Digital Forensics

Mobile phone proliferation in our societies is on the increase. Advances in semiconductor technologies related to mobile phones and the increase of computing power of mobile phones led to an increase of functionality of mobile phones while keeping the size of such devices small enough to fit in a pocket. This led mobile phones to become portable data carriers. This in turn increased the potential for data stored on mobile phone handsets to be used as evidence in civil or criminal cases. This paper examines the nature of some of the newer pieces of information that can become potential evidence on mobile phones. It also discusses some of the emerging technologies and their potential impact on mobile phone based evidence. The paper will also cover some of the inherent differences between mobile phone forensics and computer forensics. It also highlights some of the weaknesses of mobile forensic toolkits and procedures. Finally, the paper shows the need for more in depth examination of mobile phone evidence.

Russian hybrid warfare has become the principle threat to NATO over the last decade. From the Baltic Sea to the Black Sea, Russia has exercised its will across Europe; inciting tensions while limiting its activities to below the Article 5 threshold, an armed attack on one is an attack on all. The balance of power favors those who embrace inevitable technological advancement while enduring the discomfort presented by its evolution. Hybrid warfare creates complex problems requiring an unconventional mindset and while NATO Special Operations (NSOF) inherently possess this trait and are rightly-suited to contribute to NATO’s counter-hybrid strategy, little research examines how NSOF tactical activities can deliver strategic effects through the exploitation of technology. This capstone collates expansive research on Russian gray zone activities of hybrid warfare, NATO’s cyber deterrence and counter hybrid threat strategy, and NSOF’s doctrine and capabilities, to present a focused area for capability enhancement of Special Operations Forces (SOF). NSOF’s embrace of Technical Exploitation Operations (TEO) facilitated evidence-based operations in Afghanistan with great success and subsequently led to the establishment of TEO programs in Alliance nations. However, sub-disciplines like biometrics have received preference over data-rich sources like digital media, cellular phones, and other more complex exploitation forms. An appreciation of the value of digital artifacts and their ability to illuminate hybrid warfare and gray zone activities, intent, and attribution is necessary to accurately position NSOF in NATO’s cybersecurity and hybrid warfare framework.

Keywords: Cybersecurity, Dr. Christopher Riddell, hybrid warfare, gray zone activities, drone forensics.

Smart phones are one of the most troublesome technologies that exist today and steadily gaining popularity with better connectivity, functionality and productivity. The ever-increasing complexity of these smart phones gives a new level of threats. Android is one of the newer operating systems based on smart phones, is emerging as a significant force within the highly competitive smart phone market. Android phones stores an enormous amount of data that can be stored locally or remotely and allows forensic analysts to acquire these data and evidence, collecting this valuable information with regard to the investigation. There are number of forensic tools both open source and closed source are available in the market for the purpose of extracting data from the Android devices.

The key focus of this paper is to evaluate the performances of extracting tools that support the Android phones. This research project reviews the literature in the field of digital forensic and methods of retrieving data and discusses the criteria and methodology to be achieved for a meaningful evaluation. Three different software tools are evaluated along with the manual method of extraction on two Android phones. The actual forensic data within the mobile devices were identified and counted. All the three software tools were tested on both phones, to find out how much data can be extracted and these results were compared and evaluated based on the actual data on the phones.


T

This study discusses how to build an automatic fish feeder machine based on microcontroller AT89S52. Machine or the tool will be able to work automatically according to the schedule specified by the user. So it will be very flexible which fish farmers will be able to set a schedule to feed the fish in accordance with the appropriate time. This tool was built with the aim to alleviate the fish farmers work to do with feeding the fish.

The massacre of the protesters and the police during the “Euromaidan” mass protests on February 18-20, 2014 in Ukraine contributed to the overthrow of the Ukrainian government and ultimately to a start of the civil war in Donbas, Russian military interventions in Crimea and Donbas, the annexation of Crimea and an international conflict between the West and Russia. However, in spite of its importance to the politics of Ukraine and global politics this mass killing have been central subject of only a couple of studies. These studies concluded that the Maidan massacre of the protesters was a false flag operation and that far right organizations were involved in the mass killing of both police and the protesters. However, the dominant narrative promoted by the governments and the media in Ukraine and the West attributed the Maidan massacre of the protesters to the government forces and mostly ignored killings of the police. The official investigation by the Prosecutor General Office of Ukraine charged Berkut special police commanders and members with the massacre of the Madian protesters on Viktor Yanukovych orders and publicly stated that Berkut policemen and Internal Troops servicemen were killed by unknown persons of unknown allegiance.

The research question is as follows: What does a large volume of various evidence made public for the first time by the Maidan massacre trials and government investigations reveal about which of the political forces were involved in this politically crucial case of mass killing? This paper analyzes more than 350 hours of video recordings of the Maidan massacre trials and information concerning investigations of this massacre in over 2,000 official court decisions in Ukraine, media interviews of prosecutors, Maidan and Berkut lawyers, and Ukrainian media reports about these trials and investigations. It examines court testimonies of wounded protesters and relatives of the killed protesters, results of forensic ballistic and medical examinations and investigative experiments, and videos and photos of the Maidan massacre shown during the trials. A video appendix includes brief relevant videos of the Maidan massacre and information from the recordings of the Maidan massacre trial. The 55 minute long online video appendix with added English-language subtitles is compiled from brief synchronized segments of on-site reports by American, Belgian, Belarusian, British, Finish, French, Dutch, German, Polish, Russian, Spanish, and Ukrainian TV correspondents and social media videos by various Maidan protesters who filmed this massacre on February 20, 2014.

The study finds that the Maidan massacre investigations and trials revealed a variety of evidence, such as results of forensic examinations and testimonies of many wounded protesters, which shows that at least the absolute majority of the protesters were killed and wounded from Maidan-controlled locations and that the investigation and trials were for this reason stonewalled. The analysis  shows patterns of ineffective and delayed Maidan massacre trials and the GPU investigations, trumped-up charges, and ignoring, reversing, and covering-up of the evidence, which was revealed by the GPU own investigation and which pointed to the massacre of the protesters and the police by “snipers” in the Maidan-controlled buildings and not by the Berkut police. The paper discusses implications of this study for understanding the Maidan massacre and the conflict in Ukraine and the international conflict over Ukraine.

Crimes committed within electronic or digital domains, particularly within cyberspace, have become extremely common these days. Criminals are using technology to a great extent in committing various digital offences and creating new challenges for law enforcement agents, attorneys, judges, military, and security professionals. Digital forensics has become an incredible useful and invaluable tool in the detection of criminal activities, identifying and solving computer-based and computer-assisted crimes. This paper provides a brief introduction to digital forensics.

Perubahan dunia akibat penggunaan gadget/barang elektronik yang tiap hari terus berkembang membawa dampak dimana manusia seakan hidup di dunia virtual yang segalanya bisa dilakukan menggunakan barang-barang elektronik tersebut. Dunia digital yang membuat segala sesuatunya semakin mudah dan efisien membuat pola hidup manusia berubah seiring dengan perkembangan elektronik yang semakin canggih. Banyak hal yang bisa dilakukan menggunakan barang-barang elektronik, apalagi perangkat tersebut sudah terkoneksi dengan internet, maka segala pekerjaan, transaksi jual beli, transaksi keuangan dan aktivitas lainnya bisa dilakukan hanya menggunakan perangkat mobile electronic, misal handphone atau laptop. Namun, dibalik kemudahan tersebut, terdapat celah yang bisa dimanfaatkan oleh orang-orang yang tidak bertanggung jawab untuk mengambil keuntungan yang dapat merugikan orang lain melalui perangkat elektronik/internet, biasa disebut tindak kejahatan dunia maya atau lebih dikenal cyber crime. Merujuk pada pernyataan Dr. Edmond Locard yang terkenal dengan Locard's Exchange Principle yang menyebutkan "every contact leaves a trace" yang artinya "setiap kontak meninggalkan jejak" dan dari jejakjejak yang ditinggalkan akan dapat terlacak. Prinsip tersebut juga berlaku dalam dunia digital, bahwa kejahatan yang dilakukan di dunia digital/internet akan meninggalkan jejak yang nantinya dapat ditelusuri sumber kejahatan sehingga menghasilkan rekonstruksi bagaimana kejahatan tersebut bisa terjadi sehingga mengarah pada suatu kesimpulan darimana kejahatan itu berasal dan siapa pelakunya, itulah inti dari adanya digital forensic atau disebut juga computer forensic.

The integration of strong encryption into operating systems is creating challenges for forensic examiners, potentially preventing us from recovering any digital evidence from a computer. Because strong encryption cannot be circumvented without a key or passphrase, forensic examiners may not be able to access data after a computer is shut down, and must decide whether to perform a live forensic acquisition. In addition, with encryption becoming integrated into the operating system, in some cases, virtualization is the most effective approach to performing a forensic examination of a system with FDE. This paper presents the evolution of full disk encryption (FDE) and its impact on digital forensics. Furthermore, by demonstrating how full disk encryption has been dealt with in past investigations, this paper provides forensics examiners with practical techniques for recovering evidence that would otherwise be inaccessible.

Este artigo apresenta os impactos da realidade digital no acesso à informação e avalia a interoperabilidade da informação arquivística e os padrões que visam estruturá-la. Analisa a padronização da informação originada pela estrutura documental, sua relação orgânica e a Descrição Arquivística para associar com a definição e a gestão de metadados na preservação digital. Conclui que a criação de ontologias originadas por processos descritivos normatizados evidencia a informação arquivística e a padroniza, em forma de metadados, permitindo sua interoperabilidade por meio de plataformas e diferentes sistemas digitais.

Originalmente publicado em http://www.aaerj.org.br/ojs/index.php/informacaoarquivistica/article/view/139

The Internet of Things (IoT), a metaphor for smart, functional Cyberphysical Environments (CPE) is finding some usefulness in various sectors including healthcare, security, transportation and the Smart Home (SH). Within the IoT, objects potentially operate autonomously to provide specified services and complete assigned tasks. However, the introduction of new technologies and/or the novel application of existing ones usually herald the discovery of unfamiliar security vulnerabilities which lead to exploits and sometimes to security breaches. There is existing research which identifies IoT-related security concerns and breaches. This chapter discusses existing Digital Forensics (DF) models and methodologies for their applicability (or not) within the IoT domain using the SH as a case in point. The chapter also makes the argument for Smart forensics, the use of a smart autonomous system (tagged the Forensics Edge Management System (FEMS)) to provide forensic services within the self-managed CPE of the SH.

Dentro del proceso investigativo en delitos cibernéticos, todos los hallazgos encontrados vienen hacer parte fundamental de la investigación, los mismos que son tratados en el "Computer Crime Scene" como evidencia; la identificación, adquisición, seguridad y transportación como lo menciona (NIJ, 2008), son principios que deben sujetarse al apego y respeto a las leyes establecidas en "The Electronic Communication Privacy Act of 1986", "Privacy Protection Act of 1980", o a la misma "Cuarta Enmienda" donde se establece los criterios de respeto a los derechos constitucionales como lo explica (Salas, 2012), "La cuarta enmienda limita la capacidad del agente del gobierno para buscar y obtener pruebas sin una orden judicial, la Cuarta Enmienda establece: "The right of the people to be secure in their person, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issues, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized ". Estableciendo así un principio de legitimidad en cuando al uso correcto en la extracción y manejo de evidencia digital sin afectar los derechos de los ciudadanos.
Este trabajo tiene como objetivo establecer los lineamientos y normas establecidas por el Gobierno Federal en cuanto al correcto uso de los métodos de investigación y exanimación Forense dentro de una escena en delitos cibernéticos. Apegarnos a las normas y protocolos definirá nuestro trabajo como investigadores y examinadores forenses.

Digital forensics is an important and growing forensic domain. Research on miscarriages of justice and misleading evidence, as well as various inquires in the UK and the US, have highlighted human error as an issue within forensic science. This has led to increased attention to the sources of cognitive bias and potential countermeasures within many forensic disciplines. However, the area of digital forensics has yet to pay sufficient attention to this issue. The main goal of this article is to contribute to a more scientifically sound digital forensics domain by addressing the issues of cognitive bias as a source of error. In this paper we present an analysis of seven sources of cognitive and human error specifically within the digital forensics process, and discuss relevant countermeasures. We conclude that although some cognitive and bias issues are very similar across forensic domains, others are different and dependent on the specific characteristic of the domain in question, such as digital forensics. There is a need for new directions in research with regard to cognitive and human factors in digital forensics.

This study analyses the use and development of Digital Forensic case studies for the purpose of teaching and assessing Digital Forensics students and practitioners. Within this study, case studies are categorised and a number of available case studies are explored. The importance of evidentiary and non-evidentiary artefacts within the case study are examined. Mechanisms for integrating case study development and/or investigation with student assessment are proposed, the benefits and the challenges of this approach are examined. Practical and technical issues involved in the development of case studies are examined. The study concludes by proposing guidelines for the development of Digital Forensic case studies.

Please cite as follows: Lallie H., (2010), Developing Usable hard disk images for Forensic training, education and research, 4th International Conference on Cybercrime Forensics Education and Training, Canterbury Christchurch University

Secure communication is a necessity that must be considered in any smart application to guarantee the confidentiality of information. Recently, ZigBee has been utilized in different smart applications such as automatic metering, power fraud detection, industrial automation and many more. In this research paper, we evaluate the performance of ZigBee from a security perspective. We explore the ZigBee built-in security services, encryption techniques, security keys, and the trust center. The research findings serve as guidelines to focus on wireless communication security in general and on the ZigBee security issues in specific. There is a crucial need to fill in the gap where ZigBee has low-complexity processing capabilities and the need to integrate more robust enhancements and security controls.

The extraordinary development of mobile communications is a source of new security challenges. Today, mobile phones have become ubiquitous in nature involving their use in many daily activities, and sometimes those activities might be criminal in nature. The remarkable advancements in the technology and increase in computing power of these devices over last few years, has led to an increase of their functionality while keeping the size of such devices small enough to fit in a pocket. The use of mobile phones in criminal activities has led to the need of recovering the digital evidence data in them for the further investigations. It is therefore essential for investigators to be able to extract digital evidence quickly and accurately. The digital forensic examiner must know how to preserve and acquire digital evidence effectively from mobile devices. This paper provides an overview of digital evidence preservation issues, relevant solutions for digital forensics examiners, and tips for successful preservation of digital evidence on mobile devices.

Portable web browsers are installed on removable storage devices which can be taken by a user from computer to computer. One of the claimed benefits of portable web browsers is enhanced privacy, through minimization of the traces of browsing activity left on the host's hard disk. On the basis of this claim, it would appear that portable web browsers pose a challenge to forensic examiners trying to reconstruct past web browsing activity in the context of a digital investigation. The research examines one popular portable web browser, Google Chrome in both normal and private browsing mode, and compares the forensic traces of its use to forensic traces of the installed version of the same browser. The results show that Google Chrome Portable leaves traces of web browsing activity on the host computer's hard disk, and demonstrate a need for forensic testing of the privacy claims made for the use of portable web browsers.

I was recently asked to conduct research on the development of digital forensics with regard admissibility of evidence in a court of law. Digital forensics is a dynamic field growing at a fast pace. As such there's is need for laws and policies to accommodate the growning need. My research focuses primarily on Kenya, a country that was recently acknowldegd for its tech not innovations and growth of the IT industry.

—The field of digital forensic analysis has emerged in the past two decades to counter the digital crimes and investigate the modus operandi of the culprits to secure the computer systems. With the advances in technologies and pervasive nature of the computing devices, the digital forensic analysis is becoming a challenging task. Due to ease of digital equipment and popularity of Internet, criminals have been enticed to carry out digital crimes. Digital forensic is aimed to investigate the criminal activity and bring the culprits to justice. Traditionally the static analysis is used to investigate about an incident but due to a lot of issues related the accuracy and authenticity of the static analysis, the live digital forensic analysis shows an investigator a more complete picture of memory dump. In this paper, we introduce a module for profiling behavior of application programs. Profiling of application is helpful in forensic analysis as one can easily analyze the compromised system. Profiling is also helpful to the investigator in conducting malware analysis as well as debugging a system. The concept of our model is to trace the unique process name, loaded services and called modules of the target system and store it in a database for future forensic and malware analysis. We used VMware workstation version 9.0 on Windows 7 platform so that we can get the detailed and clean image of the current state of the system. The profile of the target application includes the process name, modules and services which are specific to an application program.

Digital evidence is becoming an integral part of
most cases presented to court. From computers, to
mobile phones, ATMs and surveillance cameras,
our daily life is so inextricably entwined with
technology that it is difficult to find court cases
where technology plays no part. Thus the
responsibility placed on a Digital Forensics (DF)
practitioner to present usable evidence to a court is
increasing fast. However, potential criminals have
equally compelling reasons to prevent DF
practitioners from getting their hands on
information of probative value and use tools and
methods known as Anti-Forensics (AF).
The purpose of this study is to identify the abilities
of DF practitioners to identify the impact that AF
has on their active investigations. We created a
research model that attempts to identify all the
factors and constructs that impact the AF
phenomenon. This model was then used to develop
a survey instrument to gather empirical data from
South African DFs.
We found that whilst South African DF
practitioners perceive DF as having an impact on
their investigations, they also perceive electronic
evidence as forming only part of the evidence
presented to court, and that some usable evidence
will generally remain. Unfortunately, we found also
that most DF practitioners in South Africa are well
versed only in the more commonly known AF
techniques whilst not rating their abilities on more
complex techniques well. Finally, most DF
practitioners appear not to actively attempt to
identify AF techniques as part of their
investigations. This combined with a lack of
understanding of more complex AF techniques
could leave South African DF practitioners exposed
by missing important evidence due to lack of
technical proficiency. The research and its findings
should be of benefit to academia and practicing DF
investigators with a view to assisting them better
prepare for the onslaught of AF.

Seiring dengan perkembangan teknologi internet, menyebabkan munculnya kejahatan yang disebut “CyberCrime” atau kejahatan melalui jaringan internet. Munculnya beberapa kasus “CyberCrime” di Indonesia, seperti pencurian kartu kresit, hacking beberapa situs, menyadap transmisi data orang lain, misnya email, dan manipulasi data dengan cara menyiapkan perintah yang tidak dikehendaki kedalam programmer computer. Sehingga dalam computer dimungkinkan adanya delik formil dan delik materil. Delik formil adalah  perbuatan seseorang yang memasuki computer oaring lain tanpa ijin, sedangkan delik materil adalah perbuatan yang menimbulkan akibat kerugian bagi orang lain. Adanya cybercrime telah menjadi ancaman stabilitas, sehongga pemerintah sulit mengimbangi kejahatan yang dilakukan dengan teknologi computer.
Khususnya jaringan internet dan intranet. Pengamanan secara teknis disertai dengan social pressure. Adanya banyak orang mengawasi membuat seseorang mengurungkan diri untuk melakukan kejahatan. Pendidikan etika dan moral nampaknya harus kita aktifkan kembali, khususnya untuk dunia cyberspace.
Dalam sebuah kasus kejahatan yang paling penting di siapkan yaitu barang bukti begitu juga pada kejahatan yang melibatkan alat teknologi informasi. Barang bukti sangat penting akan keberadaannya karena Barang Bukti mengarah pada proses bagaimana, siapa, dan dimana pelaku melakukannya dan tidak hanya hal Teknis saja, tapi barang bukti mempengaruhi hasil dipengadilan nantinya. Untuk itu sangat perlu memperhatikan perubahan disetiap tahap dalam proses analisa forensik yang kita kembangkan. Dalam dunia komputer dan internet, tindakan kejahatan juga akan melalui proses yang sama. Proses kejahatan yang dilakukan tersangka terhadap korbannya juga akan mengandalkan bantuan aspek pendukung dan juga akan saling melakukan pertukaran atribut. Namun dalam kasus ini aspek pendukung, media, dan atribut khas para pelakunya adalah semua yang berhubungan dengan sistem komputerisasi dan komunikasi digital. Atribut-atribut khas serta identitas dalam sebuah proses kejahatan dalam dunia komputer dan internet inilah yang disebut dengan bukti-bukti digital.

The paper explores the application of digital forensics techniques to cyber
warfare scenarios. A common accepted taxonomy for digital forensics (and anti-
forensics) activities, techniques, procedures and work flows does not yet exist
but guidelines and even international standards have given the field a framework:
this paper explores how digital forensics can be logically framed in the context
of cyber warfare.
The attribution of a cyber attack is widely considered a fundamental aspect to be
resolved before the formulation of every cyber strategy by nation-states. Digital
forensics procedures and protocols established in civilian contexts can be
adopted by military and intelligence bodies.
The paper explores the field of digital forensics as applied to cyber warfare,
mainly for defensive and intelligence operations. It proposed a taxonomy for
digital forensics activities and on the time dimension how it is applied to the
phases of forensic operations: prioritization, collection, acquisition, analysis,
interpretation, reporting/dissemination, detailing a model that tailors techniques
to military context, giving also a review of existing literature. Defensive and
intelligence activities also need knowledge of the range of anti-forensics
techniques applied by counterparts, so an analysis of the anti-forensics arsenal
and how it correlates with forensics processes is conducted.
In the conclusion the paper shows the cardinal role of digital forensics (post-
attack and in readiness processed) even in military activities and the value of
concepts developed in the civilian world, albeit adapted.

—This paper highlights the challenges faced due to non-availability of trusted specialized forensic tools for conducting investigation on gaming consoles. We have developed a framework to examine existing state-of-the-art forensic acquisition and analysis tools by exploring their applicability to eighth generation gaming consoles such as the Xbox One and PlayStation 4. The framework is used to validate the acquired images, compare the retrieved artifacts before and after restoring the console to the factory settings, and to conduct network forensics on both devices. The paper reveals the need of specialized forensic tools for forensic analysis of these devices.

Software tools designed for disk analysis play a critical role today in digital forensics investigations. However, these digital forensics tools are often difficult to use, usually task specific, and generally require professionally trained users with IT backgrounds. The relevant tools are also often open source requiring additional technical knowledge and proper configuration. This makes it difficult for investigators without some computer science background to easily conduct the needed disk analysis.
In this dissertation, we present AUDIT, a novel automated disk investigation toolkit that supports investigations conducted by non-expert (in IT and disk technology) and expert investigators. Our system design and implementation of AUDIT intelligently integrates open source tools and guides non-IT professionals while requiring minimal technical knowledge about the disk structures and file systems of the target disk image. We also present a new hierarchical disk investigation model which leads AUDIT to systematically examine the disk in its totality based on its physical and logical structures. AUDIT's capabilities as an intelligent digital assistant are evaluated through a series of experiments comparing it with a human investigator as well as against standard benchmark disk images.

Dalam buku ini pembahasan pertama kali yaitu tentang pengenalan forensik secara umum dan mengetahui jenis-jenis forensik. Setelah pengenalan forensik secara umum, pembaca selanjutnya akan mengetahui apa itu forensika digital dan perkembangannya. Baru kemudian belajar mengenai prinsip-prinsip dalam forensika digital dilakukan, seperti apa managemen investigasi yang baik, hal-hal penting apa saja yang harus dilakukan dalam forensika digital, bagaimana proses pencarian bukti digital, keabsahan bukti digital dalam undang-undang, praktek tentang bagaimana menggunakan tools forensik, bagaimana membuat laporan hasil investigasi forensika digital, mengenal tentang bagaimana menjadi saksi ahli di persidangan, dan juga mengenali apa itu anti forensik.

ISBN : 978-602-336-205-9
https://diandracreative.com/produk/belajar-mengenal-forensika-digital/

https://isbn.perpusnas.go.id/Account/SearchBuku?searchCat=Pengarang&searchTxt=didik+sudyana

Standards and certifications. Certifications are a good way to develop investigators' skills. This has is already successfully applied in other computer fields, such as computer security . A small number of certifications -such as the Certified Forensic Analyst [8] certification, which is provided by the Global Information Assurance Certification (GIAV) founded by the SANS Institute -are available. Nonetheless, certifications and standards are not only applicable to investigators.

Menjamurnya barang-barang elektronik seperti handphone, komputer, tablet, flashdisk dan lain-lain semakin hari kian merata pada kalangan masyarakat, hampir semua lapisan masyarajat memiliki perangkat elektronik untuk mempermudah komunikasi dan untuk kebutuhan sehari-hari, baik dipergunakan secara positif maupun negatif, salah satu penggunaan negatif barang elektronik ialah melakukan tindak kejahatan, baik kejahatan konvensional yang dipadu dengan penggunaan barang elektronik(computer related-crime) maupun kejahatan digital (computer crime) yang perbuatannya sepenuhnya menggunakan barang elektronik. Dalam tindak kejahatan konvensional maupun digital, pelaku bisa menggunakan teknik manipulasi barang bukti untuk menghilangkan bukti atau mempersulit Investigator melacak keberadaan pelaku, namun para Investigator juga mempunyai teknik menemukan barang bukti untuk mengendus motif kejahatan dan keberadaan si Pelaku.

Wireless Local Area Networks (WLANs) are gaining popularity as they are fast, cost effective, flexible and easy to use. They are, however, faced with some serious security challenges and the choice of security protocol is a critical issue for IT administrators.

Organised crime, as well as individual criminals, is benefiting from the protection of private browsers provide to those who would carry out illegal activity, such as money laundering, drug trafficking, the online exchange of child-abuse material, etc. The protection afforded to users of the Epic Privacy Browser illustrates these benefits. This browser is currently in use in approximately 180 countries worldwide. This paper outlines the location and type of evidence available through live and post-mortem state analyses of the Epic Privacy Browser. This study identifies the manner in which the browser functions during use, where evidence can be recovered after use, as well as the tools and effective presentation of the recovered material.

This thesis focuses on the development, implementation and optimization of pattern-matching algorithms in two different, yet closely-related research fields: malicious code detection in intrusion detection systems and digital forensics (with a special focus on the data recovery process and the metadata collection stages it involves). The thesis introduces the motivational backgrounds for the development of the work, later on presents the related work and then continues with the main achievements obtained, while in the end a few conclusions and future research directions are discussed.

The main four chapters in this thesis show the main contributions of our work and address the following topics: we present an efficient storage mechanism for hybrid CPU/GPU-based systems, and compare it with other known approaches to date. We then propose an innovative, highly parallel approach to the fast construction of very large Aho-Corasick and Commentz-Walter pattern matching automata on hybrid CPU/GPU-based systems, and compare it to existing sequential approaches. Later on we propose a new heuristics for profiling malicious behavior based on system-call analysis, using the Aho-Corasick algorithm, and also discuss a new hybrid compression mechanism for this automata based on dynamic programming, that reduces the storage space required for it. Finally, we propose an efficient new method for collecting metadata and helping the human operator or automated tools used in the data recovery process as part of the computer forensic investigations.

The research and models obtained in this thesis extend the existing literature in the field of intrusion detection systems (malicious code detection in particular), by presenting: an innovative heuristics for behavioral analysis of code in executable files through system-call interception, a novel and highly efficient approach to efficiently storing pattern-matching automata in hybrid CPU/GPU-based systems, which serves as the base for an innovative model for the fast, GPU-accelerated construction of such very large automata (for both the Aho-Corasick and Commentz-Walter algorithms) and a new hybrid compression technique applied to the Aho-Corasick automata using a dynamic programming approach, that reduces storage space significantly.