When computer forensics investigation is carried out on single workstations and the forensics image in hand is of terabytes of length, indexing of keywords takes a heavy toll. With the manifold increase of forensics data, there is an urgent need to develop a distributed digital forensics toolkit associated with sophisticated indexing and searching capabilities which utilizes multiple idle computers to index forensics images. This toolkit will deliver fast paced search performance running indexing of large forensics data and will produce smaller indexing time and faster search speeds as compared to non indexed searches on standalone workstations. The distributed resources of available computers thus make an ideal platform for virtual supercomputing performing indexing and searching on available machines.

No

Thesis (M. S.)--Oklahoma State University, 2007. / Vita. Includes bibliographical references.

Semen is a commonly found bodily fluid in sexual assault cases and with an ever increasing Sexual Assault Evidence Collection Kit (SAECK) backlog, the ability to localize seminal stains and identify spermatozoa in an accurate and efficient manner is crucial. Items of evidence are first visualized under white light followed by an Alternate Light Source (ALS) if no stains are readily visible. When potential semen stains are localized, preliminary chemical testing can be performed to guide the analyst to conduct further testing or to disregard a certain stain. Preliminary testing for semen often employs the Acid Phosphatase (AP) test which can be applied directly to an item if a stain is visible, or using a mapping technique if no stains are identified under white light or ALS. Preliminarily positive stains then undergo confirmatory testing for semen during which at least one spermatozoon must be identified to make a definitive statement that semen is present in a given stain. STK® Sperm Tracker™ is a new product that is able to perform AP mapping while in contact with an item, allowing easier localization to occur over a larger area. STK® Sperm Tracker™ yielded similar results to the AP Spot reagent when used for mapping purposes, however, traditional AP mapping was slightly more sensitive when a 10-minute reaction window was used. Rapid SpermBlue® stain and Goldcyto-SB pre-stained slides are commonly used in fertility testing as quick methods to differentially stain spermatozoa and epithelial cells. These two methods are similar to the hematoxylin and eosin (H&E) stain in that they provide a monochromatic range of coloration with darker blue nuclei compared to cytoplasm. Rapid SpermBlue® and Goldcyto-SB pre-stained slides were compared to H&E and Kenerchtrot-Picroindigocarmine (KPIC) stains in their ability to stain aged samples, samples exposed to decomposition fluids, and compromised samples in which wet evidence was sealed in plastic and left at an elevated temperature. All methods stained the compromised samples as effectively as freshly prepared samples. Simulated sexual assault swabs made with overwhelming ratios of epithelial cells to spermatozoa were prepared and the times to prepare and search slides were recorded. While Goldcyto-SB pre-stained slides were the fastest to prepare, they were also the slowest to search due to a larger surface area than is utilized by the other methods. An attempt was made to optimize a protocol in which a thiol-specific probe could be utilized as a sperm-specific dye based on the number of disulfide bonds within spermatozoa. Spermatozoa protamines are known to contain several cysteine residues which can be taken advantage of with the fluorescent probe, N-(7-dimethylamino-4-methyl-3-coumarinyl)-maleimide (DACM). Spermatozoa heads and tails fluoresced brightly with DACM and weaker fluorescence was observed on epithelial cells. To allow easier penetration of the fluorescent probe, cells were lysed with Sodium Dodecyl Sulfate (SDS) and disulfide bonds broken by the reducing agent, Tris-(2-carboxyethyl)phosphine (TCEP). DACM was able to penetrate the spermatozoa head and bind to thiols even before the addition of SDS and TCEP, though their presence did increase fluorescence. While there is a stark difference between the appearance of spermatozoa and epithelial cells using this method, proteomic work will be necessary before the method can be altered to be spermatozoa specific.

Digital forensics is the practice of trained investigators gathering and analyzing evidence from digital devices such as computers and smart phones. On these digital devices, it is possible to change the time on the device for a purpose other than what is intended. Currently there are no documented techniques to determine when this occurs. This research seeks to prove out a technique for determining when the time has been changed on forensic disk image by analyzing the log files found on the image. Out of this research a tool is created to perform this analysis in automated fashion. This tool is TADpole, a command line program that analyzes the log files on a disk image and determines if a timeline anomaly has occurred.

Modern smartphones integrate ubiquitous access to voice, data, and email communication and allow users to rapidly handle both personal and corporate business affairs. This is possible because of the smartphone’s constant connectivity with the Internet. Digital forensic investigators have long understood the value of smartphones as forensic evidence, and this thesis seeks to provide new tools to increase the amount of evidence that one can obtain and analyze from an Android smartphone. Specifically, by using proven data carving algorithms we try to uncover information about the phone’s connection to wireless access points in a capture of the device’s volatile memory.

The goal of this research is to create a methodology that measures the robustness and effectiveness of forensic tools' ability to detect data hiding. First, an extensive search for any existing guidelines testing against data hiding was performed. After finding none, existing guidelines and frameworks in cybersecurity and cyber forensics were reviewed. Next, I created the methodology in this thesis. This methodology includes a set of steps that a user should take to evaluate a forensic tool. The methodology has been designed to be flexible and scalable so as new anti-forensic data hiding methods are discovered and developed, they can easily be added to the framework, and the evaluator using the framework can tailor it to the files they are most focused on. Once a polished draft of the entire methodology was completed, it was reviewed by information technology and security professionals and updated based on their feedback.Two popular forensic tools – Autopsy/Sleuthkit and X-Ways – were evaluated using the methodology developed. Evaluation revealed improvements in the methodology that were updated. I propose that the methodology can be an effective tool to provide insight and evaluate forensic tools.

In today’s work place where corporations allow employees to use their own smart phones to access their company’s network and sensitive data, it is essential to ensure the security of said data. When an employee smart phone is compromised, companies will rely on the remote wipe command that attempts to remove sensitive data. In this thesis, we analyze the effectiveness of remote wipe commands on the Apple iPhone and Android model devices and demonstrate how data can be recovered following a remote wipe procedure. We conduct two experiments on each device to verify whether remote wipe is a viable defense mechanism or not. Furthermore, we touch on the subject of mobile forensics used by law enforcement and review methods and techniques used to recover data for use as evidence in criminal cases.

Cloud computing has been advancing at an intense pace. It has become one of the most important research topics in computer science and information systems. Cloud computing offers enterprise-scale platforms in a short time frame with little effort. Thus, it delivers significant economic benefits to both commercial and public entities. Despite this, the security and subsequent incident management requirements are major obstacles to adopting the cloud. Current cloud architectures do not support digital forensic investigators, nor comply with today’s digital forensics procedures – largely due to the fundamental dynamic nature of the cloud. When an incident has occurred, an organization-based investigation will seek to provide potential digital evidence while minimising the cost of the investigation. Data acquisition is the first and most important process within digital forensics – to ensure data integrity and admissibility. However, access to data and the control of resources in the cloud is still very much provider-dependent and complicated by the very nature of the multi-tenanted operating environment. Thus, investigators have no option but to rely on the Cloud Service Providers (CSPs) to acquire evidence for them. Due to the cost and time involved in acquiring the forensic image, some cloud providers will not provide evidence beyond 1TB despite a court order served on them. Assuming they would be willing or are required to by law, the evidence collected is still questionable as there is no way to verify the validity of evidence and whether evidence has already been lost. Therefore, dependence on the CSPs is considered one of the most significant challenges when investigators need to acquire evidence in a timely yet forensically sound manner from cloud systems. This thesis proposes a novel architecture to support a forensic acquisition and analysis of IaaS cloud-base systems. The approach, known as Cloud Forensic Acquisition and Analysis System (Cloud FAAS), is based on a cluster analysis of non-volatile memory that achieves forensically reliable images at the same level of integrity as the normal “gold standard” computer forensic acquisition procedures with the additional capability to reconstruct the image at any point in time. Cloud FAAS fundamentally, shifts access of the data back to the data owner rather than relying on a third party. In this manner, organisations are free to undertaken investigations at will requiring no intervention or cooperation from the cloud provider. The novel architecture is validated through a proof-of-concept prototype. A series of experiments are undertaken to illustrate and model how Cloud FAAS is capable of providing a richer and more complete set of admissible evidence than what current CSPs are able to provide. Using Cloud FAAS, investigators have the ability to obtain a forensic image of the system after, just prior to or hours before the incident. Therefore, this approach can not only create images that are forensically sound but also provide access to deleted and more importantly overwritten files – which current computer forensic practices are unable to achieve. This results in an increased level of visibility for the forensic investigator and removes any limitations that data carving and fragmentation may introduce. In addition, an analysis of the economic overhead of operating Cloud FAAS is performed. This shows the level of disk change that occurs is well with acceptable limits and is relatively small in comparison to the total volume of memory available. The results show Cloud FAAS has both a technical and economic basis for solving investigations involving cloud computing.

Computer forensics is an ever-growing technological field of complexity and depth. Individuals must strive to keep learning and growing their skills as they help combat cybercrime throughout the world. This study attempts to establish a method of evaluating conceptual expertise in computer forensics to help indicate whether or not an individual understands the five basic phases of computer forensics: preparation, seizure of evidence, acquisition of data, analysis of data, and reporting the findings of the analysis. A survey was presented to a university class of 30 students taking a computer forensics course and as well as posted online asking computer forensics professionals to participate in the survey. Results show that novices that were enrolled in a computer forensics course were able to identify the phases of computer forensics more readily than professionals