Journal of Digital Forensics, Security and Law

21-50

Authors: Robert Vose Simpson

Vermont state prosecutors have asked the Vermont Supreme Court to end a state trial judge’s practice of attaching conditions to computer warrants. The Vermont judge’s conditions are drawn from five conditions established in the 2009 decision of the 9th Circuit Court of Appeals in the Comprehensive Drug Testing, Inc. case (CDT II). This is the first time the validity of the “CDT conditions” will be decided by a state court of final jurisdiction in the United States. The CDT II majority reacted to what it termed “an obvious case of deliberate overreaching by the government in an effort to seize data as to which it lacked probable cause.” Determined “to guard against such unlawful conduct in the future ”,Chief Judge Alex Kozinski, author of the majority opinion, set out five conditions, or “guidance, ” that magistrate judges were to require law enforcement officers to agree to, before the judge signed a computer warrant. The 9th Circuit withdrew these conditions from the majority opinion in September 2010 (CDT III). But, it reaffirmed its conclusion that government agents had violated the Fourth Amendment to the United States Constitution in the CDT case. And, it repeated its concern that the “pressing need of law enforcement for broad authorization to examine electronic records … creates a serious risk that every warrant for electronic information will become, in effect, a general warrant, rendering the Fourth Amendment irrelevant.”

73-98

Authors: Manghui Tu

Forensic readiness can support future forensics investigation or auditing on external/internal attacks, internal sabotage and espionage, and business frauds. To establish forensics readiness, it is essential for an organization to identify what evidences are relevant and where they can be found, to determine whether they are logged in a forensic sound way and whether all the needed evidences are available to reconstruct the events successfully. Our goal of this research is to ensure evidence availability. First, both external and internal attacks are molded as augmented attack trees/graphs based on the system vulnerabilities. Second, modeled attacks are conducted against a honeynet simulating an online business information system, and each honeypot's hard drive is forensic sound imaged for each individual attack. Third, an evidence tree/graph will be built after forensics examination on the disk images for each attack. The evidence trees/graphs are expected to be used for automatic crime scene reconstruction and automatic attack/fraud detection in the future.

117-124

Authors: John C. Ebert

Anson, S., Bunting, S., Johnson, R., & Pearson, S. (2012). Mastering Windows Network Forensics and Investigation, 2nd ed. Indianapolis: John Wiley & Sons. 674 pages, ISBN: 978-1-118-16382-5, $59.99 USA/$71.99 CAN. Reviewed by John C. Ebert, Metropolitan State University (eberjo@metrostate.edu) The book is available as a paperback and e-book. The e-book versions allow you to preview several chapters at any of a number of online vendors. The e-book prices vary from the same as the soft cover version ($59.99) to about $38.99. Some of the vendor's e-books retain the color illustrations found in the print version, but others produce them in grey scale, so you might want to look out for that. The book is divided into four parts (17 chapters) plus two appendices. I am compelled to give the book illustrations a highly unfavorable assessment regarding their readability qualities. Their content is otherwise fine and meaningful. Time and again the illustrations are so miniscule that even those of us with the best of vision will be seriously challenged. I hold out the recommendation to review your e-book options over the hardcopy edition. At least in an e-book you have the hope of doing a page-zoom. Review your e-book providers carefully; some I reviewed had "fuzzy graphics." Notwithstanding the problem illustrations, I still recommend this book for its in-the-trenches information and the desktop reference it will become.

13-32

Authors: Manghui Tu, Dianxiang Xu, Cristian Balan, Kyle Cronin

Computer Crime and computer related incidents continue their prevalence and frequency and result in loss of billions of dollars. To fight against those crimes and frauds, it is urgent to develop digital forensics education programs to train a suitable workforce to efficiently and effectively investigate crimes and frauds. However, there is no standard to guide the design of digital forensics curriculum for an academic program. In this research, we investigate the research works on digital forensics curriculum design and existing education programs. Both digital forensics educators and practitioners were surveyed and the results are analyzed to determine what industry and law enforcement need. Based on the survey results and what the industry certificate programs cover, we identified topics that are desired to be covered in digital forensics courses. Finally, we propose six digital forensics courses and their topics that can be offered in both undergraduate and graduate digital forensics programs.

55-82

Authors: David Irwin, Arek Dadej, Jill Slay

The Voice over Internet Protocol (VoIP) is increasing in popularity as a cost effective and efficient means of making telephone calls via the Internet. However, VoIP may also be an attractive method of communication to criminals as their true identity may be hidden and voice and video communications are encrypted as they are deployed across the Internet. This produces in a new set of challenges for forensic analysts compared with traditional wire-tapping of the Public Switched Telephone Network (PSTN) infrastructure, which is not applicable to VoIP. Therefore, other methods of recovering electronic evidence from VoIP are required. This research investigates the analysis and recovery of digitised human, which persists in computer memory after a VoIP call. This paper proposes a proof of concept how remnants of digitised human speech from a VoIP call may be identified within a forensic memory capture based on how the human voice is detected via a microphone and encoded to a digital format using the sound card of your personal computer. This digital format is unencrypted whist processed in Random Access Memory (RAM) before it is passed to the VoIP application for encryption and transmission over the Internet. Similarly, an incoming encrypted VoIP call is decrypted by the VoIP application and passes through RAM unencrypted in order to be played via the speaker output. A series of controlled tests were undertaken whereby RAM captures were analysed for remnants of digital speech after a VoIP audio call with known conversation. The identification and analysis of digital speech from RAM attempts to construct an automatic process for the identification and subsequent reconstruction of the audio content of a VoIP call.

111-114

Authors: Milton Luoma

Garrie, D.B., & Griver, Y.M., Eds. (2012). Dispute Resolution and e-Discovery. Thomson Reuters Westlaw, 570 pages, ISBN-13: 9780314604484, US$149.00. Reviewed by Milton Luoma, JD, (Milt.Luoma@metrostate.edu) As is apparent from its title, this book tackles two very current and difficult legal issues electronic discovery and dispute resolution. The authors tie the two legal concepts together in an effort to provide litigants and practitioners a less expensive and less time consuming alternative than is typically the case with traditional litigation and court proceedings. By including electronic discovery in the discussions, the authors recognize the importance and significance of electronic discovery in mediation and arbitration as it is in traditional litigation.

11-42

Authors: Neil Fowler Wright

The Domain Name Service (DNS) is a critical core component of the global Internet and integral to the majority of corporate intranets. It provides resolution services between the human-readable name-based system addresses and the machine operable Internet Protocol (IP) based addresses required for creating network level connections. Whilst structured as a globally dispersed resilient tree data structure, from the Global and Country Code Top Level Domains (gTLD/ccTLD) down to the individual site and system leaf nodes, it is highly resilient although vulnerable to various attacks, exploits and systematic failures. This paper examines the history along with the rapid growth of DNS up to its current critical status. It then explores the often overlooked value of DNS query data; from packet traces, DNS cache data, and DNS logs, with its use in System Forensics and more frequently in Network Forensics, extrapolating examples and experiments that enhance knowledge. Continuing on, it details the common attacks that can be used directly against the DNS systems and services, before following on with the malicious uses of DNS in direct system attacks, Distributed Denial of Service (DDoS), traditional Denial of Service (DOS) attacks and malware. It explores both cyber-criminal activities and cyber-warfare based attacks, and also extrapolates from a number of more recent attacks the possible methods for data exfiltration. It explores some of the potential analytical methodologies including; common uses in Intrusion Detection Systems (IDS), as well as infection and activity tracking in malware traffic analysis, and covers some of the associated methods around technology designed to defend against, mitigate, and/or manage these and other risks, plus the effect that ISP and nation states can have by direct manipulation of DNS queries and return traffic. This paper also investigates potential behavioural analysis and time-lining, which can then be used for the development of automated analysis methods during forensic investigations and as DNS is a network protocol, there is a predomination towards network based attacks and discovery. It shows the breadth of possible attacks and the scope of investigative approaches that can be employed. Overall it is an exploration of the area of DNS in Computer Forensics, additionally providing a foundation for educational exploration and further subject research: it concludes by bringing together all these aspects to support the importance of DNS analysis in Computer Forensics.

61-74

Authors: Jason Nichols, David Biros, Mark Weiser

The National Repository of Digital Forensics Information (NRDFI) is a knowledge repository for law enforcement digital forensics investigators (LEDFI). Over six years, the NRDFI has undertaken significant design revisions in order to more closely align the architecture of the system with theory addressing motivation to share knowledge and communication within ego-centric groups and communities of practice. These revisions have been met with minimal change in usage patterns by LEDFI community members, calling into question the applicability of relevant theory when the domain for knowledge sharing activities expands beyond the confines of an individual organization to a community of practice. When considered alongside an empirical study that demonstrated a lack of generalizability for existing theory on motivators to share knowledge, a call for deeper investigation is clear. In the current study, researchers apply grounded theory methodology through interviews with members of the LEDFI community to discover aspects of community context that appear to position communities of practice along a continuum between process focus and knowledge focus. Findings suggest that these contextual categories impact a community's willingness to participate in various classes of knowledge support initiatives, and community positioning along these categories dictates prescription for design of knowledge based decision support systems beyond that which can be found in the current literature.

89-112

Authors: Fred Cohen

This paper presents an algorithm for comparing large numbers of traces to each other and identifying and presenting groups of traces with similar features. It is applied to forensic analysis in which groups of similar traces are automatically identified and presented so that attribution and other related claims may be asserted, and independently confirmed or refuted. The approach of this paper is to identify an approximate algorithm that will find a large subset of greatest common factor similar groups of arbitrary factors in far less time and space than an exact algorithm using examiner-provided selection criteria for factor definition.

143-148

Authors: Nate Keith

Vacca, J. R. and Rudolph, K. (2011). System Forensics, Investigation, and Response. Sudbury, MA: Jones and Bartlett Learning. 339 + xv pages, ISBN: 978-0-7637-9134-6, US$89.95. Reviewed by Nate Keith, MBA, (natejkeith@gmail.com) I recently expressed an interest to a respected colleague in finding a way to give back to the forensic community. He suggested writing a review for a text he recently received and provide feedback to the community. It is my intent to present an objective analysis of System Forensics, Investigation, and Response. Written by John R. Vacca and K Rudolph, this book is part of the Jones and Bartlett Learning Information Systems Security & Assurance Series. Both Vacca and Rudolph have considerable experience in the information technology field as is demonstrated by the back cover notes: John R. Vacca is an information technology consultant and internationally known best-selling author based in Pomeroy, Ohio. Since 1982, he has written 62 books and more than 600 articles in the areas of advanced storage, computer security, and aerospace technology.

15-28

Authors: Harjinder Singh Lallie, Parmjit Bains

The introduction of Jumplists in Windows 7 was an important feature from a forensic examiners viewpoint. Jumplist configuration files can provide the examiner with a wealth of information relating to file access and in particular: dates/times, Volume GUIDs and unique file object IDs relating to those files. Some of the information in the Jumplist could be used to build a more precise timeline relating to system and file usage. In this article, we analyse the structure of a Jumplist configuration file and in particular a record from a Jumplist configuration file and highlight some of the important entries therein.

55-70

Authors: Larry Melling, Bob Zeidman

The Android smartphone operating system includes a Java mobile development platform that provides for rapid development and deployment of a wide variety of applications. The open nature of the platform means that reverse engineering of applications is relatively easy, and many developers are concerned as applications similar to their own show up in the Android marketplace and want to know if these applications are pirated. Fortunately, the same characteristics that make an Android application easy to reverse engineer and copy also provide opportunities for Android developers to compare downloaded applications to their own. This paper describes the process for comparing a developer's application with a downloaded application and defines an identifiability metric to quantify the degree to which an application can be identified by its bytecode.

87-92

Authors: Diane Barrett

Zeidman, B. (2011). The Software IP Detective's Handbook: Measurement, Comparison, and Infringement Detection. Boston, MA: Pearson Education, Inc. 480 pages, ISBN-10: 0137035330;ISBN-13: 978-0137035335, US$49.99. Reviewed by Diane Barrett, American Military University. Do not the book title fool you into thinking that the book is only for those looking to detect software infringement detection. It is a comprehensive look at software intellectual property. The book covers a wide range of topics and has something to offer for just about everyone from lawyers to programmers.