Journal of Digital Forensics, Security and Law

11-42

Authors: Neil Fowler Wright

The Domain Name Service (DNS) is a critical core component of the global Internet and integral to the majority of corporate intranets. It provides resolution services between the human-readable name-based system addresses and the machine operable Internet Protocol (IP) based addresses required for creating network level connections. Whilst structured as a globally dispersed resilient tree data structure, from the Global and Country Code Top Level Domains (gTLD/ccTLD) down to the individual site and system leaf nodes, it is highly resilient although vulnerable to various attacks, exploits and systematic failures. This paper examines the history along with the rapid growth of DNS up to its current critical status. It then explores the often overlooked value of DNS query data; from packet traces, DNS cache data, and DNS logs, with its use in System Forensics and more frequently in Network Forensics, extrapolating examples and experiments that enhance knowledge. Continuing on, it details the common attacks that can be used directly against the DNS systems and services, before following on with the malicious uses of DNS in direct system attacks, Distributed Denial of Service (DDoS), traditional Denial of Service (DOS) attacks and malware. It explores both cyber-criminal activities and cyber-warfare based attacks, and also extrapolates from a number of more recent attacks the possible methods for data exfiltration. It explores some of the potential analytical methodologies including; common uses in Intrusion Detection Systems (IDS), as well as infection and activity tracking in malware traffic analysis, and covers some of the associated methods around technology designed to defend against, mitigate, and/or manage these and other risks, plus the effect that ISP and nation states can have by direct manipulation of DNS queries and return traffic. This paper also investigates potential behavioural analysis and time-lining, which can then be used for the development of automated analysis methods during forensic investigations and as DNS is a network protocol, there is a predomination towards network based attacks and discovery. It shows the breadth of possible attacks and the scope of investigative approaches that can be employed. Overall it is an exploration of the area of DNS in Computer Forensics, additionally providing a foundation for educational exploration and further subject research: it concludes by bringing together all these aspects to support the importance of DNS analysis in Computer Forensics.

61-74

Authors: Jason Nichols, David Biros, Mark Weiser

The National Repository of Digital Forensics Information (NRDFI) is a knowledge repository for law enforcement digital forensics investigators (LEDFI). Over six years, the NRDFI has undertaken significant design revisions in order to more closely align the architecture of the system with theory addressing motivation to share knowledge and communication within ego-centric groups and communities of practice. These revisions have been met with minimal change in usage patterns by LEDFI community members, calling into question the applicability of relevant theory when the domain for knowledge sharing activities expands beyond the confines of an individual organization to a community of practice. When considered alongside an empirical study that demonstrated a lack of generalizability for existing theory on motivators to share knowledge, a call for deeper investigation is clear. In the current study, researchers apply grounded theory methodology through interviews with members of the LEDFI community to discover aspects of community context that appear to position communities of practice along a continuum between process focus and knowledge focus. Findings suggest that these contextual categories impact a community's willingness to participate in various classes of knowledge support initiatives, and community positioning along these categories dictates prescription for design of knowledge based decision support systems beyond that which can be found in the current literature.

89-112

Authors: Fred Cohen

This paper presents an algorithm for comparing large numbers of traces to each other and identifying and presenting groups of traces with similar features. It is applied to forensic analysis in which groups of similar traces are automatically identified and presented so that attribution and other related claims may be asserted, and independently confirmed or refuted. The approach of this paper is to identify an approximate algorithm that will find a large subset of greatest common factor similar groups of arbitrary factors in far less time and space than an exact algorithm using examiner-provided selection criteria for factor definition.

143-148

Authors: Nate Keith

Vacca, J. R. and Rudolph, K. (2011). System Forensics, Investigation, and Response. Sudbury, MA: Jones and Bartlett Learning. 339 + xv pages, ISBN: 978-0-7637-9134-6, US$89.95. Reviewed by Nate Keith, MBA, (natejkeith@gmail.com) I recently expressed an interest to a respected colleague in finding a way to give back to the forensic community. He suggested writing a review for a text he recently received and provide feedback to the community. It is my intent to present an objective analysis of System Forensics, Investigation, and Response. Written by John R. Vacca and K Rudolph, this book is part of the Jones and Bartlett Learning Information Systems Security & Assurance Series. Both Vacca and Rudolph have considerable experience in the information technology field as is demonstrated by the back cover notes: John R. Vacca is an information technology consultant and internationally known best-selling author based in Pomeroy, Ohio. Since 1982, he has written 62 books and more than 600 articles in the areas of advanced storage, computer security, and aerospace technology.