Forensic Science International-Digital Investigation最新文献

{"title":"Melbourne DFRWS 2027","authors":"","doi":"10.1016/S2666-2817(26)00186-1","DOIUrl":"10.1016/S2666-2817(26)00186-1","url":null,"abstract":"","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302229"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149153585","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"DFRWS-Vancouver-2027","authors":"","doi":"10.1016/S2666-2817(26)00185-X","DOIUrl":"10.1016/S2666-2817(26)00185-X","url":null,"abstract":"","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302228"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149153584","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Toward next-generation DFIR triage: E01 imaging of selectively collected artifacts","authors":"JunHyeong Lee","doi":"10.1016/j.fsidi.2026.302190","DOIUrl":"10.1016/j.fsidi.2026.302190","url":null,"abstract":"<div><div>DFIR field triage after a breach needs fast collection and evidence that opens immediately in standard forensic tools. Full-disk imaging provides compatibility and chain of custody, but is slow and large. Selective acquisition tools such as KAPE, CyLR, and Velociraptor are faster, but their output is split into file copies and sidecar metadata files.</div><div>We propose a single-pass processing flow that writes NTFS regions selected by policy directly to an EWF1/E01 evidence container. Selected regions are stored as compressed chunks, while unselected regions are represented as logical zero regions. The output therefore keeps the source volume’s logical size and NTFS layout. FTK Imager, Magnet AXIOM, and X-Ways recognized this E01 without separate conversion.</div><div>On a NIST CFReDS 20.00 GB NTFS image under a 23-rule triage policy, the reference implementation generated a 308 MB E01 with a 42.28 s median over 5 runs, and the repeated outputs were byte-identical. A single run on a 446.02 GB incident-response partition generated a 1.09 GB E01. In the CFReDS comparison with KAPE, the proposed method took longer, but produced a single E01 container with container-level metadata and integrity verification.</div><div>The results depend on the selection ratio and data compressibility. If the policy selects many already compressed video or archive files, the output ratio and throughput bottleneck may change. The E01 container hash is computed over a logical disk made of selected regions and zero regions, so file identity in selective seizure must be interpreted together with a separate per-file hash manifest.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302190"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159189","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Hiding data in Btrfs file systems","authors":"Fergus Toolan,&nbsp;Georgina Humphries","doi":"10.1016/j.fsidi.2026.302198","DOIUrl":"10.1016/j.fsidi.2026.302198","url":null,"abstract":"<div><div>Data hiding in file systems is a common form of anti-forensics, however, most research in this area has been conducted on common file systems such as FAT, NTFS, Ext, etc., and not lesser used file systems. This research focuses on data hiding in Btrfs file systems. While Btrfs is now the standard for openSUSE and Fedora Linux distributions forensic tools still provide little support for the file system. This paper proposes six new techniques for data hiding in the Btrfs file system and evaluates their effectiveness using the metrics of capacity, stability and detection difficulty.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302198"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148951216","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"I will survive: CleanerScope, a phase-based pipeline for analyzing residual artifacts from Android file-wiping applications","authors":"Uju Okoye,&nbsp;Abdus Satter,&nbsp;Shishir Panta,&nbsp;Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302185","DOIUrl":"10.1016/j.fsidi.2026.302185","url":null,"abstract":"<div><div>Android secure-deletion applications claim to erase files and reduce forensic recoverability, but their own execution can leave residual evidence about app use, selected methods, and targeted files. Yet investigators lack a structured workflow for detecting, timing, and interpreting these traces across different access conditions and lifecycle phases. We present CleanerScope, an access-aware and phase-based forensic pipeline that separates artifact acquisition from artifact interpretation by collecting rooted and non-rooted evidence across four lifecycle phases (baseline, post-wipe, post-uninstall, and post-reboot), then correlating dynamic artifacts, persisted system traces, app-private storage, runtime logs, and static code analysis. We evaluate CleanerScope on nine Android wiping applications using a controlled dataset of 58 files, scripted <span>adb</span> acquisition, and static analysis with JADX. App use remained detectable across all nine applications, with <span>usage_stats</span> providing the most durable evidence for detection and timeline reconstruction. Rooted acquisition was required for app-specific method selectors, structured reports, and DataStore files, while non-rooted acquisition still supported detection and timing. Method evidence ranged from direct strings to coded selectors requiring static mapping, and seven of nine applications preserved exact filenames or paths in post-wipe artifacts. Physical-device validation on Android 14 across three applications reproduced these patterns, confirming that CleanerScope provides a reproducible workflow for recovering forensically probative evidence across access levels, lifecycle phases, and device environments.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302185"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159260","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"A forensic methodology for tracing deepfake multimedia content creation and distribution on android smartphones","authors":"Jong-in Kim,&nbsp;Dohyun Kim","doi":"10.1016/j.fsidi.2026.302181","DOIUrl":"10.1016/j.fsidi.2026.302181","url":null,"abstract":"<div><div>The recent surge in deepfake-enabled digital sexual crimes calls for digital forensic techniques that trace the entire creation-to-distribution process of deepfake content. However, prior work has remained limited to social media user-behavior analysis or deepfake authenticity detection, and no methodology has linked and traced the creation-to-distribution process. This study examines four Android deepfake creation apps and three social media apps, cross-analyzing the artifacts generated in the<span>/data</span> and<span>/sdcard</span> partitions during app use, and proposes a methodology that connects file system metadata and hash values by file identity and temporal order to verify whether creation and distribution occurred. In scenario-based verification, the entire process could be established in the absence of anti-forensic actions, and even when some storage areas were deleted, the verifiable scope from the remaining artifacts was specified. Furthermore, to compensate for cases where hash values are not preserved, visual-similarity verification based on face-recognition models (RetinaFace, ArcFace) was introduced as an auxiliary means. This verification confirmed that same-person candidates could be screened by visual similarity even for files whose hashes had changed. The proposed methodology can serve as an evidence-acquisition framework that establishes a verifiable evidentiary chain for deepfake crimes in real investigative settings.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302181"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159262","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"SoK: Operationalizing the likelihood-ratio framework for digital evidence","authors":"Jan Gruber,&nbsp;Ruud Schramp","doi":"10.1016/j.fsidi.2026.302182","DOIUrl":"10.1016/j.fsidi.2026.302182","url":null,"abstract":"<div><div>Digital forensic examiners typically assess evidential strength informally rather than within the likelihood ratio (LR) framework. The LR framework applies in principle to any digital trace; operational feasibility varies currently by trace class. We systematize thirteen data-driven works that apply the framework to traces generated by device or system operation, grouped into three clusters: sensor-derived measurements, mobility-pattern matching, and event-stream matching. We characterize each work by its approach, proposition level, and trace class, and position it on two axes—reference-data engagement and validation maturity—that jointly indicate operational readiness. All thirteen works address variability in trace generation, countering the view that digital traces are purely deterministic. We find four gaps: First, the clusters cover only a fraction of the relevant trace classes; the framework has yet to be applied to IoT sensor measurements, operating-system traces, and high-volume classes such as log data, databases, and caches. Second, similarity score-based methods dominate as a pragmatic response to high-dimensional data but discard typicality information a well-posed LR requires. Third, reference data are rarely adequate: convenience corpora often stand in for casework conditions, and only two works substantively engage the relevant population. Fourth, validation is uneven: six works go no further than reporting discrimination, and none has been validated under casework conditions or externally corroborated. Closing these gaps demands extension to the neglected trace classes, methods that capture typicality, shared reference corpora, and adherence to validation guidelines.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302182"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159263","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"CARVE: Recovering and reconstructing deleted H.264/H.265 video from honeywell surveillance systems","authors":"Pravas Giri,&nbsp;Jinhee Yoon,&nbsp;Sungjae Hwang","doi":"10.1016/j.fsidi.2026.302189","DOIUrl":"10.1016/j.fsidi.2026.302189","url":null,"abstract":"<div><div>Digital video surveillance is an important source of forensic evidence, but recovering deleted footage from network video recorder (NVR) systems remains challenging because many devices use proprietary file systems, undocumented metadata structures, and non-standard storage layouts.</div><div>This paper presents <span>carve</span>, a forensic framework for recovering and reconstructing deleted H.264/H.265 video from Honeywell surveillance systems. <span>carve</span> identifies codec-specific structures in raw video data region to carve residual fragments, separates deleted footage from current recordings using embedded timestamps, groups fragments by source camera, and reconstructs video timelines. <span>carve</span> supports two complementary reconstruction settings. When visual overlays are available, it applies custom frame preprocessing and uses PaddleOCR-VL-1.5 to extract camera labels and timestamps. Compared with directly applying PaddleOCR-VL-1.5 to raw frames, this preprocessing increases overlay detection accuracy by approximately 26% for H.264 and 50% for H.265 recordings. When overlays are unavailable, <span>carve</span> clusters fragments by source using PRNU-based sensor-noise fingerprints, and orders them using embedded timestamps. In both settings, <span>carve</span> further revisits fragments that are not assigned during initial grouping and uses them to fill detected internal temporal gaps during timeline reconstruction phase. We evaluate <span>carve</span> on a Honeywell NVR using a baseline disk image and three deletion scenarios: data-expiration, overwrite deletion, and format-deletion. Across all scenarios, <span>carve</span> achieves an average recovery rate of 99.89% and reconstructs internal temporal gaps with 100% precision. Additionally, integrity and reproducibility tests confirmed that <span>carve</span> preserves the original video data and produces consistent results across repeated executions, supporting the forensic soundness of the recovery process.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302189"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159270","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Erased photos, surviving faces: On-device AI residue as a new class of digital evidence in Samsung Gallery","authors":"ChaeMin Park,&nbsp;JuHwan Park,&nbsp;Dohyun Kim","doi":"10.1016/j.fsidi.2026.302183","DOIUrl":"10.1016/j.fsidi.2026.302183","url":null,"abstract":"<div><div>Traditional digital forensics analyzes artifacts that directly record user actions, such as logs and application databases. As on-device AI becomes common, however, <em>AI residue</em> — data derived from user content, such as facial feature vectors — can also serve as digital evidence. Using the people-tag feature of Samsung Gallery as a case study, this paper reverse-engineers the on-device face-clustering pipeline (static analysis with Ghidra, dynamic analysis with Frida) and quantitatively evaluates the forensic value and persistence of the resulting residue, with four contributions. (i) We document the pipeline from face detection to GCN clustering, including five decision thresholds and the extraction-failure boundary (|<em>pose</em>|≥ 38°), and release an open-source tool that reproduces it; tool- and device-generated vectors match at mean cosine 0.9512(<em>N</em> = 2, 440). (ii) With external reference images, the tool identifies registered persons at TPR 95.62% and detects permanently deleted persons at 95.67%. (iii) To our knowledge, this is the first quantification of how long deleted vectors persist in <span>face_data</span>: block reuse is deterministic (smallest-unreferenced-first, 100% predicted-vs-observed match), giving survival of <em>T</em>₉₀ = 83 and <em>T</em>₅₀ = 385 newly registered faces. (iv) Eight differential-residue rules distinguish normal use from intentional concealment (<em>F</em>1 = 1.0), and person data is redundantly stored in the system-protected <span>media.db</span>, auto-restoring after user-level app-data deletion. These findings establish AI residue as a distinct class of digital evidence.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302183"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159264","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Evidence-borne prompt injection in LLM-assisted textual evidence triage","authors":"Dongho Kim,&nbsp;Damin Kim,&nbsp;Moohong Min","doi":"10.1016/j.fsidi.2026.302187","DOIUrl":"10.1016/j.fsidi.2026.302187","url":null,"abstract":"<div><div>Large language models (LLMs) are increasingly used to support forensic triage and classification over natural-language evidence such as emails, SMS messages, and notes. This study presents a controlled first measurement of a new attack surface in LLM-assisted evidence triage, in which the evidence being analyzed can itself contain natural-language instructions that steer the model's forensic judgment. We define this threat as evidence-borne prompt injection, a form of indirect prompt injection in which the injection is delivered through the evidence itself, and characterize it as an interpretation-layer anti-forensic attack surface in LLM-assisted textual evidence triage. To evaluate this threat, we construct a controlled synthetic benchmark of 300 clean messaging evidence items and 9000 injection-augmented variants. The analyzer performs structured forensic triage over suspicion label, risk level, and issue type. Our results show that the GPT-4o-based analyzer achieves near-perfect suspicion-label accuracy on the clean benchmark, but outputs the attacker-targeted suspicion label in 31.3% of injected cases. The attack is highly asymmetric. False-positive injection from normal to suspicious evidence succeeds in 54.1% of cases, whereas evasion from suspicious to normal succeeds in 8.5%. We also show that a simple black-box prompt defense that treats evidence as untrusted data reduces attack success rate (ASR) from 31.3% to 0.6% without degrading clean suspicion-label accuracy. These findings show that textual evidence in LLM-assisted forensic pipelines is not only an object of analysis, but also a potential instruction carrier that can distort forensic triage outcomes.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302187"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159265","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}