All publications by year – Frank Breitinger

114 entries « ‹ 1 of 3 › »

1.	Breitinger, Frank AI and Forensics: Where We Are and the Shape of What’s Next (Miscellaneous) bf Keynote at Fifth ISEA International Conference on Security and Privacy 2026 (ISEA–ISAP 2026), 2026, (IIT Madras, Chennai, India). (BibTeX) @misc{keynote-chennai, title = {AI and Forensics: Where We Are and the Shape of What’s Next}, author = {Frank Breitinger}, year = {2026}, date = {2026-01-17}, howpublished = {bf Keynote at Fifth ISEA International Conference on Security and Privacy 2026 (ISEA–ISAP 2026)}, note = {IIT Madras, Chennai, India}, keywords = {}, pubstate = {published}, tppubtype = {misc} } Close
2.	Vanini, Céline; Hargreaves, Chris; Breitinger, Frank Evaluating tamper resistance of digital forensic artifacts during event reconstruction (Journal Article) In: Digital Threats, 2025, (Just Accepted). (Abstract \| Links \| BibTeX) @article{10.1145/3765627, title = {Evaluating tamper resistance of digital forensic artifacts during event reconstruction}, author = { Céline Vanini and Chris Hargreaves and Frank Breitinger}, url = {https://doi.org/10.1145/3765627}, doi = {10.1145/3765627}, year = {2025}, date = {2025-09-02}, journal = {Digital Threats}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, abstract = {Event reconstruction is a fundamental part of the digital forensic process, helping to answer key questions like who, what, when, and how. A common way of accomplishing that is to use tools to create timelines, which are then analyzed. However, various challenges exist, such as large volumes of data or contamination. While prior research has focused on simplifying timelines, less attention has been given to tampering, i.e., the deliberate manipulation of evidence, which can lead to errors in interpretation. This article addresses the issue by proposing a framework to assess the relative tamper resistance of different data sources used in event reconstruction. We discuss factors affecting data resilience, introduce a scoring system for evaluation, and illustrate its application with case studies. This work aims to improve the reliability of forensic event reconstruction by considering tamper resistance.}, note = {Just Accepted}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Event reconstruction is a fundamental part of the digital forensic process, helping to answer key questions like who, what, when, and how. A common way of accomplishing that is to use tools to create timelines, which are then analyzed. However, various challenges exist, such as large volumes of data or contamination. While prior research has focused on simplifying timelines, less attention has been given to tampering, i.e., the deliberate manipulation of evidence, which can lead to errors in interpretation. This article addresses the issue by proposing a framework to assess the relative tamper resistance of different data sources used in event reconstruction. We discuss factors affecting data resilience, introduce a scoring system for evaluation, and illustrate its application with case studies. This work aims to improve the reliability of forensic event reconstruction by considering tamper resistance. Close https://doi.org/10.1145/3765627 doi:10.1145/3765627 Close
3.	Dorai, Gokila; Rad, Pouria; Breitinger, Frank; Bardhan, Rajon; Ramasamy, Vijayalakshmi Mapping the Research Landscape - An Exploratory Analysis of AI Applications in Digital Forensics (Proceedings Article) In: Coppens, Bart; Volckaert, Bruno; Naessens, Vincent; De Sutter, Bjorn (Ed.): Availability, Reliability and Security, pp. 113–130, Springer Nature Switzerland, Cham, 2025, ISBN: 978-3-032-00635-6. (Abstract \| Links \| BibTeX) @inproceedings{10.1007/978-3-032-00635-6_7, title = {Mapping the Research Landscape - An Exploratory Analysis of AI Applications in Digital Forensics}, author = {Gokila Dorai and Pouria Rad and Frank Breitinger and Rajon Bardhan and Vijayalakshmi Ramasamy}, editor = {Coppens, Bart and Volckaert, Bruno and Naessens, Vincent and De Sutter, Bjorn}, url = {https://doi.org/10.1007/978-3-032-00635-6_7}, doi = {10.1007/978-3-032-00635-6_7}, isbn = {978-3-032-00635-6}, year = {2025}, date = {2025-08-09}, urldate = {2025-08-09}, booktitle = {Availability, Reliability and Security}, pages = {113–130}, publisher = {Springer Nature Switzerland}, address = {Cham}, abstract = {Artificial intelligence (AI) and machine learning (ML) have great potential to enhance digital forensic investigation, but progress is impeded by challenges in building datasets that meet technical accuracy and legal requirements. We herein compile findings from the latest scholarly literature to identify potential key aspects that are required for building forensic datasets that can effectively support AI-based investigative tools. We examine current practices in dataset building, ranging from representativeness of data, quality of annotation, chain-of-custody documentation, and metadata standardization, and consider their effects carefully on training robust AI models. Results point to key shortcomings that impede advanced AI implementations in digital forensics, which form a strong baseline for developing a standard workflow for building forensic datasets. This work, therefore, forms a stepping stone for future projects to enhance investigation capabilities through a better-structured and legally sound process of dataset building.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Artificial intelligence (AI) and machine learning (ML) have great potential to enhance digital forensic investigation, but progress is impeded by challenges in building datasets that meet technical accuracy and legal requirements. We herein compile findings from the latest scholarly literature to identify potential key aspects that are required for building forensic datasets that can effectively support AI-based investigative tools. We examine current practices in dataset building, ranging from representativeness of data, quality of annotation, chain-of-custody documentation, and metadata standardization, and consider their effects carefully on training robust AI models. Results point to key shortcomings that impede advanced AI implementations in digital forensics, which form a strong baseline for developing a standard workflow for building forensic datasets. This work, therefore, forms a stepping stone for future projects to enhance investigation capabilities through a better-structured and legally sound process of dataset building. Close https://doi.org/10.1007/978-3-032-00635-6_7 doi:10.1007/978-3-032-00635-6_7 Close
4.	Breitinger, Frank; Studiawan, Hudan; Hargreaves, Chris SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges (Journal Article) In: Forensic Science International: Digital Investigation, vol. 53, pp. 301932, 2025, ISSN: 2666-2817, (DFRWS USA 2025 - Selected Papers from the 25th Annual Digital Forensics Research Conference USA). (Abstract \| Links \| BibTeX) @article{BREITINGER2025301932, title = {SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges}, author = {Frank Breitinger and Hudan Studiawan and Chris Hargreaves}, url = {https://www.sciencedirect.com/science/article/pii/S266628172500071X}, doi = {https://doi.org/10.1016/j.fsidi.2025.301932}, issn = {2666-2817}, year = {2025}, date = {2025-08-01}, journal = {Forensic Science International: Digital Investigation}, volume = {53}, pages = {301932}, abstract = {Event reconstruction is a technique that examiners can use to attempt to infer past activities by analyzing digital artifacts. Despite its significance, the field suffers from fragmented research, with studies often focusing narrowly on aspects like timeline creation or tampering detection. This paper addresses the lack of a unified perspective by proposing a comprehensive framework for timeline-based event reconstruction, adapted from traditional forensic science models. We begin by harmonizing existing terminology and presenting a cohesive diagram that clarifies the relationships between key elements of the reconstruction process. Through a comprehensive literature survey, we classify and organize the main challenges, extending the discussion beyond common issues like data volume. Lastly, we highlight recent advancements and propose directions for future research, including specific research gaps. By providing a structured approach, key findings, and a clearer understanding of the underlying challenges, this work aims to strengthen the foundation of digital forensics.}, note = {DFRWS USA 2025 - Selected Papers from the 25th Annual Digital Forensics Research Conference USA}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Event reconstruction is a technique that examiners can use to attempt to infer past activities by analyzing digital artifacts. Despite its significance, the field suffers from fragmented research, with studies often focusing narrowly on aspects like timeline creation or tampering detection. This paper addresses the lack of a unified perspective by proposing a comprehensive framework for timeline-based event reconstruction, adapted from traditional forensic science models. We begin by harmonizing existing terminology and presenting a cohesive diagram that clarifies the relationships between key elements of the reconstruction process. Through a comprehensive literature survey, we classify and organize the main challenges, extending the discussion beyond common issues like data volume. Lastly, we highlight recent advancements and propose directions for future research, including specific research gaps. By providing a structured approach, key findings, and a clearer understanding of the underlying challenges, this work aims to strengthen the foundation of digital forensics. Close https://www.sciencedirect.com/science/article/pii/S266628172500071X doi:https://doi.org/10.1016/j.fsidi.2025.301932 Close
5.	Michelet, Gaëtan; Henseler, Hans; Beek, Harm; Scanlon, Mark; Breitinger, Frank Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations (Journal Article) In: Digital Threats: Research and Practice, 2025. (Abstract \| Links \| BibTeX) @article{10.1145/3748264, title = {Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations}, author = {Gaëtan Michelet and Hans Henseler and Harm Beek and Mark Scanlon and Frank Breitinger}, url = {https://doi.org/10.1145/3748264}, doi = {10.1145/3748264}, year = {2025}, date = {2025-07-24}, journal = {Digital Threats: Research and Practice}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, abstract = {Large language models (LLMs) have rapidly gained popularity in various fields, including digital forensics (DF), where they offer the potential to accelerate investigative processes. Although several studies have explored LLMs for tasks such as evidence identification, artifact analysis, and report writing, fine-tuning models for specific forensic applications remains underexplored. This paper addresses this gap by proposing recommendations for fine-tuning LLMs tailored to digital forensics tasks. A case study on chat summarization is presented to showcase the applicability of the recommendations, where we evaluate multiple fine-tuned models to assess their performance. The study concludes with sharing the lessons learned from the case study.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Large language models (LLMs) have rapidly gained popularity in various fields, including digital forensics (DF), where they offer the potential to accelerate investigative processes. Although several studies have explored LLMs for tasks such as evidence identification, artifact analysis, and report writing, fine-tuning models for specific forensic applications remains underexplored. This paper addresses this gap by proposing recommendations for fine-tuning LLMs tailored to digital forensics tasks. A case study on chat summarization is presented to showcase the applicability of the recommendations, where we evaluate multiple fine-tuned models to assess their performance. The study concludes with sharing the lessons learned from the case study. Close https://doi.org/10.1145/3748264 doi:10.1145/3748264 Close
6.	Breitinger, Frank AI in Forensics: Where We Are and the Shape of What’s Next (Miscellaneous) bf Keynote at AFSN Digital Forensic Workshop Symposium, 2025, (Beijing, China). (BibTeX) @misc{keynote-beijing, title = {AI in Forensics: Where We Are and the Shape of What’s Next}, author = {Frank Breitinger}, year = {2025}, date = {2025-06-17}, howpublished = {bf Keynote at AFSN Digital Forensic Workshop Symposium}, note = {Beijing, China}, keywords = {}, pubstate = {published}, tppubtype = {misc} } Close
7.	Wickramasekara, Akila; Densmore, Alanna; Breitinger, Frank; Studiawan, Hudan; Scanlon, Mark AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation (Proceedings Article) In: Proceedings of the Digital Forensics Doctoral Symposium, Association for Computing Machinery, Brno, CZ, 2025, ISBN: 9798400710766. (Abstract \| Links \| BibTeX) @inproceedings{10.1145/3712716.3712718, title = {AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation}, author = {Akila Wickramasekara and Alanna Densmore and Frank Breitinger and Hudan Studiawan and Mark Scanlon}, url = {https://doi.org/10.1145/3712716.3712718}, doi = {10.1145/3712716.3712718}, isbn = {9798400710766}, year = {2025}, date = {2025-04-01}, urldate = {2025-01-01}, booktitle = {Proceedings of the Digital Forensics Doctoral Symposium}, publisher = {Association for Computing Machinery}, address = {Brno, CZ}, series = {DFDS '25}, abstract = {Generative AI (GenAI) and Large Language Models (LLMs) show great potential in various domains, including digital forensics. A notable use case of these technologies is automatic code generation, which can reasonably be expected to include digital forensic applications in the not-too-distant future. As with any digital forensic tool, these systems must undergo extensive testing and validation. However, manually evaluating outputs, including generated DF code, remains a challenge. AutoDFBench is an automated framework designed to address this by validating AI-generated code and tools against NIST’s Computer Forensics Tool Testing Program (CFTT) procedures and subsequently calculating an AutoDFBench benchmarking score. The framework operates in four phases: data preparation, API handling, code execution, and result recording with score calculation. It benchmarks generative AI systems, such as LLMs and automated code generation agents, for DF applications. This benchmark can support iterative development or serve as a comparison metric between GenAI DF systems. As a proof of concept, NIST’s forensic string search tests were used, involving more than 24,200 tests with five top-performing code generation LLMs. These tests validated the output of 121 cases, considering two levels of user expertise, two programming languages, and ten iterations per case with varying prompts. The results also highlight the significant limitations of the DF-specific solutions generated by generic LLMs.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Generative AI (GenAI) and Large Language Models (LLMs) show great potential in various domains, including digital forensics. A notable use case of these technologies is automatic code generation, which can reasonably be expected to include digital forensic applications in the not-too-distant future. As with any digital forensic tool, these systems must undergo extensive testing and validation. However, manually evaluating outputs, including generated DF code, remains a challenge. AutoDFBench is an automated framework designed to address this by validating AI-generated code and tools against NIST’s Computer Forensics Tool Testing Program (CFTT) procedures and subsequently calculating an AutoDFBench benchmarking score. The framework operates in four phases: data preparation, API handling, code execution, and result recording with score calculation. It benchmarks generative AI systems, such as LLMs and automated code generation agents, for DF applications. This benchmark can support iterative development or serve as a comparison metric between GenAI DF systems. As a proof of concept, NIST’s forensic string search tests were used, involving more than 24,200 tests with five top-performing code generation LLMs. These tests validated the output of 121 cases, considering two levels of user expertise, two programming languages, and ten iterations per case with varying prompts. The results also highlight the significant limitations of the DF-specific solutions generated by generic LLMs. Close https://doi.org/10.1145/3712716.3712718 doi:10.1145/3712716.3712718 Close
8.	Vanini, Céline; Gruber, Jan; Hargreaves, Christopher; Benenson, Zinaida; Freiling, Felix; Breitinger, Frank Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction (Proceedings Article) In: Proceedings of the Digital Forensics Doctoral Symposium, Association for Computing Machinery, Brno, CZ, 2025, ISBN: 9798400710766. (Abstract \| Links \| BibTeX) @inproceedings{10.1145/3712716.3712727, title = {Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction}, author = {Céline Vanini and Jan Gruber and Christopher Hargreaves and Zinaida Benenson and Felix Freiling and Frank Breitinger}, url = {https://doi.org/10.1145/3712716.3712727}, doi = {10.1145/3712716.3712727}, isbn = {9798400710766}, year = {2025}, date = {2025-04-01}, urldate = {2025-01-01}, booktitle = {Proceedings of the Digital Forensics Doctoral Symposium}, publisher = {Association for Computing Machinery}, address = {Brno, CZ}, series = {DFDS '25}, abstract = {Timestamps play a pivotal role in digital forensic event reconstruction, but due to their non-essential nature, tampering or manipulation of timestamps is possible by users in multiple ways, even on running systems. This has a significant effect on the reliability of the results from applying a timeline analysis as part of an investigation. We investigate the problem of users tampering with timestamps on a running (“live”) system. While prior work has shown that digital evidence tampering is hard, we focus on the question of why this is so. By performing a qualitative user study with advanced university students, we derive factors that influence the reliability of successful tampering, such as the individual knowledge about temporal traces, and technical restrictions to change them. These insights help to assess the reliability of timestamps from individual artifacts that are used for event reconstruction and subsequently reduce the risk of misinterpretations.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Timestamps play a pivotal role in digital forensic event reconstruction, but due to their non-essential nature, tampering or manipulation of timestamps is possible by users in multiple ways, even on running systems. This has a significant effect on the reliability of the results from applying a timeline analysis as part of an investigation. We investigate the problem of users tampering with timestamps on a running (“live”) system. While prior work has shown that digital evidence tampering is hard, we focus on the question of why this is so. By performing a qualitative user study with advanced university students, we derive factors that influence the reliability of successful tampering, such as the individual knowledge about temporal traces, and technical restrictions to change them. These insights help to assess the reliability of timestamps from individual artifacts that are used for event reconstruction and subsequently reduce the risk of misinterpretations. Close https://doi.org/10.1145/3712716.3712727 doi:10.1145/3712716.3712727 Close
9.	Michelet, Gaëtan; Breitinger, Frank Automation for digital forensics: Towards a classification model for the community (Proceedings Article) In: Proceedings of the Digital Forensics Doctoral Symposium, Association for Computing Machinery, Brno, CZ, 2025, ISBN: 9798400710766. (Abstract \| Links \| BibTeX) @inproceedings{10.1145/3712716.3712725, title = {Automation for digital forensics: Towards a classification model for the community}, author = {Gaëtan Michelet and Frank Breitinger}, url = {https://doi.org/10.1145/3712716.3712725}, doi = {10.1145/3712716.3712725}, isbn = {9798400710766}, year = {2025}, date = {2025-04-01}, booktitle = {Proceedings of the Digital Forensics Doctoral Symposium}, publisher = {Association for Computing Machinery}, address = {Brno, CZ}, series = {DFDS '25}, abstract = {The current state of automation in digital forensics remains insufficiently defined. While the complexity of automated tools and methods has evolved significantly (e.g., from basic parsers to the integration of advanced techniques), it remains challenging to pinpoint the field’s overall progress or compare methods. A first step towards a solution was the work ‘Automation for digital forensics: Towards a definition for the community’ which defines automation but cannot categorize various methods. This work aims to address this gap and presents a first classification model for automation for digital forensics. Therefore, we analyzed automation classification schemes from different disciplines (e.g., cars) and assessed various model possibilities as well as characteristics. We conclude that a 2-dimensional model with the axis ‘decision’ and ‘level of automation’ is most appropriate and provide an overview table with examples.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close The current state of automation in digital forensics remains insufficiently defined. While the complexity of automated tools and methods has evolved significantly (e.g., from basic parsers to the integration of advanced techniques), it remains challenging to pinpoint the field’s overall progress or compare methods. A first step towards a solution was the work ‘Automation for digital forensics: Towards a definition for the community’ which defines automation but cannot categorize various methods. This work aims to address this gap and presents a first classification model for automation for digital forensics. Therefore, we analyzed automation classification schemes from different disciplines (e.g., cars) and assessed various model possibilities as well as characteristics. We conclude that a 2-dimensional model with the axis ‘decision’ and ‘level of automation’ is most appropriate and provide an overview table with examples. Close https://doi.org/10.1145/3712716.3712725 doi:10.1145/3712716.3712725 Close
10.	Wickramasekara, Akila; Breitinger, Frank; Scanlon, Mark Exploring the potential of large language models for improving digital forensic investigation efficiency (Journal Article) In: Forensic Science International: Digital Investigation, vol. 52, pp. 301859, 2025, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{WICKRAMASEKARA2025301859, title = {Exploring the potential of large language models for improving digital forensic investigation efficiency}, author = {Akila Wickramasekara and Frank Breitinger and Mark Scanlon}, url = {https://www.sciencedirect.com/science/article/pii/S2666281724001860}, doi = {https://doi.org/10.1016/j.fsidi.2024.301859}, issn = {2666-2817}, year = {2025}, date = {2025-02-03}, journal = {Forensic Science International: Digital Investigation}, volume = {52}, pages = {301859}, abstract = {The ever-increasing workload of digital forensic labs raises concerns about law enforcement's ability to conduct both cyber-related and non-cyber-related investigations promptly. Consequently, this article explores the potential and usefulness of integrating Large Language Models (LLMs) into digital forensic investigations to address challenges such as bias, explainability, censorship, resource-intensive infrastructure, and ethical and legal considerations. A comprehensive literature review is carried out, encompassing existing digital forensic models, tools, LLMs, deep learning techniques, and the use of LLMs in investigations. The review identifies current challenges within existing digital forensic processes and explores both the obstacles and the possibilities of incorporating LLMs. In conclusion, the study states that the adoption of LLMs in digital forensics, with appropriate constraints, has the potential to improve investigation efficiency, improve traceability, and alleviate the technical and judicial barriers faced by law enforcement entities.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close The ever-increasing workload of digital forensic labs raises concerns about law enforcement's ability to conduct both cyber-related and non-cyber-related investigations promptly. Consequently, this article explores the potential and usefulness of integrating Large Language Models (LLMs) into digital forensic investigations to address challenges such as bias, explainability, censorship, resource-intensive infrastructure, and ethical and legal considerations. A comprehensive literature review is carried out, encompassing existing digital forensic models, tools, LLMs, deep learning techniques, and the use of LLMs in investigations. The review identifies current challenges within existing digital forensic processes and explores both the obstacles and the possibilities of incorporating LLMs. In conclusion, the study states that the adoption of LLMs in digital forensics, with appropriate constraints, has the potential to improve investigation efficiency, improve traceability, and alleviate the technical and judicial barriers faced by law enforcement entities. Close https://www.sciencedirect.com/science/article/pii/S2666281724001860 doi:https://doi.org/10.1016/j.fsidi.2024.301859 Close
11.	Göbel, Thomas; Breitinger, Frank; Baier, Harald Optimising data set creation in the cybersecurity landscape with a special focus on digital forensics: Principles, characteristics, and use cases (Journal Article) In: Forensic Science International: Digital Investigation, vol. 52, pp. 301882, 2025, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{GOBEL2025301882, title = {Optimising data set creation in the cybersecurity landscape with a special focus on digital forensics: Principles, characteristics, and use cases}, author = {Thomas Göbel and Frank Breitinger and Harald Baier}, url = {https://www.sciencedirect.com/science/article/pii/S2666281725000216}, doi = {https://doi.org/10.1016/j.fsidi.2025.301882}, issn = {2666-2817}, year = {2025}, date = {2025-01-29}, urldate = {2025-01-01}, journal = {Forensic Science International: Digital Investigation}, volume = {52}, pages = {301882}, abstract = {Data sets (samples) are important for research, training, and tool development. While the FAIR principles, data repositories and archives like Zenodo and NIST's Computer Forensic Reference Data Sets (CFReDS) enhance the accessibility and reusability of data sets, standardised practices for crafting and describing these data sets require further attention. This paper analyses the existing literature to identify the key data set (generation) characteristics, issues, desirable attributes, and use cases. Although our findings are generally applicable, i.e., to the cybersecurity domain, our special focus is on the digital forensics domain. We define principles and properties for cybersecurity-relevant data sets and their implications for the data creation process to maximise their quality, utility and applicability, taking into account specific data set use cases and data origin. We aim to guide data set creators in enhancing their data sets' value for the cybersecurity and digital forensics field.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Data sets (samples) are important for research, training, and tool development. While the FAIR principles, data repositories and archives like Zenodo and NIST's Computer Forensic Reference Data Sets (CFReDS) enhance the accessibility and reusability of data sets, standardised practices for crafting and describing these data sets require further attention. This paper analyses the existing literature to identify the key data set (generation) characteristics, issues, desirable attributes, and use cases. Although our findings are generally applicable, i.e., to the cybersecurity domain, our special focus is on the digital forensics domain. We define principles and properties for cybersecurity-relevant data sets and their implications for the data creation process to maximise their quality, utility and applicability, taking into account specific data set use cases and data origin. We aim to guide data set creators in enhancing their data sets' value for the cybersecurity and digital forensics field. Close https://www.sciencedirect.com/science/article/pii/S2666281725000216 doi:https://doi.org/10.1016/j.fsidi.2025.301882 Close
12.	Hargreaves, Christopher; Breitinger, Frank; Dowthwaite, Liz; Webb, Helena; Scanlon, Mark DFPulse: The 2024 digital forensic practitioner survey (Journal Article) In: Forensic Science International: Digital Investigation, vol. 51, pp. 301844, 2024, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{HARGREAVES2024301844, title = {DFPulse: The 2024 digital forensic practitioner survey}, author = {Christopher Hargreaves and Frank Breitinger and Liz Dowthwaite and Helena Webb and Mark Scanlon}, url = {https://www.sciencedirect.com/science/article/pii/S2666281724001719}, doi = {10.1016/j.fsidi.2024.301844}, issn = {2666-2817}, year = {2024}, date = {2024-11-29}, journal = {Forensic Science International: Digital Investigation}, volume = {51}, pages = {301844}, abstract = {This paper reports on the largest survey of digital forensic practitioners to date (DFPulse) conducted from March to May 2024 resulting in 122 responses. The survey collected information about practitioners' operating environments, the technologies they encounter, investigative techniques they use, the challenges they face, the degree to which academic research is accessed and useful to the practitioner community, and their suggested future research directions. The paper includes quantitative and qualitative results from the survey and a discussion of the implications for academia, the improvements that can be made, and future research directions.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close This paper reports on the largest survey of digital forensic practitioners to date (DFPulse) conducted from March to May 2024 resulting in 122 responses. The survey collected information about practitioners' operating environments, the technologies they encounter, investigative techniques they use, the challenges they face, the degree to which academic research is accessed and useful to the practitioner community, and their suggested future research directions. The paper includes quantitative and qualitative results from the survey and a discussion of the implications for academia, the improvements that can be made, and future research directions. Close https://www.sciencedirect.com/science/article/pii/S2666281724001719 doi:10.1016/j.fsidi.2024.301844 Close
13.	Dreier, Lisa Marie; Vanini, Céline; Hargreaves, Christopher J.; Breitinger, Frank; Freiling, Felix Beyond timestamps: Integrating implicit timing information into digital forensic timelines (Journal Article) In: Forensic Science International: Digital Investigation, vol. 49, pp. 301755, 2024, ISSN: 2666-2817, (bf Best Paper Award). (Abstract \| Links \| BibTeX) @article{DREIER2024301755, title = {Beyond timestamps: Integrating implicit timing information into digital forensic timelines}, author = {Lisa Marie Dreier and Céline Vanini and Christopher J. Hargreaves and Frank Breitinger and Felix Freiling}, url = {https://www.sciencedirect.com/science/article/pii/S266628172400074X}, doi = {10.1016/j.fsidi.2024.301755}, issn = {2666-2817}, year = {2024}, date = {2024-07-08}, journal = {Forensic Science International: Digital Investigation}, volume = {49}, pages = {301755}, abstract = {Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical ``flat'' timeline is thereby extended into a ``rich'' partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.}, note = {bf Best Paper Award}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical ``flat'' timeline is thereby extended into a ``rich'' partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering. Close https://www.sciencedirect.com/science/article/pii/S266628172400074X doi:10.1016/j.fsidi.2024.301755 Close
14.	Vanini, Céline; Hargreaves, Christopher J.; Beek, Harm; Breitinger, Frank Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction (Journal Article) In: Forensic Science International: Digital Investigation, vol. 49, pp. 301759, 2024, ISSN: 2666-2817, (DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA). (Abstract \| Links \| BibTeX) @article{VANINI2024301759, title = {Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction}, author = {Céline Vanini and Christopher J. Hargreaves and Harm Beek and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281724000787}, doi = {10.1016/j.fsidi.2024.301759}, issn = {2666-2817}, year = {2024}, date = {2024-07-08}, journal = {Forensic Science International: Digital Investigation}, volume = {49}, pages = {301759}, abstract = {Timestamps and their correct interpretation play a crucial role in digital forensic investigations, particularly when the objective is to establish a timeline of events a.k.a. event reconstruction. However, the way these timestamps are generated heavily depends on an internal clock, or `system time', from which many are derived. Consequently, when this system time is skewed due to tampering, natural clock drift, or system malfunctions, recorded timestamps will not reflect the actual times the (real-world) events occurred. This raises the question of how to validate the correctness of the system clock when recording timestamps and, if found incorrect, how to determine system clock skew. To address this problem, this paper defines several important concepts such as time anchors, anchoring events, non-anchoring events and time anomalies which can be used to determine if the system time was correct. Using two examples - a Google search and a file creation - and comparing correct and skewed versions of the same set of performed actions, we illustrate the use and potential benefits of time anchors to demonstrate the correctness of the system clock for event reconstruction.}, note = {DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Timestamps and their correct interpretation play a crucial role in digital forensic investigations, particularly when the objective is to establish a timeline of events a.k.a. event reconstruction. However, the way these timestamps are generated heavily depends on an internal clock, or `system time', from which many are derived. Consequently, when this system time is skewed due to tampering, natural clock drift, or system malfunctions, recorded timestamps will not reflect the actual times the (real-world) events occurred. This raises the question of how to validate the correctness of the system clock when recording timestamps and, if found incorrect, how to determine system clock skew. To address this problem, this paper defines several important concepts such as time anchors, anchoring events, non-anchoring events and time anomalies which can be used to determine if the system time was correct. Using two examples - a Google search and a file creation - and comparing correct and skewed versions of the same set of performed actions, we illustrate the use and potential benefits of time anchors to demonstrate the correctness of the system clock for event reconstruction. Close https://www.sciencedirect.com/science/article/pii/S2666281724000787 doi:10.1016/j.fsidi.2024.301759 Close
15.	Breitinger, Frank; Hilgert, Jan-Niclas; Hargreaves, Christopher; Sheppard, John; Overdorf, Rebekah; Scanlon, Mark DFRWS EU 10-year review and future directions in Digital Forensic Research (Journal Article) In: Forensic Science International: Digital Investigation, vol. 48, pp. 301685, 2024, ISSN: 2666-2817, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe). (Abstract \| Links \| BibTeX) @article{BREITINGER2024301685, title = {DFRWS EU 10-year review and future directions in Digital Forensic Research}, author = {Frank Breitinger and Jan-Niclas Hilgert and Christopher Hargreaves and John Sheppard and Rebekah Overdorf and Mark Scanlon}, url = {https://www.sciencedirect.com/science/article/pii/S2666281723002044}, doi = {10.1016/j.fsidi.2023.301685}, issn = {2666-2817}, year = {2024}, date = {2024-03-15}, journal = {Forensic Science International: Digital Investigation}, volume = {48}, pages = {301685}, abstract = {Conducting a systematic literature review and comprehensive analysis, this paper surveys all 135 peer-reviewed articles published at the Digital Forensics Research Conference Europe (DFRWS EU) spanning the decade since its inaugural running (2014–2023). This comprehensive study of DFRWS EU articles encompasses sub-disciplines such as digital forensic science, device forensics, techniques and fundamentals, artefact forensics, multimedia forensics, memory forensics, and network forensics. Quantitative analysis of the articles' co-authorships, geographical spread and citation metrics are outlined. The analysis presented offers insights into the evolution of digital forensic research efforts over these ten years and informs some identified future research directions.}, note = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Conducting a systematic literature review and comprehensive analysis, this paper surveys all 135 peer-reviewed articles published at the Digital Forensics Research Conference Europe (DFRWS EU) spanning the decade since its inaugural running (2014–2023). This comprehensive study of DFRWS EU articles encompasses sub-disciplines such as digital forensic science, device forensics, techniques and fundamentals, artefact forensics, multimedia forensics, memory forensics, and network forensics. Quantitative analysis of the articles' co-authorships, geographical spread and citation metrics are outlined. The analysis presented offers insights into the evolution of digital forensic research efforts over these ten years and informs some identified future research directions. Close https://www.sciencedirect.com/science/article/pii/S2666281723002044 doi:10.1016/j.fsidi.2023.301685 Close
16.	Mombelli, Samuele; Lyle, James R.; Breitinger, Frank FAIRness in digital forensics datasets' metadata – and how to improve it (Journal Article) In: Forensic Science International: Digital Investigation, vol. 48, pp. 301681, 2024, ISSN: 2666-2817, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe). (Abstract \| Links \| BibTeX) @article{MOMBELLI2024301681, title = {FAIRness in digital forensics datasets' metadata – and how to improve it}, author = {Samuele Mombelli and James R. Lyle and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281723002007}, doi = {10.1016/j.fsidi.2023.301681}, issn = {2666-2817}, year = {2024}, date = {2024-03-15}, journal = {Forensic Science International: Digital Investigation}, volume = {48}, pages = {301681}, abstract = {The availability of research data (datasets) and compliance with FAIR principles—Findability, Accessibility, Interoperability, and Reusability—is critical to progressing digital forensics. This study evaluates metadata completeness and assesses the alignment with the FAIR principles using all 212 datasets from NIST's Computer Forensic Reference DataSet Portal (CFReDS). The findings underscore deficiencies in metadata quality and FAIR compliance, emphasizing the need for improved data management standards. Based on our critical review, we then propose and discuss various approaches to improve the status quo.}, note = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close The availability of research data (datasets) and compliance with FAIR principles—Findability, Accessibility, Interoperability, and Reusability—is critical to progressing digital forensics. This study evaluates metadata completeness and assesses the alignment with the FAIR principles using all 212 datasets from NIST's Computer Forensic Reference DataSet Portal (CFReDS). The findings underscore deficiencies in metadata quality and FAIR compliance, emphasizing the need for improved data management standards. Based on our critical review, we then propose and discuss various approaches to improve the status quo. Close https://www.sciencedirect.com/science/article/pii/S2666281723002007 doi:10.1016/j.fsidi.2023.301681 Close
17.	Michelet, Gaëtan; Breitinger, Frank ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models (Journal Article) In: Forensic Science International: Digital Investigation, vol. 48, pp. 301683, 2024, ISSN: 2666-2817, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe). (Abstract \| Links \| BibTeX) @article{MICHELET2024301683, title = {ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models}, author = {Gaëtan Michelet and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281723002020}, doi = {10.1016/j.fsidi.2023.301683}, issn = {2666-2817}, year = {2024}, date = {2024-03-15}, journal = {Forensic Science International: Digital Investigation}, volume = {48}, pages = {301683}, abstract = {Generative AIs, especially Large Language Models (LLMs) such as ChatGPT or Llama, have advanced significantly, positioning them as valuable tools for digital forensics. While initial studies have explored the potential of ChatGPT in the context of investigations, the question of to what extent LLMs can assist the forensic report writing process remains unresolved. To answer the question, this article first examines forensic reports with the goal of generalization (e.g., finding the `average structure' of a report). We then evaluate the strengths and limitations of LLMs for generating the different parts of the forensic report using a case study. This work thus provides valuable insights into the automation of report writing, a critical facet of digital forensics investigations. We conclude that combined with thorough proofreading and corrections, LLMs may assist practitioners during the report writing process but at this point cannot replace them.}, note = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Generative AIs, especially Large Language Models (LLMs) such as ChatGPT or Llama, have advanced significantly, positioning them as valuable tools for digital forensics. While initial studies have explored the potential of ChatGPT in the context of investigations, the question of to what extent LLMs can assist the forensic report writing process remains unresolved. To answer the question, this article first examines forensic reports with the goal of generalization (e.g., finding the `average structure' of a report). We then evaluate the strengths and limitations of LLMs for generating the different parts of the forensic report using a case study. This work thus provides valuable insights into the automation of report writing, a critical facet of digital forensics investigations. We conclude that combined with thorough proofreading and corrections, LLMs may assist practitioners during the report writing process but at this point cannot replace them. Close https://www.sciencedirect.com/science/article/pii/S2666281723002020 doi:10.1016/j.fsidi.2023.301683 Close
18.	Breitinger, Frank Network Threats and their Detection (Miscellaneous) Invited Tutorial Presenter at the International Conference on Innovations in Information Technology (IIT’23), 2023, (Al Ain, United Arab Emirates). (BibTeX) @misc{tutorial-UAE, title = {Network Threats and their Detection}, author = {Frank Breitinger}, year = {2023}, date = {2023-11-16}, howpublished = {Invited Tutorial Presenter at the International Conference on Innovations in Information Technology (IIT’23)}, note = {Al Ain, United Arab Emirates}, keywords = {}, pubstate = {published}, tppubtype = {misc} } Close
19.	Ottmann, Jenny; Breitinger, Frank; Freiling, Felix An Experimental Assessment of Inconsistencies in Memory Forensics (Journal Article) In: ACM Trans. Priv. Secur., vol. 27, no. 1, 2023, ISSN: 2471-2566. (Abstract \| Links \| BibTeX) @article{10.1145/3628600, title = {An Experimental Assessment of Inconsistencies in Memory Forensics}, author = {Jenny Ottmann and Frank Breitinger and Felix Freiling}, url = {https://doi.org10.1145/3628600}, doi = {10.1145/3628600}, issn = {2471-2566}, year = {2023}, date = {2023-10-20}, journal = {ACM Trans. Priv. Secur.}, volume = {27}, number = {1}, publisher = {Association for Computing Machinery}, address = {New York, NY, USA}, abstract = {Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads).}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads). Close https://doi.org10.1145/3628600 doi:10.1145/3628600 Close
20.	Scanlon, Mark; Breitinger, Frank; Hargreaves, Christopher; Hilgert, Jan-Niclas; Sheppard, John ChatGPT for digital forensic investigation: The good, the bad, and the unknown (Journal Article) In: Forensic Science International: Digital Investigation, vol. 46, pp. 301609, 2023, ISSN: 2666-2817, (bf Best Paper Award). (Abstract \| Links \| BibTeX) @article{SCANLON2023301609, title = {ChatGPT for digital forensic investigation: The good, the bad, and the unknown}, author = {Mark Scanlon and Frank Breitinger and Christopher Hargreaves and Jan-Niclas Hilgert and John Sheppard}, url = {https://www.sciencedirect.com/science/article/pii/S266628172300121X}, doi = {10.1016/j.fsidi.2023.301609}, issn = {2666-2817}, year = {2023}, date = {2023-10-13}, urldate = {2023-10-13}, journal = {Forensic Science International: Digital Investigation}, volume = {46}, pages = {301609}, abstract = {The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.}, note = {bf Best Paper Award}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances. Close https://www.sciencedirect.com/science/article/pii/S266628172300121X doi:10.1016/j.fsidi.2023.301609 Close
21.	Göbel, Thomas; Baier, Harald; Breitinger, Frank Data for Digital Forensics: Why a Discussion on `How Realistic is Synthetic Data' is Dispensable (Journal Article) In: Digital Threats: Research and Practice, 2023, ISSN: 2692-1626, (Presented at the 12th International Conference on IT Security Incident Management IT Forensics (IMF)). (Abstract \| Links \| BibTeX) @article{10.1145/3609863, title = {Data for Digital Forensics: Why a Discussion on `How Realistic is Synthetic Data' is Dispensable}, author = {Thomas Göbel and Harald Baier and Frank Breitinger}, url = {https://doi.org/10.1145/3609863}, doi = {10.1145/3609863}, issn = {2692-1626}, year = {2023}, date = {2023-07-20}, urldate = {2023-07-20}, journal = {Digital Threats: Research and Practice}, publisher = {Association for Computing Machinery (ACM)}, address = {New York, NY, USA}, abstract = {Digital forensics depends on data sets for various purposes like concept evaluation, educational training, and tool validation. Researchers have gathered such data sets into repositories and created data simulation frameworks for producing large amounts of data. Synthetic data often face skepticism due to its perceived deviation from real-world data, raising doubts about its realism. This paper addresses this concern, arguing that there is no definitive answer. We focus on four common digital forensic use cases that rely on data. Through these, we elucidate the specifications and prerequisites of data sets within their respective contexts. Our discourse uncovers that both real-world and synthetic data are indispensable for advancing digital forensic science, software, tools, and the competence of practitioners. Additionally, we provide an overview of available data set repositories and data generation frameworks, contributing to the ongoing dialogue on digital forensic data sets’ utility.}, note = {Presented at the 12th International Conference on IT Security Incident Management IT Forensics (IMF)}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Digital forensics depends on data sets for various purposes like concept evaluation, educational training, and tool validation. Researchers have gathered such data sets into repositories and created data simulation frameworks for producing large amounts of data. Synthetic data often face skepticism due to its perceived deviation from real-world data, raising doubts about its realism. This paper addresses this concern, arguing that there is no definitive answer. We focus on four common digital forensic use cases that rely on data. Through these, we elucidate the specifications and prerequisites of data sets within their respective contexts. Our discourse uncovers that both real-world and synthetic data are indispensable for advancing digital forensic science, software, tools, and the competence of practitioners. Additionally, we provide an overview of available data set repositories and data generation frameworks, contributing to the ongoing dialogue on digital forensic data sets’ utility. Close https://doi.org/10.1145/3609863 doi:10.1145/3609863 Close
22.	Ottmann, Jenny; Cengiz, Üsame; Breitinger, Frank; Freiling, Felix As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency (Proceedings Article) In: Proceedings of the Digital Forensics Research Conference USA (DFRWS USA), 2023. (Abstract \| Links \| BibTeX) @inproceedings{OUBF2023, title = {As if Time Had Stopped – Checking Memory Dumps for Quasi-Instantaneous Consistency}, author = {Jenny Ottmann and Üsame Cengiz and Frank Breitinger and Felix Freiling}, url = {https://dfrws.org/presentation/as-if-time-had-stopped-checking-memory-dumps-for-quasi-instantaneous-consistency/}, doi = {10.48550/arXiv.2307.12060}, year = {2023}, date = {2023-07-10}, booktitle = {Proceedings of the Digital Forensics Research Conference USA (DFRWS USA)}, abstract = {Memory dumps that are acquired while the system is running often contain inconsistencies like page smearing which hamper the analysis. One possibility to avoid inconsistencies is to pause the system during the acquisition and take an instantaneous memory dump. While this is possible for virtual machines, most systems cannot be frozen and thus the ideal dump can only be quasi-instantaneous, i.e., consistent despite the system running. In this article, we introduce a method allowing us to measure quasi-instantaneous consistency and show both, theoretically, and practically, that our method is valid but that in reality, dumps can be but usually are not quasi-instantaneously consistent. For the assessment, we run a pivot program enabling the evaluation of quasi-instantaneous consistency for its heap and allowing us to pinpoint where exactly inconsistencies occurred.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Memory dumps that are acquired while the system is running often contain inconsistencies like page smearing which hamper the analysis. One possibility to avoid inconsistencies is to pause the system during the acquisition and take an instantaneous memory dump. While this is possible for virtual machines, most systems cannot be frozen and thus the ideal dump can only be quasi-instantaneous, i.e., consistent despite the system running. In this article, we introduce a method allowing us to measure quasi-instantaneous consistency and show both, theoretically, and practically, that our method is valid but that in reality, dumps can be but usually are not quasi-instantaneously consistent. For the assessment, we run a pivot program enabling the evaluation of quasi-instantaneous consistency for its heap and allowing us to pinpoint where exactly inconsistencies occurred. Close https://dfrws.org/presentation/as-if-time-had-stopped-checking-memory-dumps-for-[...] doi:10.48550/arXiv.2307.12060 Close
23.	Breitinger, Frank; Jotterand, Alexandre Sharing datasets for digital forensic: A novel taxonomy and legal concerns (Journal Article) In: Forensic Science International: Digital Investigation, vol. 45, pp. 301562, 2023, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{BREITINGER2023301562, title = {Sharing datasets for digital forensic: A novel taxonomy and legal concerns}, author = {Frank Breitinger and Alexandre Jotterand}, url = {https://www.sciencedirect.com/science/article/pii/S2666281723000719}, doi = {10.1016/j.fsidi.2023.301562}, issn = {2666-2817}, year = {2023}, date = {2023-07-07}, journal = {Forensic Science International: Digital Investigation}, volume = {45}, pages = {301562}, abstract = {During the last few years, there have been numerous changes concerning datasets for digital forensics like the development of data generation frameworks or the newly released CFReDS website by NIST. In addition, it becomes mandatory (e.g., by funding agencies) to share datasets and publish them in a manner that they can be found and processed. The core of this article is a novel taxonomy that should be used to structure the data commonly used in the domain, complementing the existing methods. Based on the taxonomy, we discuss that it is not always necessary to release the dataset, e.g., in the case of random data. In addition, we address the legal aspects of sharing data. Lastly, as a minor contribution, we provide a separation of the terms structured, semi-structured, and unstructured data where there is currently no consent in the community.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close During the last few years, there have been numerous changes concerning datasets for digital forensics like the development of data generation frameworks or the newly released CFReDS website by NIST. In addition, it becomes mandatory (e.g., by funding agencies) to share datasets and publish them in a manner that they can be found and processed. The core of this article is a novel taxonomy that should be used to structure the data commonly used in the domain, complementing the existing methods. Based on the taxonomy, we discuss that it is not always necessary to release the dataset, e.g., in the case of random data. In addition, we address the legal aspects of sharing data. Lastly, as a minor contribution, we provide a separation of the terms structured, semi-structured, and unstructured data where there is currently no consent in the community. Close https://www.sciencedirect.com/science/article/pii/S2666281723000719 doi:10.1016/j.fsidi.2023.301562 Close
24.	Michelet, Gaëtan; Breitinger, Frank; Horsman, Graeme Automation for digital forensics: Towards a definition for the community (Journal Article) In: Forensic Science International, vol. 349, pp. 111769, 2023, ISSN: 0379-0738. (Abstract \| Links \| BibTeX) @article{MICHELET2023111769, title = {Automation for digital forensics: Towards a definition for the community}, author = {Gaëtan Michelet and Frank Breitinger and Graeme Horsman}, url = {https://www.sciencedirect.com/science/article/pii/S0379073823002190}, doi = {10.1016/j.forsciint.2023.111769}, issn = {0379-0738}, year = {2023}, date = {2023-07-04}, journal = {Forensic Science International}, volume = {349}, pages = {111769}, abstract = {Automation is crucial for managing the increasing volume of digital evidence. However, the absence of a clear foundation comprising a definition, classification, and common terminology has led to a fragmented landscape where diverse interpretations of automation exist. This resembles the wild west: some consider keyword searches or file carving as automation while others do not. We, therefore, reviewed automation literature (in the domain of digital forensics and other domains), performed three practitioner interviews, and discussed the topic with domain experts from academia. On this basis, we propose a definition and then showcase several considerations concerning automation for digital forensics, e.g., what we classify as no/basic automation or full automation (autonomous). We conclude that it requires these foundational discussions to promote and progress the discipline through a common understanding.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Automation is crucial for managing the increasing volume of digital evidence. However, the absence of a clear foundation comprising a definition, classification, and common terminology has led to a fragmented landscape where diverse interpretations of automation exist. This resembles the wild west: some consider keyword searches or file carving as automation while others do not. We, therefore, reviewed automation literature (in the domain of digital forensics and other domains), performed three practitioner interviews, and discussed the topic with domain experts from academia. On this basis, we propose a definition and then showcase several considerations concerning automation for digital forensics, e.g., what we classify as no/basic automation or full automation (autonomous). We conclude that it requires these foundational discussions to promote and progress the discipline through a common understanding. Close https://www.sciencedirect.com/science/article/pii/S0379073823002190 doi:10.1016/j.forsciint.2023.111769 Close
25.	Schneider, Johannes; Breitinger, Frank Towards AI forensics: Did the artificial intelligence system do it? (Journal Article) In: Journal of Information Security and Applications, vol. 76, pp. 103517, 2023, ISSN: 2214-2126. (Abstract \| Links \| BibTeX) @article{schneider2023towards, title = {Towards AI forensics: Did the artificial intelligence system do it?}, author = {Johannes Schneider and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2214212623001011}, doi = {10.1016/j.jisa.2023.103517}, issn = {2214-2126}, year = {2023}, date = {2023-06-07}, journal = {Journal of Information Security and Applications}, volume = {76}, pages = {103517}, abstract = {Artificial intelligence (AI) makes decisions impacting our daily lives in an increasingly autonomous manner. Their actions might cause accidents, harm, or, more generally, violate regulations. Determining whether an AI caused a specific event and, if so, what triggered the AI's action, are key forensic questions. We provide a conceptualization of the problems and strategies for forensic investigation. We focus on AI that is potentially ``malicious by design'' and gray box analysis. Our evaluation using convolutional neural networks illustrates challenges and ideas for identifying malicious AI.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Artificial intelligence (AI) makes decisions impacting our daily lives in an increasingly autonomous manner. Their actions might cause accidents, harm, or, more generally, violate regulations. Determining whether an AI caused a specific event and, if so, what triggered the AI's action, are key forensic questions. We provide a conceptualization of the problems and strategies for forensic investigation. We focus on AI that is potentially ``malicious by design'' and gray box analysis. Our evaluation using convolutional neural networks illustrates challenges and ideas for identifying malicious AI. Close https://www.sciencedirect.com/science/article/pii/S2214212623001011 doi:10.1016/j.jisa.2023.103517 Close
26.	Breitinger, Frank; Zhang, Xiaolu; Quick, Darren A forensic analysis of rclone and rclone's prospects for digital forensic investigations of cloud storage (Journal Article) In: Forensic Science International: Digital Investigation, vol. 43, pp. 301443, 2022, ISSN: 2666-2817, (bf Best Paper Award). (Abstract \| Links \| BibTeX) @article{breitinger2023rclone, title = {A forensic analysis of rclone and rclone's prospects for digital forensic investigations of cloud storage}, author = {Frank Breitinger and Xiaolu Zhang and Darren Quick}, url = {https://www.sciencedirect.com/science/article/pii/S266628172200124X}, doi = {10.1016/j.fsidi.2022.301443}, issn = {2666-2817}, year = {2022}, date = {2022-09-27}, journal = {Forensic Science International: Digital Investigation}, volume = {43}, pages = {301443}, abstract = {Organizations and end users are moving their data into the cloud and trust Cloud Storage Providers (CSP) such as pCloud, Dropbox, or Backblaze. Given their popularity, it is likely that forensic examiners encounter one or more online storage types that they will have to acquire and analyze during an investigation. To access cloud storage, CSPs provide web-interfaces, proprietary software solutions (e.g., Dropbox client for Windows) as well as APIs allowing third-party access. One of these third-party applications is rclone which is an open-source tool to access many common CSPs through a command line interface. In this article, we look at rclone from two perspectives: First, we perform a forensic analysis on rclone and discuss aspects such as password recovery of the configuration file, encryption, and JA3 fingerprints. Second, we discuss rclone as a prospect to be a forensic tool which includes its read-only mount feature and sample cases. Under the circumstances tested, rclone is suitable for forensic practitioners as it is open-source, documented, and includes some essential functionality frequently needed but practitioners need to be aware of the caveats.}, note = {bf Best Paper Award}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Organizations and end users are moving their data into the cloud and trust Cloud Storage Providers (CSP) such as pCloud, Dropbox, or Backblaze. Given their popularity, it is likely that forensic examiners encounter one or more online storage types that they will have to acquire and analyze during an investigation. To access cloud storage, CSPs provide web-interfaces, proprietary software solutions (e.g., Dropbox client for Windows) as well as APIs allowing third-party access. One of these third-party applications is rclone which is an open-source tool to access many common CSPs through a command line interface. In this article, we look at rclone from two perspectives: First, we perform a forensic analysis on rclone and discuss aspects such as password recovery of the configuration file, encryption, and JA3 fingerprints. Second, we discuss rclone as a prospect to be a forensic tool which includes its read-only mount feature and sample cases. Under the circumstances tested, rclone is suitable for forensic practitioners as it is open-source, documented, and includes some essential functionality frequently needed but practitioners need to be aware of the caveats. Close https://www.sciencedirect.com/science/article/pii/S266628172200124X doi:10.1016/j.fsidi.2022.301443 Close
27.	Göbel, Thomas; Uhlig, Frieder; Baier, Harald; Breitinger, Frank FRASHER – A framework for automated evaluation of similarity hashing (Journal Article) In: Forensic Science International: Digital Investigation, vol. 42, no. 2022-, pp. 301407, 2022, ISSN: 2666-2817, (Proceedings of the Twenty-Second Annual DFRWS USA). (Abstract \| Links \| BibTeX) @article{Goebel2022Frasher, title = {FRASHER – A framework for automated evaluation of similarity hashing}, author = {Thomas Göbel and Frieder Uhlig and Harald Baier and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281722000889}, doi = {10.1016/j.fsidi.2022.301407}, issn = {2666-2817}, year = {2022}, date = {2022-07-09}, journal = {Forensic Science International: Digital Investigation}, volume = {42}, number = {2022-}, pages = {301407}, abstract = {A challenge for digital forensic investigations is dealing with large amounts of data that need to be processed. Approximate matching (AM), a.k.a. similarity hashing or fuzzy hashing, plays a pivotal role in solving this challenge. Many algorithms have been proposed over the years such as ssdeep, sdhash, MRSH-v2, or TLSH, which can be used for similarity assessment, clustering of different artifacts, or finding fragments and embedded objects. To assess the differences between these implementations (e.g., in terms of runtime efficiency, fragment detection, or resistance against obfuscation attacks), a testing framework is indispensable and the core of this article. The proposed framework is called FRASHER (referring to a predecessor FRASH from 2013) and provides an up-to-date view on the problem of evaluating AM algorithms with respect to both the conceptual and the practical aspects. Consequently, we present and discuss relevant test case scenarios as well as release and demonstrate our framework allowing a comprehensive evaluation of AM algorithms. Compared to its predecessor, we adapt it to a modern environment providing better modularity and usability as well as more thorough testing cases.}, note = {Proceedings of the Twenty-Second Annual DFRWS USA}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close A challenge for digital forensic investigations is dealing with large amounts of data that need to be processed. Approximate matching (AM), a.k.a. similarity hashing or fuzzy hashing, plays a pivotal role in solving this challenge. Many algorithms have been proposed over the years such as ssdeep, sdhash, MRSH-v2, or TLSH, which can be used for similarity assessment, clustering of different artifacts, or finding fragments and embedded objects. To assess the differences between these implementations (e.g., in terms of runtime efficiency, fragment detection, or resistance against obfuscation attacks), a testing framework is indispensable and the core of this article. The proposed framework is called FRASHER (referring to a predecessor FRASH from 2013) and provides an up-to-date view on the problem of evaluating AM algorithms with respect to both the conceptual and the practical aspects. Consequently, we present and discuss relevant test case scenarios as well as release and demonstrate our framework allowing a comprehensive evaluation of AM algorithms. Compared to its predecessor, we adapt it to a modern environment providing better modularity and usability as well as more thorough testing cases. Close https://www.sciencedirect.com/science/article/pii/S2666281722000889 doi:10.1016/j.fsidi.2022.301407 Close
28.	AlDaajeh, Saleh; Saleous, Heba; Alrabaee, Saed; Barka, Ezedin; Breitinger, Frank; Choo, Kim-Kwang Raymond The Role of National Cybersecurity Strategies on the Improvement of Cybersecurity Education (Journal Article) In: Computers & Security, pp. 102754, 2022, ISSN: 0167-4048. (Abstract \| Links \| BibTeX) @article{ALDAAJEH2022102754, title = {The Role of National Cybersecurity Strategies on the Improvement of Cybersecurity Education}, author = {Saleh AlDaajeh and Heba Saleous and Saed Alrabaee and Ezedin Barka and Frank Breitinger and Kim-Kwang Raymond Choo}, url = {https://www.sciencedirect.com/science/article/pii/S0167404822001493}, doi = {10.1016/j.cose.2022.102754}, issn = {0167-4048}, year = {2022}, date = {2022-05-18}, journal = {Computers & Security}, pages = {102754}, abstract = {Digital information and telecommunication technologies have not only become essential to individuals' daily lives but also to a nation's sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation's cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs' curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals' cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program's curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Digital information and telecommunication technologies have not only become essential to individuals' daily lives but also to a nation's sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation's cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs' curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals' cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program's curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces. Close https://www.sciencedirect.com/science/article/pii/S0167404822001493 doi:10.1016/j.cose.2022.102754 Close
29.	Coates, Peter; Breitinger, Frank Identifying document similarity using a fast estimation of the Levenshtein Distance based on compression and signatures (Proceedings Article) In: Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU), 2022. (Abstract \| Links \| BibTeX) @inproceedings{CB2022, title = {Identifying document similarity using a fast estimation of the Levenshtein Distance based on compression and signatures}, author = {Peter Coates and Frank Breitinger}, url = {https://www.researchgate.net/publication/359961968_Identifying_document_similarity_using_a_fast_estimation_of_the_Levenshtein_Distance_based_on_compression_and_signatures}, doi = {10.48550/arXiv.2307.11496}, year = {2022}, date = {2022-03-31}, booktitle = {Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU)}, abstract = {Identifying document similarity has many applications, e.g., source code analysis or plagiarism detection. However, identifying similarities is not trivial and can be time complex. For instance, the Levenshtein Distance is a common metric to define the similarity between two documents but has quadratic runtime which makes it impractical for large documents where large starts with a few hundred kilobytes. In this paper, we present a novel concept that allows estimating the Levenshtein Distance: the algorithm first compresses documents to signatures (similar to hash values) using a user-defined compression ratio. Signatures can then be compared against each other (some constrains apply) where the outcome is the estimated Levenshtein Distance. Our evaluation shows promising results in terms of runtime efficiency and accuracy. In addition, we introduce a significance score allowing examiners to set a threshold and identify related documents.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Identifying document similarity has many applications, e.g., source code analysis or plagiarism detection. However, identifying similarities is not trivial and can be time complex. For instance, the Levenshtein Distance is a common metric to define the similarity between two documents but has quadratic runtime which makes it impractical for large documents where large starts with a few hundred kilobytes. In this paper, we present a novel concept that allows estimating the Levenshtein Distance: the algorithm first compresses documents to signatures (similar to hash values) using a user-defined compression ratio. Signatures can then be compared against each other (some constrains apply) where the outcome is the estimated Levenshtein Distance. Our evaluation shows promising results in terms of runtime efficiency and accuracy. In addition, we introduce a significance score allowing examiners to set a threshold and identify related documents. Close https://www.researchgate.net/publication/359961968_Identifying_document_similari[...] doi:10.48550/arXiv.2307.11496 Close
30.	Ottmann, Jenny; Breitinger, Frank; Freiling, Felix Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing (Proceedings Article) In: Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU), 2022. (Abstract \| Links \| BibTeX) @inproceedings{OBF2022, title = {Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing}, author = {Jenny Ottmann and Frank Breitinger and Felix Freiling}, url = {https://www.researchgate.net/publication/359962048_Defining_Atomicity_and_Integrity_for_Snapshots_of_Storage_in_Forensic_Computing}, year = {2022}, date = {2022-03-31}, booktitle = {Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU)}, abstract = {The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for ``forensically sound'' acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for ``forensically sound'' acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause/effect relations). Our concept is much stronger than the original notion of atomicity defined by Vömel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity. Close https://www.researchgate.net/publication/359962048_Defining_Atomicity_and_Integr[...] Close
31.	Huck, Jan; Breitinger, Frank Wake Up Digital Forensics' Community and Help Combating Ransomware (Journal Article) In: IEEE Security & Privacy, no. 01, pp. 2-11, 2022, ISSN: 1558-4046. (Abstract \| Links \| BibTeX) @article{huck2022wake, title = {Wake Up Digital Forensics' Community and Help Combating Ransomware}, author = {Jan Huck and Frank Breitinger}, url = {https://ieeexplore.ieee.org/document/9682529}, doi = {10.1109/MSEC.2021.3137018}, issn = {1558-4046}, year = {2022}, date = {2022-01-14}, journal = {IEEE Security & Privacy}, number = {01}, pages = {2-11}, publisher = {IEEE Computer Society}, address = {Los Alamitos, CA, USA}, abstract = {To combat ransomware, organizations, literature, and research efforts focus on technical measures and neglect procedural countermeasures. We argue that detailed case studies and best practices need to be shared to allow companies to adapt their strategies to be better prepared.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close To combat ransomware, organizations, literature, and research efforts focus on technical measures and neglect procedural countermeasures. We argue that detailed case studies and best practices need to be shared to allow companies to adapt their strategies to be better prepared. Close https://ieeexplore.ieee.org/document/9682529 doi:10.1109/MSEC.2021.3137018 Close
32.	Wu, Tina; Breitinger, Frank; Niemann, Stephen IoT network traffic analysis: Opportunities and challenges for forensic investigators? (Journal Article) In: Forensic Science International: Digital Investigation, vol. 38, pp. 301123, 2021, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{WU2021301123, title = {IoT network traffic analysis: Opportunities and challenges for forensic investigators?}, author = {Tina Wu and Frank Breitinger and Stephen Niemann}, url = {https://www.sciencedirect.com/science/article/pii/S2666281721000214}, doi = {10.1016/j.fsidi.2021.301123}, issn = {2666-2817}, year = {2021}, date = {2021-11-23}, journal = {Forensic Science International: Digital Investigation}, volume = {38}, pages = {301123}, abstract = {As IoT devices become more incorporated into our daily lives, their always on approach makes them an ideal source of evidence. While these devices should use encryption to protect sensitive information, in reality this is not always the case e.g. some expose sensitive data like credentials in cleartext. In this paper, we have conducted an extensive analysis on the communications channels of 32 IoT consumer devices. Our experiments consisted of four main parts; first we carried out a port scan to determine if any ports can be exploited and thus gain remote access. Second, we looked at whether any of the devices used encryption and if not what type of content was exposed. Third, we used the network traffic `metadata' to identify the destination the data terminated. Finally, we examined the communication between the mobile app and the cloud to see if it can be easily exploited using a proxy server. Our findings show that the majority of devices have remote access unavailable. We found the Shannon entropy test a useful pre-test in identifying unencrypted content. Although many devices encrypted their data, we found several in particular smart cameras would send data in cleartext when they detected motion or during updates. We found the majority of data transverses to the US and stored on Amazon servers with most devices contacting multiple destination. Lastly, we discovered many of the IoT device's mobile apps can be easily exploited using a HTTP Proxy.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close As IoT devices become more incorporated into our daily lives, their always on approach makes them an ideal source of evidence. While these devices should use encryption to protect sensitive information, in reality this is not always the case e.g. some expose sensitive data like credentials in cleartext. In this paper, we have conducted an extensive analysis on the communications channels of 32 IoT consumer devices. Our experiments consisted of four main parts; first we carried out a port scan to determine if any ports can be exploited and thus gain remote access. Second, we looked at whether any of the devices used encryption and if not what type of content was exposed. Third, we used the network traffic `metadata' to identify the destination the data terminated. Finally, we examined the communication between the mobile app and the cloud to see if it can be easily exploited using a proxy server. Our findings show that the majority of devices have remote access unavailable. We found the Shannon entropy test a useful pre-test in identifying unencrypted content. Although many devices encrypted their data, we found several in particular smart cameras would send data in cleartext when they detected motion or during updates. We found the majority of data transverses to the US and stored on Amazon servers with most devices contacting multiple destination. Lastly, we discovered many of the IoT device's mobile apps can be easily exploited using a HTTP Proxy. Close https://www.sciencedirect.com/science/article/pii/S2666281721000214 doi:10.1016/j.fsidi.2021.301123 Close
33.	Zhang, Xiaolu; Breitinger, Frank; Luechinger, Engelbert; O'Shaughnessy, Stephen Android application forensics: A survey of obfuscation, obfuscation detection and deobfuscation techniques and their impact on investigations (Journal Article) In: Forensic Science International: Digital Investigation, vol. 39, pp. 301285, 2021, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{Zhang2021android, title = {Android application forensics: A survey of obfuscation, obfuscation detection and deobfuscation techniques and their impact on investigations}, author = {Xiaolu Zhang and Frank Breitinger and Engelbert Luechinger and Stephen O'Shaughnessy}, url = {https://www.sciencedirect.com/science/article/pii/S2666281721002031}, doi = {10.1016/j.fsidi.2021.301285}, issn = {2666-2817}, year = {2021}, date = {2021-10-06}, journal = {Forensic Science International: Digital Investigation}, volume = {39}, pages = {301285}, abstract = {Android obfuscation techniques include not only classic code obfuscation techniques that were adapted to Android, but also obfuscation methods that target the Android platform specifically. This work examines the status-quo of Android obfuscation, obfuscation detection and deobfuscation. Specifically, it first summarizes obfuscation approaches that are commonly used by app developers for code optimization, to protect their software against code theft and code tampering but are also frequently misused by malware developers to circumvent anti-malware products. Secondly, the article focuses on obfuscation detection techniques and presents various available tools and current research. Thirdly, deobfuscation (which aims at reinstating the original state before obfuscation) is discussed followed by a brief discussion how this impacts forensic investigation. We conclude that although obfuscation is widely used in Android app development (benign and malicious), available tools and the practices on how to deal with obfuscation are not standardized, and so are inherently lacking from a forensic standpoint.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Android obfuscation techniques include not only classic code obfuscation techniques that were adapted to Android, but also obfuscation methods that target the Android platform specifically. This work examines the status-quo of Android obfuscation, obfuscation detection and deobfuscation. Specifically, it first summarizes obfuscation approaches that are commonly used by app developers for code optimization, to protect their software against code theft and code tampering but are also frequently misused by malware developers to circumvent anti-malware products. Secondly, the article focuses on obfuscation detection techniques and presents various available tools and current research. Thirdly, deobfuscation (which aims at reinstating the original state before obfuscation) is discussed followed by a brief discussion how this impacts forensic investigation. We conclude that although obfuscation is widely used in Android app development (benign and malicious), available tools and the practices on how to deal with obfuscation are not standardized, and so are inherently lacking from a forensic standpoint. Close https://www.sciencedirect.com/science/article/pii/S2666281721002031 doi:10.1016/j.fsidi.2021.301285 Close
34.	O'Shaughnessy, Stephen; Breitinger, Frank Malware family classification via efficient Huffman features (Journal Article) In: Forensic Science International: Digital Investigation, vol. 37, pp. 301192, 2021, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{OShaughnessy2021malware, title = {Malware family classification via efficient Huffman features}, author = {Stephen O'Shaughnessy and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281721001001}, doi = {10.1016/j.fsidi.2021.301192}, issn = {2666-2817}, year = {2021}, date = {2021-07-14}, booktitle = {Proceedings of the Twenty First Annual DFRWS USA}, journal = {Forensic Science International: Digital Investigation}, volume = {37}, pages = {301192}, abstract = {As malware evolves and becomes more complex, researchers strive to develop detection and classification schemes that abstract away from the internal intricacies of binary code to represent malware without the need for architectural knowledge or invasive analysis procedures. Such approaches can reduce the complexities of feature generation and simplify the analysis process. In this paper, we present efficient Huffman features (eHf), a novel compression-based approach to feature construction, based on Huffman encoding, where malware features are represented in a compact format, without the need for intrusive reverse-engineering or dynamic analysis processes. We demonstrate the viability of eHf as a solution for classifying malware into their respective families on a large malware corpus of 15 k samples, indicative of the current threat landscape. We evaluate eHf against current compression-based alternatives and show that our method is comparable or superior for classification accuracy, while exhibiting considerably greater runtime efficiency. Finally we demonstrate that eHf is resilient against code reordering obfuscation.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close As malware evolves and becomes more complex, researchers strive to develop detection and classification schemes that abstract away from the internal intricacies of binary code to represent malware without the need for architectural knowledge or invasive analysis procedures. Such approaches can reduce the complexities of feature generation and simplify the analysis process. In this paper, we present efficient Huffman features (eHf), a novel compression-based approach to feature construction, based on Huffman encoding, where malware features are represented in a compact format, without the need for intrusive reverse-engineering or dynamic analysis processes. We demonstrate the viability of eHf as a solution for classifying malware into their respective families on a large malware corpus of 15 k samples, indicative of the current threat landscape. We evaluate eHf against current compression-based alternatives and show that our method is comparable or superior for classification accuracy, while exhibiting considerably greater runtime efficiency. Finally we demonstrate that eHf is resilient against code reordering obfuscation. Close https://www.sciencedirect.com/science/article/pii/S2666281721001001 doi:10.1016/j.fsidi.2021.301192 Close
35.	Hranický, Radek; Breitinger, Frank; Ryšavý, Ondřej; Sheppard, John; Schaedler, Florin; Morgenstern, Holger; Malik, Simon What do incident response practitioners need to know? A skillmap for the years ahead (Journal Article) In: Forensic Science International: Digital Investigation, vol. 37, pp. 301184, 2021, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{hranicky2021what, title = {What do incident response practitioners need to know? A skillmap for the years ahead}, author = {Radek Hranický and Frank Breitinger and Ondřej Ryšavý and John Sheppard and Florin Schaedler and Holger Morgenstern and Simon Malik}, url = {https://www.sciencedirect.com/science/article/pii/S2666281721000925}, doi = {10.1016/j.fsidi.2021.301184}, issn = {2666-2817}, year = {2021}, date = {2021-07-14}, booktitle = {Proceedings of the Twenty First Annual DFRWS USA}, journal = {Forensic Science International: Digital Investigation}, volume = {37}, pages = {301184}, abstract = {Digital forensics incident response (DFIR) specialists are expected to possess multidisciplinary skills including expert knowledge of computer-related principles and technology. On the other hand, recent studies suggest that existing training and study programs may not fully address the needs of future DFIR professionals. To reveal possible gaps in practitioners education and identify the most needed skills, we built a skillmap for DFIR where we followed a threefold approach: (1) an online survey among DFIR experts; (2) a review of training programs; and (3) an analysis of job listings on LinkedIn. Each source was first analyzed on its own and the findings were merged into a DFIR skillmap which is the main contribution of this article. The results show that network forensics and incident handling are the most demanded domains of skills. While these are covered by existing courses the newly desired skills, in particular, cloud forensics and encrypted data, need to get more space in training and education. We hope that this article provides educators with information on ways to improve in the years ahead.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Digital forensics incident response (DFIR) specialists are expected to possess multidisciplinary skills including expert knowledge of computer-related principles and technology. On the other hand, recent studies suggest that existing training and study programs may not fully address the needs of future DFIR professionals. To reveal possible gaps in practitioners education and identify the most needed skills, we built a skillmap for DFIR where we followed a threefold approach: (1) an online survey among DFIR experts; (2) a review of training programs; and (3) an analysis of job listings on LinkedIn. Each source was first analyzed on its own and the findings were merged into a DFIR skillmap which is the main contribution of this article. The results show that network forensics and incident handling are the most demanded domains of skills. While these are covered by existing courses the newly desired skills, in particular, cloud forensics and encrypted data, need to get more space in training and education. We hope that this article provides educators with information on ways to improve in the years ahead. Close https://www.sciencedirect.com/science/article/pii/S2666281721000925 doi:10.1016/j.fsidi.2021.301184 Close
36.	Martín-Pérez, Miguel; Rodríguez, Ricardo J.; Breitinger, Frank Bringing order to approximate matching: Classification and attacks on similarity digest algorithms (Journal Article) In: Forensic Science International: Digital Investigation, pp. 301120, 2021, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{martinperez2021bringing, title = {Bringing order to approximate matching: Classification and attacks on similarity digest algorithms}, author = {Miguel Martín-Pérez and Ricardo J. Rodríguez and Frank Breitinger}, url = {https://www.sciencedirect.com/science/article/pii/S2666281721000172}, doi = {10.1016/j.fsidi.2021.301120}, issn = {2666-2817}, year = {2021}, date = {2021-03-30}, journal = {Forensic Science International: Digital Investigation}, pages = {301120}, abstract = {Fuzzy hashing or similarity hashing (a.k.a. bytewise approximate matching) converts digital artifacts into an intermediate representation to allow an efficient (fast) identification of similar objects, e.g., for blacklisting. They gained a lot of popularity over the past decade with new algorithms being developed and released to the digital forensics community. When releasing algorithms (e.g., as part of a scientific article), they are frequently compared with other algorithms to outline the benefits and sometimes also the weaknesses of the proposed approach. However, given the wide variety of algorithms and approaches, it is impossible to provide direct comparisons with all existing algorithms. In this paper, we present the first classification of approximate matching algorithms which allows an easier description and comparisons. Therefore, we first reviewed existing literature to understand the techniques various algorithms use and to familiarize ourselves with the common terminology. Our findings allowed us to develop a categorization relying heavily on the terminology proposed by NIST SP 800-168. In addition to the categorization, this article presents an abstract set of attacks against algorithms and why they are feasible. Lastly, we detail the characteristics needed to build robust algorithms to prevent attacks. We believe that this article helps newcomers, practitioners, and experts alike to better compare algorithms, understand their potential, as well as characteristics and implications they may have on forensic investigations.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Fuzzy hashing or similarity hashing (a.k.a. bytewise approximate matching) converts digital artifacts into an intermediate representation to allow an efficient (fast) identification of similar objects, e.g., for blacklisting. They gained a lot of popularity over the past decade with new algorithms being developed and released to the digital forensics community. When releasing algorithms (e.g., as part of a scientific article), they are frequently compared with other algorithms to outline the benefits and sometimes also the weaknesses of the proposed approach. However, given the wide variety of algorithms and approaches, it is impossible to provide direct comparisons with all existing algorithms. In this paper, we present the first classification of approximate matching algorithms which allows an easier description and comparisons. Therefore, we first reviewed existing literature to understand the techniques various algorithms use and to familiarize ourselves with the common terminology. Our findings allowed us to develop a categorization relying heavily on the terminology proposed by NIST SP 800-168. In addition to the categorization, this article presents an abstract set of attacks against algorithms and why they are feasible. Lastly, we detail the characteristics needed to build robust algorithms to prevent attacks. We believe that this article helps newcomers, practitioners, and experts alike to better compare algorithms, understand their potential, as well as characteristics and implications they may have on forensic investigations. Close https://www.sciencedirect.com/science/article/pii/S2666281721000172 doi:10.1016/j.fsidi.2021.301120 Close
37.	Pluskal, Jan; Breitinger, Frank; Ryšavý, Ondřej Netfox detective: A novel open-source network forensics analysis tool (Journal Article) In: Forensic Science International: Digital Investigation, vol. 35, pp. 301019, 2020, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{pluskal2020netfox, title = {Netfox detective: A novel open-source network forensics analysis tool}, author = {Jan Pluskal and Frank Breitinger and Ondřej Ryšavý}, url = {http://www.sciencedirect.com/science/article/pii/S2666281720300871}, doi = {10.1016/j.fsidi.2020.301019}, issn = {2666-2817}, year = {2020}, date = {2020-09-17}, journal = {Forensic Science International: Digital Investigation}, volume = {35}, pages = {301019}, abstract = {Network forensics is a major sub-discipline of digital forensics which becomes more and more important in an age where everything is connected. In order to cope with the amounts of data and other challenges within networks, practitioners require powerful tools that support them. In this paper, we highlight a novel open-source network forensic tool named – Netfox Detective – that outperforms existing tools such as Wireshark or NetworkMiner in certain areas. For instance, it provides a heuristically based engine for traffic processing that can be easily extended. Using robust parsers (we are not solely relying on the RFC description but use heuristics), our application tolerates malformed or missing conversation segments. Besides outlining the tool's architecture and basic processing concepts, we also explain how it can be extended. Lastly, a comparison with other similar tools is presented as well as a real-world scenario is discussed.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Network forensics is a major sub-discipline of digital forensics which becomes more and more important in an age where everything is connected. In order to cope with the amounts of data and other challenges within networks, practitioners require powerful tools that support them. In this paper, we highlight a novel open-source network forensic tool named – Netfox Detective – that outperforms existing tools such as Wireshark or NetworkMiner in certain areas. For instance, it provides a heuristically based engine for traffic processing that can be easily extended. Using robust parsers (we are not solely relying on the RFC description but use heuristics), our application tolerates malformed or missing conversation segments. Besides outlining the tool's architecture and basic processing concepts, we also explain how it can be extended. Lastly, a comparison with other similar tools is presented as well as a real-world scenario is discussed. Close http://www.sciencedirect.com/science/article/pii/S2666281720300871 doi:10.1016/j.fsidi.2020.301019 Close
38.	Breitinger, Frank; Tully-Doyle, Ryan; Przyborski, Kristen; Beck, Lauren; Harichandran, Ronald S. First year students' experience in a Cyber World course – an evaluation (Journal Article) In: Education and Information Technologies, 2020, ISBN: 1573-7608. (Abstract \| Links \| BibTeX) @article{Breitinger2020, title = {First year students' experience in a Cyber World course – an evaluation}, author = {Frank Breitinger and Ryan Tully-Doyle and Kristen Przyborski and Lauren Beck and Ronald S. Harichandran}, url = {https://link.springer.com/article/10.1007/s10639-020-10327-9}, doi = {10.1007/s10639-020-10274-5}, isbn = {1573-7608}, year = {2020}, date = {2020-09-11}, journal = {Education and Information Technologies}, abstract = {Although cybersecurity is a major present concern, it is not a required subject in University. In response, we developed Cyber World which introduces students to eight highly important cybersecurity topics (primarily taught by none cybersecurity experts). We embedded it into our critical thinking Common Course (core curriculum) which is a team-taught first-year experience required for all students. Cyber World was first taught in Fall 2018 to a cohort of over 150 students from various majors at the University of New Haven. This article presents the evaluation of our Fall taught course. In detail, we compare the performance of Cyber World students to other Common Course sections that ran in parallel and conclude that despite the higher workload students performed equally well. Furthermore, we assess the students' development throughout the course with respect to their cybersecurity knowledge where our results indicate a significant gain of knowledge. Note, this article also presents the idea and topics of Cyber World; however a detailed explanation has been released previously.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Although cybersecurity is a major present concern, it is not a required subject in University. In response, we developed Cyber World which introduces students to eight highly important cybersecurity topics (primarily taught by none cybersecurity experts). We embedded it into our critical thinking Common Course (core curriculum) which is a team-taught first-year experience required for all students. Cyber World was first taught in Fall 2018 to a cohort of over 150 students from various majors at the University of New Haven. This article presents the evaluation of our Fall taught course. In detail, we compare the performance of Cyber World students to other Common Course sections that ran in parallel and conclude that despite the higher workload students performed equally well. Furthermore, we assess the students' development throughout the course with respect to their cybersecurity knowledge where our results indicate a significant gain of knowledge. Note, this article also presents the idea and topics of Cyber World; however a detailed explanation has been released previously. Close https://link.springer.com/article/10.1007/s10639-020-10327-9 doi:10.1007/s10639-020-10274-5 Close
39.	Wu, Tina; Breitinger, Frank; O'Shaughnessy, Stephen Digital forensic tools: Recent advances and enhancing the status quo (Journal Article) In: Forensic Science International: Digital Investigation, vol. 34, pp. 300999, 2020, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{WBS20, title = {Digital forensic tools: Recent advances and enhancing the status quo}, author = {Tina Wu and Frank Breitinger and Stephen O'Shaughnessy}, url = {http://www.sciencedirect.com/science/article/pii/S2666281720301864}, doi = {10.1016/j.fsidi.2020.300999}, issn = {2666-2817}, year = {2020}, date = {2020-08-14}, journal = {Forensic Science International: Digital Investigation}, volume = {34}, pages = {300999}, abstract = {Publications in the digital forensics domain frequently come with tools – a small piece of functional software. These tools are often released to the public for others to reproduce results or use them for their own purposes. However, there has been no study on the tools to understand better what is available and what is missing. For this paper we analyzed almost 800 articles from pertinent venues from 2014 to 2019 to answer the following three questions (1) what tools (i.e., in which domains of digital forensics): have been released; (2) are they still available, maintained, and documented; and (3) are there possibilities to enhance the status quo? We found 62 different tools which we categorized according to digital forensics subfields. Only 33 of these tools were found to be publicly available, the majority of these were not maintained after development. In order to enhance the status quo, one recommendation is a centralized repository specifically for tested tools. This will require tool researchers (developers) to spend more time on code documentation and preferably develop plugins instead of stand-alone tools.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Publications in the digital forensics domain frequently come with tools – a small piece of functional software. These tools are often released to the public for others to reproduce results or use them for their own purposes. However, there has been no study on the tools to understand better what is available and what is missing. For this paper we analyzed almost 800 articles from pertinent venues from 2014 to 2019 to answer the following three questions (1) what tools (i.e., in which domains of digital forensics): have been released; (2) are they still available, maintained, and documented; and (3) are there possibilities to enhance the status quo? We found 62 different tools which we categorized according to digital forensics subfields. Only 33 of these tools were found to be publicly available, the majority of these were not maintained after development. In order to enhance the status quo, one recommendation is a centralized repository specifically for tested tools. This will require tool researchers (developers) to spend more time on code documentation and preferably develop plugins instead of stand-alone tools. Close http://www.sciencedirect.com/science/article/pii/S2666281720301864 doi:10.1016/j.fsidi.2020.300999 Close
40.	Palmbach, David; Breitinger, Frank Artifacts for detecting timestamp manipulation in NTFS on Windows and their reliability (Journal Article) In: Forensic Science International: Digital Investigation, vol. 32, pp. 300920, 2020, ISSN: 2666-2817. (Abstract \| Links \| BibTeX) @article{PB20, title = {Artifacts for detecting timestamp manipulation in NTFS on Windows and their reliability}, author = {David Palmbach and Frank Breitinger}, url = {http://www.sciencedirect.com/science/article/pii/S2666281720300159}, doi = {10.1016/j.fsidi.2020.300920}, issn = {2666-2817}, year = {2020}, date = {2020-06-04}, journal = {Forensic Science International: Digital Investigation}, volume = {32}, pages = {300920}, abstract = {Timestamps have proven to be an expedient source of evidence for examiners in the reconstruction of computer crimes. Consequently, active adversaries and malware have implemented timestomping techniques (i.e., mechanisms to alter timestamps) to hide their traces. Previous research on detecting timestamp manipulation primarily focused on two artifacts: the $MFT as well as the records in the $LogFile. In this paper, we present a new use of four existing windows artifacts – the $USNjrnl, link files, prefetch files, and Windows event logs – that can provide valuable information during investigations and diversify the artifacts available to examiners. These artifacts contain either information about executed programs or additional timestamps which, when inconsistencies occur, can be used to prove timestamp forgery. Furthermore, we examine the reliability of artifacts being used to detect timestamp manipulation, i.e., testing their ability to retain information against users actively trying to alter or delete them. Based on our findings we conclude that none of the artifacts analyzed can withstand active exploitation.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Timestamps have proven to be an expedient source of evidence for examiners in the reconstruction of computer crimes. Consequently, active adversaries and malware have implemented timestomping techniques (i.e., mechanisms to alter timestamps) to hide their traces. Previous research on detecting timestamp manipulation primarily focused on two artifacts: the $MFT as well as the records in the $LogFile. In this paper, we present a new use of four existing windows artifacts – the $USNjrnl, link files, prefetch files, and Windows event logs – that can provide valuable information during investigations and diversify the artifacts available to examiners. These artifacts contain either information about executed programs or additional timestamps which, when inconsistencies occur, can be used to prove timestamp forgery. Furthermore, we examine the reliability of artifacts being used to detect timestamp manipulation, i.e., testing their ability to retain information against users actively trying to alter or delete them. Based on our findings we conclude that none of the artifacts analyzed can withstand active exploitation. Close http://www.sciencedirect.com/science/article/pii/S2666281720300159 doi:10.1016/j.fsidi.2020.300920 Close
41.	Laskov, Pavel; Breitinger, Frank Blockchain-Technologien und deren Anwendungen im öffentlichen Sektor (Miscellaneous) Workshop Liechtensteinische Landesverwaltung, 2020, (Vaduz, Liechtenstein). (BibTeX) @misc{work-BC, title = {Blockchain-Technologien und deren Anwendungen im öffentlichen Sektor}, author = {Pavel Laskov and Frank Breitinger}, year = {2020}, date = {2020-02-19}, howpublished = {Workshop Liechtensteinische Landesverwaltung}, note = {Vaduz, Liechtenstein}, keywords = {}, pubstate = {published}, tppubtype = {misc} } Close
42.	Moia, Vitor Hugo Galhardo; Breitinger, Frank; Henriques, Marco Aurélio Amaral The impact of excluding common blocks for approximate matching (Journal Article) In: Computers & Security, vol. 89, pp. 101676, 2019, ISSN: 0167-4048. (Abstract \| Links \| BibTeX) @article{MOIA2020101676, title = {The impact of excluding common blocks for approximate matching}, author = {Vitor Hugo Galhardo Moia and Frank Breitinger and Marco Aurélio Amaral Henriques}, url = {http://www.sciencedirect.com/science/article/pii/S0167404819302159}, doi = {10.1016/j.cose.2019.101676}, issn = {0167-4048}, year = {2019}, date = {2019-11-28}, journal = {Computers & Security}, volume = {89}, pages = {101676}, abstract = {Approximate matching functions allow the identification of similarity (bytewise level) in a very efficient way, by creating and comparing compact representations of objects (a.k.a digests). However, many similarity matches occur due to common data that repeats over many different files and consist of inner structure, header and footer information, color tables, font specifications, etc.; data created by applications and not generated by users. Most of the times, this sort of information is less relevant from an investigator perspective and should be avoided. In this work, we show how the common data can be identified and filtered out by using approximate matching, as well as how they are spread over different file types and their frequency. We assess the impact on similarity when removing it (i.e., in the number of matches) and the effects on performance. Our results show that for a small price on performance, a reduction about 87% on the number of matches can be achieved when removing such data.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Approximate matching functions allow the identification of similarity (bytewise level) in a very efficient way, by creating and comparing compact representations of objects (a.k.a digests). However, many similarity matches occur due to common data that repeats over many different files and consist of inner structure, header and footer information, color tables, font specifications, etc.; data created by applications and not generated by users. Most of the times, this sort of information is less relevant from an investigator perspective and should be avoided. In this work, we show how the common data can be identified and filtered out by using approximate matching, as well as how they are spread over different file types and their frequency. We assess the impact on similarity when removing it (i.e., in the number of matches) and the effects on performance. Our results show that for a small price on performance, a reduction about 87% on the number of matches can be achieved when removing such data. Close http://www.sciencedirect.com/science/article/pii/S0167404819302159 doi:10.1016/j.cose.2019.101676 Close
43.	Breitinger, Frank; Tully-Doyle, Ryan; Hassenfeldt, Courtney A survey on smartphone user's security choices, awareness and education (Journal Article) In: Computers & Security, vol. 88, pp. 101647, 2019, ISSN: 0167-4048. (Abstract \| Links \| BibTeX) @article{BTH20, title = {A survey on smartphone user's security choices, awareness and education}, author = {Frank Breitinger and Ryan Tully-Doyle and Courtney Hassenfeldt}, url = {http://www.sciencedirect.com/science/article/pii/S0167404819301919}, doi = {10.1016/j.cose.2019.101647}, issn = {0167-4048}, year = {2019}, date = {2019-10-11}, journal = {Computers & Security}, volume = {88}, pages = {101647}, abstract = {Smartphones contain a significant amount of personal data. Additionally, they are always in the user's possession, which allows them to be abused for tracking (e.g., GPS, Bluetooth or WiFi tracking). In order to not reveal private information, smartphone users should secure their devices by setting lock screen protection, using third party security applications, and choosing appropriate security settings (often, default settings are inadequate). In this paper, we mount a survey to explore user choices, awareness and education with respect to cybersecurity. In comparison with prior work, we take the user's cybersecurity familiarity into consideration in the analysis of user practices as well as have a strong focus on the younger generations, Y and Z. Our survey findings suggest that most users have appropriate lock screen settings to protect their phones from physical access; however, they disregard other security best practices, e.g., not using a VPN when connecting to a public WiFi or turning off unused features (regardless of level of expertise). Compared to desktop computers, smartphones are less secured and fewer third party security products are installed.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Smartphones contain a significant amount of personal data. Additionally, they are always in the user's possession, which allows them to be abused for tracking (e.g., GPS, Bluetooth or WiFi tracking). In order to not reveal private information, smartphone users should secure their devices by setting lock screen protection, using third party security applications, and choosing appropriate security settings (often, default settings are inadequate). In this paper, we mount a survey to explore user choices, awareness and education with respect to cybersecurity. In comparison with prior work, we take the user's cybersecurity familiarity into consideration in the analysis of user practices as well as have a strong focus on the younger generations, Y and Z. Our survey findings suggest that most users have appropriate lock screen settings to protect their phones from physical access; however, they disregard other security best practices, e.g., not using a VPN when connecting to a public WiFi or turning off unused features (regardless of level of expertise). Compared to desktop computers, smartphones are less secured and fewer third party security products are installed. Close http://www.sciencedirect.com/science/article/pii/S0167404819301919 doi:10.1016/j.cose.2019.101647 Close
44.	Breitinger, Frank IT-Sicherheit im Finanzsektor (Miscellaneous) 7. Sorgfaltspflichttag Liechtenstein, 2019, (Schaan, Liechtenstein). (BibTeX) @misc{pres-SPG, title = {IT-Sicherheit im Finanzsektor}, author = {Frank Breitinger}, year = {2019}, date = {2019-10-01}, howpublished = {7. Sorgfaltspflichttag Liechtenstein}, note = {Schaan, Liechtenstein}, keywords = {}, pubstate = {published}, tppubtype = {misc} } Close
45.	Moia, Vitor Hugo Galhardo; Breitinger, Frank; Henriques, Marco Aurélio Amaral Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations (Proceedings Article) In: XIX Brazilian Symposium on information and computational systems security, Brazilian Computer Society (SBC) SÃpounds o Paulo-SP, Brazil 2019, (bf Best Paper Award). (Abstract \| Links \| BibTeX) @inproceedings{MBH19, title = {Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations}, author = {Vitor Hugo Galhardo Moia and Frank Breitinger and Marco Aurélio Amaral Henriques}, url = {https://sol.sbc.org.br/index.php/sbseg/article/download/13966/13815}, year = {2019}, date = {2019-09-05}, booktitle = {XIX Brazilian Symposium on information and computational systems security}, organization = {Brazilian Computer Society (SBC) SÃpounds o Paulo-SP, Brazil}, abstract = {Finding similarity in digital forensics investigations can be assisted with the use of Approximate Matching (AM) functions. These algorithms create small and compact representations of objects (similar to hashes) which can be compared to identify similarity. However, often results are biased due to common blocks (data structures found in many different files regardless of content). In this paper, we evaluate the precision and recall metrics for AM functions when removing common blocks. In detail, we analyze how the similarity score changes and impacts different investigation scenarios. Results show that many irrelevant matches can be filtered out and that a new interpretation of the score allows a better similarity detection.}, note = {bf Best Paper Award}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close Finding similarity in digital forensics investigations can be assisted with the use of Approximate Matching (AM) functions. These algorithms create small and compact representations of objects (similar to hashes) which can be compared to identify similarity. However, often results are biased due to common blocks (data structures found in many different files regardless of content). In this paper, we evaluate the precision and recall metrics for AM functions when removing common blocks. In detail, we analyze how the similarity score changes and impacts different investigation scenarios. Results show that many irrelevant matches can be filtered out and that a new interpretation of the score allows a better similarity detection. Close https://sol.sbc.org.br/index.php/sbseg/article/download/13966/13815 Close
46.	Wu, Tina; Breitinger, Frank; Baggili, Ibrahim IoT Ignorance is Digital Forensics Research Bliss: A Survey to Understand IoT Forensics Definitions, Challenges and Future Research Directions (Proceedings Article) In: Proceedings of the 14th International Conference on Availability, Reliability and Security, pp. 46:1–46:15, ACM, Canterbury, CA, United Kingdom, 2019, ISBN: 978-1-4503-7164-3. (Links \| BibTeX) @inproceedings{WBB19, title = {IoT Ignorance is Digital Forensics Research Bliss: A Survey to Understand IoT Forensics Definitions, Challenges and Future Research Directions}, author = {Tina Wu and Frank Breitinger and Ibrahim Baggili}, url = {http://doi.acm.org/10.1145/3339252.3340504}, doi = {10.1145/3339252.3340504}, isbn = {978-1-4503-7164-3}, year = {2019}, date = {2019-08-25}, booktitle = {Proceedings of the 14th International Conference on Availability, Reliability and Security}, pages = {46:1–46:15}, publisher = {ACM}, address = {Canterbury, CA, United Kingdom}, series = {ARES '19}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close http://doi.acm.org/10.1145/3339252.3340504 doi:10.1145/3339252.3340504 Close
47.	Casey, Peter; Lindsay-Decusati, Rebecca; Baggili, Ibrahim; Breitinger, Frank Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive (Journal Article) In: Digital Investigation, vol. 29, pp. S13 - S21, 2019, ISSN: 1742-2876. (Abstract \| Links \| BibTeX) @article{CASEY2019S13, title = {Inception: Virtual Space in Memory Space in Real Space – Memory Forensics of Immersive Virtual Reality with the HTC Vive}, author = {Peter Casey and Rebecca Lindsay-Decusati and Ibrahim Baggili and Frank Breitinger}, url = {http://www.sciencedirect.com/science/article/pii/S1742287619301562}, doi = {10.1016/j.diin.2019.04.007}, issn = {1742-2876}, year = {2019}, date = {2019-07-14}, journal = {Digital Investigation}, volume = {29}, pages = {S13 - S21}, abstract = {Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional ``dead'' analysis. Following the trend of anti-forensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable of reconstructing a visualization of the room setup a VR player was immersed into. In specific, we demonstrate that the VE, location, state and class of VR devices can be extracted from memory. Our work resulted in the first open source VR memory forensics plugin for the Volatility Framework. We discuss our findings, and our replicable approach that may be used in future memory forensics research.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close Virtual Reality (VR) has become a reality. With the technology's increased use cases, comes its misuse. Malware affecting the Virtual Environment (VE) may prevent an investigator from ascertaining virtual information from a physical scene, or from traditional ``dead'' analysis. Following the trend of anti-forensics, evidence of an attack may only be found in memory, along with many other volatile data points. Our work provides the primary account for the memory forensics of Immersive VR systems, and in specific the HTC Vive. Our approach is capable of reconstituting artifacts from memory that are relevant to the VE, and is also capable of reconstructing a visualization of the room setup a VR player was immersed into. In specific, we demonstrate that the VE, location, state and class of VR devices can be extracted from memory. Our work resulted in the first open source VR memory forensics plugin for the Volatility Framework. We discuss our findings, and our replicable approach that may be used in future memory forensics research. Close http://www.sciencedirect.com/science/article/pii/S1742287619301562 doi:10.1016/j.diin.2019.04.007 Close
48.	Przyborski, Kristen; Breitinger, Frank; Beck, Lauren; Harichandran, Ronald S. `Cyber World' as a Theme for a University-wide First-year Common Course (Proceedings Article) In: 2019 ASEE Annual Conference & Exposition, ASEE Conferences, Tampa, Florida, 2019, (urlhttps://peer.asee.org/31923). (Links \| BibTeX) @inproceedings{Przyborski2019, title = {`Cyber World' as a Theme for a University-wide First-year Common Course}, author = {Kristen Przyborski and Frank Breitinger and Lauren Beck and Ronald S. Harichandran}, doi = {10.18260/1-2–31923}, year = {2019}, date = {2019-06-01}, booktitle = {2019 ASEE Annual Conference & Exposition}, publisher = {ASEE Conferences}, address = {Tampa, Florida}, note = {urlhttps://peer.asee.org/31923}, keywords = {}, pubstate = {published}, tppubtype = {inproceedings} } Close doi:10.18260/1-2–31923 Close
49.	Liebler, Lorenz; Schmitt, Patrick; Baier, Harald; Breitinger, Frank On efficiency of artifact lookup strategies in digital forensics (Journal Article) In: Digital Investigation, vol. 28, pp. S116 - S125, 2019, ISSN: 1742-2876. (Abstract \| Links \| BibTeX) @article{LSB19, title = {On efficiency of artifact lookup strategies in digital forensics}, author = {Lorenz Liebler and Patrick Schmitt and Harald Baier and Frank Breitinger}, url = {http://www.sciencedirect.com/science/article/pii/S1742287619300301}, doi = {10.1016/j.diin.2019.01.020}, issn = {1742-2876}, year = {2019}, date = {2019-04-24}, journal = {Digital Investigation}, volume = {28}, pages = {S116 - S125}, abstract = {In recent years different strategies have been proposed to handle the problem of ever-growing digital forensic databases. One concept to deal with this data overload is data reduction, which essentially means to separate the wheat from the chaff, e.g., to filter in forensically relevant data. A prominent technique in the context of data reduction are hash-based solutions. Data reduction is achieved because hash values (of possibly large data input) are much smaller than the original input. Today's approaches of storing hash-based data fragments reach from large scale multithreaded databases to simple Bloom filter representations. One main focus was put on the field of approximate matching, where sorting is a problem due to the fuzzy nature of the approximate hashes. A crucial step during digital forensic analysis is to achieve fast query times during lookup (e.g., against a blacklist), especially in the scope of small or ordinary resource availability. However, a comparison of different database and lookup approaches is considerably hard, as most techniques partially differ in considered use-case and integrated features, respectively. In this work we discuss, reassess and extend three widespread lookup strategies suitable for storing hash-based fragments: (1) Hashdatabase for hash-based carving (hashdb), (2) hierarchical Bloom filter trees (hbft) and (3) flat hash maps (fhmap). We outline the capabilities of the different approaches, integrate new extensions, discuss possible features and perform a detailed evaluation with a special focus on runtime efficiency. Our results reveal major advantages for fhmap in case of runtime performance and applicability. hbft showed a comparable runtime efficiency in case of lookups, but hbft suffers from pitfalls with respect to extensibility and maintenance. Finally, hashdb performs worst in case of a single core environment in all evaluation scenarios. However, hashdb is the only candidate which offers full parallelization capabilities, transactional features, and a Single-level storage.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close In recent years different strategies have been proposed to handle the problem of ever-growing digital forensic databases. One concept to deal with this data overload is data reduction, which essentially means to separate the wheat from the chaff, e.g., to filter in forensically relevant data. A prominent technique in the context of data reduction are hash-based solutions. Data reduction is achieved because hash values (of possibly large data input) are much smaller than the original input. Today's approaches of storing hash-based data fragments reach from large scale multithreaded databases to simple Bloom filter representations. One main focus was put on the field of approximate matching, where sorting is a problem due to the fuzzy nature of the approximate hashes. A crucial step during digital forensic analysis is to achieve fast query times during lookup (e.g., against a blacklist), especially in the scope of small or ordinary resource availability. However, a comparison of different database and lookup approaches is considerably hard, as most techniques partially differ in considered use-case and integrated features, respectively. In this work we discuss, reassess and extend three widespread lookup strategies suitable for storing hash-based fragments: (1) Hashdatabase for hash-based carving (hashdb), (2) hierarchical Bloom filter trees (hbft) and (3) flat hash maps (fhmap). We outline the capabilities of the different approaches, integrate new extensions, discuss possible features and perform a detailed evaluation with a special focus on runtime efficiency. Our results reveal major advantages for fhmap in case of runtime performance and applicability. hbft showed a comparable runtime efficiency in case of lookups, but hbft suffers from pitfalls with respect to extensibility and maintenance. Finally, hashdb performs worst in case of a single core environment in all evaluation scenarios. However, hashdb is the only candidate which offers full parallelization capabilities, transactional features, and a Single-level storage. Close http://www.sciencedirect.com/science/article/pii/S1742287619300301 doi:10.1016/j.diin.2019.01.020 Close
50.	Ricci, Joseph; Baggili, Ibrahim; Breitinger, Frank Blockchain-Based Distributed Cloud Storage Digital Forensics: Where's the Beef? (Journal Article) In: IEEE Security & is Privacy, vol. 17, no. 1, pp. 34-42, 2019, ISSN: 1540-7993. (Abstract \| Links \| BibTeX) @article{RBB19, title = {Blockchain-Based Distributed Cloud Storage Digital Forensics: Where's the Beef?}, author = {Joseph Ricci and Ibrahim Baggili and Frank Breitinger}, doi = {10.1109/MSEC.2018.2875877}, issn = {1540-7993}, year = {2019}, date = {2019-01-01}, journal = {IEEE Security & is Privacy}, volume = {17}, number = {1}, pages = {34-42}, abstract = {The current state of the art in digital forensics has primarily focused on the acquisition of data from cloud storage. Here, we present a new challenge in digital forensics: blockchain-based distributed cloud storage, using STORJ as a technology example.}, keywords = {}, pubstate = {published}, tppubtype = {article} } Close The current state of the art in digital forensics has primarily focused on the acquisition of data from cloud storage. Here, we present a new challenge in digital forensics: blockchain-based distributed cloud storage, using STORJ as a technology example. Close doi:10.1109/MSEC.2018.2875877 Close

114 entries « ‹ 1 of 3 › »

Frank Breitinger

Chair for Cybersecurity, University of Augsburg (Germany)