{"title":"SoK: What does it mean to benchmark database forensics?","authors":"Ben Lenard, Alexander Rasin, James Wagner","doi":"10.1016/j.fsidi.2026.302126","DOIUrl":"10.1016/j.fsidi.2026.302126","url":null,"abstract":"<div><div>Relational Database Management Systems are the backbone of modern enterprises and public-sector services, and are thus frequent targets of security incidents, insider threats, and thorough regulatory audits. Consequently, databases have become key sources of digital evidence, requiring investigators to reconstruct past activity from audit logs, transaction logs, and backups. Although benchmarking frameworks such as those developed by the Transaction Processing Performance Council (TPC) are widely used to evaluate database performance, they do not capture forensic requirements such as evidentiary completeness, tamper-evidence, chain of custody, or regulatory compliance under GDPR and CCPA.</div><div>This survey examines the emerging domain of forensic database benchmarking. We gathered prior research on database forensics, secure logging, and tamper-evident data structures; we analyze modern forensic-ready features in commercial and open-source systems (SQL Server Ledger, Oracle Blockchain Tables, PostgreSQL pgAudit, Db2 Audit, Aurora Database Activity Streams, Oracle Real Application Security and IBM Guardium) and assess why existing benchmarks are insufficient. We propose forensic workloads, metrics, and methodologies that incorporate adversarial stressors, deleted-record recovery, and backup analysis. We also identify open research problems and call for a community-driven forensic benchmark suite. The result is an idea for evaluating not only database performance but also forensic soundness, bridging the gap between system engineering, compliance, and digital investigations.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302126"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565429","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Rusting Volatility: Accelerating memory forensics through LLM-assisted cross-language migration","authors":"Taha Gharaibeh, Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302129","DOIUrl":"10.1016/j.fsidi.2026.302129","url":null,"abstract":"<div><div>Memory forensics remains a core capability in modern Digital Forensics and Incident Response (DFIR), but practical workflows are often constrained by the runtime costs of Python-based tooling. We report an empirical migration of a production memory-forensics framework, Volatility3, from Python to Rust using Large Language Model (LLM)-assisted development. The migration produced 38 Linux forensic plugins totaling 29,028 Lines of Code (LOC) over 68 h of active implementation, with aggregate LLM usage of 900 million tokens ($2962) across two systems. To evaluate functional behavior, we applied canonical output hashing over 11 memory samples spanning two Linux kernel versions. Rust completed all 417 analyzed plugin-sample executions, whereas Python failed on 47 (11.3%) because of runtime and symbol-compatibility errors. Exact output equivalence reached 68.9% among comparable executions. Under controlled benchmark conditions, the Rust implementation achieved a 2.50 × median speedup, with structure-traversal plugins reaching up to 210 × . Overall, the results indicate that compiled-language reimplementation can improve both execution robustness and throughput for analysis-intensive forensic tasks, while LLM-assisted migration can reduce development effort when paired with strict parity validation.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302129"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565434","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Memory Forensics Techniques for Automated Detection and Analysis of Go Malware","authors":"Hala Ali, Andrew Case, Irfan Ahmed","doi":"10.1016/j.fsidi.2026.302118","DOIUrl":"10.1016/j.fsidi.2026.302118","url":null,"abstract":"<div><div>The Go programming language has become increasingly popular among malware developers due to its ability to produce statically linked, cross-platform executables that challenge traditional analysis techniques. These binaries embed a substantial runtime and compiler-generated metadata and are compiled with aggressive optimizations that discard type information for function parameters and local variables. Go's design further complicates analysis by representing strings as pointer–length pairs rather than null-terminated sequences, employing a caller-allocated stack model that obscures argument boundaries, and fragmenting program state across concurrent goroutines. Although existing static analysis and reverse engineering tools provide Go-specific support, they remain limited to compile-time artifacts and cannot recover runtime execution state and artifacts that persist solely in memory. To address this gap, we present the first memory forensics framework for runtime analysis of Go binaries. By parsing Go's internal structures, our framework reconstructs type and function metadata, recovers heap-allocated and static strings, and distinguishes application-level functions. Through ABI-aware backward analysis, it derives execution paths and argument values from call sites. To capture runtime state beyond what static analysis reveals, it analyzes goroutine stacks to identify actively executing functions and recover their runtime argument values. We implemented all capabilities as Volatility 3 plugins and evaluated them against malware observed in recent incidents, such as the <em>BRICKSTORM</em> backdoor, <em>Obscura</em> ransomware, and <em>Pantegana</em> RAT, as well as open-source samples for reproducibility. The framework successfully recovered C2 endpoints, persistence mechanisms, encryption keys, ransom notes, and execution state, including critical runtime artifacts that were absent from published threat intelligence.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302118"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148565519","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Muhammad Shaharyar Yaqub, Wooyeon Jo, Tamer Nadeem, Erdem Topsakal, Irfan Ahmed
{"title":"Digital forensic readiness of regulated medical devices: An empirical study of the GE venue ultrasound system","authors":"Muhammad Shaharyar Yaqub, Wooyeon Jo, Tamer Nadeem, Erdem Topsakal, Irfan Ahmed","doi":"10.1016/j.fsidi.2026.302121","DOIUrl":"10.1016/j.fsidi.2026.302121","url":null,"abstract":"<div><div>Medical devices increasingly operate as networked computing platforms, yet incident response remains difficult because many regulated systems restrict logging, execution, and evidence collection. Point-of-care ultrasound (POCUS) devices are especially challenging: they are workflow-driven, safety-adjacent, and often run embedded, vendor-managed Windows stacks that handle patient-associated data while limiting investigator access. This paper, to our knowledge, presents the first end-to-end forensic readiness and physical-memory forensics study of a POCUS ultrasound platform, using the GE Venue Ultrasound system as a case study.</div><div>We introduce URSA, a volatile-first readiness workflow for constrained ultrasound devices, and operationalize it with a UI-state-driven acquisition design that ties memory collection to observable clinical modes. Across seven full physical memory dumps captured before and after controlled scan-and-review interactions, we demonstrate repeatable acquisition under segmented storage and restrictive execution boundaries. Memory analysis reconstructs the clinical launch chain and yields both security-relevant artifacts and clinical exposure artifacts, including structured patient-associated logs and renderable diagnostic images recovered from RAM, with persistence characterized across states and time offsets. We complement volatile results with targeted disk-side context to quantify permission boundaries and corroborate selected findings. These findings provide practical guidance for improving forensic readiness and privacy-aware response on regulated ultrasound platforms.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"57 ","pages":"Article 302121"},"PeriodicalIF":3.1,"publicationDate":"2026-06-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"148587591","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Residual forensic indicators of file exfiltration in windows preinstallation environment","authors":"Jingue Lee , Jiyun Kim , Doowon Jeong","doi":"10.1016/j.fsidi.2026.302068","DOIUrl":"10.1016/j.fsidi.2026.302068","url":null,"abstract":"<div><div>File exfiltration conducted through bypass boot environments, such as the Windows Preinstallation Environment (Windows PE), poses a serious challenge to forensic investigations. Because endpoint security agents and logging mechanisms remain inactive, conventional artifacts of file access are absent. This study investigates the feasibility of using the NTFS $STANDARD_INFORMATION Accessed Time ($SI Atime) as a residual forensic indicator for detecting exfiltration events in Windows PE. Through controlled experiments, we analyze $SI Atime updates during file copy operations, examine their persistence under varying system conditions, and evaluate their evidentiary reliability over time. Our findings show that $SI Atime can reveal PE-based file access patterns in over two-thirds of cases, though reliability diminishes with prolonged use. To enhance robustness, we integrate Atime analysis with complementary artifacts, such as UEFI NVAR variables indicating abnormal boot order changes. This combined approach enables the reconstruction of exfiltration timelines even in the absence of logs or telemetry. The results highlight the potential of $SI Atime as a valuable residual artifact for detecting file exfiltration in bypass boot environments, offering investigators a methodological basis for addressing scenarios where traditional forensic sources are unavailable.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302068"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146077997","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Uncovering the impact of SNS processing on device source authentication: A comprehensive optimization approach","authors":"Zhu Ningxian","doi":"10.1016/j.fsidi.2026.302072","DOIUrl":"10.1016/j.fsidi.2026.302072","url":null,"abstract":"<div><div>In zero_shot device source authentication, Social Network Service (SNS) processing induces severe feature homogenization, masking device-specific fingerprints and triggering a “false confidence” paradox. This is a difficult problem, and despite active studies in recent years, it remains a great challenge. We propose a device-aware forensics framework, which integrates multimodal feature fusion, dual-verification, and a three-component optimization suite: test-time style normalization, mild transfer learning, and advanced confidence calibration. Experiments show our method elevates the camera device detection rate from a baseline of 17% to 94.0% (mean, validated over 10 independent runs), with an average confidence of 0.825 and an Expected Calibration Error (ECE) of 0.197. We reveal a trade-off between detection rate and calibration reliability, validating a “performance first, then calibration repair” optimization path. This work offers insights for building test-time adaptive and high-reliability forensic systems.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302072"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395552","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kendall J. Comeaux , Trevor T. Spinosa , Ali Ghosn , Ibrahim Baggili
{"title":"Ex Machina: A forensic evaluation of AI companion applications and their evidentiary value","authors":"Kendall J. Comeaux , Trevor T. Spinosa , Ali Ghosn , Ibrahim Baggili","doi":"10.1016/j.fsidi.2026.302050","DOIUrl":"10.1016/j.fsidi.2026.302050","url":null,"abstract":"<div><div>Artificial intelligence (AI) companion applications have emerged as a new class of conversational systems that blur the line between entertainment, intimacy, and sensitive personal data collection. Their rapid adoption and reliance on opaque cloud infrastructures create novel challenges for digital forensics, yet systematic analysis of these platforms has been limited in both academic and practitioner communities. In this paper, we present a cross-application forensic study of leading AI companion applications, combining device acquisition, network interception, and file system analysis within a rooted Android emulator to ensure reproducibility. We developed custom tools to extract and correlate artifacts such as plain-text conversation logs, authentication tokens, profile data, and hidden API calls. We also characterized third-party tracking, session management, and basic encryption, enabling automated forensic user-profile generation. Our evaluation across six applications, representing over 25 million combined downloads, reveals that sensitive user information is often retained locally, transmitted via undocumented APIs, and inconsistently protected by safeguard mechanisms, with cross-app identifiers sometimes enabling correlation of user activity. These findings demonstrate both the evidentiary potential and the privacy risks of AI companions. They offer initial guidance for evidence preservation and lawful access, while laying the groundwork for standardized forensic methodologies in this emerging domain.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302050"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554544","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Luis de-Marcos , Adrián Domínguez-Díaz , Zlatko Stapic
{"title":"Mapping the Tor darkmarket ecosystem: A network analysis of topics, communication channels, and languages","authors":"Luis de-Marcos , Adrián Domínguez-Díaz , Zlatko Stapic","doi":"10.1016/j.fsidi.2025.302032","DOIUrl":"10.1016/j.fsidi.2025.302032","url":null,"abstract":"<div><div>The Tor darkmarket ecosystem, a hidden segment of the internet hosting a range of illicit activities, remains a critical challenge for cybersecurity and law enforcement. This study employs network analysis to explore the structure, connectivity, and vulnerabilities of Tor hidden services, focusing on the interplay of topics, communication channels, and languages. Using a bipartite network framework, we analyzed 82,285 onion services and 57,071 identification forms (IDs) collected over a 20-week period. Our findings reveal hacking as the dominant topic (57,233 services), followed by finance-crypto (17,900 services), with email (43,298 IDs) and Telegram (11,218 IDs) serving as primary communication channels. Linguistically, Russian prevails in hacking (50,852 services), while English dominates other topics (29,762 services), with Portuguese activity notable in Q&A forums (781 services). Network metrics and visualizations highlight structural contrasts: hacking's expansive, collaborative structure (high diameter, long average path length) contrasts with finance-crypto's compact, centralized network (high density, low path length), reliant on just four IDs to link its services. High-degree nodes underscore vulnerabilities to targeted disruptions. The overall network's fragmentation (1848 components) alongside a large dominant component (76.72 %) suggests both resilience and exploitable interconnectedness. These insights provide a comprehensive understanding of the Tor darkmarket's organization, identifying key leverage points for intervention. By bridging gaps in topical, linguistic, and structural analyses, this study offers actionable strategies for law enforcement to investigate and mitigate illicit activities on the Dark Web, demonstrating the power of network science in addressing cybercrime.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302032"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145685824","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ricardo Marques , Patricio Domingues , Miguel Frade , Miguel Negrão
{"title":"Forensic analysis of the infotainment system of BMW vehicles","authors":"Ricardo Marques , Patricio Domingues , Miguel Frade , Miguel Negrão","doi":"10.1016/j.fsidi.2026.302066","DOIUrl":"10.1016/j.fsidi.2026.302066","url":null,"abstract":"<div><div>The automotive industry is undergoing a significant transformation driven by digitization. Modern cars are transitioning to digital and are now sophisticated computers on wheels. This digital revolution is driven by the integration of various computerized systems. One of the most noticeable systems, at least for drivers and occupants, is the In-Vehicle Infotainment (IVI) system. This system offers features such as radio, music playback and streaming, navigation, hands-free calling, and, in some cases, smartphone and internet connectivity. Data generated from user interactions with the vehicle information system can be valuable for digital forensics, providing artifacts such as call logs, contacts, GPS location history, and diagnostic data. However, acquiring and analyzing these data is challenging, as there are no universal standards for IVI systems. In this paper, we study the infotainment systems of four BMW vehicles from a digital forensic perspective. Specifically, we focus on two Computer-in-Car (CIC) BMW 3 Series systems, one from 2010 and another from 2012. We also analyze the Next Big Thing Evolution (NBT EVO) systems of two 2017’s BMWs, a 5 Series and a 7 Series. For this purpose, data from the infotainment hard disks were acquired and forensically analyzed. To overcome the lack of specific open-source tools to process these datasets, we developed two modules for the well-known Autopsy forensic software. The most relevant data recovered from the hard disks of the analyzed infotainment systems include phone call history, text messages, and linked smartphone IDs, such as Bluetooth addresses, International Mobile Equipment Identity (IMEI) and International Mobile Subscriber Identity (IMSI). The results indicate that the newer NBT EVO systems have more forensically meaningful data than the older CIC ones.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302066"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146077996","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Klara Dološ , Tobias Reichel , Mathias Gerstner , Leo Schiller , Liron Ahmeti , Andreas Attenberger , Victor Bialek , Rudolf Hackenberg , Conrad Meyer , Michael Nicks , Dennis Röck , Mirko Ross , Gerhard Steininger , Hugues Tamatcho Sontia , Svenja Wendler
{"title":"Forensic readiness for autonomous mobility: The forensic incident recorder and information system concept","authors":"Klara Dološ , Tobias Reichel , Mathias Gerstner , Leo Schiller , Liron Ahmeti , Andreas Attenberger , Victor Bialek , Rudolf Hackenberg , Conrad Meyer , Michael Nicks , Dennis Röck , Mirko Ross , Gerhard Steininger , Hugues Tamatcho Sontia , Svenja Wendler","doi":"10.1016/j.fsidi.2026.302044","DOIUrl":"10.1016/j.fsidi.2026.302044","url":null,"abstract":"<div><div>This paper outlines the essential needs for a forensic incident recorder (FIR) in autonomous vehicles, emphasizing its role in providing comprehensive data for post-incident analysis. The FIR must capture data from various vehicle systems, including onboard sensors, AI decision-making processes, internal diagnostics, V2X communications and cloud-based services, ensuring transparency and accountability. To ensure data integrity, the system must include encryption, tamper detection and redundancy. Furthermore, we introduce the concept of a forensic information system (FIS), an integrated solution for data storage, relevance determination and secure access, incorporating local and cloud-based storage. Triggers for permanent data storage and data upload to the cloud are suggested. Ultimately, the paper aims to highlight the need for comprehensive strategic and operational preparation for forensic investigations in the environment of autonomous, connected mobility.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302044"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"146022914","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}