The Automation of the Extraction of Evidence masked by Steganographic Techniques in WAV and MP3 Audio Files

Antiforensics techniques and particularly steganography and cryptography have become increasingly pressing issues that affect the current digital forensics practice, both techniques are widely researched and developed as considered in the heart of the modern digital era but remain double edged swords standing between the privacy conscious and the criminally malicious, dependent on the severity of the methods deployed. This paper advances the automation of hidden evidence extraction in the context of audio files enabling the correlation between unprocessed evidence artefacts and extreme Steganographic and Cryptographic techniques using the Least Significant Bits extraction method (LSB). The research generates an in-depth review of current digital forensic toolkit and systems and formally address their capabilities in handling steganography-related cases, we opted for experimental research methodology in the form of quantitative analysis of the efficiency of detecting and extraction of hidden artefacts in WAV and MP3 audio files by comparing standard industry software. This work establishes an environment for the practical implementation and testing of the proposed approach and the new toolkit for extracting evidence hidden by Cryptographic and Steganographic techniques during forensics investigations. The proposed multi-approach automation demonstrated a huge positive impact in terms of efficiency and accuracy and notably on large audio files (MP3 and WAV) which the forensics analysis is time-consuming and requires significant computational resources and memory. However, the proposed automation may occasionally produce false positives (detecting steganography where none exists) or false negatives (failing to detect steganography that is present) but overall achieve a balance between detecting hidden data accurately along with minimising the false alarms.Comment: Wires Forensics Sciences Under Revie

AMR Compressed-Domain Analysis for Multimedia Forensics Double Compression Detection

An audio recording must be authentic to be admitted as evidence in a criminal prosecution so that the speech is saved with maximum fidelity and interpretation mistakes are prevented. AMR (adaptive multi-rate) encoder is a worldwide standard for speech compression and for GSM mobile network transmission, including 3G and 4G. In addition, such encoder is an audio file format standard with extension AMR which uses the same compression algorithm. Due to its extensive usage in mobile networks and high availability in modern smartphones, AMR format has been found in audio authenticity cases for forgery searching. Such exams compound the multimedia forensics field which consists of, among other techniques, double compression detection, i. e., to determine if a given AMR file was decompressed and compressed again. AMR double compression detection is a complex engineering problem whose solution is still underway. In general terms, if an AMR file is double compressed, it is not an original one and it was likely doctored. The published works in literature about double compression detection are based on decoded waveform AMR files to extract features. In this paper, a new approach is proposed to AMR double compression detection which, in spite of processing decoded audio, uses its encoded version to extract compressed-domain linear prediction (LP) coefficient-based features. By means of feature statistical analysis, it is possible to show that they can be used to achieve AMR double compression detection in an effective way, so that they can be considered a promising path to solve AMR double compression problem by artificial neural networks

Forensic analysis of video file formats

AbstractVideo file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing

A novel hybrid method for effective identification and extraction of digital evidence masked by steganographic techniques in WAV and MP3 files

Anti-forensics techniques, particularly steganography and cryptography, have become increasingly pressing issues affecting current digital forensics practices. This paper advances the automation of hidden evidence extraction in audio files by proposing a novel multi-approach method. This method facilitates the correlation between unprocessed artefacts, indexed and live forensics analysis, and traditional steganographic and cryp- tographic detection techniques. In this work, we opted for experimental research methodology in the form of a quantitative analysis of the efficiency of the proposed automation in detecting and extracting hidden artefacts in WAV and MP3 audio files. This comparison is made against standard industry systems. This work advances the current automation in extracting evidence hidden by cryptographic and steganographic techniques during forensic investigations. The proposed multi-approach demonstrates a clear enhancement in terms of cover- age and accuracy, notably on large audio files (MP3 and WAV), where manual forensic analysis is complex, time-consuming and requires significant expertise. Nonetheless, the proposed multi-approach automation may occasionally produce false positives (detecting steganography where none exists) or false negatives (failing to detect steganography that is present). However, it strikes a good balance between efficiently and effectively detecting hidden evidence, minimising false negatives and validating its reliability

Digital Forensics Overview

Digital Evaluation and Exploitation (DEEP): Research in "trusted" systems and exploitation

Fast Computation of Sliding Discrete Tchebichef Moments and Its Application in Duplicated Regions Detection

International audienceComputational load remains a major concern when processing signals by means of sliding transforms. In this paper, we present an efficient algorithm for the fast computation of one-dimensional and two-dimensional sliding discrete Tchebichef moments. To do so, we first establish the relationships that exist between the Tchebichef moments of two neighboring windows taking advantage of Tchebichef polynomials’ properties. We then propose an original way to fast compute the moments of one window by utilizing the moment values of its previous window. We further theoretically establish the complexity of our fast algorithm and illustrate its interest within the framework of digital forensics and more precisely the detection of duplicated regions in an audio signal or an image. Our algorithm is used to extract local features of such a signal tampering. Experimental results show that its complexity is independent of the window size, validating the theory. They also exhibit that our algorithm is suitable to digital forensics and beyond to any applications based on sliding Tchebichef moments

ANALYSIS OF THE IMPACT OF DISTORTION ON SOUND RECORDINGS AS ANTI FORENSIC ACTIVITIES

Anti-forensics on audio is aimed at complicating investigations on audio forensics, on sound recordings. Sound recordings can be altered or manipulated in various ways as well as the provision of distortion effects on sound recordings. Effect such distortions will make it difficult for investigators to find out the owner of the original voice. Analysis of distortion effects on sound recordings for anti-forensic activities, has not been widely carried out. Distortion can be an effective anti-forensic technique because the sound produced will be noisy, making it difficult for investigators to conduct investigations. In this study, testing was carried out using 3 types of distortion, namely Hard Clipping, Hard Overdrive and Odd Harmonics. To find out the extent to which the three types of distortions make it difficult to identify the owner of the original sound, the variables that affect each type of distortion are set at low, medium, and high levels. Formant values from the original and distorted sound samples were compared for later analysis using the Anova One-Way approach to show whether the original sound was identical and the other three voices were distorted. The test was carried out using 10 sound samples. From the results of the anova analysis, it is known that the types of Distortion of Hard Clipping and Odd Harmonics with variables at high levels can manipulate sound recordings, making it difficult to recognize the authenticity of a sound recording. Unlike the case with the type of Distortion of Hard Overdrive with variable level high low and Hard Clipping and Odd Harmonics with variable level low medium, it proves that sound recordings can still be identified

ANALYSIS OF THE IMPACT OF DISTORTION ON SOUND RECORDINGS AS ANTI FORENSIC ACTIVITIES

Anti-forensics on audio is aimed at complicating investigations on audio forensics, on sound recordings. Sound recordings can be altered or manipulated in various ways as well as the provision of distortion effects on sound recordings. Effect such distortions will make it difficult for investigators to find out the owner of the original voice. Analysis of distortion effects on sound recordings for anti-forensic activities, has not been widely carried out. Distortion can be an effective anti-forensic technique because the sound produced will be noisy, making it difficult for investigators to conduct investigations. In this study, testing was carried out using 3 types of distortion, namely Hard Clipping, Hard Overdrive and Odd Harmonics. To find out the extent to which the three types of distortions make it difficult to identify the owner of the original sound, the variables that affect each type of distortion are set at low, medium, and high levels. Formant values from the original and distorted sound samples were compared for later analysis using the Anova One-Way approach to show whether the original sound was identical and the other three voices were distorted. The test was carried out using 10 sound samples. From the results of the anova analysis, it is known that the types of Distortion of Hard Clipping and Odd Harmonics with variables at high levels can manipulate sound recordings, making it difficult to recognize the authenticity of a sound recording. Unlike the case with the type of Distortion of Hard Overdrive with variable level high low and Hard Clipping and Odd Harmonics with variable level low medium, it proves that sound recordings can still be identified

Improved steganalysis technique based on least significant bit using artificial neural network for MP3 files

MP3 files are one of the most widely used digital audio formats that provide a high compression ratio with reliable quality. Their widespread use has resulted in MP3 audio files becoming excellent covers to carry hidden information in audio steganography on the Internet. Emerging interest in uncovering such hidden information has opened up a field of research called steganalysis that looked at the detection of hidden messages in a specific media. Unfortunately, the detection accuracy in steganalysis is affected by bit rates, sampling rate of the data type, compression rates, file track size and standard, as well as benchmark dataset of the MP3 files. This thesis thus proposed an effective technique to steganalysis of MP3 audio files by deriving a combination of features from MP3 file properties. Several trials were run in selecting relevant features of MP3 files like the total harmony distortion, power spectrum density, and peak signal-to-noise ratio (PSNR) for investigating the correlation between different channels of MP3 signals. The least significant bit (LSB) technique was used in the detection of embedded secret files in stego-objects. This involved reading the stego-objects for statistical evaluation for possible points of secret messages and classifying these points into either high or low tendencies for containing secret messages. Feed Forward Neural Network with 3 layers and traingdx function with an activation function for each layer were also used. The network vector contains information about all features, and is used to create a network for the given learning process. Finally, an evaluation process involving the ANN test that compared the results with previous techniques, was performed. A 97.92% accuracy rate was recorded when detecting MP3 files under 96 kbps compression. These experimental results showed that the proposed approach was effective in detecting embedded information in MP3 files. It demonstrated significant improvement in detection accuracy at low embedding rates compared with previous work