Forensic Science International-Digital Investigation最新文献_第9页

Drone forensics in law enforcement: Assessing utilisation, challenges, and emerging necessities 执法中的无人机取证：评估利用率，挑战和新兴需求

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-09-29 DOI: 10.1016/j.fsidi.2025.302003

Ranul Deelaka Thantilage , Gerry Buttner , Ray Genoe

{"title":"Drone forensics in law enforcement: Assessing utilisation, challenges, and emerging necessities","authors":"Ranul Deelaka Thantilage , Gerry Buttner , Ray Genoe","doi":"10.1016/j.fsidi.2025.302003","DOIUrl":"10.1016/j.fsidi.2025.302003","url":null,"abstract":"<div><div>The proliferation of drone technology has introduced new challenges and opportunities for law enforcement, necessitating the development of drone forensics as a specialised field within digital forensics. This survey paper explores the critical role of drone forensics in modern policing, focusing on its applications in investigating crimes involving unmanned aerial vehicles (UAVs) and addressing emerging security threats. This paper examines the tools, data extraction methods, and operational practices employed in drone forensic investigations, with particular attention to cases of unauthorised surveillance, smuggling, and cyber-attacks. Furthermore, this study discusses the technical, legal, and ethical challenges associated with drone forensics, including encryption, anti-forensic techniques, proprietary software, and privacy concerns. Through a synthesis of current practices, technological advancements, and relevant case studies, this survey provides insights into the effectiveness, limitations, and evolving needs of drone forensics. Recommendations are offered to enhance law enforcement capabilities, emphasising the importance of continuous training, standardised protocols, and collaboration across agencies. This survey paper aims to support policymakers, law enforcement agencies, and forensic practitioners in integrating drone forensics as a versatile and effective approach for safeguarding public safety and ensuring justice in an increasingly drone-integrated world.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302003"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145220646","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Complex networks-based anomaly detection for financial transactions in anti-money laundering 反洗钱金融交易中基于复杂网络的异常检测

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-10-07 DOI: 10.1016/j.fsidi.2025.302005

Rodrigo Marcel Araujo Oliveira , Angelo Marcio Oliveira Sant’Anna , Paulo Henrique Ferreira

{"title":"Complex networks-based anomaly detection for financial transactions in anti-money laundering","authors":"Rodrigo Marcel Araujo Oliveira , Angelo Marcio Oliveira Sant’Anna , Paulo Henrique Ferreira","doi":"10.1016/j.fsidi.2025.302005","DOIUrl":"10.1016/j.fsidi.2025.302005","url":null,"abstract":"<div><div>Money laundering is a global threat that undermines the integrity of the financial system and the stability of the world economy. This paper proposes an approach based on complex network techniques to support investigating financial transactions of individuals suspected of money laundering. The study includes analyses for anomaly detection, community detection, density analysis, and cycle identification, aiming to capture complex patterns of interaction among accounts. Anomaly detection was based on a Graph Neural Networks model. The results highlight the model’s effectiveness, as indicated by the Silhouette score and Davies-Bouldin index metrics obtained on the test set, which were 0.83 and 1.59, respectively. This suggests that the groups of anomalous and normal accounts are well represented in terms of similarity and dissimilarity. The study also incorporates various financial indicators, such as moving averages over different time windows of transactions. The K-means algorithm was employed to identify patterns in financial transactions and determine the number of clusters. Correspondence Analysis was applied to establish similarities among the transactional profiles of the investigated individuals. The findings are relevant to the investigative process, providing analytical support for monitoring and prioritizing cases and identifying potential transactional patterns and groups of individuals possibly involved in illicit activities, such as drug trafficking, fraud, and scams.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302005"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145267233","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Uncovering digital traces of DeepSeek: Cross-platform mobile and network forensics 揭露深度搜索的数字痕迹：跨平台移动和网络取证

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-11-18 DOI: 10.1016/j.fsidi.2025.302028

Yufeng Gong , Sonali Tyagi , Vaishnavi Mahindra , Umit Karabiyik

{"title":"Uncovering digital traces of DeepSeek: Cross-platform mobile and network forensics","authors":"Yufeng Gong , Sonali Tyagi , Vaishnavi Mahindra , Umit Karabiyik","doi":"10.1016/j.fsidi.2025.302028","DOIUrl":"10.1016/j.fsidi.2025.302028","url":null,"abstract":"<div><div>As an application focusing on generative artificial intelligence, open-source LLM DeepSeek has been widely adopted by many research institutions and international companies around the world. More than 60 million active daily users have been reported on DeepSeek by QuestMobile. Given the rapid growth in the population of DeepSeek users and the fact that mobile devices gradually function as centers for users to interact with AI chatbots, it is essential to conduct thorough mobile forensics along with network forensics on the DeepSeek mobile app to discover potential evidence stored in both Android and iOS devices and provide valuable insight into its potential vulnerabilities. However, given the app’s recent introduction, there is currently a lack of systematic forensic research that investigates its potentially valuable artifacts, data persistence mechanisms, and network communication patterns across platforms. This research focused on user data and application usage, such as log files, metadata, and other critical traces, which revealed insights into its operational behavior in different versions of DeepSeek and the data sent over the network. Our analysis can help forensic researchers and investigators fully utilize the forensic value of DeepSeek on mobile devices to have a clear view of what can be recovered and obtained.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302028"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145578847","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A comprehensive analysis and evaluation of SQLite deleted Record recovery techniques: A survey SQLite删除记录恢复技术的综合分析与评价：调查

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-11-22 DOI: 10.1016/j.fsidi.2025.302031

Seonghyeon Lee , Sooyoung Park , Insoo Lee , Jongmoo Choi

{"title":"A comprehensive analysis and evaluation of SQLite deleted Record recovery techniques: A survey","authors":"Seonghyeon Lee , Sooyoung Park , Insoo Lee , Jongmoo Choi","doi":"10.1016/j.fsidi.2025.302031","DOIUrl":"10.1016/j.fsidi.2025.302031","url":null,"abstract":"<div><div>SQLite is a lightweight, file-based relational database that is widely deployed on mobile and IoT devices to store diverse data. Due to its widespread use, SQLite has become an important subject of interest in digital forensics. In particular, SQLite exhibits structural characteristics that allow deleted data to persist temporarily within database, specifically through internal components such as the freelist and Write-Ahead Log (WAL). As a result, deleted content often remains recoverable even after deletion requests, making SQLite a valuable source of forensic artifacts. These characteristics have motivated the development of various techniques and tools for recovering deleted records from SQLite. However, comparative evaluations of the strengths, limitations, and performance of each approach based on consistent criteria remain relatively scarce. To address this gap, this study systematically categorizes existing deleted record recovery techniques into three types, namely Metadata-based, Carving-based, and WAL-based, and compares their trade-offs. In addition, we select representative open-source SQLite recovery tools, such as Undark, SQLite Deleted Record Parser, Bring2Lite, and FQLite, and quantitatively measure their recovery performance, reliability, and throughput based on various deletion scenarios. We also present a detailed analysis of incorrect recoveries (false positives) caused by structural changes in the database. These findings can provide practical guidelines for selecting the most suitable SQLite recovery method depending on the context, and can contribute to the development of more effective recovery techniques and tools in the future.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302031"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145578846","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Editorial – Introducing the last Volume of 2025 社论-介绍2025年最后一卷

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-12-02 DOI: 10.1016/j.fsidi.2025.302033

Kim-Kwang Raymond Choo Senior Editor

引用次数: 0

Evaluating digital forensic findings in Trojan horse defense cases using Bayesian networks 利用贝叶斯网络评估特洛伊木马辩护案件中的数字取证结果

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-11-05 DOI: 10.1016/j.fsidi.2025.302023

Marouschka Vink , Ruud Schramp , Bas Kokshoorn , Marjan J. Sjerps

{"title":"Evaluating digital forensic findings in Trojan horse defense cases using Bayesian networks","authors":"Marouschka Vink , Ruud Schramp , Bas Kokshoorn , Marjan J. Sjerps","doi":"10.1016/j.fsidi.2025.302023","DOIUrl":"10.1016/j.fsidi.2025.302023","url":null,"abstract":"<div><div>Digital forensic scientists primarily rely on individual internal reasoning and categorical conclusions when evaluating evidence in casework. This can make it difficult to maintain structured reasoning that is logically sound, balanced, robust, and transparent. Trojan horse defense cases exemplify these challenges in evaluating digital forensic findings. The key challenge in such cases is combining multiple observations into a logically sound probabilistic evaluation while maintaining an understandable forensic report for court and other recipients. To address these challenges, we propose using the likelihood ratio framework to evaluate digital findings in Trojan horse defense cases, with Bayesian networks serving to visualize the evaluation and derive a likelihood ratio. We will illustrate this approach by demonstrating the construction of a Bayesian network through a case example. We show that these networks are very suitable to model the evaluation of digital evidence in Trojan horse defense cases and that they can be easily adapted for various case circumstances. Based on our findings, we strongly recommend broader exploration of Bayesian networks in digital forensic casework.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302023"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145473733","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AI-driven dataset creation in mobile forensics using LLM-based storyboards 使用基于法学硕士的故事板在移动取证中创建ai驱动的数据集

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-10-03 DOI: 10.1016/j.fsidi.2025.302002

Dirk Pawlaszczyk , Philipp Engler , Ronny Bodach , Christian Hummert , Margaux Michel , Ralf Zimmermann

引用次数: 0

An effective automotive forensic technique utilizing various logs of Android-based In-vehicle infotainment systems 一种有效的汽车取证技术，利用基于android的车载信息娱乐系统的各种日志

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-09-01 DOI: 10.1016/j.fsidi.2025.301990

Sunjae Kim , Jeehun Jung , Haein Kang , Yejin Yoon , Seong-je Cho , Minkyu Park , Sangchul Han

{"title":"An effective automotive forensic technique utilizing various logs of Android-based In-vehicle infotainment systems","authors":"Sunjae Kim , Jeehun Jung , Haein Kang , Yejin Yoon , Seong-je Cho , Minkyu Park , Sangchul Han","doi":"10.1016/j.fsidi.2025.301990","DOIUrl":"10.1016/j.fsidi.2025.301990","url":null,"abstract":"<div><div>Android-based In-vehicle infotainment (IVI) systems generate log message containing valuable forensic artifacts from interactions with internal or external devices. These log messages can help in vehicle accidents or criminal investigations; however, there is limited knowledge of the stored information and the methods of accessing them. In addition, digital forensic analysis of the Android-based IVI systems is not supported by the popular forensic tool, Berla's iVe. To address this, we first acquire multiple types of logs from three Jellybean-based systems (2017-2019) and two KitKat-based IVI systems (2022-2023) using a practical and non-invasive method, and then perform a comprehensive and comparative analysis of the logging mechanisms in the IVI systems. We then examine volatile and nonvolatile log data acquired from the IVI systems from the perspective of vehicle forensics. Jellybean-based systems maintain seven ring buffers for volatile logs, while KitKat-based systems use five. Volatile logs are erased when the system is powered off. Both versions of the Android systems store nonvolatile log files of seven different types, with data retained for up to a year. We conducted a thorough analysis of the acquired logs, uncovering artifacts related to navigation use, radio listening, engine start/stop, door access, seat belt use, and Bluetooth connections, including phone calls and SMS messages. In addition, we compare the artifacts identified within those IVI systems. Finally, our analysis creates a timeline to track driver behavior, and provides critical insights into driver actions and vehicle events.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 301990"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"144922521","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AKF: A modern synthesis framework for building datasets in digital forensics AKF：用于在数字取证中构建数据集的现代综合框架

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-10-03 DOI: 10.1016/j.fsidi.2025.302004

Lloyd Gonzales , Nancy LaTourrette, Bill Doherty

{"title":"AKF: A modern synthesis framework for building datasets in digital forensics","authors":"Lloyd Gonzales , Nancy LaTourrette, Bill Doherty","doi":"10.1016/j.fsidi.2025.302004","DOIUrl":"10.1016/j.fsidi.2025.302004","url":null,"abstract":"<div><div>The forensic community depends on datasets containing disk images, network captures, and other forensic artifacts for education and research. These datasets must be reflective of the artifacts that real-world analysts encounter, which can evolve rapidly as new software is released. Additionally, these datasets must be free of sensitive data that would limit their distribution. To address the issues of relevance and sensitivity, many researchers and educators develop datasets by hand. While this approach is viable, it is time-consuming and rarely produces datasets that are fully reflective of real-world conditions. As a result, there is ongoing research into forensic synthesizers, which simplify the process of creating complex datasets that are free of legal and logistical concerns.</div><div>This work introduces the automated kinetic framework (AKF), a modular synthesizer for creating and interacting with virtualized environments to simulate human activity. AKF makes significant improvements to the approaches and implementations of prior synthesizers used to generate forensic artifacts. AKF also improves the process of documenting these datasets by leveraging the CASE standard to provide human- and machine-readable reporting. Finally, AKF offers several options for using these features to build and document datasets, including a custom scripting language. These contributions aim to streamline the development of forensic datasets and ensure the long-term usefulness of AKF-generated datasets and the framework as a whole.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302004"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145220647","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A comprehensive artifact analysis of Google applications on Android and iOS platforms Android和iOS平台上b谷歌应用程序的综合工件分析

IF 2.2 4区医学

Forensic Science International-Digital Investigation Pub Date : 2025-12-01 Epub Date: 2025-11-11 DOI: 10.1016/j.fsidi.2025.302029

Jisu Park , Jincheol Park , Hyunjun Kim , Soojin Kang , Jongsung Kim

{"title":"A comprehensive artifact analysis of Google applications on Android and iOS platforms","authors":"Jisu Park , Jincheol Park , Hyunjun Kim , Soojin Kang , Jongsung Kim","doi":"10.1016/j.fsidi.2025.302029","DOIUrl":"10.1016/j.fsidi.2025.302029","url":null,"abstract":"<div><div>Google provides a diverse suite of applications (e.g., Gmail, Google Drive, Google Maps, and Google Docs Editor), which are interconnected to enhance user convenience. This study comparatively analyzes the artifacts generated by 25 Google applications on Android and iOS platforms. We start by describing an artifact acquisition method and the utility of artifacts in digital forensic investigations. Based on these investigations, we identify the differences between the two platforms in terms of their data storage patterns and demonstrate that the integrated analysis of both platforms provides a more comprehensive set of artifacts than single-platform analysis. Subsequently, we analyze the synchronization among Google applications. We demonstrate how various applications share and synchronize data, and present methods for utilizing the interactions among the corresponding artifacts. The results of this analysis, we develop a tool for effectively tracing and analyzing the collected artifacts. By comparing the artifact acquisition rates of Android and iOS, we highlight the distinct data provided by each platform. Compared with existing methods, our integrated approach is expected to provide richer and more accurate digital evidence.</div></div>","PeriodicalId":48481,"journal":{"name":"Forensic Science International-Digital Investigation","volume":"55 ","pages":"Article 302029"},"PeriodicalIF":2.2,"publicationDate":"2025-12-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"145527963","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"医学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0