Forensic Science International-Digital Investigation最新文献_第2页

Active block hashing for efficient integrity verification of modern storage media and their forensic duplicates 用于现代存储介质及其法医副本的有效完整性验证的活动块散列

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302193

Jan Gruber, Felix Freiling, Simson L. Garfinkel

{"title":"Active block hashing for efficient integrity verification of modern storage media and their forensic duplicates","authors":"Jan Gruber, Felix Freiling, Simson L. Garfinkel","doi":"10.1016/j.fsidi.2026.302193","DOIUrl":"10.1016/j.fsidi.2026.302193","url":null,"abstract":"<div><div>Verifying evidential integrity through hashing underpins the chain of custody in digital forensics, yet modern storage technologies create complications because devices no longer reliably retain stale data. Sequential bitwise hashing is computationally expensive and sensitive to block-level changes caused by TRIM/Deallocate/Unmap operations on flash-based storage, where the controller silently alters blocks once they are deallocated; file hashing avoids this but is incomplete since it excludes relevant file system (FS) metadata. This article introduces <em>tree-based active block hashing</em>, a deterministic hashing scheme that leverages file system semantics to protect the integrity of active blocks. These data blocks are organized into a Merkle tree that remains invariant to TRIM-induced changes and, rather than merely signaling that verification failed, localizes modifications, including those affecting file system metadata, enabling examiners to pinpoint affected blocks, assess their evidential impact, and perform partial integrity verification. We formalize the construction, define activation functions for FAT, NTFS, and ext file systems, and present an open-source implementation. An empirical evaluation on solid-state drives with varying file systems and fill levels shows that active block hashing outperforms sequential bitwise hashing on partially filled media and remains competitive with FS parser-mediated file hashing while offering broader integrity coverage. Limitations arise for highly filled media and in the presence of file system corruption, indicating that the approach complements existing modification detection methods, as it characterizes a trade-off between integrity protection, computational efficiency, and granularity of integrity verification.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302193"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159268","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Sixth DFRWS APAC 2026 第六届DFRWS APAC 2026

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302194

Gaurav Gogia (Proceedings Chair of DFRWS APAC 2026), Jieon Kim (Proceedings Vice Chair of DFRWS APAC 2026)

引用次数: 0

Time-anchor: Detecting system clock manipulation in android Time-anchor：在android中检测系统时钟操作

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302191

Jihye Jang, Eunji Lee, Yeon Baek, Jungho Kim, Sungjin Lee, Gibum Kim

{"title":"Time-anchor: Detecting system clock manipulation in android","authors":"Jihye Jang, Eunji Lee, Yeon Baek, Jungho Kim, Sungjin Lee, Gibum Kim","doi":"10.1016/j.fsidi.2026.302191","DOIUrl":"10.1016/j.fsidi.2026.302191","url":null,"abstract":"<div><div>Timestamps generated in mobile environments primarily rely on the device system clock. However, their reliability can be compromised by user-initiated time changes, system errors, or time discrepancies between servers and devices. Analyses based on a single timestamp may therefore lead to errors in event timeline reconstruction. Nevertheless, a common standard for evaluating timestamps in mobile forensic analysis has not yet been established. This study examines the effects of system clock manipulation on timestamps recorded in Android artifacts and proposes a method for detecting time manipulation by comparing device time, generated from the device system clock, with external time, obtained from external servers. Experiments were conducted on four Android smartphones from two vendors, spanning Android 9 to 16, under three time conditions: normal, backdated, and postdated. Everyday activities, including calls, SMS, notes, voice recordings, messengers, emails, web browsing, and cloud storage were performed, and time information stored in application databases, file system metadata, logs, and notification history was analyzed. The results show that call logs, voice recording files, and web browsing records primarily reflected device time and shifted according to system time manipulation. In contrast, external time was preserved in some artifacts from SMS, notes, messengers, emails, and cloud services, enabling the detection of time manipulation and estimation of clock skew. These findings provide practical criteria for evaluating timestamp reliability in mobile forensic analysis and improve the accuracy of mobile timestamp interpretation.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302191"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

It's up to us what AI and the next generation learn about Digital Investigation 人工智能和下一代人对数字调查的了解取决于我们

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-09-03 DOI: 10.1016/j.fsidi.2026.302204

引用次数: 0

Blockchain feature extraction and behavioral profiling for illicit transaction analysis 区块链特征提取和行为分析的非法交易分析

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-08-29 DOI: 10.1016/j.fsidi.2026.302197

Mahdi Daghmehchi Firoozjaei, MinChang Kim, Hyoungshick Kim, Arash Habibi Lashkari, Ali A. Ghorbani

{"title":"Blockchain feature extraction and behavioral profiling for illicit transaction analysis","authors":"Mahdi Daghmehchi Firoozjaei, MinChang Kim, Hyoungshick Kim, Arash Habibi Lashkari, Ali A. Ghorbani","doi":"10.1016/j.fsidi.2026.302197","DOIUrl":"10.1016/j.fsidi.2026.302197","url":null,"abstract":"<div><div>Cryptocurrencies have become a dominant medium for financial transactions in dark web ecosystems, enabling illicit activities through pseudonymous and decentralized payment mechanisms. Understanding and monitoring such activities require systematic analysis of blockchain transaction data. Blockchain profiling provides a principled approach for characterizing user behavior, identifying suspicious patterns, and tracing illicit fund flows in adversarial environments. In this paper, we examine the goals and challenges of blockchain-based user profiling in dark web contexts, highlighting the impact of pseudonymity, obfuscation techniques, data sparsity, and adversarial adaptation. We further introduce a structured taxonomy of blockchain features designed to support comprehensive profiling of illicit activity, encompassing transactional, temporal, structural, behavioral, and obfuscation-related dimensions. To validate the relevance of the proposed taxonomy, we conduct an empirical analysis using the Elliptic Bitcoin dataset, comprising <span><math><mrow><mn>203,769</mn></mrow></math></span> transactions and <span><math><mrow><mn>234,355</mn></mrow></math></span> fund-flow edges, to extract representative profiling features and compare the behavioral characteristics of illicit and licit transactions using statistical significance testing. Our results reveal consistent and statistically supported behavioral differences in illicit and licit transaction patterns, while also identifying features with limited discriminative power. These findings highlight key limitations and provide insights for developing more robust, multi-feature blockchain profiling frameworks for dark web ecosystems.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302197"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148951217","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

WALRUS: Reconstructing deleted and encrypted SQLite WAL pages from unallocated space 从未分配的空间重建已删除和加密的SQLite WAL页面

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302188

Sueun Jung, Jungheum Park

引用次数: 0

Extending detection engineering to digital forensics: The Velociraptor unified detection-forensics methodology 将检测工程扩展到数字取证：迅猛龙统一检测取证方法

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302179

Aghni Anugrah Raesa, Adithyan Shaji Nambiar, Veda Dawoonauth, Aditya Kumar, Mike Cohen, Priyanka Singh

{"title":"Extending detection engineering to digital forensics: The Velociraptor unified detection-forensics methodology","authors":"Aghni Anugrah Raesa, Adithyan Shaji Nambiar, Veda Dawoonauth, Aditya Kumar, Mike Cohen, Priyanka Singh","doi":"10.1016/j.fsidi.2026.302179","DOIUrl":"10.1016/j.fsidi.2026.302179","url":null,"abstract":"<div><div>Detection engineering monitors live endpoint logs through centralised platforms. Digital forensics reconstructs past activity from durable artefacts such as Prefetch files and command history. These two disciplines work in parallel. Detection rules depend on log streams that attackers can clear, while forensic analysis remains largely manual.</div><div>This paper presents a unified methodology that treats forensic artefacts as structured log sources for Sigma detection rules. Detection logic initiates targeted evidence acquisition so that every alert carries the forensic artefacts that support it. A four-stage process converts artefact knowledge into reusable detection rules. Correlation rules link related detections using native timestamps where the artefact records them and positional ordering where it does not.</div><div>Two case studies demonstrate the approach. The first detects bursts of network discovery activity (MITRE ATT&CK T1016) in Windows Prefetch, a forensic fallback when event logs are unavailable. The second detects a four-step infection chain in Linux bash history, where no timestamps exist. Both operate on artefacts that persist after log tampering, and each rule is authored once and then reused across endpoints.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302179"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159192","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CAFE: A claim-level cross-artifact verification framework for assessing the reliability of Windows forensic evidence under anti-forensic manipulation CAFE：一个索赔级别的跨工件验证框架，用于评估反取证操作下Windows取证证据的可靠性

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302192

Hyunwoo Shin, Jungheum Park

{"title":"CAFE: A claim-level cross-artifact verification framework for assessing the reliability of Windows forensic evidence under anti-forensic manipulation","authors":"Hyunwoo Shin, Jungheum Park","doi":"10.1016/j.fsidi.2026.302192","DOIUrl":"10.1016/j.fsidi.2026.302192","url":null,"abstract":"<div><div>Windows forensic investigations rely on heterogeneous artifacts such as Event Logs, Prefetch, Amcache, browser records, and file system metadata to reconstruct user and system activities. However, selective deletion, clearing, or regeneration can undermine conclusions drawn from a single source. CAFE addresses this problem by linking examiner-supplied candidate claims to normalized evidence items and explicitly representing provenance, support, conflict, and explained absence across artifact families. It separates the reconstruction of event claims from identifying which artifact family has become less reliable due to manipulation, allowing the loss of evidence supporting a claim and the degradation of that artifact family's continuity to be reported as distinct outcomes. We evaluate CAFE on Windows 10 and Windows 11 using seven controlled scenarios with three repetitions per operating system. CAFE raised no high severity conflicts in clean runs and localized all declared target surfaces in 34 of 36 manipulated runs. When manipulation removed a claim's primary source, reduced claim support exposed the resulting evidentiary loss rather than inferring an unsupported event. These findings demonstrate the feasibility of claim level cross artifact analysis as an explainable verification layer under controlled conditions.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302192"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159267","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

STAFT: Privacy-preserving semantic trace abstraction for forensic triage of personal AI agent incidents 员工：保护隐私的语义跟踪抽象，用于个人AI代理事件的法医分类

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302184

Minseok Hur, Jiho Shin, Moohong Min

{"title":"STAFT: Privacy-preserving semantic trace abstraction for forensic triage of personal AI agent incidents","authors":"Minseok Hur, Jiho Shin, Moohong Min","doi":"10.1016/j.fsidi.2026.302184","DOIUrl":"10.1016/j.fsidi.2026.302184","url":null,"abstract":"<div><div>Personal AI assistants act on private user context, which makes their execution traces primary forensic artifacts that are themselves privacy-sensitive. We present <span>staft</span> (<strong>S</strong>emantic <strong>T</strong>race <strong>A</strong>bstraction for <strong>F</strong>orensic <strong>T</strong>riage), a forensic triage framework that replaces raw trace content with compact <span>action, target</span>, and <span>intent</span> tags for low-authorization triage while hash-linking the abstraction to the sealed raw trace at creation time. Across 150 agent traces from OS-HARM spanning indirect prompt injection, deliberate misuse, and model misbehavior, scope-matched Presidio masking removes the identifiers it is configured to detect while leaving the trace surface nearly unchanged (<em>M</em><sub>2</sub> = 0.998 in every category). On the 50 injection traces, <span>staft</span> reduces token volume by 98.5%. In a focused evaluation of 18 validated canaries drawn from 12 traces, an adversary given the abstracted trace and the original task instruction recovers none, whereas identifier masking leaves 10 recoverable. The abstracted trace still narrows the six candidate sources to a shortlist of three containing the ground-truth source for 94% of traces. Under the evaluated benchmark and threat model, <span>staft</span> suppresses identifier- and surface-level exposure while retaining the behavioral structure that early triage depends on, and it supports scoped escalation rather than replacing analysis of the raw evidence.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302184"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159259","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Forensic reliability of publicly accessible image-authentication and deepfake-detection tools: An investigator-led evaluation of open-source and free-to-use platforms 公开访问的图像认证和深度伪造检测工具的取证可靠性：调查人员主导的开源和免费使用平台的评估

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302186

Michael Rettinger, Ben Beaumont, Nhien-An Le-Khac, Hong-Hanh Nguyen-Le

{"title":"Forensic reliability of publicly accessible image-authentication and deepfake-detection tools: An investigator-led evaluation of open-source and free-to-use platforms","authors":"Michael Rettinger, Ben Beaumont, Nhien-An Le-Khac, Hong-Hanh Nguyen-Le","doi":"10.1016/j.fsidi.2026.302186","DOIUrl":"10.1016/j.fsidi.2026.302186","url":null,"abstract":"<div><div>Deepfake, AI-generated, and conventionally tampered images increasingly appear in fraud, harassment, misinformation, and other investigations in which investigators must assess whether a questioned image is authentic, manipulated, or synthetic. Although deepfake-detection research is extensive, much less is known about the forensic reliability of the public tools that investigators, journalists, and first responders can access during early-stage triage. This paper evaluates six publicly accessible tools from two operational paradigms: analyst-interpreted forensic platforms (InVID & WeVerify, FotoForensics, and Forensically) and automated AI classifiers (DecopyAI, FaceOnLive, and Bitmind). Using blinded protocols, Dataset 1 assessed the forensic platforms on 100 authentic, tampered, and AI-generated images, while Dataset 2 assessed the classifiers and one blinded investigator on 150 real and deepfake images spanning facial and scene categories. Within their respective datasets, the two paradigms showed distinct error patterns. Forensic-platform assessments achieved high sensitivity but sometimes interpreted traces from genuine or benignly processed images as evidence of suspicious manipulation, whereas AI classifiers maintained high specificity for real images but missed substantial numbers of deepfakes, including all sampled HeyGen outputs. On Dataset 2, the investigator achieved a higher accuracy point estimate than every classifier. Human–AI disagreement was strongly asymmetric: most disagreements occurred when the investigator correctly identified a deepfake that a classifier labelled real. These findings indicate that publicly accessible image-authentication and deepfake-detection tools are useful for early-stage triage but should not be treated as standalone evidence. We recommend multi-tool usage, documented human review, and escalation of disagreement cases.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302186"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159261","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0