Forensic Science International-Digital Investigation最新文献

{"title":"Mind the slack? Reassessing the relevance of file slack in modern forensic investigations","authors":"Anton Schwietert,&nbsp;Jan-Niclas Hilgert","doi":"10.1016/j.fsidi.2026.302123","DOIUrl":"10.1016/j.fsidi.2026.302123","url":null,"abstract":"<div><div>File slack space has long been regarded as a potential source of residual data in digital forensic investigations. While prior work has established that slack exists in meaningful quantities on production systems and can be exploited for data hiding, the question of whether modern filesystem's own operations actually produce residual data in slack regions has not been systematically examined across today's diverse filesystem and operating system landscape. This paper presents a cross-platform empirical study of file slack space behavior across 12 filesystem implementations on Linux, macOS, and Windows. Through controlled detection and persistence experiments we examine whether residual data occurs in slack space and whether it survives common filesystem operations. Under these controlled conditions, the default filesystems of the three desktop platforms tested (NTFS on Windows, APFS on macOS, ext4 on Linux) cleared both RAM slack and drive slack across all tested file creation and modification scenarios. Beyond these defaults, behavior diverged substantially: FAT-based filesystems preserved drive slack, Copy-on-Write filesystems introduced ”ghost slack” through block relocation, and the same filesystem specification yielded different slack behavior across operating systems and driver implementations. These findings demonstrate that slack space behavior is governed by the interplay of filesystem type, operating system, and driver implementation, and that its forensic value must be assessed on a per-configuration basis rather than assumed. We release our experimentation framework as open-source to support reproducibility.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302123"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148587589","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Advancing reliable synthetic video detection: Insights from the SAFE challenge","authors":"Kirill Trapeznikov,&nbsp;Gabriel Mancino-Ball,&nbsp;Jonathan Li,&nbsp;Paul Cummer,&nbsp;Jai Aslam,&nbsp;Danial Samadi Vahdati,&nbsp;Tai Nguyen,&nbsp;Matthew C. Stamm,&nbsp;Peter Bautista,&nbsp;Michael Davinroy,&nbsp;Laura Cassani,&nbsp;Jill Crisman","doi":"10.1016/j.fsidi.2026.302120","DOIUrl":"10.1016/j.fsidi.2026.302120","url":null,"abstract":"<div><div>The proliferation of generative video technologies has intensified the need for reliable methods to detect and characterize synthetic media. To address this challenge, we organized the SAFE: Synthetic Video Detection Challenge, co-located with the <em>Authenticity and Provenance in the Age of Generative AI (APAI) Workshop</em> at ICCV 2025. The competition invited participants to develop and evaluate algorithms capable of distinguishing real from synthetic videos under fully blind evaluation conditions with over 600 submissions from 12 teams over a 90 day span. Hosted on the Hugging Face platform, the challenge comprised two primary tasks: (1) detection of synthetic video content generated by diverse state-of-the-art models, and (2) detection of synthetic content following common post-processing operations such as resizing, re-compression, motion blur and others. The challenge data consisted of 13 modern high quality synthetic video models with generated content matched to real videos from 21 diverse and challenge sources, all adding up to 20 h of 6000 video samples. This paper describes the challenge design, dataset construction, evaluation methodology, and outcomes, offering insights into the generalization and robustness of contemporary synthetic video detection methods. Our findings highlight measurable progress in cross-generator generalization but also persistent vulnerabilities to post-processing artifacts. <span><span>https://safe-video-2025.dsri.org</span><svg><path></path></svg></span>.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302120"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148587590","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Plug and Fake: On automatic forensic dataset generation of USB traces","authors":"Dennis Wolf,&nbsp;Lena L. Voigt,&nbsp;Harald Baier","doi":"10.1016/j.fsidi.2026.302122","DOIUrl":"10.1016/j.fsidi.2026.302122","url":null,"abstract":"<div><div>USB devices are widely used, versatile, and inherently trusted by the USB host, hence allowing them to subtly bypass advanced security measures. This might be a reason why USB-based attacks have become more sophisticated and numerous over the last years and target for instance highly sensitive areas, like power plants. These attacks need to be investigated, which is often done in a post-mortem analysis of the disk images. The digital forensic community agrees on the importance of digital forensic datasets (e.g., for training and education of experts) and that the dynamic change and general complexity of our IT landscape make the automatic generation of them indispensable. Hence, in this paper our first goal is to spot the actual pervasiveness of USB-related artifacts in public datasets by reviewing the availability of synthetic Windows disk images in a semi-automatic way. Windows is chosen in this work, due to its large market share and general availability of datasets. We reveal two limitations regarding USB drive involvement in forensic scenarios: First, disk images for scenarios containing USB drives are difficult to obtain, as most scenarios do not explicitly mention the involvement of removable media – either because it is insignificant to the scenario or because its omission is intentional as part of the challenge design. Second, USB connection artifacts are unrealistic, particularly in contemporary Windows environments. For instance, among the 14 disk images in our dataset using Windows 10 or later, only five contained any traces of USB connections. Moreover, the extent of these traces was limited: only a single contemporary Windows image includes artifacts from more than two different USB storage devices. Our assumption is that lack of automation leads to such unrealistic datasets. We approach this problem by emulating USB drives on Raspberry Pi hardware, since this leaves us with the possibility to configure the USB identifiers, relevant for a forensic investigation. Furthermore, we examine the commercially available USB Rubber Ducky in this context, for it provides similar functionality. Both solutions are then integrated into a state-of-the-art data synthesis framework to enable the generation of versatile datasets, as demonstrated in two different scenarios. In our subsequent analysis of the generated data, we show that the expected traces were successfully created, making our solution a valid option for easily generating USB traces in future datasets.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302122"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148587592","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"DFRWS Americas 2027","authors":"","doi":"10.1016/j.fsidi.2026.302161","DOIUrl":"10.1016/j.fsidi.2026.302161","url":null,"abstract":"","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302161"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565433","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"I guess it is correct - A survey about acquiring and analyzing main memory","authors":"Lisa Rzepka,&nbsp;Benedikt Mader,&nbsp;Zinaida Benenson,&nbsp;Harald Baier","doi":"10.1016/j.fsidi.2026.302119","DOIUrl":"10.1016/j.fsidi.2026.302119","url":null,"abstract":"<div><div>In order to detect, mitigate, and respond to stealthy attacks, such as Living off the Land (LOTL) and fileless malware, an in-depth analysis of the affected main memory is unavoidable. While live analysis provides initial insights into malicious activity, acquiring and analyzing a main memory dump offers a more substantial and deeper view of the system. However, acquiring main memory is a complex task that often leads to inconsistencies. Although this is common knowledge, the forensics community currently lacks details about the actual usage of main memory forensics and its pros and cons. To remedy this blind spot, this paper presents the results of a survey conducted with memory forensics practitioners. Based on 31 comprehensively answered questionnaires we gain insights into preferred methods of memory acquisition (i.e., kernel-level software) and related concerns (i.e., system crashes during dumping). With respect to memory analysis, common use cases include obtaining information about processes, network connections as well as indicators of malware on the system. Although inconsistencies in a memory dump are rather common, the survey reveals that the correctness of a memory dump is postulated rather than thoroughly tested. Hence, as a step toward more reliable memory acquisition, we point out key issues during software-based memory dumping.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302119"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148587588","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Seeing the evidence: A forensic framework for analyzing Ray-Ban Meta AI smart glasses","authors":"Shishir Panta,&nbsp;Ruba Alsmadi,&nbsp;Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302128","DOIUrl":"10.1016/j.fsidi.2026.302128","url":null,"abstract":"<div><div>Meta's Ray-Ban smart glasses, paired with the Meta AI mobile application, are part of a rapidly growing class of generative AI-enabled wearable devices, with over two million units sold by early 2025. As adoption increases, these devices are becoming increasingly relevant to civil and criminal investigations. However, the forensic landscape for these systems remains underexplored and is not yet supported by existing tools. This paper presents (i) a forensic methodology for acquiring and analyzing the Ray-Ban Meta ecosystem, (ii) a forensic framework that formalizes evidence distribution, correlation, and attribution across the glasses–companion–cloud ecosystem, and (iii) an open-source contribution that operationalizes these findings. Through privileged filesystem acquisition of the Android companion application and correlation with Meta cloud exports, we recover and validate account and device identifiers, media artifacts, geolocation traces, and AI interaction records. We further evaluate user-initiated anti-forensic actions, including deletion, unpairing, and factory reset, demonstrating that certain identifiers and traces persist across these attempts and that cloud exports retain complementary conversational evidence. We also develop a Meta AI Parser plugin for the Android Logs, Events, and Protobuf Parser (ALEAPP) to automate artifact extraction and timeline correlation, providing digital forensic practitioners with a practical workflow for investigating generative AI-enabled smart glasses.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302128"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"With or without logs: Memory forensic reconstruction of Model Context Protocol (MCP) activity in agentic LLM systems","authors":"Abdus Satter,&nbsp;Makei Salmon,&nbsp;Lara Muhanna,&nbsp;Trevor T. Spinosa,&nbsp;Taha Gharaibeh,&nbsp;Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302130","DOIUrl":"10.1016/j.fsidi.2026.302130","url":null,"abstract":"<div><div>Large Language Model agents increasingly rely on the Model Context Protocol (MCP) to invoke external tools for code execution, data access, and API interaction, expanding both automation capabilities and the forensic attack surface of modern AI-enabled systems. MCP interactions often occur within ephemeral runtimes where durable logs and network traces may be incomplete, unavailable, or deliberately removed, limiting post-incident visibility into agent behavior. In this paper, we present <span>MCPRecon</span>, a protocol-aware memory forensics technique for reconstructing MCP interaction traces from volatile memory. <span>MCPRecon</span> leverages the standardized JSON-RPC 2.0 message structure and MCP method semantics to identify, validate, and correlate MCP protocol artifacts directly from RAM, without relying on disk logs, network captures, or transport-specific instrumentation. Given a post-incident memory snapshot, <span>MCPRecon</span> recovers tool discovery results, invocation arguments, execution outcomes, and tool identifiers, and reconstructs request–response traces using JSON-RPC identifiers. We evaluate <span>MCPRecon</span> across multiple real-world MCP clients, deployment modes (stdio and HTTP), and scenarios, demonstrating that forensically relevant MCP artifacts persist in volatile memory and can be reliably reconstructed. Finally, we illustrate the forensic relevance of recovered artifacts through a successful proof-of-concept attack involving malicious MCP tool usage in Composer 1 and Gemini 3 Flash, showing how memory-resident protocol evidence enables attribution and post-incident analysis when traditional logs are absent.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302130"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565435","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Forensic analysis of container snapshot chains for post-event reconstruction","authors":"Radostin Stoyanov,&nbsp;Lorena Goldoni,&nbsp;Adrian Reber,&nbsp;Christopher Hargreaves,&nbsp;Rodrigo Bruno","doi":"10.1016/j.fsidi.2026.302114","DOIUrl":"10.1016/j.fsidi.2026.302114","url":null,"abstract":"<div><div>Container orchestration platforms have become a crucial part of the cloud-native infrastructure for deploying modern applications. The highly dynamic and ephemeral nature of these environments, however, introduces new challenges for digital forensics: malicious code often runs entirely in memory and vanishes when the container terminates, leaving no traces. The absence of forensic data can be just as dangerous as the malicious activity itself, preventing post-incident investigation and adequate response. In this paper, we propose Forensic Snapshot Chains (FSC) – a framework that transparently captures and preserves the state, configurations, and metadata of running containers. These snapshot artifacts allow investigators to accurately reconstruct and analyze the events during a security incident without impacting the running cluster. To achieve this, FSC leverages memory-tracking mechanisms inspired by live-migration optimization techniques that enable high-frequency snapshot capture when a security alert is triggered, while minimizing performance and storage overhead. Our evaluation with real-world cloud-native workloads demonstrates that FSC, with minimal performance overhead, enables accurate temporal reconstruction of memory-resident malicious activity derived from container snapshot chains under both stealthy execution and active attack scenarios.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302114"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565518","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Do you dare to try test-driven forensics? Increasing trust in desktop forensics with ADARE","authors":"Michael Külper,&nbsp;Martin Lambertz,&nbsp;Mariia Rybalka","doi":"10.1016/j.fsidi.2026.302115","DOIUrl":"10.1016/j.fsidi.2026.302115","url":null,"abstract":"<div><div>Digital forensic relies on validated tools and established procedures, yet the underlying operating systems, applications, and analysis tools evolve rapidly. This evolution can cause artifact behavior and tool outputs to drift, silently degrading repeatability and confidence in long-lived forensic interpretations. We present test-driven forensics, a practical approach that treats forensic expectations as executable specifications: expected artifacts and expected tool outputs are encoded as tests that can be rerun across versions to detect regressions. Crucially, our approach also enables State Transition Testing, validating the system's expected state after each user action rather than only performing post-mortem checks on a final disk image; this supports causal attribution and makes transient behavior testable. We implement the methodology in ADARE, an open-source framework that runs controlled experiments in virtual machines and simulates realistic user activity via computer-vision-guided GUI automation. ADARE includes a companion web platform for sharing experiments, environments, and results to facilitate independent reruns and peer verification. We evaluate ADARE in five case studies spanning artifact research and tool validation. In particular, a 25-version regression study of Autopsy reveals substantial, largely undocumented changes in exported report outputs, demonstrating how executable tests make drift measurable and reproducible at scale.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302115"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565520","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

{"title":"Every Frame You Take: A Taxonomy and Reproducible Testing Framework for Digital Surveillance Cameras","authors":"Maximilian Eichhorn,&nbsp;Felix Gabel,&nbsp;Felix Freiling","doi":"10.1016/j.fsidi.2026.302117","DOIUrl":"10.1016/j.fsidi.2026.302117","url":null,"abstract":"<div><div>We present a definition and taxonomy of digital surveillance cameras and provide a structured approach for extracting forensically relevant artifacts from these devices. As part of this approach, we implemented a Python-based framework for automatically and reproducibly generating test data within a camera test environment and evaluated it using 9 cameras from various manufacturers. We show that despite considerable device diversity, some devices exhibit minimal differences upon closer examination of their forensic artifacts. Still, although some generalization across camera subgroups is possible, device-specific analysis remains necessary for a comprehensive forensic investigation.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302117"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565424","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}