Journal of Digital Forensics, Security and Law

Number 1, 2013

7-16
Science Column: Measuring Inconsistency Methods for Evidentiary Value

Authors: Fred Cohen

Abstract

View in PDF

Number of views: 459

Many inconsistency analysis methods may be used to detect altered records or statements. But for admission as evidence, the reliability of the method has to be determined and measured. For example, in China, for evidence to be admitted, it has to have 95% certainty of being correct, and that certainty must be shown to the court, while in the US, evidence is admitted if it is more probative than prejudicial (a >50% standard). In either case, it is necessary to provide a measurement of some sort in order to pass muster under challenges from the other side. And in most cases, no such measurement has been undertaken. The question of how to undertake a scientific measurement to make such a determination, or at least to claim such a metric, is not well defined for digital forensics, but perhaps we can bring some light to the subject this issue.

17-38
A Simple Experiment With Microsoft Office 2010 and Windows 7 Utilizing Digital Forensic Methodology

Authors: Gregory H. Carlton

Abstract

View in PDF

Number of views: 478

Digital forensic examiners are tasked with retrieving data from digital storage devices, and frequently these examiners are expected to explain the circumstances that led to the data being in its current state. Through written reports or verbal, expert testimony delivered in court, digital forensic examiners are expected to describe whether data have been altered, and if so, then to what extent have data been altered. Addressing these expectations results from opinions digital forensic examiners reach concerning their understanding of electronic storage and retrieval methods. The credibility of these opinions evolves from the scientific basis from which they are drawn using forensic methodology. Digital forensic methodology, being a scientific process, is derived from observations and repeatable findings in controlled environments. Furthermore, scientific research methods have established that causal conclusions can be drawn only when observed in controlled experiments. With this in mind, it seems beneficial that digital forensic examiners have a library of experiments from which they can perform, observe results, and derive conclusions. After having conducted an experiment on a specific topic, a digital forensic examiner will be in a better position to express with confidence the state of the current data and perhaps the conditions that led to its current state. This study provides a simple experiment using the contemporary versions of the most widely used software applications running on the most commonly installed operation system. Here, using the Microsoft Office 2010 applications, a simple Word document, an Excel spreadsheet, a PowerPoint presentation, and an Access database are created and then modified. A forensic analysis is performed to determine the extent in which the changes to the data are identified. The value in this study is not that it yields new forensic analysis techniques, but rather that it illustrates a methodology that other digital forensic examiners can apply to develop experiments representing their specific data challenges.

39-72
How Often is Employee Anger an Insider Risk I?

Authors: Eric David Shaw

Abstract

View in PDF

Number of views: 460

This research introduced two new scales for the identification and measurement of negative sentiment and insider risk in communications in order to examine the unexplored relationship between these two constructs. The inter-rater reliability and criterion validity of the Scale of Negativity in Texts (SNIT) and the Scale of Insider Risk in Digital Communications (SIRDC) were established with a random sample of email from the Enron archive and criterion measures from established insiders, disgruntled employees, suicidal, depressed, angry, anxious and other sampled groups. In addition, the sensitivity of the scales to changes over time as the risk of digital attack increased and transitioned to a physical attack was also examined in an actual case study. Inter-rater reliability for the SNIT was extremely high across groups while the SIRDC produced lower, but acceptable levels of agreement. Both measures also significantly distinguished the criterion groups from the overall Enron sample. The scales were then used to measure the frequency of negative sentiment and insider risk indicators in the random Enron sample and the relationship between the two constructs. While low levels of negative sentiment were found in 20% of the sample, moderate and high levels of negative sentiment were extremely rare, occurring in less than 1% of communications. Less than 4% of the sampled emails displayed indicators of insider risk on the SIRDC. Emails containing high levels of insider risk comprised less than one percent or the sample. Of the emails containing negative sentiment in the sample, only 16.3%, also displayed indicators of insider risk. The odds of a communication containing insider risk increased with the level of negative sentiment and only low levels of insider risk were found at low levels of negative sentiment. All of the emails found to contain insider risk indicators on the SIRDC also displayed some level of negative sentiment. The implications of these findings for insider risk detection were then examined.

73-90
Visualizing Forensic Data : Evidence Guidelines (Part 1)

Authors: Damian Schofield

Abstract

View in PDF

Number of views: 465

Visualisation is becoming increasingly important for understanding information, such as investigative data (for example: computing, medical and crime scene evidence) and analysis (for example: network capability assessment, data file reconstruction and planning scenarios). Investigative data visualisation is used to reconstruct a scene or item and is used to assist the viewer (who may well be a member of the general public with little or no understanding of the subject matter) to understand what is being presented. Analysis visualisations, on the other hand, are usually developed to review data, information and assess competing scenario hypotheses for those who usually have an understanding of the subject matter. Visualisation represents information that has been digitally recorded (for example: pictures, video and sound), hand written and/or spoken data, to show what may have, could have, did happen or is believed to have happened. That is why visualising data is an important development in the analysis and investigation realms, as visualisation explores the accuracies, inconsistencies and discrepancies of the collected data and information. This paper presents introduces some of the various graphical techniques and technology used to display digital information in a courtroom. The advantages and disadvantages involved in the implementation of this technology are also discussed. This paper is part one of a two part series that aims to describe the use of, and provide guidelines for, the use of graphical displays in courtrooms.