Search Results (38)

The rapid advancement of social media and the exponential increase in online information have made open-source intelligence an essential component of modern criminal investigations. However, existing digital forensics standards mainly focus on evidence derived from controlled devices such as computers and mobile storage, providing limited guidance for social media–based intelligence. Evidence captured from online platforms is often volatile, editable, and difficult to verify, which raises doubts about its authenticity and admissibility in court. To address these challenges, this study proposes a systematic and legally compliant open-source intelligence framework aligned with digital forensics principles. The framework comprises five stages: identification, acquisition, authentication, preservation, and validation. By integrating blockchain-based notarization and image verification mechanisms into existing forensic workflows, the proposed system ensures data integrity, traceability, and authenticity. The implemented prototype demonstrates the feasibility of conducting reliable and legally compliant open-source intelligence investigations, providing law enforcement agencies with a standardized operational guideline for social media–based evidence collection. Full article

Terminal forensics in large mobile networks is a vital activity for identifying compromised devices and analyzing malicious actions. In contrast, the study described here begins with the domain of terminal forensics as the primary focus, rather than the threat itself. This paper proposes a new multi-criteria decision-making (MCDM) model that integrates complex picture fuzzy sets (CPFS) with the combinative distance-based assessment (CODAS), referred to throughout as complex picture fuzzy CODAS (CPF-CODAS). The aim is to assist in forensic analysis for detecting mobile botnet command and control (C&C) systems. The CPF-CODAS model accounts for the uncertainty, hesitation, and complex numerical values involved in expert decision-making, using degrees of membership as positive, neutral, and negative values. An illustrative forensic case study is constructed where three mobile devices are evaluated by three cybersecurity professionals based on six key parameters related to botnet activity. The results demonstrate that the model can effectively distinguish suspicious devices and support the use of the CPF-CODAS approach in terminal forensics of mobile networks. The robustness, symmetry, and advantages of this model over existing MCDM methods are confirmed through sensitivity and comparison analyses. In conclusion, this paper introduces a novel probabilistic decision-support tool that digital forensic specialists can incorporate into their workflow to proactively identify and prevent actions of mobile botnet C&C servers. Full article

In this study, bone detection was performed using the YOLO algorithm on a dataset comprising photographs of the scapula, humerus, and femur from cattle, horses, and dogs. Subsequently, convolutional neural networks (CNNs) were employed to classify both the bone type and the species. Trained on a total of 26,148 images, the model achieved an accuracy rate of up to 97.6%. The system was designed to operate not only on mobile devices but also in an offline, “closed model” version, thereby enhancing its applicability in forensic medicine settings where data security is critical. Additionally, the application was structured as a virtual assistant capable of responding to users in both written and spoken formats and of generating output in PDF format. In this regard, this study presents a significant example of digital transformation in fields such as veterinary anatomy education, forensic medicine, archaeology, and crime scene investigation, providing a solid foundation for future applications. Full article

The advancement of Internet of Things (IoT), robots, drones, and vehicles signifies ongoing progress, accompanied by increasing complexities and challenges in forensic investigations. Globally, investigators encounter obstacles when extracting evidence from these vast landscapes, which include diverse devices, networks, and cloud environments. Of particular concern is the process of evidence collection, especially regarding fingerprints and facial recognition within the realm of vehicle forensics. Moreover, ensuring the integrity of forensic evidence is a critical issue, as it is vulnerable to attacks targeting data centres and server farms. Mitigating these challenges, along with addressing evidence mobility, presents additional complexities. This paper introduces a groundbreaking infrastructure known as SpiderNet, which is based on cloud computing principles. We will illustrate how this architecture facilitates the identification of devices, secures the integrity of evidence both at its source and during transit, and enables investigations into individuals involved in criminal activities. Through case studies, we will demonstrate the potential of SpiderNet to assist law enforcement agencies in addressing crimes perpetrated within IoT environments. Full article

The Android operating system has become increasingly popular, not only on mobile phones but also in various other platforms such as Internet-of-Things devices, tablet computers, and wearable devices. Due to its open-source nature and significant market share, Android poses an attractive target for malicious actors. One of the notable security challenges associated with this operating system is riskware. Riskware refers to applications that may pose a security threat due to their vulnerability and potential for misuse. Although riskware constitutes a considerable portion of Android’s ecosystem malware, it has not been studied as extensively as other types of malware such as ransomware and trojans. In this study, we employ machine learning techniques to analyze the behavior of different riskware families and identify similarities in their actions. Furthermore, our research identifies specific behaviors that can be used to distinguish these riskware families. To achieve these insights, we utilize various tools such as k-Means clustering, principal component analysis, extreme gradient boost classifiers, and Shapley additive explanation. Our findings can contribute significantly to the detection, identification, and forensic analysis of Android riskware. Full article

The revolutionary breakthroughs in Machine Learning (ML) and Artificial Intelligence (AI) are extensively being harnessed across a diverse range of domains, e.g., forensic science, healthcare, virtual assistants, cybersecurity, and robotics. On the flip side, they can also be exploited for negative purposes, like producing authentic-looking fake news that propagates misinformation and diminishes public trust. Deepfakes pertain to audio or visual multimedia contents that have been artificially synthesized or digitally modified through the application of deep neural networks. Deepfakes can be employed for benign purposes (e.g., refinement of face pictures for optimal magazine cover quality) or malicious intentions (e.g., superimposing faces onto explicit image/video to harm individuals producing fake audio recordings of public figures making inflammatory statements to damage their reputation). With mobile devices and user-friendly audio and visual editing tools at hand, even non-experts can effortlessly craft intricate deepfakes and digitally altered audio and facial features. This presents challenges to contemporary computer forensic tools and human examiners, including common individuals and digital forensic investigators. There is a perpetual battle between attackers armed with deepfake generators and defenders utilizing deepfake detectors. This paper first comprehensively reviews existing image, video, and audio deepfake databases with the aim of propelling next-generation deepfake detectors for enhanced accuracy, generalization, robustness, and explainability. Then, the paper delves deeply into open challenges and potential avenues for research in the audio and video deepfake generation and mitigation field. The aspiration for this article is to complement prior studies and assist newcomers, researchers, engineers, and practitioners in gaining a deeper understanding and in the development of innovative deepfake technologies. Full article

With the frequent occurrence of drone-related criminal cases, drone forensics has become a hot spot of concern. During drone-related criminal investigations, the implicated drones are often forcibly brought down, which poses significant challenges in conducting forensic analysis. In order to restore the truth of criminal cases, it is necessary to extract data not only from the external TF card but also from internal chip memory in drone forensics. To address this issue, a drone data parser (DRDP) is proposed to extract internal and external data from criminal-implicated drones. In this paper, we present comprehensive forensics on the DJI Mavic 2 Pro, analyzing the main file structure and encryption model. According to its file structures, three case studies are conducted on various file types (DAT files, TXT files, and default files) to verify the effectiveness and applicability of the designed procedure. The results show that the encrypted data of the implicated drone, such as GPS information, flight time, flight altitude, flight distance, three velocity components (x, y, z) and other information can be extracted and decrypted correctly, which provides evidence for the identification of the case facts. Full article

Fingerprints are unique patterns used as biometric keys because they allow an individual to be unambiguously identified, making their application in the forensic field a common practice. The design of a system that can match the details of different images is still an open problem, especially when applied to large databases or, to real-time applications in forensic scenarios using mobile devices. Fingerprints collected at a crime scene are often manually processed to find those that are relevant to solving the crime. This work proposes an efficient methodology that can be applied in real time to reduce the manual work in crime scene investigations that consumes time and human resources. The proposed methodology includes four steps: (i) image pre-processing using oriented Gabor filters; (ii) the extraction of minutiae using a variant of the Crossing Numbers method which include a novel ROI definition through convex hull and erosion followed by replacing two or more very close minutiae with an average minutiae; (iii) the creation of a model that represents each minutia through the characteristics of a set of polygons including neighboring minutiae; (iv) the individual search of a match for each minutia in different images using metrics on the absolute and relative errors. While in the literature most methodologies look to validate the entire fingerprint model, connecting the minutiae or using minutiae triplets, we validate each minutia individually using n-vertex polygons whose vertices are neighbor minutiae that surround the reference. Our method also reveals robustness against false minutiae since several polygons are used to represent the same minutia, there is a possibility that even if there are false minutia, the true polygon is present and identified; in addition, our method is immune to rotations and translations. The results show that the proposed methodology can be applied in real time in standard hardware implementation, with images of arbitrary orientations. Full article

Diagnoses in forensic science cover many disciplinary and technical fields, including thanatology and clinical forensic medicine, as well as all the disciplines mobilized by these two major poles: criminalistics, ballistics, anthropology, entomology, genetics, etc. A diagnosis covers three major interrelated concepts: a categorization of pathologies (the diagnosis); a space of signs or symptoms; and the operation that makes it possible to match a set of signs to a category (the diagnostic approach). The generalization of digitization in all sectors of activity—including forensic science, the acculturation of our societies to data and digital devices, and the development of computing, storage, and data analysis capacities—constitutes a favorable context for the increasing adoption of artificial intelligence (AI). AI can intervene in the three terms of diagnosis: in the space of pathological categories, in the space of signs, and finally in the operation of matching between the two spaces. Its intervention can take several forms: it can improve the performance (accuracy, reliability, robustness, speed, etc.) of the diagnostic approach, better define or separate known diagnostic categories, or better associate known signs. But it can also bring new elements, beyond the mere improvement of performance: AI takes advantage of any data (data here extending the concept of symptoms and classic signs, coming either from the five senses of the human observer, amplified or not by technical means, or from complementary examination tools, such as imaging). Through its ability to associate varied and large-volume data sources, but also its ability to uncover unsuspected associations, AI may redefine diagnostic categories, use new signs, and implement new diagnostic approaches. We present in this article how AI is already mobilized in forensic science, according to an approach that focuses primarily on improving current techniques. We also look at the issues related to its generalization, the obstacles to its development and adoption, and the risks related to the use of AI in forensic diagnostics. Full article

Criminal investigations aiming to track the route walked by missing persons and fugitives (MPFs) usually involve intelligence analysts, military planners, experts in mobile forensics, traditional investigative methods, and sniffer dog handlers. Nonetheless, when MPFs are devoid of any technological device and move in uninhabited rural areas devoid of tele cameras and densely covered by vegetation, tracking the route walked by MPFs may be a much more arduous task. In the XVIII century, the expert Georg Popp was able to link a homicide suspect to a sequence of different sites of criminal interest, located in the countryside, by studying the stains of soils found on the footwear and trousers of the suspect. In such complex cases, a very efficient approach for tracking the route walked by MPFs may consist of comparing the geological traces found on the MPFs and their belongings with soils exposed in the event scenes. In particular, the search for peculiar or rare particles and aggregates may strengthen the weight of the geological forensic evidence comparisons. A match of mineralogical, textural, and organic matter data may demonstrate the provenance of the traces from the soil of a specific site, thereby linking the MPFs to the scene of events. Based on the above, the present paper reports geological determinations accomplished for a “mediatic” casework. The results allowed a general high degree of compatibility among traces collected on the MPFs and on the soil from the scene of events to be ascertained. The most significant positive matches, based on the finding of ten peculiar and rare particles and assemblages, allowed the reconstruction of a route about 1.1 km long, as the crow flies, on the event site. Although this procedure was extremely time consuming and available only in a backwards reconstruction linked to the MPFs’ findings, it was of uttermost importance in strengthening the inferences proposed, and for which other methods could not provide any information. Full article

Drones, also known as unmanned aerial vehicles (UAVs) and sometimes referred to as ‘Mobile IoT’ or ‘Flying IoT’, are widely adopted worldwide, with their market share continuously increasing. While drones are generally harnessed for a wide range of positive applications, recent instances of drones being employed as lethal weapons in conflicts between countries like Russia, Ukraine, Israel, Palestine, and Hamas have demonstrated the potential consequences of their misuse. Such misuse poses a significant threat to cybersecurity and human lives, thereby highlighting the need for research to swiftly and accurately analyze drone-related crimes, identify the responsible pilot, and establish when and what illegal actions were carried out. In contrast to existing research, involving limited data collection and analysis of the drone, our study focused on collecting and rigorously analyzing data without restrictions from the remote controller used to operate the drone. This comprehensive approach allowed us to unveil essential details, including the pilot’s account information, the specific drone used, pairing timestamps, the pilot’s operational location, the drone’s flight path, and the content captured during flights. We developed methodologies and proposed artifacts to reveal these specifics, which were supported by real-world data. Significantly, this study is the pioneering digital forensic investigation of remote controller devices. We meticulously collected and analyzed all internal data, and we even employed reverse engineering to decrypt critical information files. These achievements hold substantial significance. The outcomes of this research are expected to serve as a digital forensic methodology for drone systems, thereby making valuable contributions to numerous investigations. Full article

The identification and recovery of suspected human biofluid evidence can present a bottleneck in the crime scene investigation workflow. Crime Scene Investigators typically deploy one of a number of presumptive enhancement reagents, depending on what they perceive an analyte to be; the selection of this reagent is largely based on the context of suspected evidence and their professional experience. Positively identified samples are then recovered to a forensic laboratory where confirmatory testing is carried out by large lab-based instruments, such as through mass-spectrometry-based techniques. This work proposes a proof-of-concept study into the use of a small, robust and portable ion mobility spectrometry device that can analyse samples in situ, detecting, identifying and discriminating commonly encountered body fluids from interferences. This analysis exploits the detection and identification of characteristic volatile organic compounds generated by gentle heating, at ambient temperature and pressure, and categorises samples using machine learning, providing investigators with instant identification. The device is shown to be capable of producing characteristic mobility spectra using a dual micro disc pump configuration which separates blood and urine from three visually similar interferences using an unsupervised PCA model with no misclassified samples. The device has the potential to reduce the need for potentially contaminating and destructive presumptive tests, and address the bottleneck created by the time-consuming and laborious detection, recovery and analysis workflow currently employed. Full article

With the global expansion of urban infrastructure and development of 5G communication technology, advanced information and communications technology has been applied to power systems and the use of smart grids has increased. Smart grid systems collect energy data using Internet-of-Things (IoT) devices, such as data concentrator units (DCUs) and smart meters, to effectively manage energy. Services and functions for energy management are being incorporated into home IoT devices. In this paper, the IoT for energy management in smart cities and smart homes is referred to as the E-IoT. Systems that use the E-IoT can efficiently manage data, but they present many potential security threats, because the E-IoT devices in such homes and enterprises are networked for energy management. Therefore, in this study, to identify vulnerabilities in the E-IoT device systems, digital forensics is applied to the E-IoT device systems. E-IoT devices supplied to Korean power systems were used to build a digital forensic test bed similar to actual E-IoT environments. For digital forensics application, E-IoT data acquisition and analysis methodology was proposed. The proposed methodology consisted of three methods—network packet data analysis, hardware interface analysis, and mobile device paired with E-IoT—which were applied to a DCU, smart meter, smart plug, smart heat controller, smart microwave, and smart monitoring system. On analyzing the user and system data acquired, artifacts such as the device name and energy consumption were derived. User accounts and passwords and energy-usage logs were obtained, indicating the possibility of leakage of personal information and the vulnerabilities of E-IoT devices. Full article

At present, the mobile device sector is experiencing significant growth. In particular, wearable devices have become a common element in society. This fact implies that users unconsciously accept the constant dynamic collection of private data about their habits and behaviours. Therefore, this work focuses on highlighting and analysing some of the main issues that forensic analysts face in this sector, such as the lack of standard procedures for analysis and the common use of private protocols for data communication. Thus, it is almost impossible for a digital forensic specialist to fully specialize in the context of wearables, such as smartwatches for sports activities. With the aim of highlighting these problems, a complete forensic analysis laboratory for such sports devices is described in this paper. We selected a smartwatch belonging to the Garmin Forerunner Series, due to its great popularity. Through an analysis, its strengths and weaknesses in terms of data protection are described. We also analyse how companies are increasingly taking personal data privacy into consideration, in order to minimize unwanted information leaks. Finally, a set of initial security recommendations for the use of these kinds of devices are provided to the reader. Full article

Source acquisition device identification from recorded audio aims to identify the source recording device by analyzing the intrinsic characteristics of audio, which is a challenging problem in audio forensics. In this paper, we propose a spatiotemporal representation learning framework with multi-attention mechanisms to tackle this problem. In the deep feature extraction stage of recording devices, a two-branch network based on residual dense temporal convolution networks (RD-TCNs) and convolutional neural networks (CNNs) is constructed. The spatial probability distribution features of audio signals are employed as inputs to the branch of the CNN for spatial representation learning, and the temporal spectral features of audio signals are fed into the branch of the RD-TCN network for temporal representation learning. This achieves simultaneous learning of long-term and short-term features to obtain an accurate representation of device-related information. In the spatiotemporal feature fusion stage, three attention mechanisms—temporal, spatial, and branch attention mechanisms—are designed to capture spatiotemporal weights and achieve effective deep feature fusion. The proposed framework achieves state-of-the-art performance on the benchmark CCNU_Mobile dataset, reaching an accuracy of 97.6% for the identification of 45 recording devices, with a significant reduction in training time compared to other models. Full article