Forensic Science International-Digital Investigation最新文献_第6页

DFRWS down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server DFRWS掉进兔子洞：对Matrix协议和Synapse服务器的法医分析

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302049

Yikai Wang , Xuepei Zhang , Shufan Wu , Yan Chen

{"title":"DFRWS down the Rabbit-Hole: A forensic analysis of the Matrix protocol and Synapse server","authors":"Yikai Wang , Xuepei Zhang , Shufan Wu , Yan Chen","doi":"10.1016/j.fsidi.2026.302049","DOIUrl":"10.1016/j.fsidi.2026.302049","url":null,"abstract":"<div><div>The widespread adoption of end-to-end encrypted messaging platforms presents significant challenges for digital forensic investigations. This paper presents the first comprehensive forensic analysis of Synapse, the official Matrix Homeserver implementation, focusing on server-side artifacts persisting in both database structures and system logs despite end-to-end encryption. Through systematic examination of production deployments, we identify recoverable digital evidence across 175 database tables and structured log entries, including authentication records, communication timelines, device fingerprints, and file transfer metadata. While message content remains cryptographically protected, our analysis demonstrates substantial investigative value in metadata accessible to investigators with lawful server access. We developed SynExtract, a specialized tool that automates extraction and correlation of artifacts from both Synapse databases and log files. Our findings provide practical guidance and a tool for law enforcement personnel conducting forensic examinations of Matrix infrastructure in criminal investigations.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302049"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554636","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Ctrl+Alt+Deceit: Policing the Deepfake Dilemma Ctrl+Alt+ deception: Policing the Deepfake Dilemma

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302058

Áine MacDermott

{"title":"Ctrl+Alt+Deceit: Policing the Deepfake Dilemma","authors":"Áine MacDermott","doi":"10.1016/j.fsidi.2026.302058","DOIUrl":"10.1016/j.fsidi.2026.302058","url":null,"abstract":"<div><div>In a digital world where “truth” can be rewritten with a few lines of code, <em>Ctrl + Alt + Deceit</em> has become the new normal for forensic practitioners. The rapid growth of deepfake technologies presents a mounting challenge for digital forensics, threatening the integrity and reliability of multimedia evidence. This paper presents findings from a practitioner-focused survey designed to assess the real-world impact of synthetic media on forensic workflows. The study explores the prevalence of deepfake-related cases, regional trends in AI-generated media, and the operational readiness of digital forensic units (DFUs) to respond to these emerging threats. Despite increasing interest in detection technologies, the results reveal a substantial gap between technical capabilities and practical deployment, with many DFUs operating without formal guidance, policy structures, or legislative backing. The paper concludes with a set of best practice recommendations tailored to the unique demands of deepfake forensics, offering insights to support both practitioners and researchers in developing robust, informed approaches to multimedia evidence in the era of synthetic media.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302058"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554549","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Boon or Bane: Source Camera Identification meets AI-generated images 恩或祸：源相机识别满足人工智能生成的图像

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302064

Samantha Klier, Harald Baier

{"title":"Boon or Bane: Source Camera Identification meets AI-generated images","authors":"Samantha Klier, Harald Baier","doi":"10.1016/j.fsidi.2026.302064","DOIUrl":"10.1016/j.fsidi.2026.302064","url":null,"abstract":"<div><div>Linking an image to its origin is a fundamental task in digital forensics often addressed through Source Camera Identification (SCI) based on Sensor Pattern Noise (SPN). However, recent advances in AI-enhanced smartphone photography challenge the reliability of SPN. On the other hand, noise-based identification approaches have been successfully transferred to AI-generated images. Therefore, we investigate whether the noise patterns of AI-generated images interfere with those of modern smartphones and analyze the implications for standard procedures. Our empirical evaluation reveals that the noise in AI-generated images is not predominantly additive, contradicting prior assumptions. Furthermore, we show that fingerprints of AI image generators can identify corresponding images only when the prompted resolution matches. Additionally, the standard PCE threshold leads to high false-positive rates — 61 % for Adobe Firefly Image 4 and 100 % for ChatGPT 5 — when comparing AI images to smartphone fingerprints. We demonstrate that simple center-cropping effectively eliminates these false positives without reducing true-positive identification performance. Our findings highlight the need for updated forensic methodologies due to the influence of software on imaging pipelines.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302064"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554554","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

CPR: Corrupted PDF recovery algorithm for digital forensic investigations 用于数字法医调查的损坏PDF恢复算法

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302054

Seoyoung Kim , Yunji Park , Woobeen Park , Doowon Jeong

{"title":"CPR: Corrupted PDF recovery algorithm for digital forensic investigations","authors":"Seoyoung Kim , Yunji Park , Woobeen Park , Doowon Jeong","doi":"10.1016/j.fsidi.2026.302054","DOIUrl":"10.1016/j.fsidi.2026.302054","url":null,"abstract":"<div><div>As digital documents have become the dominant medium for information exchange, PDF has emerged as a standard format and a crucial source of evidence in digital forensic investigations. However, PDFs are internally organized as reference-based object structures whose interdependencies make recovery from corruption particularly challenging. Moreover, variations in encoding and storage—stemming from different producer tools—further complicate forensic analysis and reconstruction. This paper presents a comprehensive byte-level forensic analysis of the PDF structure and characterizes content-generation patterns across multiple producer types. Focusing on text data, we classify character storage within Content Objects into three categories—Text, XObject, and Path—and systematically analyze structural differences by generation method. Building on these insights, we propose CPR (Corrupted PDF Recovery), an algorithm designed to restore content from partially damaged PDFs. CPR carves objects from raw bytes, reconstructs inter-object relationships, and dynamically adapts its recovery process to the file's generation characteristics. For text restoration, CPR leverages a font mapping database (FontDB) and employs a large language model (LLM) to validate recovered outputs. Evaluation on a multilingual dataset encompassing three languages and multiple corruption scenarios demonstrates CPR's superiority over existing tools, achieving approximately 166 % higher recovery rate and greater forensic completeness, even when only a single content object exists. The CPR implementation, dataset, and FontDB are openly released as open source to support reproducibility and further forensic research.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302054"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554642","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Structural analysis of the Windows NT heap for memory forensics 用于内存取证的Windows NT堆的结构分析

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302060

Daniel Uroz , Abraham Díaz-Campo Pinilla , Ricardo J. Rodríguez

{"title":"Structural analysis of the Windows NT heap for memory forensics","authors":"Daniel Uroz , Abraham Díaz-Campo Pinilla , Ricardo J. Rodríguez","doi":"10.1016/j.fsidi.2026.302060","DOIUrl":"10.1016/j.fsidi.2026.302060","url":null,"abstract":"<div><div>Modern attacks increasingly target user-space memory, leveraging dynamic heap allocations to store payloads, obfuscate runtime behavior, and evade traditional detection mechanisms. These heap-based techniques complicate memory forensics, as existing tools typically treat dynamic memory as a flat, unstructured region. To address this gap, in this paper we present a forensic methodology for the extraction and structural analysis of Windows NT heap entries, implemented in an open-source plugin for the Volatility 3 framework, called HeapList. Our approach supports all major Windows versions, from Vista to Windows 11, on both ×86 and ×64 architectures. We reconstruct the backend and frontend heap layers, decode encoded metadata, and enable navigation and directed extraction of heap entries. We validate our methodology through cross-verification with <span>WinDbg</span> and controlled testing using the Windows Heap API. Additionally, we discuss how our plugin can facilitate reverse engineering, the identification of dynamic payloads, heap layout inspection, and memory triage. By providing structured access to user-space heap memory, our work improves forensic visibility into dynamic memory and enables deeper analysis of heap-centric behavior in modern threat landscapes. Finally, we demonstrate the applicability of our approach in real-world scenarios by extracting information relevant to forensic analysis of user-space applications (specifically, from Telegram Desktop) through heap analysis.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302060"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554550","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A hybrid neural-symbolic approach for the longitudinal profiling of coercive control in digital investigations 数字调查中强制控制的纵向分析的混合神经-符号方法

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-02-24 DOI: 10.1016/j.fsidi.2026.302074

Dhruv Patel, Soran Parsa, Anju P. Johnson

{"title":"A hybrid neural-symbolic approach for the longitudinal profiling of coercive control in digital investigations","authors":"Dhruv Patel, Soran Parsa, Anju P. Johnson","doi":"10.1016/j.fsidi.2026.302074","DOIUrl":"10.1016/j.fsidi.2026.302074","url":null,"abstract":"<div><div>The exponential growth of text-based digital evidence, particularly in mobile chat logs, challenges current forensic workflows. This is especially acute in investigations of coercive control, where evidence manifests not as a single ‘smoking gun’ but as a cumulative behavioural profiling of psychological abuse often missed by standard keyword searches. To address this data-to-insight gap, we present the Digital Conversation Analysis Pipeline (DCAP), a proof-of-concept Human-in-the-Loop (HITL) framework designed for investigative triage. The pipeline parses heterogeneous text-based evidence and analyses it using a novel hybrid classification architecture. The system detects individual linguistic markers and aggregates them into a cumulative behavioural profile, combining the precision of rule-based forensic search with the contextual recall of a BERT-based model. Acknowledging the strict ethical and privacy constraints that limit access to real-world forensic datasets, the model was initialised on a synthetic dataset and validated using a ‘Hybrid Injection’ stress-test, embedding 200 confirmed real-world toxic samples into the forensic timeline. In comparative experiments, the hybrid model achieved a 0.85 macro F1-score, significantly outperforming standard forensic keyword search baselines. We demonstrate the pipeline’s engineering utility on a simulated 8451-message case file. By isolating the Person Under Investigation (PUI), the system generated an auditable, quantitative triage report that reduced the target’s review volume by 92.8%. While further validation on diverse real-world data is required, this work proposes a foundational ‘warm-start’ framework for AI-assisted lead generation, prioritising explainability and investigator oversight over autonomous decision-making.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302074"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395556","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

DFRWS USA 2026 Arlington

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/S2666-2817(26)00043-0

引用次数: 0

Welcome to the 13th annual DFRWS Europe conference! 欢迎参加第13届DFRWS欧洲年会！

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302065

引用次数: 0

Forensic activity classification using digital traces from iPhones: A machine learning-based approach 使用iphone的数字痕迹进行取证活动分类：一种基于机器学习的方法

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-03-24 DOI: 10.1016/j.fsidi.2026.302047

Conor McCarthy , Jan Peter van Zandwijk , Marcel Worring , Zeno Geradts

{"title":"Forensic activity classification using digital traces from iPhones: A machine learning-based approach","authors":"Conor McCarthy , Jan Peter van Zandwijk , Marcel Worring , Zeno Geradts","doi":"10.1016/j.fsidi.2026.302047","DOIUrl":"10.1016/j.fsidi.2026.302047","url":null,"abstract":"<div><div>Smartphones and smartwatches are ever-present in daily life, and provide a rich source of information on their users' behaviour. In particular, digital traces derived from the phone's embedded movement sensors present an opportunity for a forensic investigator to gain insight into a person's physical activities. In this work, we present a machine learning-based approach to translate digital traces into likelihood ratios (LRs) for different types of physical activities. Evaluating on a new dataset, NFI_FARED, which contains digital traces from four different types of iPhones labelled with 19 activities, it was found that our approach could produce useful LR systems to distinguish 167 out of a possible 171 activity pairings. The same approach was extended to analyse likelihoods for multiple activities (or groups of activities) simultaneously and create activity timelines to aid in both the early and latter stages of forensic investigations. The dataset and all code required to replicate the results have also been made public<sup>⋆</sup> to encourage further research on this topic. ∗Dataset: <span><span>https://huggingface.co/datasets/NetherlandsForensicInstitute/NFI_FARED_Digital_Traces</span><svg><path></path></svg></span>, Code: <span><span>https://github.com/Con-or-McCarthy/Data2Activity_1</span><svg><path></path></svg></span>.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302047"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147554586","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

The implementation of digital forensic science in a Swiss police force 数字法医科学在瑞士警察部队的应用

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2026-03-01 Epub Date: 2026-02-12 DOI: 10.1016/j.fsidi.2026.302069

Elénore Ryser , Simon Baechler

{"title":"The implementation of digital forensic science in a Swiss police force","authors":"Elénore Ryser , Simon Baechler","doi":"10.1016/j.fsidi.2026.302069","DOIUrl":"10.1016/j.fsidi.2026.302069","url":null,"abstract":"<div><div>To contribute to the understanding of the operationalisation of digital forensic science and the associated challenges, this study observes daily practices and interactions of a digital forensic unit. The observation was focused on four main questions: (1) What are the primary missions of a DFU? (2) What workflow procedures do DFUs use in performing their duties? (3) How useful are DFUs and digital traces at various stages of an investigation? (4) What obstacles do DFUs face in fulfilling their missions?</div><div>This study draws on 160 hours of field observations conducted between January and March 2020 in a Swiss police force, the analysis of the unit internal casework database (2018-2019 past cases) and 6 semi-structured interviews with different stakeholders. The study is divided between an active participation in the digital forensic work (handling, analysing digital objects and reporting) and a passive participation in field work. Different uses and expectations of the digital forensic unit services depending on the investigation context were observed during the analysis of the field search notes, casework database and while conducting the interviews. The findings also allowed for the categorization and timelining of the types of activities conducted by a digital forensic unit.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"56 ","pages":"Article 302069"},"PeriodicalIF":2.2,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"147395550","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0