Towards a Process Model for Hash Functions in Digital Forensics

2014 ◽  
pp. 170-186
Author(s):  
Frank Breitinger ◽  
Huajian Liu ◽  
Christian Winter ◽  
Harald Baier ◽  
Alexey Rybalchenko ◽  
...  
Keyword(s):  
Process Model ◽  
Digital Forensics ◽  
Hash Functions

Digital Forensics Laboratory Process Model

2015 ◽  
pp. 61-69
Author(s):  
Jiří Hájek ◽  
Ondřej Hykš ◽  
Karel Koliš ◽  
Jaromír Veber
Keyword(s):  
Process Model ◽  
Digital Forensics

Towards automated preprocessing of bulk data in digital forensic investigations using hash functions

2015 ◽  
Vol 57 (6) ◽  
Author(s):  
Harald Baier
Keyword(s):  
Data Structures ◽  
Digital Forensics ◽  
Hash Functions ◽  
Site Investigation ◽  
Process Models ◽  
Approximate Matching ◽  
Digital Forensic ◽  
Bulk Data ◽  
Digital Forensic Investigations ◽  
Cryptographic Hash Functions

AbstractHandling bulk data (e. g. some terabytes of data) is a issue in contemporary digital forensics. Separating relevant data structures from irrelevant ones resembles finding the needle in the haystack. The article at hand presents and assesses automatic hash-based techniques to preprocess the input data with the goal to facilitate the investigator's job. We discuss concepts like blacklisting and whitelisting based on cryptographic hash functions and approximate matching, respectively. In case of two established process models for a lab and an on-site investigation, respectively, we describe how to jointly use these techniques to automatically get a pointer to the needle.

scholarly journals DEEP: Extending the Digital Forensics Process Model for Criminal Investigations

2020 ◽  
Vol 7 (4) ◽  
pp. 225-240
Author(s):  
Jan Collie ◽  
Richard E Overill
Keyword(s):  
Process Model ◽  
Digital Forensics ◽  
Criminal Investigations

scholarly journals Pendekatan Model Bisnis Untuk Pemetaan Triage Forensics

EXPLORE ◽  
2020 ◽  
Vol 10 (2) ◽  
Author(s):  
Subektiningsih Subektiningsih
Keyword(s):  
Process Model ◽  
Digital Forensics

Prinsip dasar forensik triase digital sama dengan triase medis, dalam bentuk pemilihan pasien yang diprioritaskan untuk perawatan. Mirip dengan forensik triase digital yang memilah bukti potensial untuk diperoleh informasi yang relevan dan tentukan urutan investigasi. Forensik triase digital dimaksudkan untuk mempercepat pengumpulan dan pemeriksaan bukti di TKP karena waktu sangat penting dalam penyelidikan. Waktu dapat mempengaruhi kondisi bukti dan insiden, sehingga diperlukan prosedur untuk meminimalkan insiden, serangan, atau ancaman untuk merusak bukti. Forensik triase digital diterapkan sesuai dengan kondisi insiden yang terjadi di TKP, yang berkorelasi dengan personil atau aktor yang melakukan investigasi, bukti-bukti yang diperoleh, serta kehadiran pihak-pihak terkait dan kemudian dapat ditempatkan di Triage Digital Forensics Model (TDFM). Pemetaan komponen forensik triase digital menggunakan Bisnis Process Model and Notation (BPMN) untuk menunjukkan interaksi yang terjadi dan menggambarkan proses itu harus dieksekusi. TDFM terdiri dari serangkaian proses dalam melakukan forensik triase digital yang dimulai dengan penyelidikan di Scene Kasus, diikuti dengan mengumpulkan bukti fisik / bukti elektronik untuk ekstraksi data investigasi. Proses selanjutnya adalah melakukan pemeriksaan untuk menentukan ambang batas bukti untuk diperiksa lebih lanjut, disimpan, atau dikembalikan. Akhirnya, prosesnya berkaitan dengan para pihak terkait dengan insiden / serangan yang sedang diselidiki. Bagian ini dalam bentuk pengiriman hasil investigasi, koordinasi, observasi, dan kontrol. Kriteria prioritas TDFM adalah keberadaannya bukti, jenis serangan / kejadian kondisi di tempat kejadian, penilaian resolusi kasus berdasarkan daftar kasus yang telah berhasil diselesaikan (daftar sebelumnya). Pemetaan dan validasi ini TDFM menggunakan Bizagi Modeller. Validasi elemen bertujuan untuk memastikan penggunaan elemen yang benar sesuai dengan Aturan BPMN. Validasi proses juga dilakukan untuk melihat kesesuaian alur proses. Fokus pada Penentuan prioritas penyelidikan ini bersifat subyektif karena tergantung pada kemampuan dan pengalaman aktor / personel. TDFM diharapkan menjadi referensi untuk melakukan investigasi yang membutuhkan langsung tindakan forensik atau mati forensik.

scholarly journals Manajemen Pengelolaan Bukti Digital Untuk Meningkatkan Aksesibilitas Pada Masa Pandemi Covid-19

2021 ◽  
Vol 19 (1) ◽  
pp. 27
Author(s):  
Moch Bagoes Pakarti ◽  
Dhomas Hatta Fudholi ◽  
Yudi Prayudi
Keyword(s):  
Management System ◽  
Digital Forensics ◽  
Current Problem ◽  
Human Life ◽  
Hash Functions ◽  
Digital Evidence ◽  
Chain Of Custody

Covid-19 has a major impact on human life, including the process of managing digital evidence. Management of digital evidence requires special handling that can store and maintain the integrity of digital evidence. The current problem is there is no concept of storing digital evidence that can be accessed online in wider accessibility. Online digital evidence management is proposed as a solution to solve this problem. This concept is in the form of an online digital evidence management system that can be accessed anywhere and anytime using MD5 and SHA1 hash functions in order to maintain the properties of digital evidence so that it can be legally accepted. The problems with digital evidence management require a Management System for Digital Evidence that is suitable for application in Digital Forensics Laboratory. This research had successfully implemented the concept of online chain of custody. It is expected, with the concept of Online Digital Evidence Management, this digital evidence control and all activities related to it can be maintained and well documented. Moreover, it can reach a wider area accessed anywhere and any time and reduce the spread of Covid-19.

scholarly journals The Emergence of Cloud Storage and the Need for a New Digital Forensic Process Model

2013 ◽  
pp. 79-104 ◽  
Author(s):  
Richard Adams
Keyword(s):  
Cloud Computing ◽  
Process Model ◽  
Digital Forensics ◽  
New Technology ◽  
Personal Data ◽  
Digital Evidence ◽  
Digital Forensic ◽  
Standards Of Practice ◽  
High Level ◽  
Level Process

Cloud computing is just one of many recent technologies that have highlighted shortcomings in the development of formal digital forensic processes, which up until now have been focused on a particular group of practitioners, such as law enforcement, and have been too high-level to be of significant practical use, or have been too detailed and specific to accommodate new technology as it emerges. Because the tools and procedures employed by digital forensic practitioners are generally outside the knowledge and understanding of the courts, they need to be described in such a way that they can be understood by the layperson. In addition, they should also conform to some standards of practice and be recognised by other practitioners working in the field (Armstrong, 2003; Kessler, 2010). Unfortunately, as Cohen (2011) points out, the whole field of digital forensics lacks consensus in fundamental aspects of its activities in terms of methodology and procedures. There has been a lot of activity around different aspects of cloud computing, and in Australia this has centered on the protection of personal data (Solomon, 2010). On an international scale, there have been several articles written by lawyers (Gillespie, 2012; Hutz, 2012; Kunick, 2012) discussing other legal considerations of accessing data in the cloud; however, this chapter looks at the issues surrounding digital evidence acquisition and introduces a new high-level process model that can assist digital forensic practitioners when it comes to presenting evidence in court that originated in the cloud.

Sign in / Sign up

Export Citation Format

Share Document