Advances in Digital Forensics XIX: 19th IFIP WG 11.9 International Conference, ICDF 2023, Arlington, Virginia, USA, January 30-31, 2023, Revised ... and Communication Technology, 687)

Digital forensics deals with the acquisition, preservation, examination, analysis and presentation of electronic evidence. Computer networks, cloud computing, smartphones, embedded devices and the Internet of Things have expanded the role of digital forensics beyond traditional computer crime investigations. Practically every crime now involves some aspect of digital evidence; digital forensics provides the techniques and tools to articulate this evidence in legal proceedings. Digital forensics also has myriad intelligence applications; furthermore, it has a vital role in cyber security – investigations of security breaches yield valuable information that can be used to design more secure and resilient systems. This book, Advances in Digital Forensics XIX , is the nineteenth volume in the annual series produced by the IFIP Working Group 11.9 on Digital Forensics, an international community of scientists, engineers and practitioners dedicated to advancing the state of the art of research and practice in digital forensics. The book presents original research results and innovative applications in digital forensics. Also, it highlights some of the major technical and legal issues related to digital evidence and electronic crime investigations. This volume contains fourteen revised and edited chapters based on papers presented at the Nineteenth IFIP WG 11.9 International Conference on Digital Forensics held at SRI International in Arlington, Virginia, USA on January 30-31, 2023. A total of 24 full-length papers were submitted for presentation at the conference. Preface Conference Organization Contents List of Contributors I Mobile Device Forensics Forensic Analysis of the iOS Apple Pay Mobile Payment System 1 Introduction 2 Related Work 3 Experimental Methodology 4 Experiments and Findings 4.1 Experimental Devices 4.2 Apple Pay Application Artifacts 4.3 iOS Artifacts 4.4 Artifacts from Other Applications 4.5 iCloud Backup Artifacts 4.6 Investigative Scenarios 5 Discussion 6 Conclusions References Forensic Analysis of Android Cryptocurrency Wallet Applications 1 Introduction 2 Background 3 Motivating Example 4 Methodology 4.1 Log Message Forensic Analysis 4.2 Filesystem Forensic Analysis 5 Experimental Evaluation 5.1 Log Message Analysis Results 5.2 Filesystem Analysis Results 5.3 Large-Scale Forensic Analysis Results 6 Related Work 6.1 Logging System Analysis 6.2 Taint Analysis 7 Discussion 8 Conclusions References An Anti-Fuzzing Approach for Android Apps 1 Introduction 2 Android App Fuzzing 3 Methodology 3.1 AFuzzShield Overview 3.2 App Fuzzer Patterns 3.3 Real-World Human Patterns 3.4 Differentiating Fuzzer and Human Patterns 4 Evaluation 4.1 Real-World App Performance 4.2 Discussion 5 Related Work 5.1 Android App Fuzzing Techniques 5.2 Android App Anti-Analysis Techniques 6 Conclusions References Nintendo 3DS Forensic Examination Tools 1 Introduction 2 Previous Research 3 Toolset Workflow 4 Artifact Generation 5 Forensic Tool Development 6 Toolset Validation 7 Observations 8 Toolset Evaluation 9 Conclusions References II Forensic Data Collection Revealing Human Attacker Behaviors Using an Adaptive Internet of Things Honeypot Ecosystem 1 Introduction 2 Related Work 3 Adaptive Honeypot Ecosystem 4 Eliciting Rich Attacker Behaviors 4.1 Adapting Shell Services 4.2 Adapting Honeypots to Device Types 4.3 Summary 5 Data Analytics 5.1 Clustering Captured Commands 5.2 Clustering Results 6 Conclusions References Towards Direct-Control Data Acquisition by Nano-Probing Non-Volatile Memory Cells 1 Introduction 2 Background 3 Direct-Control Data Acquisition Workflow 3.1 Method Development Phase 3.2 Method Application Phase 4 Experiments and Results 4.1 Baseline Experiment 4.2 Data Acquisition Experiments 5 Discussion 5.1 Chip Preparation 6 Conclusions References III Image and Video Forensics Using Perceptual Hashing for Targeted Content Scanning 1 Introduction 2 Related Work 3 Perceptual Hashing 3.1 Perceptual Hashing Details 3.2 Perceptual Hash Functions 4 Targeted Content Scanning 5 Attacking PHTCS 5.1 Detection Evasion 5.2 Hash Collision 5.3 Data Leakage 5.4 Evaluation of NeuralHash Detection Evasion 6 Conclusions References Analysis of Document Security Features 1 Introduction 2 Classification of Document Fraud 2.1 Nature-Based Document Fraud 2.2 Methodology-Based Document Fraud 2.3 Quality-Based Document Fraud 3 Security Feature Classification 3.1 Security Feature Types 3.2 Security Feature Inspection Levels 3.3 Security Feature Security Levels 4 Analysis of Security Features 5 Conclusions References Deepfake Detection Using Multiple Facial Features 1 Introduction 2 Related Work 2.1 Deepfake Generation 2.2 Deepfake Video Detection 2.3 Aspect Ratio 3 Deepfake Detection Method 3.1 Data Pre-Processing 3.2 Aspect Ratio Computation 3.3 Classification 4 Experiments and Results 4.1 Datasets 4.2 Parameters 4.3 Comparative Evaluation 4.4 Analysis 5 Discussion 6 Conclusions References IV Novel Applications Identifying Superspreaders by Ranking System Object Instance Graphs 1 Introduction 2 Background 2.1 System Object Dependency Graphs 2.2 System Object Instance Graphs 3 Proposed Approach 3.1 Dependency Rank Generation 3.2 System Object Instance Ranking 4 Implementation 5 Attack Scenario and Results 5.1 Attack Scenario 5.2 Results 6 Related Work 7 Conclusions References A Dynamic Malicious Document Detection Method Based on Multi-Memory Features 1 Introduction 2 Related Work 2.1 Static Analysis Methods 2.2 Dynamic Analysis Methods 3 Proposed Detection Method 3.1 Overview 3.2 High-Coverage Dump Service 4 Experimental Evaluation and Results 4.1 Experimental Dataset 4.2 Experimental Setup 4.3 Evaluation Metrics 4.4 Experiments and Results 5 Conclusions References Traceable Transformer-Based Anomaly Detection for a Water Treatment System 1 Introduction 2 Related Work 3 TTPAD Method 3.1 Data Distribution Based Detection 3.2 Transformer-Encoder Based Detection 4 TTPAD Method Evaluation 4.1 SWaT Dataset 4.2 Evaluation and Results 5 Conclusions References V Legal Issues and Applications Evolution of Global Digital Forensics Laws and Emergent Challenges 1 Introduction 2 Legal and Policy Issues 3 Investigations 4 Legal Provisions on Evidence Admissibility 4.1 United States Legal Provisions 4.2 United Kingdom Legal Provisions 4.3 Indian Legal Provisions 5 Indian Challenges and Solutions 5.1 Agency Challenges 6 Proposed Solutions 7 Enhancing Global Cooperation 8 Conclusions References A Blockchain Model for Sharing Information in Criminal Justice Systems 1 Introduction 2 Background 2.1 Conceptual Model 2.2 Blockchain Technology 3 ShareCrimE Model 3.1 Identifying Users/Agents 3.2 Establishing Applications 3.3 Establishing Services 3.4 Establishing the Blockchain Network 3.5 Integrating Model Components 4 ShareCrimE Model Design 4.1 Information Flows 4.2 Main Channel Sequence Diagram 5 ShareCrimE Prototype Results 6 Evaluation 7 Related Work 8 Conclusions References