Rethinking Digital Forensics

© IAER 2019In the modern socially-driven, knowledge-based virtual computing environment in which organisations are operating, the current digital forensics tools and practices can no longer meet the need for scientific rigour. There has been an exponential increase in the complexity of the networks with the rise of the Internet of Things, cloud technologies and fog computing altering business operations and models. Adding to the problem are the increased capacity of storage devices and the increased diversity of devices that are attached to networks, operating autonomously. We argue that the laws and standards that have been written, the processes, procedures and tools that are in common use are increasingly not capable of ensuring the requirement for scientific integrity. This paper looks at a number of issues with current practice and discusses measures that can be taken to improve the potential of achieving scientific rigour for digital forensics in the current and developing landscapePeer reviewe

An educational paradigm for teaching computer forensics

Teaching Computer Forensics to students at postgraduate and undergraduate levels is a challenge. Creating an assignment that is both realistic and also helpful to students when pursuing careers in this competitive area is also a demanding task for the lecturer. A problem-based learning (PBL) strategy has been used to increase the employability of the students, by designing a real-world problem for the students to solve. It can be shown that this enhances the employability skills of the students when it comes to finding jobs. The coursework is based around a case study. To add an extra dimension to the assessment we involved final year Law students from the School of Humanities, Law Department, to act as jury members and also to help to cross-examine the postgraduate students while they presented their findings in the role of an Expert Witness. This created at the same time a valuable exercise for the legal students in the context that evidence presented in courts is increasingly computer-based evidence. This paper discusses the preparation of the evidence files, how employability is enhanced by the use of a PBL approach to teaching, the process of evaluating the results of the students work and concludes with an overview of the student experience for all students involved

Calm before the storm: the challenges of cloud computing in digital forensics

Cloud computing is a rapidly evolving information technology (IT) phenomenon. Rather than procure, deploy and manage a physical IT infrastructure to host their software applications, organizations are increasingly deploying their infrastructure into remote, virtualized environments, often hosted and managed by third parties. This development has significant implications for digital forensic investigators, equipment vendors, law enforcement, as well as corporate compliance and audit departments (among others). Much of digital forensic practice assumes careful control and management of IT assets (particularly data storage) during the conduct of an investigation. This paper summarises the key aspects of cloud computing and analyses how established digital forensic procedures will be invalidated in this new environment. Several new research challenges addressing this changing context are also identified and discussed

The next generation for the forensic extraction of electronic evidence from mobile telephones

Electronic evidence extracted from a mobile telephone provide a wealth of information about the user. Before a court allows the trier of fact to consider the electronic evidence, the court must ensure that the subject matter, testimony of which is to be given, is scientific. Therefore, regard must, at the investigation stage, be given to fulfill the requirements of science and law, including international standards. Such compliance also moves the extraction of electronic evidence from mobile telephones into the next generation, a more rigorous position as a forensic science, by being able to give in court well- reasoned and concrete claims about the accuracy and validity of conclusions.published_or_final_versio

Digital Forensic Evidence in the Courtroom: Understanding Content and Quality

With the widespread permeation of continually advancing technologies into our daily lives, it is inevitable that the product of those technologies, i.e. digital information, makes its way into the courtroom. This has largely occurred in the form of electronic discovery, or “e-discovery,” where each party involved in an action provides the relevant information they possess electronically. However, in cases where information is hidden, erased, or otherwise altered, digital forensic analysis is necessary to draw further conclusions about the available evidence. Digital forensic analysis is analogous to more traditional forensic analysis. For example, in criminal cases where a firearm was used in the commission of the crime, but the gun is not readily admissible, forensic science is necessary to trace the origin of the weapon, perform fingerprint analysis on it, and compare fired bullet casings to ensure the weapon used and the weapon analyzed are one and the same. In sum, digital forensics is the preservation and analysis of electronic data. These data include the primary substantive data (the gun) and the secondary data attached to the primary data, such as data trails and time/date stamps (the fingerprints). These data trails and other metadata markers are often the key to establishing a timeline and correlating important events

Digital Forensic Evidence in the Courtroom: Understanding Content and Quality

With the widespread permeation of continually advancing technologies into our daily lives, it is inevitable that the product of those technologies, i.e. digital information, makes its way into the courtroom. This has largely occurred in the form of electronic discovery, or “e-discovery,” where each party involved in an action provides the relevant information they possess electronically. However, in cases where information is hidden, erased, or otherwise altered, digital forensic analysis is necessary to draw further conclusions about the available evidence. Digital forensic analysis is analogous to more traditional forensic analysis. For example, in criminal cases where a firearm was used in the commission of the crime, but the gun is not readily admissible, forensic science is necessary to trace the origin of the weapon, perform fingerprint analysis on it, and compare fired bullet casings to ensure the weapon used and the weapon analyzed are one and the same. In sum, digital forensics is the preservation and analysis of electronic data. These data include the primary substantive data (the gun) and the secondary data attached to the primary data, such as data trails and time/date stamps (the fingerprints). These data trails and other metadata markers are often the key to establishing a timeline and correlating important events

Current state of validation and testing of digital forensic tools in the United States.

The Federal courts' decision in Dauber v. Merrell Dow Pharmaceutical, Inc. (1993) requires forensic testing protocols and tools to be validated and tested for reliability before they can be used to support expert witness testimony. Digital forensic labs and individual examiners in the United States should be performing their own validation and verification tests on their digital forensic tools. The Scientific Working Group of Digital Evidence (SWDGE) recommends that examiners perform validation testing whenever there are new, revised, or reconfigured tools, techniques, or procedures. This study surveyed digital forensics examiners in the U.S. to provide a description of the current state of validation and testing of digital forensic tools, current protocols used for validation, and barriers to performing these tests. The findings included, 95% validate and test their Digital Forensic tools. 80.3% document the validation and testing process and their results. 53.6% validate and test each function if the forensic tool performs several different functions. Examiners should test their digital forensic tools to make sure they are working properly and receiving accurate results. The findings and testimony can be dismissed in court if the examiner is not following set standards.--Abstract

Artificial Intelligence in the Courtroom: Forensic Machines, Expert Witnesses, and the Confrontation Clause

From traditional methods like ballistics and fingerprinting, to the probabilistic genotyping models of the twenty-first century, the forensic laboratory has evolved into a cutting-edge area of scientific exploration. This rapid growth in forensic technologies will not stop here. Considering recent developments in artificial intelligence (“AI”), future forensic tools will likely become increasingly sophisticated. To be sure, AI-enabled forensic tools are far from theoretical; AI applications in the forensic sciences have already emerged in practice. Machine learning-enabled acoustic gunshot detectors, facial recognition software, and a variety of pattern recognition learning models are already disrupting law enforcement operations across the country. Soon, criminal defendants will need to learn how to navigate a courtroom dominated by AI-enabled expert systems. Unfortunately, there is little guidance in the caselaw or in the Federal Rules of Evidence on how exactly criminal defendants should approach AI as evidence in the courtroom. Although a handful of scholars have taken up the task of exploring the intersection of AI and evidence law, these studies have primarily focused on issues in authentication or issues with applying the Daubert standard to AI evidence. This study contributes to this ongoing exploration of AI in the courtroom by providing an analysis of the rights of criminal defendants facing AI-generated testimony under the Confrontation Clause of the Sixth Amendment. This study will illustrate that, in a future where AI-enabled forensic tools are increasingly used to inculpate defendants in criminal prosecutions, the right to confrontation will become increasingly eroded. This is largely because courts have carved out a broad “machine-generated data” exception to the Confrontation Clause. Under this exception, data generated by a sufficiently autonomous machine will fall outside the ambit of constitutional protection. The rationale is that such transmissions are too autonomous to be attributed to any human actor, and the Confrontation Clause protects only statements made by a human rather than a machine learning model. This exception to the right to confrontation is significant. Practically, these limitations could have a measurable negative impact on a defendant’s capacity to test the reliability of an AI model in court. Normatively, this study illustrates that, in a world where AI algorithms proffer inculpatory evidence of criminal wrongdoing, the right to confrontation adds little value for criminal defendants. As courts and scholars reinterpret and refine the rules of evidence to better reflect technological realities, some attention should be given to the proper place of the right to confrontation

Fire Pattern Analysis, Junk Science, Old Wives Tales, and Ipse Dixit: Emerging Forensic 3D Imaging Technologies to the Rescue?

Forensic science is undergoing a period of transformation as legal and scientific forces converge and force older forensic sciences toward a new scientific paradigm. Fire investigative undertakings are not an exception to this trend. Skeptical defense attorneys who routinely formulate astute Daubert challenges to contest the scientific validity and reliability of every major forensic science discipline are one catalyst to this revolution. Furthermore, a steady influx of novel scientific advances makes possible the formulation of consistent and scientifically-based quantitative forensic evidence analyses to overcome the “undervalidated and oversold” problems affecting many areas of forensic science