Journal of Digital Forensics, Security and Law

7-10

Authors: Simson Garfinkel

Researchers can spend their time reverse engineering, performing reverse analysis, or making substantive contributions to digital forensics science. Although work in all of these areas is important, it is the scientific breakthroughs that are the most critical for addressing the challenges that we face. Reverse Engineering is the traditional bread-and-butter of digital forensics research. Companies like Microsoft and Apple deliver computational artifacts (operating systems, applications and phones) to the commercial market. These artifacts are bought and used by billions. Some have evil intent, and (if society is lucky), the computers end up in the hands of law enforcement. Unfortunately the original vendors rarely provide digital forensics tools that make their systems amenable to analysis by law enforcement. Hence the need for reverse engineering.

19-34

Authors: Thomas Lonardo, Tricia Martland, Doug White, Alan Rea

This paper focuses on Federal law as it relates to consent to search relating to Fourth Amendment privacy in the practice of Digital Forensics. In particular, Digital Examiners should be aware of how decisions in Federal Court may impact their ability to acquire evidence in both civil and criminal settings. Digital Forensics, being a relatively new field, is particularly subject to change as cases and appeals are decided. This paper provides an overview of relevant case law relating to issues in Digital Forensics. More importantly, our research provides Digital Forensic Examiners (DFE), as defined by Lonardo, White, and Rea (Lonardo, 2008, 2009), with scenarios that illustrate the various nuances when dealing with the consent to search. From issues of common authority, conflicting consent, apparent authority, and voluntary consent, our research explores court findings and applies them to practical advice and policy formation for DFEs.

63-66

Authors: Schulte Christopher

Hoog, A., & Strzempka, K. (2011). iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices. Waltham, MA: Syngress. 336 pages, ISBN: 978-1-59749-659-9, US$69.95. Reviewed by Christopher Schulte, EnCE & ACE, LuciData Inc., Minneapolis, Minnesota (cschulte@lucidatainc.com) These are exciting times for Digital Forensics practitioners. While our examinations of mobile devices (including cell phones and tablet computers) continue to bring new and sometimes hair-pulling challenges into our labs and on-site engagements, research and understanding of these tiny computers is increasing at what seems an exponential rate. This is especially true in the iOS (Apple Computers' mobile operating system that powers the iPhone, iPad, iPod Touch and Apple TV) space. The diligent work of talented computer scientists in this field allows examiners everywhere to reap the benefits of easier, faster and more effective examinations that yield more accurate and defendable results.

7-10

Authors: Christopher Kelley

Digital forensic practitioners are faced with an extraordinary opportunity. In fact, we may never again be faced with such an opportunity, and this opportunity will challenge us in ways we may never again be challenged. At this point in the history of the Digital Forensics profession, digital forensic specialists have the unique opportunity to help this profession emerge from its infancy. But for this profession to mature -- and to flourish -- individuals and organizations integral to the practice must assemble and shape its future. This is our opportunity. In fact, this is our mandate.

17-30

Authors: Patryk Szewczyk

In theory an ADSL router is capable of providing immense security capabilities including but not limited to wireless encryption, denial of service prevention through firewall rule sets, and logging facilities for review or analysis of network events. However, most laymen may be unaware of the intricacies of the security measures available to them. As a result a vast array of information could remain on ADSL routers once the device is sold, including the users' approach to security, Internet usage habits, or more importantly confidential user or account information. This paper presents the findings of data acquired from second hand ADSL routers purchased during the first quarter of 2011. The outcomes demonstrate that individuals are not removing their identity adequately and are leaving confidential data which may lead to detrimental outcomes if misused. The paper also demonstrates that the overall security of these devices is alarmingly low, and thus many consumers may fall victim to new and emergent Internet based crimes.

63-74

Authors: Gregory H. Carlton, Joe Matsumoto

As the proliferation of digital computational systems continue to expand, increasingly complex technologies emerge, including those regarding large, enterprise-wide, information storage and retrieval systems. Within this study, we examine four contemporary enterprise storage technologies. Our examination of these technologies is presented with an overview of the technological features of each offering and then followed with a discussion of the impact of these technologies on digital forensics methods, particularly regarding forensic data acquisition. We offer a general opinion concerning a recommended data acquisition method when faced with the task of obtaining a forensic image of data contained within these technologies, we discuss limitations of our study, and lastly, we suggest areas in which additional research would benefit the field of digital forensics.

79-86

Authors: Nick Flor, Haile Shannon

Most information systems are secured at minimum by some form of password protection. For various reasons a password may be unavailable, requiring some form of password recovery procedure. One such procedure is software-based automated password recovery, where a program attempts to log into a system by repeatedly trying different password combinations. At the core of such software is a password generator. This article describes the basic iterative and recursive algorithms for generating all possible passwords of a given length, which is commonly referred to as brute-force password generation. The paper ends with a discussion of alternative password recovery procedures one should attempt before brute-force password recovery.

7-8

Authors: Simson Garfinkel

Inheritance powder is the name that was given to poisons, especially arsenic, that were commonly used in the 17th and early 18th centuries to hasten the death of the elderly. For most of the 17th century, arsenic was deadly but undetectable, making it nearly impossible to prove that someone had been poisoned. The first arsenic test produced a gas hardly something that a scientist could show to a judge. Faced with a growing epidemic of poisonings, doctors and chemists spent decades searching for something better.

17-24

Authors: Peter Hannay

The Amazon Kindle eBook reader supports a wide range of capabilities beyond reading books. This functionality includes an inbuilt cellular data connection known as Whispernet. The Kindle provides web browsing, an application framework, eBook delivery and other services over this connection. The historic data left by user interaction with this device may be of forensic interest. Analysis of the Amazon Kindle device has resulted in a method to reliably extract and interpret data from these devices in a forensically complete manner.

49-64

Authors: M. Tariq Banday

Electronic Mail (E-Mail), which is one of the most widely used applications of Internet, has become a global communication infrastructure service. However, security loopholes in it enable cybercriminals to misuse it by forging its headers or by sending it anonymously for illegitimate purposes, leading to e-mail forgeries. E-mail messages include transit handling envelope and trace information in the form of structured fields which are not stripped after messages are delivered, leaving a detailed record of e-mail transactions. A detailed header analysis can be used to map the networks traversed by messages, including information on the messaging software and patching policies of clients and gateways, etc. Cyber forensic e-mail analysis is employed to collect credible evidence to bring criminals to justice. This paper projects the need for e-mail forensic investigation and lists various methods and tools used for its realization. A detailed header analysis of a multiple tactic spoofed e-mail message is carried out in this paper. It also discusses various possibilities for detection of spoofed headers and identification of its originator. Further, difficulties that may be faced by investigators during forensic investigation of an e-mail message have been discussed along with their possible solutions.

7-14

Authors: Fred Cohen

In a recent study, digital forensics was found to lack a consensus around even the most basis notions and terminology of the field. To quote: These two preliminary studies individually suggest that scientific consensus in the area of digital forensic evidence examination is lacking in the broad sense, but that different groups within that overall community may have limited consensus around areas in which they have special expertise, and that the current peer reviewed publication process is not acting to bring about the sorts of elements typically found in the advancement of a science toward such a consensus. ... perhaps the most significant challenge may be in the development of a common language to describe the field.

37-54

Authors: Fred Cohen

This paper describes a case study in which a method for forensic analysis of control was applied to resolve probative technical issues in a legal action. It describes one instance in which the analysis was successfully applied without challenge, addresses the details of most of the different facets of the analysis method, and demonstrates how such analysis provides a systematic approach to using technical methods to address legal issues as a case study.

73-76

Authors: Christopher Schulte

Morrissey, S. (2010). iOS Forensic Analysis: For iPhone, iPad and iPod Touch. New York: Apress. 372 pages, ISBN: 978-1-4302-3342-8, US$59.99. Reviewed by Christopher Schulte, EnCE & ACE, LuciData Inc., Minneapolis, Minnesota (cschulte@lucidatainc.com) As Digital Forensics practitioners, we know that our discipline is constantly evolving. Keeping abreast means we need to continually refine and broaden our knowledge pools through experience, education, research, peer exchange, and more. Mobile device forensics can be especially dynamic and challenging. With multiple standards in place at the hardware, operating system, and user interface levels, it can be daunting to preserve, analyze, search and report on these tiny yet ubiquitous hand-held computers. Apple Computer’s line of mobile products (iOS devices - iPhone, iPad, iPod Touch) is no exception to this rule.