{"id":297,"date":"2015-10-12T21:38:58","date_gmt":"2015-10-13T02:38:58","guid":{"rendered":"https:\/\/fbreitinger.de\/?page_id=297"},"modified":"2021-08-17T07:27:30","modified_gmt":"2021-08-17T12:27:30","slug":"all-publications-by-year","status":"publish","type":"page","link":"https:\/\/fbreitinger.de\/?page_id=297","title":{"rendered":"All publications by year"},"content":{"rendered":"
<\/a>
<\/div><\/div><\/form>
120 entries<\/span> «<\/a> ‹<\/a> 1 of 3 ›<\/a> »<\/a> <\/div><\/div>
1.<\/td>

K\u00fclper, Michael; Hilgert, Jan-Niclas; Breitinger, Frank; Lambertz, Martin<\/p>

What's Next, Cloud? A Forensic Framework for Analyzing Self-hosted Cloud Storage Solutions<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span> Choo, Kim-Kwang Raymond; Perez-Pons, Alexander; Upadhyay, Himanshu; Lu, Rongxing; Chow, Kam Pui (Ed.): Digital Forensics and Cyber Crime, <\/span>pp. 241\u2013263, <\/span>Springer Nature Switzerland, <\/span>Cham, <\/span>2026<\/span>, ISBN: 978-3-032-22542-9<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{10.1007\/978-3-032-22542-9_15,
\r\ntitle = {What's Next, Cloud? A Forensic Framework for Analyzing Self-hosted Cloud Storage Solutions},
\r\nauthor = {Michael K\u00fclper and Jan-Niclas Hilgert and Frank Breitinger and Martin Lambertz},
\r\neditor = {Kim-Kwang Raymond Choo and Alexander Perez-Pons and Himanshu Upadhyay and Rongxing Lu and Kam Pui Chow},
\r\ndoi = {10.1007\/978-3-032-22542-9_15},
\r\nisbn = {978-3-032-22542-9},
\r\nyear  = {2026},
\r\ndate = {2026-07-17},
\r\nbooktitle = {Digital Forensics and Cyber Crime},
\r\npages = {241\u2013263},
\r\npublisher = {Springer Nature Switzerland},
\r\naddress = {Cham},
\r\nabstract = {Self-hosted cloud storage platforms like Nextcloud are gaining popularity among individuals and organizations seeking greater control over their data. However, this shift introduces new challenges for digital forensic investigations, particularly in systematically analyzing both client and server components. Despite Nextcloud's widespread use, it has received limited attention in forensic research. In this work, we critically examine existing cloud storage forensic frameworks and highlight their limitations. To address the gaps, we propose an extended forensic framework that incorporates device monitoring and leverages cloud APIs for structured, repeatable evidence acquisition. Using Nextcloud as a case study, we demonstrate how its native APIs can be used to reliably access forensic artifacts, and we introduce an open-source acquisition tool that implements this approach. Our framework equips investigators with a more flexible method for analyzing self-hosted cloud storage systems, and offers a foundation for further development in this evolving area of digital forensics.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
2.<\/td>

Herrmann, Jessica; Breitinger, Frank<\/p>

KI in der Rechtspr\u00fcfung: Warum XAI allein nicht ausreicht<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>SIAK-Journal \u2212Zeitschrift f\u00fcr Polizeiwissenschaft und polizeiliche Praxis, <\/span>vol. 23, <\/span>no. 1, <\/span>pp. 85-101, <\/span>2026<\/span>, ISBN: 1813-3495<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{herrmann2026siak,
\r\ntitle = {KI in der Rechtspr\u00fcfung: Warum XAI allein nicht ausreicht},
\r\nauthor = {Jessica Herrmann AND Frank Breitinger},
\r\nurl = {https:\/\/www.bmi.gv.at\/104\/Wissenschaft_und_Forschung\/SIAK-Journal\/SIAK-Journal-Ausgaben\/Jahrgang_2026\/files\/Herrmann_1_2026.pdf},
\r\ndoi = {10.7396\/2026_1_G},
\r\nisbn = {1813-3495},
\r\nyear  = {2026},
\r\ndate = {2026-04-01},
\r\njournal = {SIAK-Journal \u2212Zeitschrift f\u00fcr Polizeiwissenschaft und polizeiliche Praxis},
\r\nvolume = {23},
\r\nnumber = {1},
\r\npages = {85-101},
\r\nedition = {3\/2026},
\r\nabstract = {Die juristische Subsumtion gilt seit jeher als Pr\u00fcfstein f\u00fcr die Leistungsf\u00e4higkeit moderner KI-Systeme. Trotz jahrzehntelanger Forschung gelingt es bislang kaum, juristische Pr\u00fcfschritte in ihrer dogmatischen Tiefe maschinell abzubilden. Fr\u00fche Expertensysteme scheiterten an starren Formalisierungen, aktuelle Sprachmodelle er\u00f6ffnen zwar neue M\u00f6glichkeiten, doch ihre Argumentationslogik bleibt probabilistisch und rechtlich nur eingeschr\u00e4nkt nachvollziehbar. Hier zeigt sich die Spannung zwischen technischer Leistungsf\u00e4higkeit und normativer Strukturtreue. KI-Modelle k\u00f6nnen plausibel klingende Texte erzeugen, ohne eine systematische Pr\u00fcfstruktur einzuhalten. Vor diesem Hintergrund stellt sich die Frage: Was fehlt noch zum KI-Richter und womit m\u00fcssen wir uns befassen, um eine rechtsstaatliche Einf\u00fchrung zu erm\u00f6glichen? Die meisten Verfahren der \u201eExplainable AI``(\u201eerkl\u00e4rbare KI``, XAI) liefern bislang lediglich technische Transparenz, nicht aber eine rechtsstaatlich tragf\u00e4hige Begr\u00fcndung im Sinne einer \u201eExplainability by Design``. Ein juristisch normiertes Lastenheft kann hier Ma\u00dfst\u00e4be setzen, indem es Anforderungen an Pr\u00fcfschritte, Alternativdarstellungen, Protokollierung und Zielgruppenad\u00e4quanz definiert. Dieser Artikel stellt den aktuellen Forschungsstand entlang von f\u00fcnf methodischen Hauptlinien dar: regelbasierte Systeme, sprachmodellbasierte Ans\u00e4tze, fall- und vektorbasierte Verfahren, wissensrepr\u00e4sentationsbasierte Modelle sowie hybride Architekturen und diskutiert ihre jeweiligen St\u00e4rken und Grenzen im Hinblick auf Transparenz, Flexibilit\u00e4t und dogmatische Steuerbarkeit. Im Zentrum steht die These, dass nur Systeme, die von vornherein so konstruiert sind, dass jeder Subsumtionsschritt explizit nachvollziehbar bleibt, perspektivisch als eigenst\u00e4ndige Entscheidungsinstanz diskutiert werden k\u00f6nnen.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Die juristische Subsumtion gilt seit jeher als Pr\u00fcfstein f\u00fcr die Leistungsf\u00e4higkeit moderner KI-Systeme. Trotz jahrzehntelanger Forschung gelingt es bislang kaum, juristische Pr\u00fcfschritte in ihrer dogmatischen Tiefe maschinell abzubilden. Fr\u00fche Expertensysteme scheiterten an starren Formalisierungen, aktuelle Sprachmodelle er\u00f6ffnen zwar neue M\u00f6glichkeiten, doch ihre Argumentationslogik bleibt probabilistisch und rechtlich nur eingeschr\u00e4nkt nachvollziehbar. Hier zeigt sich die Spannung zwischen technischer Leistungsf\u00e4higkeit und normativer Strukturtreue. KI-Modelle k\u00f6nnen plausibel klingende Texte erzeugen, ohne eine systematische Pr\u00fcfstruktur einzuhalten. Vor diesem Hintergrund stellt sich die Frage: Was fehlt noch zum KI-Richter und womit m\u00fcssen wir uns befassen, um eine rechtsstaatliche Einf\u00fchrung zu erm\u00f6glichen? Die meisten Verfahren der \u201eExplainable AI``(\u201eerkl\u00e4rbare KI``, XAI) liefern bislang lediglich technische Transparenz, nicht aber eine rechtsstaatlich tragf\u00e4hige Begr\u00fcndung im Sinne einer \u201eExplainability by Design``. Ein juristisch normiertes Lastenheft kann hier Ma\u00dfst\u00e4be setzen, indem es Anforderungen an Pr\u00fcfschritte, Alternativdarstellungen, Protokollierung und Zielgruppenad\u00e4quanz definiert. Dieser Artikel stellt den aktuellen Forschungsstand entlang von f\u00fcnf methodischen Hauptlinien dar: regelbasierte Systeme, sprachmodellbasierte Ans\u00e4tze, fall- und vektorbasierte Verfahren, wissensrepr\u00e4sentationsbasierte Modelle sowie hybride Architekturen und diskutiert ihre jeweiligen St\u00e4rken und Grenzen im Hinblick auf Transparenz, Flexibilit\u00e4t und dogmatische Steuerbarkeit. Im Zentrum steht die These, dass nur Systeme, die von vornherein so konstruiert sind, dass jeder Subsumtionsschritt explizit nachvollziehbar bleibt, perspektivisch als eigenst\u00e4ndige Entscheidungsinstanz diskutiert werden k\u00f6nnen.<\/div>
Close<\/a><\/p><\/div>
3.<\/td>

Michelet, Ga\u00ebtan; Schneider, Janine; Withanage, Aruna; Breitinger, Frank<\/p>

Hey GPT-OSS, looks like you got it \u2013 Now walk me through it! An assessment of the reasoning language models chain of thought process for digital forensics<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 56, <\/span>pp. 302052, <\/span>2026<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{MICHELET2026302052,
\r\ntitle = {Hey GPT-OSS, looks like you got it \u2013 Now walk me through it! An assessment of the reasoning language models chain of thought process for digital forensics},
\r\nauthor = {Ga{\u00eb}tan Michelet and Janine Schneider and Aruna Withanage and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281726000090},
\r\ndoi = {10.1016\/j.fsidi.2026.302052},
\r\nissn = {2666-2817},
\r\nyear  = {2026},
\r\ndate = {2026-03-24},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {56},
\r\npages = {302052},
\r\nabstract = {Large language models (LLMs), including systems such as ChatGPT, are increasingly examined for their role in digital forensics. Current research not only surveys their potential applications but also investigates how fine-tuning and model adaptation can enhance performance on specialized forensic tasks. However, the understandability and interpretability of the results (outputs) reduce their operational and legal usability. Recently, a new class of reasoning language models has emerged, designed to handle logic-based tasks through an `internal reasoning' mechanism. Yet, users typically only see the final answer, not the underlying reasoning. One of these reasoning models is gpt-oss, which can be deployed locally, providing full access to its underlying reasoning process. This article presents the first investigation into the potential of reasoning language models for digital forensics. Four test use cases are examined to assess the usability of the reasoning component in supporting results understandability. The evaluation combines a new quantitative metric with qualitative analysis. Findings show that the reasoning component aids in understanding, interpreting, and validating LLM outputs in digital forensics at medium reasoning levels, but the support is often limited, and higher reasoning levels do not enhance response quality.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Large language models (LLMs), including systems such as ChatGPT, are increasingly examined for their role in digital forensics. Current research not only surveys their potential applications but also investigates how fine-tuning and model adaptation can enhance performance on specialized forensic tasks. However, the understandability and interpretability of the results (outputs) reduce their operational and legal usability. Recently, a new class of reasoning language models has emerged, designed to handle logic-based tasks through an `internal reasoning' mechanism. Yet, users typically only see the final answer, not the underlying reasoning. One of these reasoning models is gpt-oss, which can be deployed locally, providing full access to its underlying reasoning process. This article presents the first investigation into the potential of reasoning language models for digital forensics. Four test use cases are examined to assess the usability of the reasoning component in supporting results understandability. The evaluation combines a new quantitative metric with qualitative analysis. Findings show that the reasoning component aids in understanding, interpreting, and validating LLM outputs in digital forensics at medium reasoning levels, but the support is often limited, and higher reasoning levels do not enhance response quality.<\/div>
Close<\/a><\/p><\/div>
4.<\/td>

Silalahi, Swardiantara; Ahmad, Tohari; Studiawan, Hudan; Breitinger, Frank<\/p>

DroPTC: Sentence-level drone flight log forensics using contrastive learning and explainable AI<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 56, <\/span>pp. 302051, <\/span>2026<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{SILALAHI2026302051,
\r\ntitle = {DroPTC: Sentence-level drone flight log forensics using contrastive learning and explainable AI},
\r\nauthor = {Swardiantara Silalahi and Tohari Ahmad and Hudan Studiawan and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281726000089},
\r\ndoi = {10.1016\/j.fsidi.2026.302051},
\r\nissn = {2666-2817},
\r\nyear  = {2026},
\r\ndate = {2026-03-24},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {56},
\r\npages = {302051},
\r\nabstract = {Unmanned Aerial Vehicles (UAVs), commonly known as drones, are increasingly deployed across diverse application domains, raising critical challenges for digital forensic investigation following safety incidents and system failures. In drone investigations, systematic analysis of flight logs is essential for reconstructing events, identifying root causes, and supporting reliable incident attribution and risk mitigation. Because a message may contain multiple sentences, message-level analysis cannot precisely pinpoint which log segment indicates a problem. Therefore, this paper proposes DroPTC (Drone Problem Type Classifier), an end-to-end framework to identify and classify problems at the sentence level. A rule-based segmenter is designed to segment log messages into sentences based on historical log characteristics. Using the resulting log sentences, a pre-trained embedding is fine-tuned using contrastive learning for semantic alignment. The integrated gradient is employed to enhance the model's interpretability, enabling admissible and trustworthy analysis. Sentence deduplication is utilized to identify unique log events, thereby reducing the analyst workload. Quantitative and qualitative analysis of the experimental results show that DroPTC outperforms the baselines in three aspects: performance, trustworthiness, and efficiency. This paper also presents a working open-source tool as the tested implementation of the proposed framework. The tool accepts the decrypted flight log file and produces a forensic report in HTML and PDF format.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Unmanned Aerial Vehicles (UAVs), commonly known as drones, are increasingly deployed across diverse application domains, raising critical challenges for digital forensic investigation following safety incidents and system failures. In drone investigations, systematic analysis of flight logs is essential for reconstructing events, identifying root causes, and supporting reliable incident attribution and risk mitigation. Because a message may contain multiple sentences, message-level analysis cannot precisely pinpoint which log segment indicates a problem. Therefore, this paper proposes DroPTC (Drone Problem Type Classifier), an end-to-end framework to identify and classify problems at the sentence level. A rule-based segmenter is designed to segment log messages into sentences based on historical log characteristics. Using the resulting log sentences, a pre-trained embedding is fine-tuned using contrastive learning for semantic alignment. The integrated gradient is employed to enhance the model's interpretability, enabling admissible and trustworthy analysis. Sentence deduplication is utilized to identify unique log events, thereby reducing the analyst workload. Quantitative and qualitative analysis of the experimental results show that DroPTC outperforms the baselines in three aspects: performance, trustworthiness, and efficiency. This paper also presents a working open-source tool as the tested implementation of the proposed framework. The tool accepts the decrypted flight log file and produces a forensic report in HTML and PDF format.<\/div>
Close<\/a><\/p><\/div>
5.<\/td>

Wickramasekara, Akila; Mihiranga, Tharusha; Withanage, Aruna; Weerasinghe, Buddhima; Breitinger, Frank; Sheppard, John; Scanlon, Mark<\/p>

AutoDFBench 1.0: A benchmarking framework for digital forensic tool testing and generated code evaluation<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 56, <\/span>pp. 302055, <\/span>2026<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{WICKRAMASEKARA2026302055,
\r\ntitle = {AutoDFBench 1.0: A benchmarking framework for digital forensic tool testing and generated code evaluation},
\r\nauthor = {Akila Wickramasekara and Tharusha Mihiranga and Aruna Withanage and Buddhima Weerasinghe and Frank Breitinger and John Sheppard and Mark Scanlon},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281726000120},
\r\ndoi = {10.1016\/j.fsidi.2026.302055},
\r\nissn = {2666-2817},
\r\nyear  = {2026},
\r\ndate = {2026-03-24},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {56},
\r\npages = {302055},
\r\nabstract = {The National Institute of Standards and Technology (NIST) Computer Forensic Tool Testing (CFTT) programme has become the de facto standard for providing digital forensic tool testing and validation. However to date, no comprehensive framework exists to automate benchmarking across the diverse forensic tasks included in the programme. This gap results in inconsistent validation, challenges in comparing tools, and limited validation reproducibility. This paper introduces AutoDFBench 1.0, a modular benchmarking framework that supports the evaluation of both conventional DF tools and scripts, as well as AI-generated code and agentic approaches. The framework integrates five areas defined by the CFTT programme: string search, deleted file recovery, file carving, Windows registry recovery, and SQLite data recovery. AutoDFBench 1.0 includes ground truth data comprising of 63 test cases and 10,968 unique test scenarios, and execute evaluations through a RESTful API that produces structured JSON outputs with standardised metrics, including precision, recall, and F1 score for each test case, and the average of these F1 scores becomes the AutoDFBench Score. The benchmarking framework is validated against CFTT's datasets. The framework enables fair and reproducible comparison across tools and forensic scripts, establishing the first unified, automated, and extensible benchmarking framework for digital forensic tool testing and validation. AutoDFBench 1.0 supports tool vendors, researchers, practitioners, and standardisation bodies by facilitating transparent, reproducible, and comparable assessments of DF technologies.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
The National Institute of Standards and Technology (NIST) Computer Forensic Tool Testing (CFTT) programme has become the de facto standard for providing digital forensic tool testing and validation. However to date, no comprehensive framework exists to automate benchmarking across the diverse forensic tasks included in the programme. This gap results in inconsistent validation, challenges in comparing tools, and limited validation reproducibility. This paper introduces AutoDFBench 1.0, a modular benchmarking framework that supports the evaluation of both conventional DF tools and scripts, as well as AI-generated code and agentic approaches. The framework integrates five areas defined by the CFTT programme: string search, deleted file recovery, file carving, Windows registry recovery, and SQLite data recovery. AutoDFBench 1.0 includes ground truth data comprising of 63 test cases and 10,968 unique test scenarios, and execute evaluations through a RESTful API that produces structured JSON outputs with standardised metrics, including precision, recall, and F1 score for each test case, and the average of these F1 scores becomes the AutoDFBench Score. The benchmarking framework is validated against CFTT's datasets. The framework enables fair and reproducible comparison across tools and forensic scripts, establishing the first unified, automated, and extensible benchmarking framework for digital forensic tool testing and validation. AutoDFBench 1.0 supports tool vendors, researchers, practitioners, and standardisation bodies by facilitating transparent, reproducible, and comparable assessments of DF technologies.<\/div>
Close<\/a><\/p><\/div>
6.<\/td>

Adila, Rida; Studiawan, Hudan; Breitinger, Frank<\/p>

Forensic Event Reconstruction With Process Mining<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>IEEE Access, <\/span>vol. 14, <\/span>pp. 18964-18985, <\/span>2026<\/span>, ISSN: 2169-3536<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{11369961,
\r\ntitle = {Forensic Event Reconstruction With Process Mining},
\r\nauthor = {Rida Adila and Hudan Studiawan and Frank Breitinger},
\r\ndoi = {10.1109\/ACCESS.2026.3660165},
\r\nissn = {2169-3536},
\r\nyear  = {2026},
\r\ndate = {2026-02-02},
\r\njournal = {IEEE Access},
\r\nvolume = {14},
\r\npages = {18964-18985},
\r\nabstract = {Event reconstruction is a fundamental aspect of the investigative process in digital forensics. During this process, one systematically analyzes and organizes evidence to formulate a hypothesis regarding past events. The starting point is often the raw data from forensic timelines (e.g., a table including all parsed events), which may include millions of timeline entries. Various tools and techniques have been proposed to create and analyze timelines. However, the feasibility of applying process mining solutions remains unexplored. Process mining, with its ability to uncover patterns, deviations, and process flows from event data, can offer valuable insights into forensic event reconstruction. In this study, we explore the utilization of episode mining to generate case identifiers and provide event sequences, visualizations, and evaluation metrics from process models generated by process mining algorithms. As a result, we developed an open-source, web-based prototype application. Experiments and case studies conclude that the proposed method can reconstruct events and provide intuitive results to forensic investigators.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
7.<\/td>

Breitinger, Frank<\/p>

AI and Forensics: Where We Are and the Shape of What\u2019s Next (Miscellaneous<\/span>)<\/p>

bf Keynote at Fifth ISEA International Conference on Security and Privacy 2026 (ISEA\u2013ISAP 2026), <\/span>2026<\/span>, (IIT Madras, Chennai, India)<\/span>.<\/p>

(BibTeX<\/a><\/span>)<\/p>

8.<\/td>

Vanini, C\u00e9line; Hargreaves, Chris; Breitinger, Frank<\/p>

Evaluating tamper resistance of digital forensic artifacts during event reconstruction<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Digital Threats, <\/span>2025<\/span>, (Just Accepted)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{10.1145\/3765627,
\r\ntitle = {Evaluating tamper resistance of digital forensic artifacts during event reconstruction},
\r\nauthor = { C\u00e9line Vanini and Chris Hargreaves and Frank Breitinger},
\r\nurl = {https:\/\/doi.org\/10.1145\/3765627},
\r\ndoi = {10.1145\/3765627},
\r\nyear  = {2025},
\r\ndate = {2025-09-02},
\r\njournal = {Digital Threats},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {New York, NY, USA},
\r\nabstract = {Event reconstruction is a fundamental part of the digital forensic process, helping to answer key questions like who, what, when, and how. A common way of accomplishing that is to use tools to create timelines, which are then analyzed. However, various challenges exist, such as large volumes of data or contamination. While prior research has focused on simplifying timelines, less attention has been given to tampering, i.e., the deliberate manipulation of evidence, which can lead to errors in interpretation. This article addresses the issue by proposing a framework to assess the relative tamper resistance of different data sources used in event reconstruction. We discuss factors affecting data resilience, introduce a scoring system for evaluation, and illustrate its application with case studies. This work aims to improve the reliability of forensic event reconstruction by considering tamper resistance.},
\r\nnote = {Just Accepted},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
9.<\/td>

Dorai, Gokila; Rad, Pouria; Breitinger, Frank; Bardhan, Rajon; Ramasamy, Vijayalakshmi<\/p>

Mapping the Research Landscape - An Exploratory Analysis of AI Applications in Digital Forensics<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span> Coppens, Bart; Volckaert, Bruno; Naessens, Vincent; De Sutter, Bjorn (Ed.): Availability, Reliability and Security, <\/span>pp. 113\u2013130, <\/span>Springer Nature Switzerland, <\/span>Cham, <\/span>2025<\/span>, ISBN: 978-3-032-00635-6<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{10.1007\/978-3-032-00635-6_7,
\r\ntitle = {Mapping the Research Landscape - An Exploratory Analysis of AI Applications in Digital Forensics},
\r\nauthor = {Gokila Dorai and Pouria Rad and Frank Breitinger and Rajon Bardhan and Vijayalakshmi Ramasamy},
\r\neditor = {Coppens, Bart and Volckaert, Bruno and Naessens, Vincent and De Sutter, Bjorn},
\r\nurl = {https:\/\/doi.org\/10.1007\/978-3-032-00635-6_7},
\r\ndoi = {10.1007\/978-3-032-00635-6_7},
\r\nisbn = {978-3-032-00635-6},
\r\nyear  = {2025},
\r\ndate = {2025-08-09},
\r\nurldate = {2025-08-09},
\r\nbooktitle = {Availability, Reliability and Security},
\r\npages = {113\u2013130},
\r\npublisher = {Springer Nature Switzerland},
\r\naddress = {Cham},
\r\nabstract = {Artificial intelligence (AI) and machine learning (ML) have great potential to enhance digital forensic investigation, but progress is impeded by challenges in building datasets that meet technical accuracy and legal requirements. We herein compile findings from the latest scholarly literature to identify potential key aspects that are required for building forensic datasets that can effectively support AI-based investigative tools. We examine current practices in dataset building, ranging from representativeness of data, quality of annotation, chain-of-custody documentation, and metadata standardization, and consider their effects carefully on training robust AI models. Results point to key shortcomings that impede advanced AI implementations in digital forensics, which form a strong baseline for developing a standard workflow for building forensic datasets. This work, therefore, forms a stepping stone for future projects to enhance investigation capabilities through a better-structured and legally sound process of dataset building.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
10.<\/td>

Breitinger, Frank; Studiawan, Hudan; Hargreaves, Chris<\/p>

SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 53, <\/span>pp. 301932, <\/span>2025<\/span>, ISSN: 2666-2817<\/span>, (DFRWS USA 2025 - Selected Papers from the 25th Annual Digital Forensics Research Conference USA)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{BREITINGER2025301932,
\r\ntitle = {SoK: Timeline based event reconstruction for digital forensics: Terminology, methodology, and current challenges},
\r\nauthor = {Frank Breitinger and Hudan Studiawan and Chris Hargreaves},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S266628172500071X},
\r\ndoi = {https:\/\/doi.org\/10.1016\/j.fsidi.2025.301932},
\r\nissn = {2666-2817},
\r\nyear  = {2025},
\r\ndate = {2025-08-01},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {53},
\r\npages = {301932},
\r\nabstract = {Event reconstruction is a technique that examiners can use to attempt to infer past activities by analyzing digital artifacts. Despite its significance, the field suffers from fragmented research, with studies often focusing narrowly on aspects like timeline creation or tampering detection. This paper addresses the lack of a unified perspective by proposing a comprehensive framework for timeline-based event reconstruction, adapted from traditional forensic science models. We begin by harmonizing existing terminology and presenting a cohesive diagram that clarifies the relationships between key elements of the reconstruction process. Through a comprehensive literature survey, we classify and organize the main challenges, extending the discussion beyond common issues like data volume. Lastly, we highlight recent advancements and propose directions for future research, including specific research gaps. By providing a structured approach, key findings, and a clearer understanding of the underlying challenges, this work aims to strengthen the foundation of digital forensics.},
\r\nnote = {DFRWS USA 2025 - Selected Papers from the 25th Annual Digital Forensics Research Conference USA},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
11.<\/td>

Michelet, Ga\u00ebtan; Henseler, Hans; Beek, Harm; Scanlon, Mark; Breitinger, Frank<\/p>

Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Digital Threats: Research and Practice, <\/span>2025<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{10.1145\/3748264,
\r\ntitle = {Fine-Tuning Large Language Models for Digital Forensics: Case Study and General Recommendations},
\r\nauthor = {Ga\u00ebtan Michelet and Hans Henseler and Harm Beek and Mark Scanlon and Frank Breitinger},
\r\nurl = {https:\/\/doi.org\/10.1145\/3748264},
\r\ndoi = {10.1145\/3748264},
\r\nyear  = {2025},
\r\ndate = {2025-07-24},
\r\njournal = {Digital Threats: Research and Practice},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {New York, NY, USA},
\r\nabstract = {Large language models (LLMs) have rapidly gained popularity in various fields, including digital forensics (DF), where they offer the potential to accelerate investigative processes. Although several studies have explored LLMs for tasks such as evidence identification, artifact analysis, and report writing, fine-tuning models for specific forensic applications remains underexplored. This paper addresses this gap by proposing recommendations for fine-tuning LLMs tailored to digital forensics tasks. A case study on chat summarization is presented to showcase the applicability of the recommendations, where we evaluate multiple fine-tuned models to assess their performance. The study concludes with sharing the lessons learned from the case study.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
12.<\/td>

Breitinger, Frank<\/p>

AI in Forensics: Where We Are and the Shape of What\u2019s Next (Miscellaneous<\/span>)<\/p>

bf Keynote at AFSN Digital Forensic Workshop Symposium, <\/span>2025<\/span>, (Beijing, China)<\/span>.<\/p>

(BibTeX<\/a><\/span>)<\/p>

13.<\/td>

Wickramasekara, Akila; Densmore, Alanna; Breitinger, Frank; Studiawan, Hudan; Scanlon, Mark<\/p>

AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Doctoral Symposium, <\/span>Association for Computing Machinery, <\/span>Brno, CZ, <\/span>2025<\/span>, ISBN: 9798400710766<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{10.1145\/3712716.3712718,
\r\ntitle = {AutoDFBench: A Framework for AI Generated Digital Forensic Code and Tool Testing and Evaluation},
\r\nauthor = {Akila Wickramasekara and Alanna Densmore and Frank Breitinger and Hudan Studiawan and Mark Scanlon},
\r\nurl = {https:\/\/doi.org\/10.1145\/3712716.3712718},
\r\ndoi = {10.1145\/3712716.3712718},
\r\nisbn = {9798400710766},
\r\nyear  = {2025},
\r\ndate = {2025-04-01},
\r\nurldate = {2025-01-01},
\r\nbooktitle = {Proceedings of the Digital Forensics Doctoral Symposium},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {Brno, CZ},
\r\nseries = {DFDS '25},
\r\nabstract = {Generative AI (GenAI) and Large Language Models (LLMs) show great potential in various domains, including digital forensics. A notable use case of these technologies is automatic code generation, which can reasonably be expected to include digital forensic applications in the not-too-distant future. As with any digital forensic tool, these systems must undergo extensive testing and validation. However, manually evaluating outputs, including generated DF code, remains a challenge. AutoDFBench is an automated framework designed to address this by validating AI-generated code and tools against NIST\u2019s Computer Forensics Tool Testing Program (CFTT) procedures and subsequently calculating an AutoDFBench benchmarking score. The framework operates in four phases: data preparation, API handling, code execution, and result recording with score calculation. It benchmarks generative AI systems, such as LLMs and automated code generation agents, for DF applications. This benchmark can support iterative development or serve as a comparison metric between GenAI DF systems. As a proof of concept, NIST\u2019s forensic string search tests were used, involving more than 24,200 tests with five top-performing code generation LLMs. These tests validated the output of 121 cases, considering two levels of user expertise, two programming languages, and ten iterations per case with varying prompts. The results also highlight the significant limitations of the DF-specific solutions generated by generic LLMs.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Generative AI (GenAI) and Large Language Models (LLMs) show great potential in various domains, including digital forensics. A notable use case of these technologies is automatic code generation, which can reasonably be expected to include digital forensic applications in the not-too-distant future. As with any digital forensic tool, these systems must undergo extensive testing and validation. However, manually evaluating outputs, including generated DF code, remains a challenge. AutoDFBench is an automated framework designed to address this by validating AI-generated code and tools against NIST\u2019s Computer Forensics Tool Testing Program (CFTT) procedures and subsequently calculating an AutoDFBench benchmarking score. The framework operates in four phases: data preparation, API handling, code execution, and result recording with score calculation. It benchmarks generative AI systems, such as LLMs and automated code generation agents, for DF applications. This benchmark can support iterative development or serve as a comparison metric between GenAI DF systems. As a proof of concept, NIST\u2019s forensic string search tests were used, involving more than 24,200 tests with five top-performing code generation LLMs. These tests validated the output of 121 cases, considering two levels of user expertise, two programming languages, and ten iterations per case with varying prompts. The results also highlight the significant limitations of the DF-specific solutions generated by generic LLMs.<\/div>
Close<\/a><\/p><\/div>
14.<\/td>

Vanini, C\u00e9line; Gruber, Jan; Hargreaves, Christopher; Benenson, Zinaida; Freiling, Felix; Breitinger, Frank<\/p>

Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Doctoral Symposium, <\/span>Association for Computing Machinery, <\/span>Brno, CZ, <\/span>2025<\/span>, ISBN: 9798400710766<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{10.1145\/3712716.3712727,
\r\ntitle = {Understanding Strategies and Challenges of Timestamp Tampering for Improved Digital Forensic Event Reconstruction},
\r\nauthor = {C\u00e9line Vanini and Jan Gruber and Christopher Hargreaves and Zinaida Benenson and Felix Freiling and Frank Breitinger},
\r\nurl = {https:\/\/doi.org\/10.1145\/3712716.3712727},
\r\ndoi = {10.1145\/3712716.3712727},
\r\nisbn = {9798400710766},
\r\nyear  = {2025},
\r\ndate = {2025-04-01},
\r\nurldate = {2025-01-01},
\r\nbooktitle = {Proceedings of the Digital Forensics Doctoral Symposium},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {Brno, CZ},
\r\nseries = {DFDS '25},
\r\nabstract = {Timestamps play a pivotal role in digital forensic event reconstruction, but due to their non-essential nature, tampering or manipulation of timestamps is possible by users in multiple ways, even on running systems. This has a significant effect on the reliability of the results from applying a timeline analysis as part of an investigation. We investigate the problem of users tampering with timestamps on a running (\u201clive\u201d) system. While prior work has shown that digital evidence tampering is hard, we focus on the question of why this is so. By performing a qualitative user study with advanced university students, we derive factors that influence the reliability of successful tampering, such as the individual knowledge about temporal traces, and technical restrictions to change them. These insights help to assess the reliability of timestamps from individual artifacts that are used for event reconstruction and subsequently reduce the risk of misinterpretations.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
15.<\/td>

Michelet, Ga\u00ebtan; Breitinger, Frank<\/p>

Automation for digital forensics: Towards a classification model for the community<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Doctoral Symposium, <\/span>Association for Computing Machinery, <\/span>Brno, CZ, <\/span>2025<\/span>, ISBN: 9798400710766<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{10.1145\/3712716.3712725,
\r\ntitle = {Automation for digital forensics: Towards a classification model for the community},
\r\nauthor = {Ga\u00ebtan Michelet and Frank Breitinger},
\r\nurl = {https:\/\/doi.org\/10.1145\/3712716.3712725},
\r\ndoi = {10.1145\/3712716.3712725},
\r\nisbn = {9798400710766},
\r\nyear  = {2025},
\r\ndate = {2025-04-01},
\r\nbooktitle = {Proceedings of the Digital Forensics Doctoral Symposium},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {Brno, CZ},
\r\nseries = {DFDS '25},
\r\nabstract = {The current state of automation in digital forensics remains insufficiently defined. While the complexity of automated tools and methods has evolved significantly (e.g., from basic parsers to the integration of advanced techniques), it remains challenging to pinpoint the field\u2019s overall progress or compare methods. A first step towards a solution was the work \u2018Automation for digital forensics: Towards a definition for the community\u2019 which defines automation but cannot categorize various methods. This work aims to address this gap and presents a first classification model for automation for digital forensics. Therefore, we analyzed automation classification schemes from different disciplines (e.g., cars) and assessed various model possibilities as well as characteristics. We conclude that a 2-dimensional model with the axis \u2018decision\u2019 and \u2018level of automation\u2019 is most appropriate and provide an overview table with examples.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
16.<\/td>

Wickramasekara, Akila; Breitinger, Frank; Scanlon, Mark<\/p>

Exploring the potential of large language models for improving digital forensic investigation efficiency<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 52, <\/span>pp. 301859, <\/span>2025<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{WICKRAMASEKARA2025301859,
\r\ntitle = {Exploring the potential of large language models for improving digital forensic investigation efficiency},
\r\nauthor = {Akila Wickramasekara and Frank Breitinger and Mark Scanlon},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281724001860},
\r\ndoi = {https:\/\/doi.org\/10.1016\/j.fsidi.2024.301859},
\r\nissn = {2666-2817},
\r\nyear  = {2025},
\r\ndate = {2025-02-03},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {52},
\r\npages = {301859},
\r\nabstract = {The ever-increasing workload of digital forensic labs raises concerns about law enforcement's ability to conduct both cyber-related and non-cyber-related investigations promptly. Consequently, this article explores the potential and usefulness of integrating Large Language Models (LLMs) into digital forensic investigations to address challenges such as bias, explainability, censorship, resource-intensive infrastructure, and ethical and legal considerations. A comprehensive literature review is carried out, encompassing existing digital forensic models, tools, LLMs, deep learning techniques, and the use of LLMs in investigations. The review identifies current challenges within existing digital forensic processes and explores both the obstacles and the possibilities of incorporating LLMs. In conclusion, the study states that the adoption of LLMs in digital forensics, with appropriate constraints, has the potential to improve investigation efficiency, improve traceability, and alleviate the technical and judicial barriers faced by law enforcement entities.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
17.<\/td>

G\u00f6bel, Thomas; Breitinger, Frank; Baier, Harald<\/p>

Optimising data set creation in the cybersecurity landscape with a special focus on digital forensics: Principles, characteristics, and use cases<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 52, <\/span>pp. 301882, <\/span>2025<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{GOBEL2025301882,
\r\ntitle = {Optimising data set creation in the cybersecurity landscape with a special focus on digital forensics: Principles, characteristics, and use cases},
\r\nauthor = {Thomas G\u00f6bel and Frank Breitinger and Harald Baier},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281725000216},
\r\ndoi = {https:\/\/doi.org\/10.1016\/j.fsidi.2025.301882},
\r\nissn = {2666-2817},
\r\nyear  = {2025},
\r\ndate = {2025-01-29},
\r\nurldate = {2025-01-01},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {52},
\r\npages = {301882},
\r\nabstract = {Data sets (samples) are important for research, training, and tool development. While the FAIR principles, data repositories and archives like Zenodo and NIST's Computer Forensic Reference Data Sets (CFReDS) enhance the accessibility and reusability of data sets, standardised practices for crafting and describing these data sets require further attention. This paper analyses the existing literature to identify the key data set (generation) characteristics, issues, desirable attributes, and use cases. Although our findings are generally applicable, i.e., to the cybersecurity domain, our special focus is on the digital forensics domain. We define principles and properties for cybersecurity-relevant data sets and their implications for the data creation process to maximise their quality, utility and applicability, taking into account specific data set use cases and data origin. We aim to guide data set creators in enhancing their data sets' value for the cybersecurity and digital forensics field.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
18.<\/td>

Hargreaves, Christopher; Breitinger, Frank; Dowthwaite, Liz; Webb, Helena; Scanlon, Mark<\/p>

DFPulse: The 2024 digital forensic practitioner survey<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 51, <\/span>pp. 301844, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{HARGREAVES2024301844,
\r\ntitle = {DFPulse: The 2024 digital forensic practitioner survey},
\r\nauthor = {Christopher Hargreaves and Frank Breitinger and Liz Dowthwaite and Helena Webb and Mark Scanlon},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281724001719},
\r\ndoi = {10.1016\/j.fsidi.2024.301844},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-11-29},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {51},
\r\npages = {301844},
\r\nabstract = {This paper reports on the largest survey of digital forensic practitioners to date (DFPulse) conducted from March to May 2024 resulting in 122 responses. The survey collected information about practitioners' operating environments, the technologies they encounter, investigative techniques they use, the challenges they face, the degree to which academic research is accessed and useful to the practitioner community, and their suggested future research directions. The paper includes quantitative and qualitative results from the survey and a discussion of the implications for academia, the improvements that can be made, and future research directions.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
19.<\/td>

Dreier, Lisa Marie; Vanini, C\u00e9line; Hargreaves, Christopher J.; Breitinger, Frank; Freiling, Felix<\/p>

Beyond timestamps: Integrating implicit timing information into digital forensic timelines<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 49, <\/span>pp. 301755, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>, (bf Best Paper Award)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{DREIER2024301755,
\r\ntitle = {Beyond timestamps: Integrating implicit timing information into digital forensic timelines},
\r\nauthor = {Lisa Marie Dreier and C\u00e9line Vanini and Christopher J. Hargreaves and Frank Breitinger and Felix Freiling},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S266628172400074X},
\r\ndoi = {10.1016\/j.fsidi.2024.301755},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-07-08},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {49},
\r\npages = {301755},
\r\nabstract = {Generating timelines, i.e., sorting events by their respective timestamps, is an essential technique commonly used in digital forensic investigations. But timestamps are not the only source of timing information. For example, sequence numbers embedded in databases or positional information, such as the line numbers in log files, often contain implicit information about the order of events without directly referencing a timestamp. We present a method that can integrate such timing information into digital forensic timelines by separating sources of timing information into distinct time domains, each with its own timeline, and then connecting these timelines based on relations observed within digital evidence. The classical ``flat'' timeline is thereby extended into a ``rich'' partial order, which we call hyper timeline. Our technique allows ordering of events without timestamps and opens a rich set of possibilities to identify and characterize timestamp inconsistencies, e.g., those that arise from timestamp tampering.},
\r\nnote = {bf Best Paper Award},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
20.<\/td>

Vanini, C\u00e9line; Hargreaves, Christopher J.; Beek, Harm; Breitinger, Frank<\/p>

Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 49, <\/span>pp. 301759, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>, (DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{VANINI2024301759,
\r\ntitle = {Was the clock correct? Exploring timestamp interpretation through time anchors for digital forensic event reconstruction},
\r\nauthor = {C\u00e9line Vanini and Christopher J. Hargreaves and Harm Beek and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281724000787},
\r\ndoi = {10.1016\/j.fsidi.2024.301759},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-07-08},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {49},
\r\npages = {301759},
\r\nabstract = {Timestamps and their correct interpretation play a crucial role in digital forensic investigations, particularly when the objective is to establish a timeline of events a.k.a. event reconstruction. However, the way these timestamps are generated heavily depends on an internal clock, or `system time', from which many are derived. Consequently, when this system time is skewed due to tampering, natural clock drift, or system malfunctions, recorded timestamps will not reflect the actual times the (real-world) events occurred. This raises the question of how to validate the correctness of the system clock when recording timestamps and, if found incorrect, how to determine system clock skew. To address this problem, this paper defines several important concepts such as time anchors, anchoring events, non-anchoring events and time anomalies which can be used to determine if the system time was correct. Using two examples - a Google search and a file creation - and comparing correct and skewed versions of the same set of performed actions, we illustrate the use and potential benefits of time anchors to demonstrate the correctness of the system clock for event reconstruction.},
\r\nnote = {DFRWS USA 2024 - Selected Papers from the 24th Annual Digital Forensics Research Conference USA},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
21.<\/td>

Breitinger, Frank; Hilgert, Jan-Niclas; Hargreaves, Christopher; Sheppard, John; Overdorf, Rebekah; Scanlon, Mark<\/p>

DFRWS EU 10-year review and future directions in Digital Forensic Research<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 48, <\/span>pp. 301685, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{BREITINGER2024301685,
\r\ntitle = {DFRWS EU 10-year review and future directions in Digital Forensic Research},
\r\nauthor = {Frank Breitinger and Jan-Niclas Hilgert and Christopher Hargreaves and John Sheppard and Rebekah Overdorf and Mark Scanlon},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281723002044},
\r\ndoi = {10.1016\/j.fsidi.2023.301685},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-03-15},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {48},
\r\npages = {301685},
\r\nabstract = {Conducting a systematic literature review and comprehensive analysis, this paper surveys all 135 peer-reviewed articles published at the Digital Forensics Research Conference Europe (DFRWS EU) spanning the decade since its inaugural running (2014\u20132023). This comprehensive study of DFRWS EU articles encompasses sub-disciplines such as digital forensic science, device forensics, techniques and fundamentals, artefact forensics, multimedia forensics, memory forensics, and network forensics. Quantitative analysis of the articles' co-authorships, geographical spread and citation metrics are outlined. The analysis presented offers insights into the evolution of digital forensic research efforts over these ten years and informs some identified future research directions.},
\r\nnote = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
22.<\/td>

Mombelli, Samuele; Lyle, James R.; Breitinger, Frank<\/p>

FAIRness in digital forensics datasets' metadata \u2013 and how to improve it<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 48, <\/span>pp. 301681, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{MOMBELLI2024301681,
\r\ntitle = {FAIRness in digital forensics datasets' metadata \u2013 and how to improve it},
\r\nauthor = {Samuele Mombelli and James R. Lyle and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281723002007},
\r\ndoi = {10.1016\/j.fsidi.2023.301681},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-03-15},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {48},
\r\npages = {301681},
\r\nabstract = {The availability of research data (datasets) and compliance with FAIR principles\u2014Findability, Accessibility, Interoperability, and Reusability\u2014is critical to progressing digital forensics. This study evaluates metadata completeness and assesses the alignment with the FAIR principles using all 212 datasets from NIST's Computer Forensic Reference DataSet Portal (CFReDS). The findings underscore deficiencies in metadata quality and FAIR compliance, emphasizing the need for improved data management standards. Based on our critical review, we then propose and discuss various approaches to improve the status quo.},
\r\nnote = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
23.<\/td>

Michelet, Ga\u00ebtan; Breitinger, Frank<\/p>

ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 48, <\/span>pp. 301683, <\/span>2024<\/span>, ISSN: 2666-2817<\/span>, (DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{MICHELET2024301683,
\r\ntitle = {ChatGPT, Llama, can you write my report? An experiment on assisted digital forensics reports written using (local) large language models},
\r\nauthor = {Ga\u00ebtan Michelet and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281723002020},
\r\ndoi = {10.1016\/j.fsidi.2023.301683},
\r\nissn = {2666-2817},
\r\nyear  = {2024},
\r\ndate = {2024-03-15},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {48},
\r\npages = {301683},
\r\nabstract = {Generative AIs, especially Large Language Models (LLMs) such as ChatGPT or Llama, have advanced significantly, positioning them as valuable tools for digital forensics. While initial studies have explored the potential of ChatGPT in the context of investigations, the question of to what extent LLMs can assist the forensic report writing process remains unresolved. To answer the question, this article first examines forensic reports with the goal of generalization (e.g., finding the `average structure' of a report). We then evaluate the strengths and limitations of LLMs for generating the different parts of the forensic report using a case study. This work thus provides valuable insights into the automation of report writing, a critical facet of digital forensics investigations. We conclude that combined with thorough proofreading and corrections, LLMs may assist practitioners during the report writing process but at this point cannot replace them.},
\r\nnote = {DFRWS EU 2024 - Selected Papers from the 11th Annual Digital Forensics Research Conference Europe},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
24.<\/td>

Breitinger, Frank<\/p>

Network Threats and their Detection (Miscellaneous<\/span>)<\/p>

Invited Tutorial Presenter at the International Conference on Innovations in Information Technology (IIT\u201923), <\/span>2023<\/span>, (Al Ain, United Arab Emirates)<\/span>.<\/p>

(BibTeX<\/a><\/span>)<\/p>

25.<\/td>

Ottmann, Jenny; Breitinger, Frank; Freiling, Felix<\/p>

An Experimental Assessment of Inconsistencies in Memory Forensics<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>ACM Trans. Priv. Secur., <\/span>vol. 27, <\/span>no. 1, <\/span>2023<\/span>, ISSN: 2471-2566<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{10.1145\/3628600,
\r\ntitle = {An Experimental Assessment of Inconsistencies in Memory Forensics},
\r\nauthor = {Jenny Ottmann and Frank Breitinger and Felix Freiling},
\r\nurl = {https:\/\/doi.org10.1145\/3628600},
\r\ndoi = {10.1145\/3628600},
\r\nissn = {2471-2566},
\r\nyear  = {2023},
\r\ndate = {2023-10-20},
\r\njournal = {ACM Trans. Priv. Secur.},
\r\nvolume = {27},
\r\nnumber = {1},
\r\npublisher = {Association for Computing Machinery},
\r\naddress = {New York, NY, USA},
\r\nabstract = {Memory forensics is concerned with the acquisition and analysis of copies of volatile memory (memory dumps). Based on an empirical assessment of observable inconsistencies in 360 memory dumps of a running Linux system, we confirm a state of overwhelming inconsistency in memory forensics: almost a third of these dumps had an empty process list and was therefore obviously incomplete. Out of those dumps that were analyzable, almost every second dump showed some form of inconsistency that potentially impacts the interpretation of the dump in a forensic investigation. These results are based on a new way to estimate the level of causal consistency of a memory dump. The factors influencing these inconsistencies are less clear but in general correlate with the level of concurrency (system load and number of threads).},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
26.<\/td>

Scanlon, Mark; Breitinger, Frank; Hargreaves, Christopher; Hilgert, Jan-Niclas; Sheppard, John<\/p>

ChatGPT for digital forensic investigation: The good, the bad, and the unknown<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 46, <\/span>pp. 301609, <\/span>2023<\/span>, ISSN: 2666-2817<\/span>, (bf Best Paper Award)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{SCANLON2023301609,
\r\ntitle = {ChatGPT for digital forensic investigation: The good, the bad, and the unknown},
\r\nauthor = {Mark Scanlon and Frank Breitinger and Christopher Hargreaves and Jan-Niclas Hilgert and John Sheppard},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S266628172300121X},
\r\ndoi = {10.1016\/j.fsidi.2023.301609},
\r\nissn = {2666-2817},
\r\nyear  = {2023},
\r\ndate = {2023-10-13},
\r\nurldate = {2023-10-13},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {46},
\r\npages = {301609},
\r\nabstract = {The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.},
\r\nnote = {bf Best Paper Award},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
The disruptive application of ChatGPT (GPT-3.5, GPT-4) to a variety of domains has become a topic of much discussion in the scientific community and society at large. Large Language Models (LLMs), e.g., BERT, Bard, Generative Pre-trained Transformers (GPTs), LLaMA, etc., have the ability to take instructions, or prompts, from users and generate answers and solutions based on very large volumes of text-based training data. This paper assesses the impact and potential impact of ChatGPT on the field of digital forensics, specifically looking at its latest pre-trained LLM, GPT-4. A series of experiments are conducted to assess its capability across several digital forensic use cases including artefact understanding, evidence searching, code generation, anomaly detection, incident response, and education. Across these topics, its strengths and risks are outlined and a number of general conclusions are drawn. Overall this paper concludes that while there are some potential low-risk applications of ChatGPT within digital forensics, many are either unsuitable at present, since the evidence would need to be uploaded to the service, or they require sufficient knowledge of the topic being asked of the tool to identify incorrect assumptions, inaccuracies, and mistakes. However, to an appropriately knowledgeable user, it could act as a useful supporting tool in some circumstances.<\/div>
Close<\/a><\/p><\/div>
27.<\/td>

G\u00f6bel, Thomas; Baier, Harald; Breitinger, Frank<\/p>

Data for Digital Forensics: Why a Discussion on `How Realistic is Synthetic Data' is Dispensable<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Digital Threats: Research and Practice, <\/span>2023<\/span>, ISSN: 2692-1626<\/span>, (Presented at the 12th International Conference on IT Security Incident Management IT Forensics (IMF))<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{10.1145\/3609863,
\r\ntitle = {Data for Digital Forensics: Why a Discussion on `How Realistic is Synthetic Data' is Dispensable},
\r\nauthor = {Thomas G\u00f6bel and Harald Baier and Frank Breitinger},
\r\nurl = {https:\/\/doi.org\/10.1145\/3609863},
\r\ndoi = {10.1145\/3609863},
\r\nissn = {2692-1626},
\r\nyear  = {2023},
\r\ndate = {2023-07-20},
\r\nurldate = {2023-07-20},
\r\njournal = {Digital Threats: Research and Practice},
\r\npublisher = {Association for Computing Machinery (ACM)},
\r\naddress = {New York, NY, USA},
\r\nabstract = {Digital forensics depends on data sets for various purposes like concept evaluation, educational training, and tool validation. Researchers have gathered such data sets into repositories and created data simulation frameworks for producing large amounts of data. Synthetic data often face skepticism due to its perceived deviation from real-world data, raising doubts about its realism. This paper addresses this concern, arguing that there is no definitive answer. We focus on four common digital forensic use cases that rely on data. Through these, we elucidate the specifications and prerequisites of data sets within their respective contexts. Our discourse uncovers that both real-world and synthetic data are indispensable for advancing digital forensic science, software, tools, and the competence of practitioners. Additionally, we provide an overview of available data set repositories and data generation frameworks, contributing to the ongoing dialogue on digital forensic data sets\u2019 utility.},
\r\nnote = {Presented at the 12th International Conference on IT Security Incident Management IT Forensics (IMF)},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
28.<\/td>

Ottmann, Jenny; Cengiz, \u00dcsame; Breitinger, Frank; Freiling, Felix<\/p>

As if Time Had Stopped \u2013 Checking Memory Dumps for Quasi-Instantaneous Consistency<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Research Conference USA (DFRWS USA), <\/span>2023<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{OUBF2023,
\r\ntitle = {As if Time Had Stopped \u2013 Checking Memory Dumps for Quasi-Instantaneous Consistency},
\r\nauthor = {Jenny Ottmann and \u00dcsame Cengiz and Frank Breitinger and Felix Freiling},
\r\nurl = {https:\/\/dfrws.org\/presentation\/as-if-time-had-stopped-checking-memory-dumps-for-quasi-instantaneous-consistency\/},
\r\ndoi = {10.48550\/arXiv.2307.12060},
\r\nyear  = {2023},
\r\ndate = {2023-07-10},
\r\nbooktitle = {Proceedings of the Digital Forensics Research Conference USA (DFRWS USA)},
\r\nabstract = {Memory dumps that are acquired while the system is running often contain inconsistencies like page smearing which hamper the analysis. One possibility to avoid inconsistencies is to pause the system during the acquisition and take an instantaneous memory dump. While this is possible for virtual machines, most systems cannot be frozen and thus the ideal dump can only be quasi-instantaneous, i.e., consistent despite the system running. In this article, we introduce a method allowing us to measure quasi-instantaneous consistency and show both, theoretically, and practically, that our method is valid but that in reality, dumps can be but usually are not quasi-instantaneously consistent. For the assessment, we run a pivot program enabling the evaluation of quasi-instantaneous consistency for its heap and allowing us to pinpoint where exactly inconsistencies occurred.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
29.<\/td>

Breitinger, Frank; Jotterand, Alexandre<\/p>

Sharing datasets for digital forensic: A novel taxonomy and legal concerns<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 45, <\/span>pp. 301562, <\/span>2023<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{BREITINGER2023301562,
\r\ntitle = {Sharing datasets for digital forensic: A novel taxonomy and legal concerns},
\r\nauthor = {Frank Breitinger and Alexandre Jotterand},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281723000719},
\r\ndoi = {10.1016\/j.fsidi.2023.301562},
\r\nissn = {2666-2817},
\r\nyear  = {2023},
\r\ndate = {2023-07-07},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {45},
\r\npages = {301562},
\r\nabstract = {During the last few years, there have been numerous changes concerning datasets for digital forensics like the development of data generation frameworks or the newly released CFReDS website by NIST. In addition, it becomes mandatory (e.g., by funding agencies) to share datasets and publish them in a manner that they can be found and processed. The core of this article is a novel taxonomy that should be used to structure the data commonly used in the domain, complementing the existing methods. Based on the taxonomy, we discuss that it is not always necessary to release the dataset, e.g., in the case of random data. In addition, we address the legal aspects of sharing data. Lastly, as a minor contribution, we provide a separation of the terms structured, semi-structured, and unstructured data where there is currently no consent in the community.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
30.<\/td>

Michelet, Ga\u00ebtan; Breitinger, Frank; Horsman, Graeme<\/p>

Automation for digital forensics: Towards a definition for the community<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International, <\/span>vol. 349, <\/span>pp. 111769, <\/span>2023<\/span>, ISSN: 0379-0738<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{MICHELET2023111769,
\r\ntitle = {Automation for digital forensics: Towards a definition for the community},
\r\nauthor = {Ga\u00ebtan Michelet and Frank Breitinger and Graeme Horsman},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0379073823002190},
\r\ndoi = {10.1016\/j.forsciint.2023.111769},
\r\nissn = {0379-0738},
\r\nyear  = {2023},
\r\ndate = {2023-07-04},
\r\njournal = {Forensic Science International},
\r\nvolume = {349},
\r\npages = {111769},
\r\nabstract = {Automation is crucial for managing the increasing volume of digital evidence. However, the absence of a clear foundation comprising a definition, classification, and common terminology has led to a fragmented landscape where diverse interpretations of automation exist. This resembles the wild west: some consider keyword searches or file carving as automation while others do not. We, therefore, reviewed automation literature (in the domain of digital forensics and other domains), performed three practitioner interviews, and discussed the topic with domain experts from academia. On this basis, we propose a definition and then showcase several considerations concerning automation for digital forensics, e.g., what we classify as no\/basic automation or full automation (autonomous). We conclude that it requires these foundational discussions to promote and progress the discipline through a common understanding.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
31.<\/td>

Schneider, Johannes; Breitinger, Frank<\/p>

Towards AI forensics: Did the artificial intelligence system do it?<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Journal of Information Security and Applications, <\/span>vol. 76, <\/span>pp. 103517, <\/span>2023<\/span>, ISSN: 2214-2126<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{schneider2023towards,
\r\ntitle = {Towards AI forensics: Did the artificial intelligence system do it?},
\r\nauthor = {Johannes Schneider and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2214212623001011},
\r\ndoi = {10.1016\/j.jisa.2023.103517},
\r\nissn = {2214-2126},
\r\nyear  = {2023},
\r\ndate = {2023-06-07},
\r\njournal = {Journal of Information Security and Applications},
\r\nvolume = {76},
\r\npages = {103517},
\r\nabstract = {Artificial intelligence (AI) makes decisions impacting our daily lives in an increasingly autonomous manner. Their actions might cause accidents, harm, or, more generally, violate regulations. Determining whether an AI caused a specific event and, if so, what triggered the AI's action, are key forensic questions. We provide a conceptualization of the problems and strategies for forensic investigation. We focus on AI that is potentially ``malicious by design'' and gray box analysis. Our evaluation using convolutional neural networks illustrates challenges and ideas for identifying malicious AI.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
32.<\/td>

Breitinger, Frank; Zhang, Xiaolu; Quick, Darren<\/p>

A forensic analysis of rclone and rclone's prospects for digital forensic investigations of cloud storage<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 43, <\/span>pp. 301443, <\/span>2022<\/span>, ISSN: 2666-2817<\/span>, (bf Best Paper Award)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{breitinger2023rclone,
\r\ntitle = {A forensic analysis of rclone and rclone's prospects for digital forensic investigations of cloud storage},
\r\nauthor = {Frank Breitinger and Xiaolu Zhang and Darren Quick},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S266628172200124X},
\r\ndoi = {10.1016\/j.fsidi.2022.301443},
\r\nissn = {2666-2817},
\r\nyear  = {2022},
\r\ndate = {2022-09-27},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {43},
\r\npages = {301443},
\r\nabstract = {Organizations and end users are moving their data into the cloud and trust Cloud Storage Providers (CSP) such as pCloud, Dropbox, or Backblaze. Given their popularity, it is likely that forensic examiners encounter one or more online storage types that they will have to acquire and analyze during an investigation. To access cloud storage, CSPs provide web-interfaces, proprietary software solutions (e.g., Dropbox client for Windows) as well as APIs allowing third-party access. One of these third-party applications is rclone which is an open-source tool to access many common CSPs through a command line interface. In this article, we look at rclone from two perspectives: First, we perform a forensic analysis on rclone and discuss aspects such as password recovery of the configuration file, encryption, and JA3 fingerprints. Second, we discuss rclone as a prospect to be a forensic tool which includes its read-only mount feature and sample cases. Under the circumstances tested, rclone is suitable for forensic practitioners as it is open-source, documented, and includes some essential functionality frequently needed but practitioners need to be aware of the caveats.},
\r\nnote = {bf Best Paper Award},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
33.<\/td>

G\u00f6bel, Thomas; Uhlig, Frieder; Baier, Harald; Breitinger, Frank<\/p>

FRASHER \u2013 A framework for automated evaluation of similarity hashing<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 42, <\/span>no. 2022-, <\/span>pp. 301407, <\/span>2022<\/span>, ISSN: 2666-2817<\/span>, (Proceedings of the Twenty-Second Annual DFRWS USA)<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{Goebel2022Frasher,
\r\ntitle = {FRASHER \u2013 A framework for automated evaluation of similarity hashing},
\r\nauthor = {Thomas G\u00f6bel and Frieder Uhlig and Harald Baier and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281722000889},
\r\ndoi = {10.1016\/j.fsidi.2022.301407},
\r\nissn = {2666-2817},
\r\nyear  = {2022},
\r\ndate = {2022-07-09},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {42},
\r\nnumber = {2022-},
\r\npages = {301407},
\r\nabstract = {A challenge for digital forensic investigations is dealing with large amounts of data that need to be processed. Approximate matching (AM), a.k.a. similarity hashing or fuzzy hashing, plays a pivotal role in solving this challenge. Many algorithms have been proposed over the years such as ssdeep, sdhash, MRSH-v2, or TLSH, which can be used for similarity assessment, clustering of different artifacts, or finding fragments and embedded objects. To assess the differences between these implementations (e.g., in terms of runtime efficiency, fragment detection, or resistance against obfuscation attacks), a testing framework is indispensable and the core of this article. The proposed framework is called FRASHER (referring to a predecessor FRASH from 2013) and provides an up-to-date view on the problem of evaluating AM algorithms with respect to both the conceptual and the practical aspects. Consequently, we present and discuss relevant test case scenarios as well as release and demonstrate our framework allowing a comprehensive evaluation of AM algorithms. Compared to its predecessor, we adapt it to a modern environment providing better modularity and usability as well as more thorough testing cases.},
\r\nnote = {Proceedings of the Twenty-Second Annual DFRWS USA},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
34.<\/td>

AlDaajeh, Saleh; Saleous, Heba; Alrabaee, Saed; Barka, Ezedin; Breitinger, Frank; Choo, Kim-Kwang Raymond<\/p>

The Role of National Cybersecurity Strategies on the Improvement of Cybersecurity Education<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Computers & Security, <\/span>pp. 102754, <\/span>2022<\/span>, ISSN: 0167-4048<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{ALDAAJEH2022102754,
\r\ntitle = {The Role of National Cybersecurity Strategies on the Improvement of Cybersecurity Education},
\r\nauthor = {Saleh AlDaajeh and Heba Saleous and Saed Alrabaee and Ezedin Barka and Frank Breitinger and Kim-Kwang Raymond Choo},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404822001493},
\r\ndoi = {10.1016\/j.cose.2022.102754},
\r\nissn = {0167-4048},
\r\nyear  = {2022},
\r\ndate = {2022-05-18},
\r\njournal = {Computers & Security},
\r\npages = {102754},
\r\nabstract = {Digital information and telecommunication technologies have not only become essential to individuals' daily lives but also to a nation's sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation's cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs' curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals' cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program's curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Digital information and telecommunication technologies have not only become essential to individuals' daily lives but also to a nation's sustained economic growth, societal well-being, critical infrastructure resilience, and national security. Consequently, the protection of a nation's cyber sovereignty from malicious acts is a major concern. This signifies the importance of cybersecurity education in facilitating the creation of a resilient cybersecurity ecosystem and in supporting cyber sovereignty. This study reviews a sample from world-leading countries National Cybersecurity Strategic Plans (NCSPs) and analyzes the associated existing cybersecurity education and training improvement initiatives. Furthermore, a proposal to adopt the Goal-Question-Outcomes(GQO)+Strategies paradigm into cybersecurity education and training programs curricula improvement to national cybersecurity strategic goals is presented. The proposal maps cybersecurity strategic goals to cybersecurity skills and competencies using the National Initiative for Cybersecurity Education (NICE) framework. The newly proposed cybersecurity education and training programs' curricula learning outcomes were generated from the GQO+Strategies paradigm based on the three major cybersecurity strategic goals: Development of secure digital and information technology infrastructure and services, defending from sophisticated cyber threats, and enrichment of individuals' cybersecurity maturity and awareness. It is highly recommended that cybersecurity university program administrators utilize the proposed GQO+Strategies to align their program's curriculum to NCSP. Hence, closing the gap that exists with the relevant skills and sustain national cybersecurity workforces.<\/div>
Close<\/a><\/p><\/div>
35.<\/td>

Coates, Peter; Breitinger, Frank<\/p>

Identifying document similarity using a fast estimation of the Levenshtein Distance based on compression and signatures<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU), <\/span>2022<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{CB2022,
\r\ntitle = {Identifying document similarity using a fast estimation of the Levenshtein Distance based on compression and signatures},
\r\nauthor = {Peter Coates and Frank Breitinger},
\r\nurl = {https:\/\/www.researchgate.net\/publication\/359961968_Identifying_document_similarity_using_a_fast_estimation_of_the_Levenshtein_Distance_based_on_compression_and_signatures},
\r\ndoi = {10.48550\/arXiv.2307.11496},
\r\nyear  = {2022},
\r\ndate = {2022-03-31},
\r\nbooktitle = {Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU)},
\r\nabstract = {Identifying document similarity has many applications, e.g., source code analysis or plagiarism detection. However, identifying similarities is not trivial and can be time complex. For instance, the Levenshtein Distance is a common metric to define the similarity between two documents but has quadratic runtime which makes it impractical for large documents where large starts with a few hundred kilobytes. In this paper, we present a novel concept that allows estimating the Levenshtein Distance: the algorithm first compresses documents to signatures (similar to hash values) using a user-defined compression ratio. Signatures can then be compared against each other (some constrains apply) where the outcome is the estimated Levenshtein Distance. Our evaluation shows promising results in terms of runtime efficiency and accuracy. In addition, we introduce a significance score allowing examiners to set a threshold and identify related documents.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
36.<\/td>

Ottmann, Jenny; Breitinger, Frank; Freiling, Felix<\/p>

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing<\/a> (Proceedings Article<\/span>)<\/p>

In: <\/span>Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU), <\/span>2022<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@inproceedings{OBF2022,
\r\ntitle = {Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing},
\r\nauthor = {Jenny Ottmann and Frank Breitinger and Felix Freiling},
\r\nurl = {https:\/\/www.researchgate.net\/publication\/359962048_Defining_Atomicity_and_Integrity_for_Snapshots_of_Storage_in_Forensic_Computing},
\r\nyear  = {2022},
\r\ndate = {2022-03-31},
\r\nbooktitle = {Proceedings of the Digital Forensics Research Conference Europe (DFRWS EU)},
\r\nabstract = {The acquisition of data from main memory or from hard disk storage is usually one of the first steps in a forensic investigation. We revisit the discussion on quality criteria for ``forensically sound'' acquisition of such storage and propose a new way to capture the intent to acquire an instantaneous snapshot from a single target system. The idea of our definition is to allow a certain flexibility into when individual portions of memory are acquired, but at the same time require being consistent with causality (i.e., cause\/effect relations). Our concept is much stronger than the original notion of atomicity defined by V\u00f6mel and Freiling (2012) but still attainable using copy-on-write mechanisms. As a minor result, we also fix a conceptual problem within the original definition of integrity.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {inproceedings}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
37.<\/td>

Huck, Jan; Breitinger, Frank<\/p>

Wake Up Digital Forensics' Community and Help Combating Ransomware<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>IEEE Security & Privacy, <\/span>no. 01, <\/span>pp. 2-11, <\/span>2022<\/span>, ISSN: 1558-4046<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

38.<\/td>

Wu, Tina; Breitinger, Frank; Niemann, Stephen<\/p>

IoT network traffic analysis: Opportunities and challenges for forensic investigators?<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 38, <\/span>pp. 301123, <\/span>2021<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{WU2021301123,
\r\ntitle = {IoT network traffic analysis: Opportunities and challenges for forensic investigators?},
\r\nauthor = {Tina Wu and Frank Breitinger and Stephen Niemann},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281721000214},
\r\ndoi = {10.1016\/j.fsidi.2021.301123},
\r\nissn = {2666-2817},
\r\nyear  = {2021},
\r\ndate = {2021-11-23},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {38},
\r\npages = {301123},
\r\nabstract = {As IoT devices become more incorporated into our daily lives, their always on approach makes them an ideal source of evidence. While these devices should use encryption to protect sensitive information, in reality this is not always the case e.g. some expose sensitive data like credentials in cleartext. In this paper, we have conducted an extensive analysis on the communications channels of 32 IoT consumer devices. Our experiments consisted of four main parts; first we carried out a port scan to determine if any ports can be exploited and thus gain remote access. Second, we looked at whether any of the devices used encryption and if not what type of content was exposed. Third, we used the network traffic `metadata' to identify the destination the data terminated. Finally, we examined the communication between the mobile app and the cloud to see if it can be easily exploited using a proxy server. Our findings show that the majority of devices have remote access unavailable. We found the Shannon entropy test a useful pre-test in identifying unencrypted content. Although many devices encrypted their data, we found several in particular smart cameras would send data in cleartext when they detected motion or during updates. We found the majority of data transverses to the US and stored on Amazon servers with most devices contacting multiple destination. Lastly, we discovered many of the IoT device's mobile apps can be easily exploited using a HTTP Proxy.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
As IoT devices become more incorporated into our daily lives, their always on approach makes them an ideal source of evidence. While these devices should use encryption to protect sensitive information, in reality this is not always the case e.g. some expose sensitive data like credentials in cleartext. In this paper, we have conducted an extensive analysis on the communications channels of 32 IoT consumer devices. Our experiments consisted of four main parts; first we carried out a port scan to determine if any ports can be exploited and thus gain remote access. Second, we looked at whether any of the devices used encryption and if not what type of content was exposed. Third, we used the network traffic `metadata' to identify the destination the data terminated. Finally, we examined the communication between the mobile app and the cloud to see if it can be easily exploited using a proxy server. Our findings show that the majority of devices have remote access unavailable. We found the Shannon entropy test a useful pre-test in identifying unencrypted content. Although many devices encrypted their data, we found several in particular smart cameras would send data in cleartext when they detected motion or during updates. We found the majority of data transverses to the US and stored on Amazon servers with most devices contacting multiple destination. Lastly, we discovered many of the IoT device's mobile apps can be easily exploited using a HTTP Proxy.<\/div>
Close<\/a><\/p><\/div>
39.<\/td>

Zhang, Xiaolu; Breitinger, Frank; Luechinger, Engelbert; O'Shaughnessy, Stephen<\/p>

Android application forensics: A survey of obfuscation, obfuscation detection and deobfuscation techniques and their impact on investigations<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 39, <\/span>pp. 301285, <\/span>2021<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{Zhang2021android,
\r\ntitle = {Android application forensics: A survey of obfuscation, obfuscation detection and deobfuscation techniques and their impact on investigations},
\r\nauthor = {Xiaolu Zhang and Frank Breitinger and Engelbert Luechinger and Stephen O'Shaughnessy},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281721002031},
\r\ndoi = {10.1016\/j.fsidi.2021.301285},
\r\nissn = {2666-2817},
\r\nyear  = {2021},
\r\ndate = {2021-10-06},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {39},
\r\npages = {301285},
\r\nabstract = {Android obfuscation techniques include not only classic code obfuscation techniques that were adapted to Android, but also obfuscation methods that target the Android platform specifically. This work examines the status-quo of Android obfuscation, obfuscation detection and deobfuscation. Specifically, it first summarizes obfuscation approaches that are commonly used by app developers for code optimization, to protect their software against code theft and code tampering but are also frequently misused by malware developers to circumvent anti-malware products. Secondly, the article focuses on obfuscation detection techniques and presents various available tools and current research. Thirdly, deobfuscation (which aims at reinstating the original state before obfuscation) is discussed followed by a brief discussion how this impacts forensic investigation. We conclude that although obfuscation is widely used in Android app development (benign and malicious), available tools and the practices on how to deal with obfuscation are not standardized, and so are inherently lacking from a forensic standpoint.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
40.<\/td>

O'Shaughnessy, Stephen; Breitinger, Frank<\/p>

Malware family classification via efficient Huffman features<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 37, <\/span>pp. 301192, <\/span>2021<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{OShaughnessy2021malware,
\r\ntitle = {Malware family classification via efficient Huffman features},
\r\nauthor = {Stephen O'Shaughnessy and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281721001001},
\r\ndoi = {10.1016\/j.fsidi.2021.301192},
\r\nissn = {2666-2817},
\r\nyear  = {2021},
\r\ndate = {2021-07-14},
\r\nbooktitle = {Proceedings of the Twenty First Annual DFRWS USA},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {37},
\r\npages = {301192},
\r\nabstract = {As malware evolves and becomes more complex, researchers strive to develop detection and classification schemes that abstract away from the internal intricacies of binary code to represent malware without the need for architectural knowledge or invasive analysis procedures. Such approaches can reduce the complexities of feature generation and simplify the analysis process. In this paper, we present efficient Huffman features (eHf), a novel compression-based approach to feature construction, based on Huffman encoding, where malware features are represented in a compact format, without the need for intrusive reverse-engineering or dynamic analysis processes. We demonstrate the viability of eHf as a solution for classifying malware into their respective families on a large malware corpus of 15 k samples, indicative of the current threat landscape. We evaluate eHf against current compression-based alternatives and show that our method is comparable or superior for classification accuracy, while exhibiting considerably greater runtime efficiency. Finally we demonstrate that eHf is resilient against code reordering obfuscation.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
41.<\/td>

Hranick\u00fd, Radek; Breitinger, Frank; Ry\u0161av\u00fd, Ond\u0159ej; Sheppard, John; Schaedler, Florin; Morgenstern, Holger; Malik, Simon<\/p>

What do incident response practitioners need to know? A skillmap for the years ahead<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 37, <\/span>pp. 301184, <\/span>2021<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{hranicky2021what,
\r\ntitle = {What do incident response practitioners need to know? A skillmap for the years ahead},
\r\nauthor = {Radek Hranick\u00fd and Frank Breitinger and Ond\u0159ej Ry\u0161av\u00fd and John Sheppard and Florin Schaedler and Holger Morgenstern and Simon Malik},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281721000925},
\r\ndoi = {10.1016\/j.fsidi.2021.301184},
\r\nissn = {2666-2817},
\r\nyear  = {2021},
\r\ndate = {2021-07-14},
\r\nbooktitle = {Proceedings of the Twenty First Annual DFRWS USA},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {37},
\r\npages = {301184},
\r\nabstract = {Digital forensics incident response (DFIR) specialists are expected to possess multidisciplinary skills including expert knowledge of computer-related principles and technology. On the other hand, recent studies suggest that existing training and study programs may not fully address the needs of future DFIR professionals. To reveal possible gaps in practitioners education and identify the most needed skills, we built a skillmap for DFIR where we followed a threefold approach: (1) an online survey among DFIR experts; (2) a review of training programs; and (3) an analysis of job listings on LinkedIn. Each source was first analyzed on its own and the findings were merged into a DFIR skillmap which is the main contribution of this article. The results show that network forensics and incident handling are the most demanded domains of skills. While these are covered by existing courses the newly desired skills, in particular, cloud forensics and encrypted data, need to get more space in training and education. We hope that this article provides educators with information on ways to improve in the years ahead.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
42.<\/td>

Mart\u00edn-P\u00e9rez, Miguel; Rodr\u00edguez, Ricardo J.; Breitinger, Frank<\/p>

Bringing order to approximate matching: Classification and attacks on similarity digest algorithms<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>pp. 301120, <\/span>2021<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{martinperez2021bringing,
\r\ntitle = {Bringing order to approximate matching: Classification and attacks on similarity digest algorithms},
\r\nauthor = {Miguel Mart\u00edn-P\u00e9rez and Ricardo J. Rodr\u00edguez and Frank Breitinger},
\r\nurl = {https:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281721000172},
\r\ndoi = {10.1016\/j.fsidi.2021.301120},
\r\nissn = {2666-2817},
\r\nyear  = {2021},
\r\ndate = {2021-03-30},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\npages = {301120},
\r\nabstract = {Fuzzy hashing or similarity hashing (a.k.a. bytewise approximate matching) converts digital artifacts into an intermediate representation to allow an efficient (fast) identification of similar objects, e.g., for blacklisting. They gained a lot of popularity over the past decade with new algorithms being developed and released to the digital forensics community. When releasing algorithms (e.g., as part of a scientific article), they are frequently compared with other algorithms to outline the benefits and sometimes also the weaknesses of the proposed approach. However, given the wide variety of algorithms and approaches, it is impossible to provide direct comparisons with all existing algorithms. In this paper, we present the first classification of approximate matching algorithms which allows an easier description and comparisons. Therefore, we first reviewed existing literature to understand the techniques various algorithms use and to familiarize ourselves with the common terminology. Our findings allowed us to develop a categorization relying heavily on the terminology proposed by NIST SP 800-168. In addition to the categorization, this article presents an abstract set of attacks against algorithms and why they are feasible. Lastly, we detail the characteristics needed to build robust algorithms to prevent attacks. We believe that this article helps newcomers, practitioners, and experts alike to better compare algorithms, understand their potential, as well as characteristics and implications they may have on forensic investigations.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
Fuzzy hashing or similarity hashing (a.k.a. bytewise approximate matching) converts digital artifacts into an intermediate representation to allow an efficient (fast) identification of similar objects, e.g., for blacklisting. They gained a lot of popularity over the past decade with new algorithms being developed and released to the digital forensics community. When releasing algorithms (e.g., as part of a scientific article), they are frequently compared with other algorithms to outline the benefits and sometimes also the weaknesses of the proposed approach. However, given the wide variety of algorithms and approaches, it is impossible to provide direct comparisons with all existing algorithms. In this paper, we present the first classification of approximate matching algorithms which allows an easier description and comparisons. Therefore, we first reviewed existing literature to understand the techniques various algorithms use and to familiarize ourselves with the common terminology. Our findings allowed us to develop a categorization relying heavily on the terminology proposed by NIST SP 800-168. In addition to the categorization, this article presents an abstract set of attacks against algorithms and why they are feasible. Lastly, we detail the characteristics needed to build robust algorithms to prevent attacks. We believe that this article helps newcomers, practitioners, and experts alike to better compare algorithms, understand their potential, as well as characteristics and implications they may have on forensic investigations.<\/div>
Close<\/a><\/p><\/div>
43.<\/td>

Pluskal, Jan; Breitinger, Frank; Ry\u0161av\u00fd, Ond\u0159ej<\/p>

Netfox detective: A novel open-source network forensics analysis tool<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 35, <\/span>pp. 301019, <\/span>2020<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{pluskal2020netfox,
\r\ntitle = {Netfox detective: A novel open-source network forensics analysis tool},
\r\nauthor = {Jan Pluskal and Frank Breitinger and Ond\u0159ej Ry\u0161av\u00fd},
\r\nurl = {http:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281720300871},
\r\ndoi = {10.1016\/j.fsidi.2020.301019},
\r\nissn = {2666-2817},
\r\nyear  = {2020},
\r\ndate = {2020-09-17},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {35},
\r\npages = {301019},
\r\nabstract = {Network forensics is a major sub-discipline of digital forensics which becomes more and more important in an age where everything is connected. In order to cope with the amounts of data and other challenges within networks, practitioners require powerful tools that support them. In this paper, we highlight a novel open-source network forensic tool named \u2013 Netfox Detective \u2013 that outperforms existing tools such as Wireshark or NetworkMiner in certain areas. For instance, it provides a heuristically based engine for traffic processing that can be easily extended. Using robust parsers (we are not solely relying on the RFC description but use heuristics), our application tolerates malformed or missing conversation segments. Besides outlining the tool's architecture and basic processing concepts, we also explain how it can be extended. Lastly, a comparison with other similar tools is presented as well as a real-world scenario is discussed.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
44.<\/td>

Breitinger, Frank; Tully-Doyle, Ryan; Przyborski, Kristen; Beck, Lauren; Harichandran, Ronald S.<\/p>

First year students' experience in a Cyber World course \u2013 an evaluation<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Education and Information Technologies, <\/span>2020<\/span>, ISBN: 1573-7608<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{Breitinger2020,
\r\ntitle = {First year students' experience in a Cyber World course \u2013 an evaluation},
\r\nauthor = {Frank Breitinger and Ryan Tully-Doyle and Kristen Przyborski and Lauren Beck and Ronald S. Harichandran},
\r\nurl = {https:\/\/link.springer.com\/article\/10.1007\/s10639-020-10327-9},
\r\ndoi = {10.1007\/s10639-020-10274-5},
\r\nisbn = {1573-7608},
\r\nyear  = {2020},
\r\ndate = {2020-09-11},
\r\njournal = {Education and Information Technologies},
\r\nabstract = {Although cybersecurity is a major present concern, it is not a required subject in University. In response, we developed Cyber World which introduces students to eight highly important cybersecurity topics (primarily taught by none cybersecurity experts). We embedded it into our critical thinking Common Course (core curriculum) which is a team-taught first-year experience required for all students. Cyber World was first taught in Fall 2018 to a cohort of over 150 students from various majors at the University of New Haven. This article presents the evaluation of our Fall taught course. In detail, we compare the performance of Cyber World students to other Common Course sections that ran in parallel and conclude that despite the higher workload students performed equally well. Furthermore, we assess the students' development throughout the course with respect to their cybersecurity knowledge where our results indicate a significant gain of knowledge. Note, this article also presents the idea and topics of Cyber World; however a detailed explanation has been released previously.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
45.<\/td>

Wu, Tina; Breitinger, Frank; O'Shaughnessy, Stephen<\/p>

Digital forensic tools: Recent advances and enhancing the status quo<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 34, <\/span>pp. 300999, <\/span>2020<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{WBS20,
\r\ntitle = {Digital forensic tools: Recent advances and enhancing the status quo},
\r\nauthor = {Tina Wu and Frank Breitinger and Stephen O'Shaughnessy},
\r\nurl = {http:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281720301864},
\r\ndoi = {10.1016\/j.fsidi.2020.300999},
\r\nissn = {2666-2817},
\r\nyear  = {2020},
\r\ndate = {2020-08-14},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {34},
\r\npages = {300999},
\r\nabstract = {Publications in the digital forensics domain frequently come with tools \u2013 a small piece of functional software. These tools are often released to the public for others to reproduce results or use them for their own purposes. However, there has been no study on the tools to understand better what is available and what is missing. For this paper we analyzed almost 800 articles from pertinent venues from 2014 to 2019 to answer the following three questions (1) what tools (i.e., in which domains of digital forensics): have been released; (2) are they still available, maintained, and documented; and (3) are there possibilities to enhance the status quo? We found 62 different tools which we categorized according to digital forensics subfields. Only 33 of these tools were found to be publicly available, the majority of these were not maintained after development. In order to enhance the status quo, one recommendation is a centralized repository specifically for tested tools. This will require tool researchers (developers) to spend more time on code documentation and preferably develop plugins instead of stand-alone tools.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
46.<\/td>

Palmbach, David; Breitinger, Frank<\/p>

Artifacts for detecting timestamp manipulation in NTFS on Windows and their reliability<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Forensic Science International: Digital Investigation, <\/span>vol. 32, <\/span>pp. 300920, <\/span>2020<\/span>, ISSN: 2666-2817<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{PB20,
\r\ntitle = {Artifacts for detecting timestamp manipulation in NTFS on Windows and their reliability},
\r\nauthor = {David Palmbach and Frank Breitinger},
\r\nurl = {http:\/\/www.sciencedirect.com\/science\/article\/pii\/S2666281720300159},
\r\ndoi = {10.1016\/j.fsidi.2020.300920},
\r\nissn = {2666-2817},
\r\nyear  = {2020},
\r\ndate = {2020-06-04},
\r\njournal = {Forensic Science International: Digital Investigation},
\r\nvolume = {32},
\r\npages = {300920},
\r\nabstract = {Timestamps have proven to be an expedient source of evidence for examiners in the reconstruction of computer crimes. Consequently, active adversaries and malware have implemented timestomping techniques (i.e., mechanisms to alter timestamps) to hide their traces. Previous research on detecting timestamp manipulation primarily focused on two artifacts: the $MFT as well as the records in the $LogFile. In this paper, we present a new use of four existing windows artifacts \u2013 the $USNjrnl, link files, prefetch files, and Windows event logs \u2013 that can provide valuable information during investigations and diversify the artifacts available to examiners. These artifacts contain either information about executed programs or additional timestamps which, when inconsistencies occur, can be used to prove timestamp forgery. Furthermore, we examine the reliability of artifacts being used to detect timestamp manipulation, i.e., testing their ability to retain information against users actively trying to alter or delete them. Based on our findings we conclude that none of the artifacts analyzed can withstand active exploitation.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
47.<\/td>

Laskov, Pavel; Breitinger, Frank<\/p>

Blockchain-Technologien und deren Anwendungen im \u00f6ffentlichen Sektor (Miscellaneous<\/span>)<\/p>

Workshop Liechtensteinische Landesverwaltung, <\/span>2020<\/span>, (Vaduz, Liechtenstein)<\/span>.<\/p>

(BibTeX<\/a><\/span>)<\/p>

48.<\/td>

Moia, Vitor Hugo Galhardo; Breitinger, Frank; Henriques, Marco Aur\u00e9lio Amaral<\/p>

The impact of excluding common blocks for approximate matching<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Computers & Security, <\/span>vol. 89, <\/span>pp. 101676, <\/span>2019<\/span>, ISSN: 0167-4048<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{MOIA2020101676,
\r\ntitle = {The impact of excluding common blocks for approximate matching},
\r\nauthor = {Vitor Hugo Galhardo Moia and Frank Breitinger and Marco Aur\u00e9lio Amaral Henriques},
\r\nurl = {http:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404819302159},
\r\ndoi = {10.1016\/j.cose.2019.101676},
\r\nissn = {0167-4048},
\r\nyear  = {2019},
\r\ndate = {2019-11-28},
\r\njournal = {Computers & Security},
\r\nvolume = {89},
\r\npages = {101676},
\r\nabstract = {Approximate matching functions allow the identification of similarity (bytewise level) in a very efficient way, by creating and comparing compact representations of objects (a.k.a digests). However, many similarity matches occur due to common data that repeats over many different files and consist of inner structure, header and footer information, color tables, font specifications, etc.; data created by applications and not generated by users. Most of the times, this sort of information is less relevant from an investigator perspective and should be avoided. In this work, we show how the common data can be identified and filtered out by using approximate matching, as well as how they are spread over different file types and their frequency. We assess the impact on similarity when removing it (i.e., in the number of matches) and the effects on performance. Our results show that for a small price on performance, a reduction about 87% on the number of matches can be achieved when removing such data.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
49.<\/td>

Breitinger, Frank; Tully-Doyle, Ryan; Hassenfeldt, Courtney<\/p>

A survey on smartphone user's security choices, awareness and education<\/a> (Journal Article<\/span>)<\/p>

In: <\/span>Computers & Security, <\/span>vol. 88, <\/span>pp. 101647, <\/span>2019<\/span>, ISSN: 0167-4048<\/span>.<\/p>

(Abstract<\/a><\/span> | Links<\/a><\/span> | BibTeX<\/a><\/span>)<\/p>

@article{BTH20,
\r\ntitle = {A survey on smartphone user's security choices, awareness and education},
\r\nauthor = {Frank Breitinger and Ryan Tully-Doyle and Courtney Hassenfeldt},
\r\nurl = {http:\/\/www.sciencedirect.com\/science\/article\/pii\/S0167404819301919},
\r\ndoi = {10.1016\/j.cose.2019.101647},
\r\nissn = {0167-4048},
\r\nyear  = {2019},
\r\ndate = {2019-10-11},
\r\njournal = {Computers & Security},
\r\nvolume = {88},
\r\npages = {101647},
\r\nabstract = {Smartphones contain a significant amount of personal data. Additionally, they are always in the user's possession, which allows them to be abused for tracking (e.g., GPS, Bluetooth or WiFi tracking). In order to not reveal private information, smartphone users should secure their devices by setting lock screen protection, using third party security applications, and choosing appropriate security settings (often, default settings are inadequate). In this paper, we mount a survey to explore user choices, awareness and education with respect to cybersecurity. In comparison with prior work, we take the user's cybersecurity familiarity into consideration in the analysis of user practices as well as have a strong focus on the younger generations, Y and Z. Our survey findings suggest that most users have appropriate lock screen settings to protect their phones from physical access; however, they disregard other security best practices, e.g., not using a VPN when connecting to a public WiFi or turning off unused features (regardless of level of expertise). Compared to desktop computers, smartphones are less secured and fewer third party security products are installed.},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {article}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div>
50.<\/td>

Breitinger, Frank<\/p>

IT-Sicherheit im Finanzsektor (Miscellaneous<\/span>)<\/p>

7. Sorgfaltspflichttag Liechtenstein, <\/span>2019<\/span>, (Schaan, Liechtenstein)<\/span>.<\/p>

(BibTeX<\/a><\/span>)<\/p>

@misc{pres-SPG,
\r\ntitle = {IT-Sicherheit im Finanzsektor},
\r\nauthor = {Frank Breitinger},
\r\nyear  = {2019},
\r\ndate = {2019-10-01},
\r\nhowpublished = {7. Sorgfaltspflichttag Liechtenstein},
\r\nnote = {Schaan, Liechtenstein},
\r\nkeywords = {},
\r\npubstate = {published},
\r\ntppubtype = {misc}
\r\n}
\r\n<\/pre><\/div>
Close<\/a><\/p><\/div><\/td><\/tr><\/table>
120 entries<\/span> «<\/a> ‹<\/a> 1 of 3 ›<\/a> »<\/a> <\/div><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":15,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-full-width.php","meta":{"footnotes":""},"class_list":["post-297","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/pages\/297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fbreitinger.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=297"}],"version-history":[{"count":14,"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/pages\/297\/revisions"}],"predecessor-version":[{"id":1105,"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/pages\/297\/revisions\/1105"}],"up":[{"embeddable":true,"href":"https:\/\/fbreitinger.de\/index.php?rest_route=\/wp\/v2\/pages\/15"}],"wp:attachment":[{"href":"https:\/\/fbreitinger.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}