Journal of Digital Forensics, Security and Law

15-36

Authors: David Irwin, Jill Slay, Arek Dadej, Malcolm Shore

The popularity of Voice over the Internet Protocol (VoIP) is increasing as the cost savings and ease of use is realised by a wide range of home and corporate users. However, the technology is also attractive to criminals. This is because VoIP is a global telephony service, in which it is difficult to verify the user's identification. The security of placing such calls may also be appealing to criminals, as many implementations use strong encryption to secure both the voice payload as well as to control messages making monitoring such VoIP calls difficult since conventional methods such as wire-tapping is not applicable to VoIP calls. Therefore, other methods of recovering electronic evidence and information from VoIP are required. This research looks at what protocol evidence remains after a VoIP call has taken place examining both a virtual hard disk and the Random Access Memory (RAM). This paper proposes a set of identifiable credentials based on packet header information contained within the VoIP protocol stack. A series of controlled tests were undertaken whereby these credentials were forensically searched for on a virtual machine which was used to make the VoIP call. This experiment was then repeated by a search for the same protocol credentials within the RAM.

55-72

Authors: Gary C Kessler

As digital evidence grows in both volume and importance in criminal and civil courts, judges need to fairly and justly evaluate the merits of the offered evidence. To do so, judges need a general understanding of the underlying technologies and applications from which digital evidence is derived. Due to the relative newness of the computer forensics field, there have been few studies on the use of digital forensic evidence and none about judges’ relationship with digital evidence. This paper describes a recent study, using grounded theory methods, into judges’ awareness, knowledge, and perceptions of digital evidence. This study is the first in the U.S. to examine judges and digital forensics, thus opening up a new avenue of research. It is the second time that grounded theory has been employed in a published digital forensics study, demonstrating the applicability of that methodology to this discipline.

77-90

Authors: Nick Flor, Kenneth Guillory

A packet sniffer is a piece of software that allows a person to eavesdrop on computer communications over the internet. A packet sniffer can be used as a diagnostic tool by network administrators or as a spying tool by hackers who can use it to steal passwords and other private information from computer users. Whether you are a network administrator or information assurance specialist, it helps to have a detailed understanding of how packet sniffers work. And one of the best ways to acquire such an understanding is to build and modify an actual packet sniffer.