan

引用次数: 1

MapReduce-based frequent itemset mining for analysis of electronic evidence 基于mapreduce的频繁项集挖掘用于电子证据分析

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911549

Xueqing Jiang, Guozi Sun

{"title":"MapReduce-based frequent itemset mining for analysis of electronic evidence","authors":"Xueqing Jiang, Guozi Sun","doi":"10.1109/SADFE.2013.6911549","DOIUrl":"https://doi.org/10.1109/SADFE.2013.6911549","url":null,"abstract":"Association rules can mine the relevant evidence of computer crime from the massive data and association rules among data itemset, and further mine crime trends and connections among different crimes. They can help polices detect case and prevent crime with clues and criterions. Frequent itemset mining (FIM) plays a fundamental role in mining associations, correlations and many real-world data mining fields such as electronic evidence analysis area. FP-growth is the most famous FIM algorithm for discovering frequent patterns. As the data incrementing, the cost of time and space will be the bottleneck of FP-growth mining algorithms. One of the existing incremental frequent pattern mining algorithms called SPO-tree can perform incremental mining by a single scan for incremental mining. But how to apply this algorithm to the analysis of electronic evidence more effectively will become the focus of this paper. In the past research, little people take care of the item mined to the frequent item needing to update or inserted a little data. The past algorithms are not suit for this problem especially in forensic area. So, in this paper, we propose a novel parallelized algorithm called PISPO based on the cloud-computing framework MapReduce, which is widely used to cope with large-scale data and captures both the content and state to be distributed to the changed and original of the transactions dataset to SPO-tree.","PeriodicalId":287131,"journal":{"name":"2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE)","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124980803","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

The next generation for the forensic extraction of electronic evidence from mobile telephones 从移动电话中提取电子证据的下一代法医

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911548

Hayson Tse, Kam-pui Chow, M. Kwan

引用次数: 2

Legal/forensic concerns in the analysis of digital device hardcopy output 数字设备硬拷贝输出分析中的法律/法医问题

2013 8th International Workshop on Systematic Approaches to Digital Forensics Engineering (SADFE) Pub Date : 2013-11-01 DOI: 10.1109/SADFE.2013.6911543

M. Losavio, D. Keeling

引用次数: 1