The continuous adoption of technology in our daily lives has created an avenue for malicious individuals to exploit, especially as we regularly interact with these devices, sharing sensitive information such as health records, financial data, and personal details. Consequently, in our technologically advanced world, it is highly probable that crimes will encompass electronic devices, necessitating digital forensics investigations to unearth vital information for resolving these cases. However, due to the advances of these devices, digital forensic analysts may need to utilize hacking skills to either get into and/or investigate these devices. For the evidence acquired to be deemed acceptable in court, these hacking skills must be ethical. Ethical hacking in the field of digital forensics has become increasingly prevalent and valuable. By using the techniques and tools employed by the attacker, investigators can collect valuable digital evidence, preserve the integrity of evidence, and provide a comprehensive analysis for legal proceedings. However, the use of ethical hacking in digital forensics also presents ethical considerations. It is crucial to adhere to legal and ethical guidelines such as the anonymization of data, defining the scope of the investigation, and obtaining formal consent as part of ethical hacking activities. In this paper, we discuss the implications of using ethical hacking tools and procedures in digital forensic investigations, along with recommendations and guidelines to preserve the privacy, transparency, intellectual property, and data integrity of the evidence. Furthermore, we introduce four scenarios to show that ethical violations can occur during digital forensic investigations when the analyst uses hacking techniques.

Internet of Things devices such as Amazon Alexa have grown in popularity over the years due to the ease it gives to its’ user. As a result of the common occurrence of crimes taking place at homes, especially violent crimes there is a high possibility of the presence of an Alexa when a criminal investigation occurs; thus, forensic investigations on these devices are required to assess the evidential value to forensic examiners. This paper focused on the carrying out a forensic investigation of Amazon Alexa Echo Dot 4thgeneration on the software and the cloud level. This paper shows how forensic artifacts could be obtained from the Alexa application on an iPhone and an Android smartphone, as well as adapted and described an open source tool that can be used to collect evidence from an Amazon Alexa Echo Dot 4thgeneration at the cloud level.

Industrial control systems (ICS) can be exposed to cyberattacks with potentially catastrophic consequences. Intrusion detection is a fraud prevention technique derived from big data that play a key role in detecting attacks at the earliest stage. Data historian is essential to understanding all events and activities across the network. This article introduces the basic mechanisms by which common attacks on ICS can be detected and analyzed through different forensic tools. We explored the common vulnerabilities and potential attack vectors present in critical infrastructures and described measures that can be deployed to mitigate those threats. We discussed several common attack scenarios and artifacts that a forensic analysis of an affected ICS device can recover to help diagnose an attack. An ICS test lab was implemented and used to examine the common attacks. A menu driven set of forensic tools specific for ICS was developed to allow the extraction and analysis of the resulting attack vector.

Today's digital forensics software tools mostly do not offer automatic analysis methods to reveal evidences among huge amounts of digital files within hard disk images. It is important that finding evidence in digital and cyber forensics investigations as soon as possible by examining hard disk images. E-mails constitute a rich source of information in hard disk images, and they are the most possible data source to obtain an evidence. The analyzers search e-mail files by manually or using traditional methods in order to find an evidence. However, this operation could take a long time due to the size of the e-mail data which can contain a huge number of files and a huge volume of data. This study introduces an end-to-end distributed graph analysis framework for large-scale digital forensic datasets, and evaluates the accuracy of the centrality algorithms and the scalability of the proposed framework in terms of running time performance. The framework is comprised of specific processes to perform pre-processing, graph building, and algorithm activities. An architecture is introduced based on distributed big data techniques. Three different centrality algorithms are implemented to analyze the accuracy of our framework. Further, three implementations are provided to demonstrate the running time performance of our framework. Experiments are performed on Enron e-mail dataset to analyze the centrality algorithms, to evaluate the performance of the framework, and to compare the running times between the traditional approach and our approach. Moreover, the running time performance of the framework is evaluated under various parallelization level. The accuracy of the results is also evaluated and compared between the centrality algorithms. The comparison shows that some certain algorithms provide more accurate results and it is possible to improve the running time by orders of magnitude utilizing our end-to-end distributed graph analysis approach.

Android smartphones are becoming more and more popular each year. With this increased user base, comes an increased need for Android OS to protect its users from malicious applications that may violate users' privacy. The Google Play Store is the main means of dissemination for new applications and as such should provide a layer of efficient protection against malicious applications. However, there have been times when malicious applications were allowed on the Play Store, even after the introduction of the recent Play Protect Service. In this paper, we have opted to investigate the efficiency of the Play Protect Service in detecting malicious applications that are both sideloaded onto a device and uploaded directly to the Play Store. In order to accomplish this, we have developed a spyware application, called InstaCam, that is advertised as a simple camera app. However, it asks for functionally unnecessary permissions that make it a practically dangerous app. We tested InstaCam against various antivirus applications, including Play Protect. The results show that there is substantial delay in the ability of Play Protect to detect our malicious application while other popular antivirus software is capable of detecting InstaCam in a timelier manner.

Traditional hard disk drives (HDD) are gradually being substituted by new non-mechanical storage media called solid-state drive (SSD) as they are lighter, faster, and more reliable alternatives. Companies have already started to use SSD in their products but the downside they are facing is its substantial price for less storage capacity. When it comes to performing forensic analysis on SSD, the autonomous behavior of the media makes it look less promising compared to the traditional hard disk drives. With wear-leveling on the go, the persistence of deleted data is always in question. The deleted data can stay on the media either partially or wholly and is dependent on various factors including file system, make and model, and the operating systems running to name a few. In this research, we analyzed the behavior of wear-leveling with NTFS file system on triple-level cell (TLC) serial-ATA (SATA) SSD as the primary storage device. The aim of this paper is to give a detailed comparison of wear-leveling with TRIM ON and TRIM OFF states effecting different file types. Our research work will help in providing a benchmark for digital forensics investigators who are constantly troubled by the thought of examining SSD.

Encryption is the process of encoding data in a way that prevents unauthorized access. Encryption is commonly applied in two ways. One is to encrypt the entire disk storage. This type of encryption can only be effective when the system is stopped, or the drive ejected. Another one is called granular encryption, which encrypts specific data at different granularity levels while the application is running. Although many granular encryption methods have been proposed, data security has not been fully achieved. In this paper, we propose a novel pixel-based granular encryption method to better protect sensitive user data in database systems. Our experimental results show that the proposed encryption method is not only more secure, but also generally faster than other existing text-based encryption methods, and it takes less time to encrypt long digits of data.

The analysis of database artifacts can provide a wealth of information about a suspected database intrusion. A key part of this analysis is the ability to reconstruct the actions of the intruder in order to identify any data that was compromised or any modifications that took place. This research paper identifies some of the core concepts behind forensic reconstruction, and then provides a summary of current research efforts within forensic database reconstruction including the concept of the ideal log setting, a forensically aware database logging method, and the use of relational algebra and internal log structures for the reconstruction of databases.