Forensic Science International-Digital Investigation最新文献_第3页

Forensic analysis of virtual phone applications: Artifact recovery, provider identification, and automated user attribution 虚拟电话应用程序的取证分析：工件恢复、提供者识别和自动用户归属

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/j.fsidi.2026.302180

Yeonsu Yeo, Eunji Lee, Kiseok Lee, Gibum Kim

{"title":"Forensic analysis of virtual phone applications: Artifact recovery, provider identification, and automated user attribution","authors":"Yeonsu Yeo, Eunji Lee, Kiseok Lee, Gibum Kim","doi":"10.1016/j.fsidi.2026.302180","DOIUrl":"10.1016/j.fsidi.2026.302180","url":null,"abstract":"<div><div>Virtual Phone Applications (VPAs) provide Internet-based phone numbers for calls and messaging without a physical SIM, but their multinational CPaaS/VoIP infrastructures complicate attribution and often require cross-border cooperation. Prior forensic research has not systematically examined VPA-specific number issuance, reissuance, provider mediation, and backend communication. We analyzed six Android VPAs—Text & Call, Talkatone, Dingtone, textPlus, My 2nd Line, and OnPhone—on rooted devices under controlled registration, number-issuance, reissuance, calling, and messaging scenarios. Device, APK, network, and API analyses recovered message histories, call histories, and virtual-number artifacts from all six applications, access-IP artifacts from five, and identified the CPaaS/VoIP provider for each service. Authenticated API analysis enabled historical-record retrieval for four applications, and number reissuance generally preserved prior communications while updating current-number metadata, allowing number-change history to be inferred. Based on these findings, we developed a Python tool for heuristic VPA identification and automated artifact extraction and analysis. Across 150 VPA installations, the tool achieved 99.33% precision, 98.67% recall, and a 99.00% F1-score; a rerun on the same population after threshold refinement eliminated the observed errors, while extraction and analysis succeeded for all six target applications. We also propose a provider-aware forensic workflow supporting evidence acquisition and provider-directed requests in cross-border investigations.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"58 ","pages":"Article 302180"},"PeriodicalIF":3.1,"publicationDate":"2026-09-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"149159258","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DFRWS-Edinburgh-EU-2027

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-09-01 Epub Date: 2026-10-10 DOI: 10.1016/S2666-2817(26)00184-8

引用次数: 0

DFRWS APAC 2026

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302169

引用次数: 0

Investigation of large language models, GenAI, and proprietary AI systems:Digital forensic evidence, readiness and regulation 大型语言模型、GenAI和专有AI系统的调查：数字取证证据、准备和监管

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-05-29 DOI: 10.1016/j.fsidi.2026.302135

Mark Scanlon

引用次数: 0

DFRWS EU 2027 Edinburgh

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302160

引用次数: 0

From dockets to Docker: Engineering realistic forensic scenarios for Onion Service investigations 从摘要到Docker：洋葱服务调查的工程现实取证场景

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302125

Pascal Tippe, Daniel Spiekermann, Adrian Tippe

{"title":"From dockets to Docker: Engineering realistic forensic scenarios for Onion Service investigations","authors":"Pascal Tippe, Daniel Spiekermann, Adrian Tippe","doi":"10.1016/j.fsidi.2026.302125","DOIUrl":"10.1016/j.fsidi.2026.302125","url":null,"abstract":"<div><div>Digital forensics education relies heavily on static datasets, which often fail to replicate the complexity of investigating live, anonymous infrastructures. This paper bridges the gap between theoretical anonymization technologies and isolated forensic artifacts by presenting a novel training environment grounded in historical case data. We first analyzed court documents from 16 high-profile Onion Service takedowns, revealing that successful investigations leverage multiple information sources and rely primarily on linking information and technical misconfigurations rather than protocol exploits. We operationalized these findings into <em>DarkMarket</em>, a containerized simulation that requires trainees to navigate a multi-layered investigative chain ranging from identifying information leaks to executing active scanning. A qualitative pilot study with four active-duty law enforcement digital forensic practitioners validated the environment's realism while highlighting a structural gap: current forensic taxonomies proved insufficient for live Onion Service investigations, which instead required adaptive, hypothesis-driven methodologies. Furthermore, we observed a potential <em>Technical Halo Effect</em>, where the robust frontend security led experts to heuristically overestimate the adversary's backend competence. These findings underscore that effectively attributing high-value targets requires expanding forensic competencies to include the controlled, active verification strategies found in Network Investigative Techniques.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302125"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565428","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

SoK: Anti-forensics evolution, platform coverage, and mobile residual evidence SoK：反取证进化、平台覆盖和移动残留证据

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302127

Uju Okoye, Roohana Karim, Abdur Onik, Ibrahim Baggili

{"title":"SoK: Anti-forensics evolution, platform coverage, and mobile residual evidence","authors":"Uju Okoye, Roohana Karim, Abdur Onik, Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302127","DOIUrl":"10.1016/j.fsidi.2026.302127","url":null,"abstract":"<div><div>This Systematization of Knowledge (SoK) analyzes 197 primary studies (2005–2024) to examine how anti-forensics (AF) techniques have evolved, their distribution across platforms, and what forensic artifacts persist after mobile AF activity. We report three key findings. First, AF has matured from traditional data hiding and artifact wiping toward deception-oriented approaches; data fabrication now dominates, and AI-driven anti-forensics (AAF) has emerged but exclusively in multimedia pipelines, with no mobile validation. Second, platform coverage is imbalanced: Windows and Android dominate, while iOS and macOS each appear in only a few studies, and cross-platform validation is rare. Third, mobile AF tends to displace rather than erase evidence: across 18 studies, 93 residual observations persist in SQLite/WAL, logs, caches, and filesystem metadata, concentrated in app-private (51.6%) and OS-level (29.0%) storage. This SoK contributes a new two-part taxonomy linking AF strategy families (with an AAF extension) to mobile residual evidence by store type and location, along with an empirical baseline for cross-platform AF research. The findings highlight the need for standardized benchmarks, expanded iOS coverage, and mobile-focused AAF evaluation to strengthen forensic reliability.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302127"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565430","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DFRWS USA 2026 editorial article DFRWS USA 2026社论文章

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302132

引用次数: 0

Forensic analysis of video data deletion and recovery in Honeywell surveillance file system 霍尼韦尔监控文件系统中视频数据删除与恢复的取证分析

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302116

Jinhee Yoon, Sungjae Hwang

{"title":"Forensic analysis of video data deletion and recovery in Honeywell surveillance file system","authors":"Jinhee Yoon, Sungjae Hwang","doi":"10.1016/j.fsidi.2026.302116","DOIUrl":"10.1016/j.fsidi.2026.302116","url":null,"abstract":"<div><div>Real-time video surveillance systems store recorded video using digital video recorders (DVRs) and network video recorders (NVRs). To support continuous high-volume video storage, these devices employ specialized, nonstandard file systems that are often proprietary and undocumented. This lack of documentation significantly increases the time and effort required for forensic analysis. In this study, we analyze an undocumented proprietary file system used by Honeywell video surveillance devices—one that, to the best of our knowledge, has not been examined in prior work—and investigate its deletion mechanisms and demonstrate the feasibility of video recovery after deletion. We perform a file system analysis using a binary diffing technique and evaluate three deletion methods supported by the target device: ① formatting-based deletion, ② data expiration, and ③ overwrite. For each method, we investigate changes in file system metadata and on-disk data structures and demonstrate the feasibility of video data recovery. Our findings aim to support more efficient and accurate forensic investigations of Honeywell surveillance products and provide foundational insights into the analysis of proprietary file systems used in video recording devices.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302116"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565521","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

The enemy of reproducibility is opacity: What's inside the Elliptic bitcoin dataset (and why it is wrong) 可再现性的敌人是不透明：Elliptic比特币数据集里面有什么（以及为什么它是错误的）

IF 3.1 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-06-01 Epub Date: 2026-07-22 DOI: 10.1016/j.fsidi.2026.302124

Miroslav Šafář, Jan Pluskal, Vladimír Veselý, Ondřej Ryšavý

{"title":"The enemy of reproducibility is opacity: What's inside the Elliptic bitcoin dataset (and why it is wrong)","authors":"Miroslav Šafář, Jan Pluskal, Vladimír Veselý, Ondřej Ryšavý","doi":"10.1016/j.fsidi.2026.302124","DOIUrl":"10.1016/j.fsidi.2026.302124","url":null,"abstract":"<div><div>Machine-learning methods for Bitcoin transaction classification are frequently evaluated on the Elliptic Bitcoin Dataset (2019), and many recent “state-of-the-art” results rely on this benchmark. Yet Elliptic's feature construction process was not fully disclosed, making the benchmark difficult to reproduce and limiting operational use: without clear feature semantics, practitioners cannot compute the required inputs for previously trained models on new transactions encountered in real investigations. Beyond hindering its real-world application, this opacity has also obscured what information the dataset actually contains and how it propagates across standard experimental splits. In this paper, we reverse engineer the Elliptic dataset to recover the meaning of almost all features and to reconstruct key aspects of the dataset's derivation. This analysis enables a systematic audit of evaluation practices and leads to an unsettling finding: the dataset's commonly used training and testing splits are not properly isolated. We provide evidence of this leakage and discuss why it can compromise the validity and comparability of Elliptic-based evaluations. Finally, we propose a solutions to the problems that occurred during Elliptic dataset construction, accompanied with a methodology for building Bitcoin transaction classification datasets, with explicit feature semantics, leakage-resistant splitting that respects temporal and graph dependencies, and full pipeline transparency. We release an open-source tool that collects and transforms raw Bitcoin blockchain data into a transparent transaction dataset, enabling the development of models suitable for real-world forensic applications.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302124"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565425","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0