The growth of data/information on social media and in large organizations is huge in terms of velocity, volume and variety which is also something being tackled by the large IT companies providing Big Data solutions. The other challenges which are linked to managing the huge pile of data are about ensuring preservation and access of crucial data which has implications in every sector ranging from pharmaceuticals to aerospace and cultural institutions (museums, archives and governmental records). The challenges for data management are further complicated by the changing infrastructure landscape and the new business models to host data in virtualized cloud-based storage termed as Cloud solutions (PaaS, SaaS, and IaaS). Several large companies and public institutions are migrating their data/applications to cloud due to the apparent benefits of scalability, reliability, cost, easy of operability and security. The digitization and maintenance of e-records / digital archives in Cloud provides many potential benefits but it is also prone to several risks to ensure long-term retention of data as well as to ensure integrity, authenticity and accessibility of data. For several organizations such as memory institutions, heavy industries (Aerospace & Defence), banks and pharmaceutical companies, it is business critical to securely store data for long-term with integrity, authenticity and accessibility ensured. Hence, along with preservation of data, it is crucial to keep integrity and authenticity of data intact. The digital forensics methods and tools offer several solutions to ensure preservation of data and detect risks at pre-ingest stage of digital archiving to take appropriate measures towards ensuring authenticity, integrity and accessibility. The specific forensics methods and tools also offers possibilities to detect malicious activities or tampering in the digital archives and prepare report for presentation in the court. This thesis work is focussed on the applications of digital forensics towards ensuring the preservation of data in cloud-based storage. It discusses the applications of processes, methods and tools to improve the acquisition, management and accessibility of collections hosted on cloud-based storage (Google Drive, Sky Drive). The pilot platform (i.e. Google Drive) would be tested with forensics methods/tools to draw conclusions for the memory institutions about hosting their data on cloud storage.

abstract: The digital forensics community has neglected email forensics as a process, despite the fact that email remains an important tool in the commission of crime. Current forensic practices focus mostly on that of disk forensics, while email forensics is left as an analysis task stemming from that practice. As there is no well-defined process to be used for email forensics the comprehensiveness, extensibility of tools, uniformity of evidence, usefulness in collaborative/distributed environments, and consistency of investigations are hindered. At present, there exists little support for discovering, acquiring, and representing web-based email, despite its widespread use. To remedy this, a systematic process which includes discovering, acquiring, and representing web-based email for email forensics which is integrated into the normal forensic analysis workflow, and which accommodates the distinct characteristics of email evidence will be presented. This process focuses on detecting the presence of non-obvious artifacts related to email accounts, retrieving the data from the service provider, and representing email in a well-structured format based on existing standards. As a result, developers and organizations can collaboratively create and use analysis tools that can analyze email evidence from any source in the same fashion and the examiner can access additional data relevant to their forensic cases. Following, an extensible framework implementing this novel process-driven approach has been implemented in an attempt to address the problems of comprehensiveness, extensibility, uniformity, collaboration/distribution, and consistency within forensic investigations involving email evidence. / Dissertation/Thesis / M.S. Computer Science 2013

Submitted by Fabio Sobreira Campos da Costa (fabio.sobreira@ufpe.br) on 2016-03-15T14:10:33Z No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) Mestrado - CIn-UFPE - José Paulo.pdf: 1469540 bytes, checksum: ce7369f282093630fb39f482f5e6b4f9 (MD5) / Made available in DSpace on 2016-03-15T14:10:33Z (GMT). No. of bitstreams: 2 license_rdf: 1232 bytes, checksum: 66e71c371cc565284e70f40736c94386 (MD5) Mestrado - CIn-UFPE - José Paulo.pdf: 1469540 bytes, checksum: ce7369f282093630fb39f482f5e6b4f9 (MD5) Previous issue date: 2015-08-31 / A criptografia tem três princípios básicos: garantir a confidencialidade das mensagens, que elas não sejam alteradas por intrusos e que a mensagem flua entre o remetente e destinatário sem que haja a interrupção desta comunicação. Visto resumidamente as metas de um esquema criptográfico, podemos observar o quão importante a criptografia é nos dias atuais. Funções hash são usadas comumente para garantir a integridade de dados, ou seja, garantir que os dados não foram mudados. Os hashes acabam sendo usados em diversas áreas, especialmente na perícia computacional onde o perito prova que não alterou os dados que ele coletou. Porém, seria necessário que houvesse um maior cuidado com a utilização de hashes, afinal existem muitos deles que são considerados inseguros e podem continuar a ser usados indevidamente. Visto isso, este trabalho tenta analisar o cenário atual dentro da perícia forense computacional e da legislação de alguns países, com o objetivo de apontar melhorias para que despertem uma preocupação quanto a confiança na utilização dos hashes criptográficos. / The cryptography has three basic principles: ensure the confidentiality of messages, don’t be changed by intruders and the message flow between the sender and the recipient without any interruption in communication. Considering the goals of a cryptographic scheme, we can realise how important encryption is today. Hash functions are commonly used to ensure data integrity, that is, ensure that the data haven’t changed. Hashes are used in various fields, especially in computer forensics where the specialist proves that he didn’t manipulate the data he collected. However, it would be necessary a greater concern with the use of hashes, after all there are many of them who are considered unsafe and can to continue to be used incorrectly. Considering it, this paper attempts to analyze the current situation within the computer forensic expertise and the legislation of some countries, in order to point out improvements to awaken a concern with the confidence in the use of cryptographic hashes.

Orientador: Arício Xavier Linhares / Dissertação (mestrado) - Universidade Estadual de Campinas, Instituto de Biologia / Made available in DSpace on 2018-08-23T07:56:31Z (GMT). No. of bitstreams: 1 Brancoli_DanielLuz_M.pdf: 2919175 bytes, checksum: 945c65bec3a80aec88b5f6b239293fd2 (MD5) Previous issue date: 2013 / Resumo: A estimativa do intervalo pós-morte (IPM), período entre a ocorrência da morte e o momento em que o corpo ou carcaça é encontrado, é uma das principais utilizações de insetos na área forense. A partir de informações sobre a biologia, ecologia e distribuição geográfica dos insetos, bem como do comportamento de toda fauna presente em um corpo é possível estimar o menor intervalo da ocorrência da morte. Diversos fatores tais como temperatura, umidade, presença de substâncias tóxicas nos tecidos de uma carcaça, podem interferir no ciclo de vida de um inseto, afetando diretamente a estimativa do IPM quando esta é baseada em parâmetros biológicos do inseto. Por isso, múltiplos fatores devem ser considerados para que a perícia seja mais precisa. Com o aumento no número de mortes de animais de importância econômica devido à intoxicação medicamentosa, se faz necessárias pesquisas voltadas para a entomotoxicologia, uma área que carece de estudos específicos. Assim, o presente trabalho visou identificar a entomofauna associada a carcaças de cabras (Capra aegagrus hircus L.) mortas após tratamento com ivermectina, expostas em ambiente natural, além de averiguar possíveis diferenças na atratividade, no desenvolvimento dos imaturos que utilizaram esse substrato para alimentação e se a temperatura e o padrão de colonização da massa larval divergem entre as carcaças de animais mortos por intoxicação. Esse último parâmetro foi avaliado por meio de registros termográficos realizados em intervalos de 12 horas. Além da importância de fatores abióticos como luminosidade, temperatura, umidade e pluviosidade, pôde-se observar a ação da ivermectina nas carcaças tratadas, interferindo na composição da fauna colonizadora, no tempo total e em cada estágio da decomposição, assim como no padrão físico e comportamental das massas larvais em comparação ao grupo controle. Ainda foi demonstrado que a termografia pode ser utilizada como uma nova ferramenta em estudos periciais, auxiliando de forma significativa a avaliação dos parâmetros das massas larvais / Abstract: The estimation of the postmortem interval (PMI), period between the occurrence of death and the time at which the body or casing is found, is one of the main uses of insects in the forensic field. Using information on the biology, ecology and geographical distribution of insects, as well as the behavior of the entire fauna present in a body, is possible to estimate the time of death. Several factors such as temperature, humidity, presence of toxic substances in the tissues of a carcass, may interfere with the life cycle of an insect, directly affecting the estimate of PMI when it is based on biological parameters of the insect. Therefore, multiple factors should be considered so that the forensic analysis is more accurate. With the increase in the number of animal's deaths of economic importance due to drug intoxication, becomes necessary a research on entomotoxicology, an area with lack of specific studies. Thus, the present study aimed to identify the insect fauna associated with carcasses of goats (Capra aegagrus hircus L.) killed after treatment with ivermectin and exposed in the natural environment. Still, investigate possible differences in attractiveness, the immature development that used this substrate for feeding and if the temperature and the colonization pattern of larval mass differ between carcasses of animals killed after ivermectin inoculation. This last parameter was evaluated by thermographic shots performed at intervals of 12 hours. Besides the importance of abiotic factors such as luminosity, temperature, humidity and rainfall, the action of ivermectin on carcasses couse interferense in the composition of the colonizing fauna, the total time of colonization and the time of the decomposition stages, as well as the physical patterns and behavior of larval masses compared to the control group. Although it has been shown that thermography can be used as a new tool in forensic studies, helping to evaluate the parameters of larval mass / Mestrado / Parasitologia / Mestre em Parasitologia

Submitted by Simone Cabanelas (simonecabanelas@hotmail.com) on 2013-11-14T16:26:46Z No. of bitstreams: 1 VersãofinalDissertacaoSimone.pdf: 1028771 bytes, checksum: e0a0ef7528618e530556339356b16497 (MD5) / Approved for entry into archive by Janete de Oliveira Feitosa (janete.feitosa@fgv.br) on 2013-12-04T13:10:07Z (GMT) No. of bitstreams: 1 VersãofinalDissertacaoSimone.pdf: 1028771 bytes, checksum: e0a0ef7528618e530556339356b16497 (MD5) / Approved for entry into archive by Marcia Bacha (marcia.bacha@fgv.br) on 2013-12-16T15:52:56Z (GMT) No. of bitstreams: 1 VersãofinalDissertacaoSimone.pdf: 1028771 bytes, checksum: e0a0ef7528618e530556339356b16497 (MD5) / Made available in DSpace on 2013-12-16T15:57:29Z (GMT). No. of bitstreams: 1 VersãofinalDissertacaoSimone.pdf: 1028771 bytes, checksum: e0a0ef7528618e530556339356b16497 (MD5) Previous issue date: 2013-11-07 / The current work presents a study on the effectiveness of the Forensics Computer Report with regard to the aid in the formation of the conviction of the magistrate to elaborate sentences. Therefore, studies were carried out with the reports and the sentences that used these reports, trying to find the relationship between them in order to analyze the quality of the Report produced and its importance to the court decision and thus to promote social justice. The study allowed to state that the forensic work is relevant, in most of the cases, to assist the judges in their decision making. The result of the survey revealed that some variables do not depend on the forensic work, as the questions formulated by the requester of the report and the criminal type, are relevant for the forensic exams to be even more effective and to assist the promotion of justice. This research can be an instrument of management by the Technical - Scientific Board of Department of Federal Police in order to fill the gap that exists today, in which the federal forensic experts have no feedback on the work developed, since it demonstrates the importance of the forensic work as evidence of crimes. It will also assist managers in developing methodology for elaborating forensic computer reports that seek indicate criminal authorship and materiality in their exams. Society needs its public agencies to act promoting social justice for the citizens. In this scenario, the forensics computer report is one of the tools that can assist the realization of justice in a more concretely form. / O presente trabalho apresenta um estudo sobre a efetividade dos Laudos Periciais Criminais de Informática no que diz respeito ao auxílio na formação da convicção do magistrado para elaborar as sentenças. Para tanto, foram realizadas pesquisas nos laudos e nas sentenças que utilizaram esses laudos, buscando encontrar relação entre ambos com vistas a analisar a qualidade do Laudo produzido e sua importância para a decisão judicial e, consequentemente, para a promoção da justiça social. O estudo realizado permite afirmar que o trabalho pericial é relevante, na maioria dos casos analisados, para auxiliar os magistrados em suas tomadas de decisões. O resultado da pesquisa revelou que algumas variáveis que não dependem do trabalho pericial, como os questionamentos formulados pelo requisitante do laudo e o tipo penal, são relevantes para que os exames periciais sejam ainda mais efetivos e auxiliem na promoção da Justiça. Esta pesquisa pode ser um instrumento de gestão da Diretoria Técnico-Científica do Departamento de Polícia Federal no sentido de preencher a lacuna hoje existente, tendo em vista que os peritos criminais federais não possuem feedback sobre o trabalho desenvolvido, ao tempo em que demonstra a importância do trabalho pericial para a comprovação de delitos. Servirá também para auxiliar os gestores no desenvolvimento de metodologia de elaboração de laudos periciais de informática que busquem indicar autoria e materialidade delitiva em seus exames. A sociedade precisa que seus órgãos públicos atuem de maneira a promover justiça social para os cidadãos. Nesse cenário, o laudo pericial de informática é um dos instrumentos que podem auxiliar a efetivação da justiça de forma mais concreta.

Detta papper koncentrerar sig på kriminaltekniska undersökningar av text, med fokus på användande av mjukvara med öppen källkod. Pappret diskuterar och undersöker olika tekniker för framtida automatisering av dessa undersökningar.

Context. For computer forensic investigations, the necessity of unmodified data content is of vital essence. The solution presented in this paper is based on a trusted chain of execution, that ensures that only authorized software can run. In the study, the proposed application operates in an UEFI environment where it has a direct access to physical memory, which can be extracted and stored on a secondary storage medium for further analysis. Objectives. The aim is to perform this task while being sheltered from influence from a potentially contaminated operating system. Methods. By identifying key components and establishing the foundation for a trusted environment where the memory imaging tool can, unhindered, operate and produce a reliable result Results. Three distinct states where trust can be determined has been identified and a method for entering and traversing them is presented. Conclusions. Tools that does not follow the trusted model might be subjected to subversion, thus they might be considered inadequate when performing memory extraction for forensic purposes.

>Magister Scientiae - MSc / Insertion-deletion polymorphisms (indels) have been underutilized in forensic identification of individuals in comparison with single nucleotide polymorphisms (SNPs) and short tandem repeat (STRs) systems. The use of indels for the purpose of human identification is more advantageous than previously used methods as it combines desirable characteristics of both the SNPs and STRs i.e. low costs and simplistic typing methods as well as indels having small amplicons size, making them suitable for genotyping highly degraded DNA. Currently there is only one commercial kit available for the forensic community, the Investigator® DIPlex kit (Qiagen), which cover a total of 30 indel loci distributed over 19 autosomal chromosomes. The objective of this study was to evaluate the Qiagen Investigator® DIPplex kit for forensic application in South Africa. The kit‘s performance was evaluated by comparing different extraction methods; sensitivity, robustness and reproducibility were evaluated and forensic parameters (match probability, power of discrimination, polymorphism information content, power of exclusion and typical paternity index) were estimated based on population data generated from five South African populations (Afrikaner, Mixed Ancestry, Indian-Asian, Xhosa and Zulu). Population comparisons were performed using Fst-analysis, factorial component analysis as well as phylogenetic tree construction. DNA was extracted from buccal swabs and whole blood collected from a total of 512 individuals from the five South African population groups and genotyped using the Qiagen Investigator® DIPplex kit. Sanger DNA sequencing and sequence alignments confirmed the presence of a null allele at locus HLD97 which was present in high frequency in the Xhosa and Zulu populations. This observation was made in 14 individuals belonging to the Xhosa and Zulu populations. Null allele frequencies in all five South African populations were also estimated. Null alleles were estimated for all loci using analytical methods i.e. Charkraborty null allele estimator, Brookfield null allele estimators 1 and 2 and ML-NullFreq software program. The kit performed well in the laboratory, not requiring any additional reagents or instrumentation and successfully generating profiles with input DNA amounts as low as 0.2 ng/μL. Although well suited for forensic application, the Qiagen Investigator® DIPplex kit showed some drawbacks with regards to application on South African populations. The presence of a null allele at the HLD97 locus as well as indication of population substructure affects allele frequency estimates for the South African populations. Correction for population substructure as present within the South African populations should be considered using FST analysis and it is recommended that the HLD97 locus should be excluded from any kinship analysis performed on South African populations.

As digital crimes have risen, so has the need for digital forensics. Numerous state-of-the-art tools have been developed to assist digital investigators conduct proper investigations into digital crimes. However, digital investigations are becoming increasingly complex and time consuming due to the amount of data involved, and digital investigators can find themselves unable to conduct them in an appropriately efficient and effective manner. This situation has prompted the need for new tools capable of handling such large, complex investigations. Data mining is one such potential tool. It is still relatively unexplored from a digital forensics perspective, but the purpose of data mining is to discover new knowledge from data where the dimensionality, complexity or volume of data is prohibitively large for manual analysis. This study assesses the self-organising map (SOM), a neural network model and data mining technique that could potentially offer tremendous benefits to digital forensics. The focus of this study is to demonstrate how the SOM can help digital investigators to make better decisions and conduct the forensic analysis process more efficiently and effectively during a digital investigation. The SOM’s visualisation capabilities can not only be used to reveal interesting patterns, but can also serve as a platform for further, interactive analysis. / Dissertation (MSc (Computer Science))--University of Pretoria, 2007. / Computer Science / unrestricted

The rate at which technology evolves by far outpaces the rate at which methods are developed to prevent and prosecute digital crime. This unfortunate situation may potentially allow computer criminals to commit crimes using technologies for which no proper forensic investigative technique currently exists. Such a scenario would ultimately allow criminals to go free due to the lack of evidence to prove their guilt. A solution to this problem would be for law enforcement agencies and governments to invest in the research and development of forensic technologies in an attempt to keep pace with the development of digital technologies. Such an investment could potentially allow new forensic techniques to be developed and released more frequently, thus matching the appearance of new computing devices on the market. A key element in improving the situation is to produce more research results, utilizing less resources, and by performing research more efficiently. This can be achieved by improving the process used to conduct forensic research. One of the problem areas in research and development is the development of prototypes to prove a concept or to test a hypothesis. An in-depth understanding of the extremely technical aspects of operating systems, such as file system structures and memory management, is required to allow forensic researchers to develop prototypes to prove their theories and techniques. The development of such prototypes is an extremely challenging task. It is complicated by the presence of minute details that, if ignored, may have a negative impact on the accuracy of results produced. If some of the complexities experienced in the development of prototypes could simply be removed from the equation, researchers may be able to produce more and better results with less effort, and thus ultimately speed up the forensic research process. This dissertation describes the development of a platform that facilitates the rapid development of forensic prototypes, thus allowing researchers to produce such prototypes utilizing less time and fewer resources. The purpose of the platform is to provide a set of rich features which are likely to be required by developers performing research prototyping. The proposed platform contributes to the development of prototypes using fewer resources and at a faster pace. The development of the platform, as well as various considerations that helped to shape its architecture and design, are the focus points of this dissertation. Topics such as digital forensic investigations, open-source software development, and the development of the proposed forensic platform are discussed. Another purpose of this dissertation is to serve as a proof-of-concept for the developed platform. The development of a selection of forensics prototypes, as well as the results obtained, are also discussed. Copyright / Dissertation (MSc)--University of Pretoria, 2009. / Computer Science / unrestricted