Journal of Digital Forensics, Security and Law

39-60

Authors: Peter J. Best, Pall Rikhardsson, Mark Toleman

Enterprise systems, real time recording and real time reporting pose new and significant challenges to the accounting and auditing professions. This includes developing methods and tools for continuous assurance and fraud detection. In this paper we propose a methodology for continuous fraud detection that exploits security audit logs, changes in master records and accounting audit trails in enterprise systems. The steps in this process are: (1) threat monitoring-surveillance of security audit logs for ‘red flags, (2) automated extraction and analysis of data from audit trails, and (3) using forensic investigation techniques to determine whether a fraud has actually occurred. We demonstrate how mySAP, an enterprise system, can be used for audit trail analysis in detecting financial frauds; afterwards we use a case study of a suspected fraud to illustrate how to implement the methodology.

23-42

Authors: Damir Kahvedzic, Tahar Kechadi

The extraction of the user activity is one of the main goals in the analysis of digital evidence. In this paper we present a methodology for extracting this activity by comparing multiple Restore Points found in the Windows XP operating system. The registry copies represent a snapshot of the state of the system at a certain point in time. Differences between them can reveal user activity from one instant to another. The algorithms for comparing the hives and interpreting the results are of high complexity. We develop an approach that takes into account the nature of the investigation and the characteristics of the hives to reduce the complexity of the comparison and result interpretation processes. The approach concentrates on hives that present higher activity and highlights only those differences that are relevant to the investigation. The approach is implemented as a software tool that is able to compare any set of offline hives and categorise the results according to the user needs. The categorisation of the results, in terms of activity will help the investigator in interpreting the results. In this paper we present a general concept of result categorisation to prove its efficiency on Windows XP, but these can be adapted to any Windows versions including the latest versions.

59-62

Authors: Gary Kessler

Varsalone, J. (Tech. Ed.), Kubasiak, R.R., Morrissey, S., et al. (2009). Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit. Burlington, MA: Syngress. 551 + xix pages, ISBN: 978-1-59749-297-3, US$59.95. Reviewed by Gary C. Kessler (gary.kessler@champlain.edu) At last! A quality book about computer forensics for Apple products! Alas, I get ahead of myself. Apple's hold on the personal computer marketplace started dwindling on August 12, 1981, the day that the IBM PC was introduced. As an Apple ][+ bigot myself, I refused to touch a PC for some years. But I was also a command line bigot, so when the first Macintosh was introduced in 1983 and hermetically sealed the operating system from users, I did not go out and buy one. In fact, like many of my era, I did eventually end up on the PC side which, ironically, let me do many of the things that my trusty Apple ][+ had in earlier times -- write code, play with the hardware, and, indeed, get to a command line. And, of course, tons of application developers flocked to the PC because of its open architecture.

29-42

Authors: Jeremy S. Daily, Nathan Singleton, Elizabeth Downing, Gavin W. Manes

The proper generation and preservation of digital data from Event Data Recorders (EDRs) can provide invaluable evidence to automobile crash reconstruction investigations. However, data collected from the EDR can be difficult to use and authenticate, complicating the presentation of such information as evidence in legal proceedings. Indeed, current techniques for removing and preserving such data do not meet the courts standards for electronic evidence. Experimentation with an EDR unit from a 2001 GMC Sierra pickup truck highlighted particular issues with repeatability of results. Fortunately, advances in the digital forensics field and memory technology can be applied to EDR analysis in order to provide more complete and usable data. The presented issues should assist in the identification and development of a model for forensically sound collection and investigation techniques for EDRs.

61-80

Authors: Thomas Lonardo, Doug White, Alan Rea

In this paper the authors examine statutes that regulate, license, and enforce investigative functions in each US state. After identification and review of Private Investigator licensing requirements, the authors find that very few state statutes explicitly differentiate between Private Investigators and Digital Examiners. After contacting all state agencies the authors present a distinct grouping organizing state approaches to professional Digital Examiner licensing. The authors conclude that states must differentiate between Private Investigator and Digital Examiner licensing requirements and oversight.

17-34

Authors: Merrill Warkentin, Ernst Bekkering, Mark B. Schmidt

Steganography has long been regarded as a tool used for illicit and destructive purposes such as crime and warfare. Currently, digital tools are widely available to ordinary computer users also. Steganography software allows both illicit and legitimate users to hide messages so that they will not be detected in transit. This article provides a brief history of steganography, discusses the current status in the computer age, and relates this to forensic, security, and legal issues. The paper concludes with recommendations for digital forensics investigators, IT staff, individual users, and other stakeholders.

55-70

Authors: Andy Jones, Craig Valli, Iain Sutherland

The ownership and use of mobile phones, Personal Digital Assistants and other hand held devices is now ubiquitous both for home and business use. The majority of these devices have a high initial cost, a relatively short period before they become obsolescent and a relatively low second hand value. As a result of this, when the devices are replaced, there are indications that they tend to be discarded. As technology has continued to develop, it has led to an increasing diversity in the number and type of devices that are available, and the processing power and the storage capacity of the digital storage in the device. All organisations, whether in the public or private sector increasingly use hand held devices that contain digital media for the storage of information relating to their business, their employees or their customers. Similarly, individual private users increasingly use hand held devices containing digital media for the storage of information relating to their private lives. The research revealed that a significant number of organisations and private users are ignorant or misinformed about the volume and type of information that is stored on the hand held devices and the media on which it is stored. It is apparent that they have either not considered, or are unaware of, the potential impact of this information becoming available to their competitors or those with criminal intent. This main purpose of this study was to gain an understanding of the volume and type of information that may remain on hand held devices that are offered for sale on the second hand market. A second aim of the research was to determine the level of damage that could, potentially be caused, if the information that remains on the devices fell into the wrong hands. The study examined a number of hand held devices that had been obtained from sources in the UK and Australia that ranged from internet auction sites, to private sales and commercial resellers. The study was carried out by the security research team at the BT IT Futures Centre in conjunction with Edith Cowan University in Australia and the University of Glamorgan in the UK. The basis of the research was to acquire a number of second hand hand held devices from a diverse range of sources and then determine whether they still contained information relating to a previous owner or whether the information had been effectively removed. The devices that were obtained for the research were supplied blind to the researchers through a third party. The ‘blind’ supply of the devices meant that the people undertaking the research were provided with no information about the device and that the source of the devices and any external markings were hidden from them. This process was put in place to ensure that any findings of the research were based solely on the information that could be recovered from the digital storage media that was contained within the device. The underlying methodology that was used in the research was based on the forensic imaging of the devices. A forensic image of a device is a copy of the digital media that has been created in a scientifically sound manner to a standard that is acceptable to the courts. This procedure was implemented to ensure that the evidential integrity of the devices was maintained, with the devices also then being stored in a secure manner. All subsequent research was then conducted on the image of the device. This was considered to be a sensible precaution against the possibility that information discovered on a device might indicate criminal activity and require the involvement of law enforcement. Following the forensic imaging of the devices, the images that were created were then analysed to determine whether any information remained and whether it could be easily recovered using commonly available tools and techniques that anyone who had purchased the device could acquire.

25-34

Authors: Vivienne Mee

Researchers at Rits Information Security performed a study in how the Irish population disposes of their old computers. How would you dispose of your old computer, or how would the company you work for dispose of their old computers? The majority of Irish homeowners, would bring their old computers to local civic amenity centres, give it away to a relative or sell it on to another party. Some organisations would give their old equipment to a staff member, as a gift gesture, others may simply discard in the local civic amenity site. What is wrong with the methods currently being used for discarding of our old PCs? With this question in mind, Rits Information Security embarked on a study to highlight the problems home users, and corporate users face when discarding retired PCs. In this paper, Rits Information Security describes research in which a number of hard disks were taken from computers after they had been released for resale on Irish online auction sites. The research that was undertaken involved an analysis of the disks to determine if any information remained on these disks, and whether the information could be easily recovered using commonly available tools and techniques. From this analysis, a number of disks could be traced to specific organisations, including large financial institutions, various consultancy firms, numerous small trade organisation, auctioneers, and insurance brokers. In addition to these, a number of computers were found to have originated from the home environment. The results indicate that careless disposal of computers and storage media in the Republic of Ireland is a significant problem. Very few of the disks tested had undergone a thorough or efficient cleansing process. The level of information that could be recovered from the majority of the disks tested would have proven useful for corporate espionage, identity theft, blackmail, and fraud.

57-60

Authors: Gary Kessler

Cohen, F. (2008). Challenges to Digital Forensic Evidence. Livermore, CA: Fred Cohen & Associates. 129 pages, ISBN: 1-878109-41-3, US$39. Reviewed by Gary C. Kessler (gary.kessler@champlain.edu) This book is about evidence gleaned as the result of the digital forensics process and providing expert testimony about that evidence. I am always suspicious when someone self-proclaims themselves as an "expert" although all authors are doing just that, at least by inference. Readers who are familiar with the author, Fred Cohen, or his large body of published works will know that he neither proclaims his expertise quietly nor inaccurately. Indeed, Cohen is an ideal person to weigh in on the topic of suitability and malleability of information acquired from computers and about providing testimony about that information and the process with which it was found.