Summary Social media usage in mobile phones has increased substantially in recent times, and they are a critically important source of a forensics investigation. In this paper, we have developed Python‐based forensic analyzers that are integrated with the open‐source tool Autopsy. The proposed analyzers find forensic artifacts from the three most widely used social media messaging applications, that is, WhatsApp, Instagram, and Facebook Messenger. This research focuses on finding forensic artifacts stored by these social media applications on an iOS device. These analyzers extract data critical for a forensic investigation such as text messages, media attachments, sender and receiver details, timestamps, contact information, and other related forensics data from the full file system image of iOS devices. These Python‐based plugins extract the required data from the social media applications' databases and present the evidential artifacts in a human‐readable format. We integrated these analyzers into the Autopsy Forensics tool and showcased the gathered evidence so that investigators are capable to analyze the extracted information effortlessly. The data integrity is maintained by converting it into readable form without permanently altering the database format. The results prove that the proposed analyzers can successfully extract and analyze forensics data at a low computational overhead.

Summary The container‐based cloud has its distinct security challenges. In this article, moving target defense (MTD) is used to increase the cost and effort of the attacker to exploit resources and follow an attack path to compromise the critical resources in a container‐based cloud. The existing MTD mechanisms for cloud have not focused on intruder prevention inside containerized environment. The proposed solution is one of its kind that utilizes resource movement inside and across the virtual private network in the cloud to deceive intruders. The framework continuously changes the target/container to increase confusion about the routing path, so attackers cannot follow the simple attack path. This obscure cloud architecture increases the delay in attack and gives system/network administrators significant time to use Intrusion Detection mechanisms for countering the attack. The proposed scheme is implemented on the Google Cloud Platform (GCP) by using an extensive network of nodes hosting the stateful pods that are created and destroyed periodically. The experimental analysis confirmed that the proposed scheme substantially increased the attack path length and added obscurity at a low computation cost. However, as per experiments, implementing the proposed scheme in GCP slightly increases the dollar cost.

Abstract Over the past decade, there has been a rapidly rising trend of malware (ransomware) that limits user access by encrypting the data and demanding the ransom against the decryption key. In most cases, such encryption may lead to a permanent data loss. In order to prevent this unwanted encryption, we propose a method based on Moving Target Defense (MTD) approach. Our method is based on the alteration of the attack surface to reduce the attack success ratio. We have used multiple layers of MTD. The first layer generates random extensions that hide the existing known file extensions. This will protect user files against those ransomware variants which encrypt files having some specific extensions. Our second layer of protection uses event‐based MTD in which tasks are scheduled to change file extensions at the occurrence of specific events which mostly occur due to the execution of ransomware in the system. As a result of our proposed method, we have successfully protected user files against well‐known ransomware variants such as WannaCry, Cerber, Locky, Tesla, Revil, Bitlocker, Darkside, Ranzy.

Summary The rise of social media‐related crimes has led to the rise of mobile forensics. Since mobile forensics and privacy preservation are conflicting fields, it is important to find a middle ground where forensics can be performed on any device without compromising the confidentiality of an individual. This paper presents a framework called “role‐based mobile forensics framework with cryptography (RBMF2C)” that can be easily implemented and protects users' privacy and does not interfere with the forensic process. A mobile forensic platform called Sher‐locked phones developed using C# is also presented in this paper that is developed following the aforementioned RBMF2C framework. This platform consists of five layers: access control, evidence gathering, data analysis, privacy, and reporting layer. The developed platform implements the RBMF2C framework on the evidence gathering, analysis, and reporting layer to protect the evidential image, evidential findings, and final report from being accessed by unauthorized users. The implementation of privacy preservation techniques as proposed by the proposed framework such as role‐based access control, keyword search, and encryption/ decryption did not hinder the performance of the developed toolkit, and suspects data privacy is also preserved to a substantial extent.