Over the decades, computer forensics has expanded from primarily examining computer evidence found on hard drives into the examination of digital devices with increasing storage capacity, to the identification of crimes and illegal activities involving the use of computers, to addressing standards and practices deficiencies, and to addressing the need to educate and train law enforcement, computer forensic technicians, and investigators. This dissertation presents the concept mapping case domain modeling approach to aid examiners/investigators in searching and identifying digital evidence and analyzing the case domain during the examination and analysis phase of the computer forensic investigation. The examination and analysis phases of a computer forensic process are two of the most important phases of the investigative process because the search for and identification of evidence data is crucial to a case; any data uncovered will help determine the guilt or innocence of a suspect. In addition, these phases can become very time consuming and cumbersome. Therefore, finding a method to reduce the amount of time spent searching and identifying potential evidence and analyzing the case domain would greatly enhance the efficiency of the computer forensic process. The hypothesis of this dissertation is that the concept mapping case domain modeling approach can serve as a method for organizing, examining, and analyzing digital forensic evidence and can enhance the quality of forensic examinations without increasing the time required to examine and analyze forensic evidence by more than 5%. Four experiments were conducted to evaluate the effectiveness of the concept mapping case domain modeling approach. Analysis of the experiments supports the hypothesis that the concept mapping case domain modeling approach can be used to organize, search, identify, and analyze digital evidence in an examination.

No description available.

No description available.

No description available.

No description available.

No description available.

In today's information technology-driven world, most criminal acts leave digital evidence. In such cases, cooperation from victims through the handover of digital devices such as the mobile phone isa success factor that enables evidence-seeking through digital forensics. Unfortunately, forensic examination of the victims' devices becomes a potential additional negative consequence for the victim who experiences an invasion of privacy. The privacy invasion can make victims of crime less cooperative and willing to report crimes, leading to a reduced number of criminals held accountable for their actions. To address this problem, 400 Swedish adults were surveyed to identify their hypothetical willingness to report certain crimes. The survey examined the impact a mobile phone handover made on the willingness to report a crime. The findings demonstrated significantly lower willingness to report a crime when a mobile phone was necessary as evidence. However, the data could not support privacy as a common tendency cause. The presented results can be used as a reference for further research on attitudes and behaviours regarding the subject.

Malware is a growing concern that not only affects large businesses but the basic consumer as well. As a result, there is a need to develop tools that can identify the malicious activities of malware authors. A useful technique to achieve this is memory forensics. Memory forensics is the study of volatile data and its structures in Random Access Memory (RAM). It can be utilized to pinpoint what actions have occurred on a computer system. This dissertation utilizes memory forensics to extract relationships between objects and supervised machine learning as a novel method for identifying malicious processes in a system memory dump. In this work, the Object Association Extractor (OAE) was created to extract objects in a memory dump and label the relationships as a graph of nodes and edges. With OAE, we extracted processes from 13,882 memory images that contained malware from the repository VirusShare and 91 memory images created with benign software from the package management software Chocolatey. The final dataset contained 267,824 processes. Two feature sets were created from the processes dataset and used to train classifiers based on four classification algorithms. These classifiers were evaluated against the ZeroR method using accuracy and recall as the evaluation metrics. The experiments showed that both sets of features used to build classifiers were able to beat the ZeroR method for the Decision Tree and Random Forest algorithms. The Random Forest classifier achieved the highest performance by reaching a recall score of almost 97%.

Indiana University-Purdue University Indianapolis (IUPUI) / Blow flies are often utilized in the field of forensic science due to their ability to aid in the estimation of time since death. Currently, estimations of postmortem interval require assumptions to be made and are prone to a margin of error, prompting research that may contribute to more accurate postmortem interval estimations and help to fill in the gaps of unknown information. Blow flies are necrophagous, feeding on feces and carrion, and therefore, are constantly sampling the environment. This behavior can be exploited in order to monitor the biodiversity in an environment. Through analysis of DNA isolated from the guts of blow flies, information can be obtained regarding what animals have died in an environment, what animals are still living in that environment, and the abundance and diversity of the animals present in a specific environment. Using fly-derived ingested DNA is a viable method for vertebrate resource identification and biodiversity monitoring. Over the course of a two-summer sampling period, in and around two national parks, a total of 162 blow fly (Phormia regina) samples returned a positive vertebrate DNA identification, with 33 species identified from five animal orders. Of the total number of flies collected and analyzed, 23.58% returned a positive vertebrate species identification. The method detected both abundant and common species based on National Park surveys, as well as some uncommon or unknown to the park species. In the SE region, 9 individuals belonging to the Rodentia order, 12 individuals belonging to the Artiodactyla order, 21 individuals belonging to the Carnivora order, 1 individual belonging to the Cingulata order, and 3 individuals belonging to the Lagomorph order were detected. In the SE region, 63% of the individuals detected belonged to the common category, 14% of the individuals detected belonged to the uncommon category, and 23% of the individuals detected belonged to the not in park/unknown category. In the NW region, 42 individuals belonging to the Rodentia order, 46 individuals belonging to the Artiodactyla order, and 28 individuals belonging to the Carnivora order were detected. In the NW region, 52% of the individuals detected belonged to the abundant category, 36% of the individuals detected belonged to the common category, and 12% of the individuals detected belonged to the uncommon category. The relative biodiversity of the sampled environment can be inferred. In the SE region, the Shannon Biodiversity Index was calculated to be 2.28 with an evenness of 0.844, while in the NW region, the Shannon Biodiversity Index was calculated to be 2.79 with an evenness of 0.855. Unsurprisingly, there was greater biodiversity in the Northwest Park samples than in the Southeast Park samples. Additionally, the ideal weather conditions for blow fly collection were determined be at a temperature of between 60- and 80-degrees Fahrenheit, a relative humidity between 50% and 60%, no precipitation, and a wind speed between 2 and 8 miles per hour. This information has further implications in the field of forensic science, specifically dealing with wildlife forensics, pathogen distributions, and can help to improve accuracy in regards to postmortem interval (PMI) estimations.

The proliferation of multimedia data, including digital images and videos, has led to an increase in their misuse, such as the unauthorized sharing of sensitive content, the spread of fake news, and the dissemination of misleading propaganda. To address these issues, the research field of multimedia forensics has developed tools to distinguish genuine multimedia from fakes and identify the sources of those who share sensitive content. However, the accuracy and reliability of multimedia forensics tools are threatened by recent technological advancements in new multimedia processing software and camera devices. For example, source attribution involves attributing an image or video to a specific camera device, which is crucial for addressing privacy violations, cases of revenge porn, and instances of child pornography. These tools exploit forensic traces unique to each camera’s manufacturing process, such as Photo Response Non-Uniformity (PRNU). Nevertheless, image and video processing transformations can disrupt the consistency of PRNU, necessitating the development of new methods for its recovery. Conversely, to distinguish genuine multimedia from fakes, AI-based image and video forgery localization methods have also emerged. However, they constantly face challenges from new, more sophisticated AI-forgery techniques and are hindered by factors like AI-aided post-processing and, in the case of videos, lower resolutions, and stronger compression. This doctoral study investigates the relevance of exploiting temporal information during the parameters estimation used to reverse complex spatial transformations for source attribution, and video forgery localization in low-resolution H.264 post-processed inpainted videos. Two novel methods will be presented that model the set of parameters involved in reversing in-camera and out-camera complex spatial transformations applied to images and videos as time series, improving source attribution accuracy and computational efficiency. Regarding video inpainting localization, a novel dataset of videos inpainted and post-processed with Temporal Consistency Networks will be introduced, and we will present our solution to improve video inpainting localization by taking into account spatial and temporal inconsistencies at dense optical flow level. The research presented in this dissertation has resulted in several publications that contribute to the field of multimedia forensics, addressing challenges related to source attribution and video forgery localization.