Tool Set of Computer Forensics

CHEN Zuyi,GONG Jian,XU Xiaoqin

DOI: https://doi.org/10.3969/j.issn.1000-3428.2005.05.056

2005-01-01

Abstract:This paper introduces the state-of-art of computer forensics toolkits with the evidence collecting tools being emphasized. These tools are compared, and their development trends are prospected.

What problem does this paper attempt to address?

A Survey of Digital Passive Lossless Forensics on Forged and Altered Document

SHANG Shi-ze,KONG Xiang-wei,YOU Xin-gang

DOI: https://doi.org/10.3969/j.issn.1671-1122.2015.04.011

2015-01-01

Abstract:The examination of forged and altered document is an important part in judicial expertise. The traditional examination methods need professional testers and devices, the disadvantages include high cost, long testing time, damage on the documents, etc. In recent years, the digital passive lossless forensics on forged and altered document has been developed which only uses scanner and computer. In this paper, we first introduce the life-cycle of document and its forging and altering methods. Then, we summarize the passive lossless forensics on forged and altered document, and describe the technologies on device identiifcation, copy paper identiifcation and authenticity detection, respectively. We give a detailed description on the characteristics introduced by devices and altering methods, and their forensics methods. Finally, we describe the questions and challenges on digital passive lossless forensics on documents.
Analysis of Network Forensics System and Its Tools

XU Xiao-qin,GONG Jian,ZHOU Peng

DOI: https://doi.org/10.3969/j.issn.1673-629x.2005.05.046

2005-01-01

Abstract:With the development of Web,the quantities of computer crimes are increasing and computer forensics is becoming more and more important.Computer forensics is divided into post-event investigation and real-time investigation.In the early days,network security tools were used in network forensics.But it is limited and the data that they produced can't be regarded as the evidence in the legal meaning.Network forensics system has made up these deficiencies in real-time investigation.It involves capturing,recording,analyzing and reconstructing network audit trails.The paper discusses the network forensics system and a detailed comparison has been made to these tools.
Discussion on Computer Forensics

赵倩,曹天杰,耿涛

DOI: https://doi.org/10.3969/j.issn.1671-0428.2008.08.020

IF: 5.105

2008-01-01

Computers & Security

Abstract:With the development of information technology, more and more computer crimes occur. It has been the focus that people pay attention to how to use computer forensics collect electronic evidence to punish the crime. The paper mainly introduced the concept, principle and process of computer forensics, also introduced some common tools especially Encase.
Study of system about digital Forensics Technology

Liu Jianjun,Chen Guangxuan

DOI: https://doi.org/10.3969/j.issn.1009-6833.2013.05.004

2013-01-01

Abstract:With the emergence of a large number of criminal cases involving digital evidence,its value rising.but the understanding of digital evidence is not clear,not uniform.digital forensic is a very strong discipline closed to legal practice,the development of its system depends on many applications of computer,at the same time must meet the requirements of legal system itself,and be able to deal with all kinds of complicated case.This paper combed through the hierarchical structure of digital forensics technology,to collect evidence is explored on the whole,and a detailed analysis of the various elements of electronic evidence.
Design and Implementation of Dynamic Computer Forensics System Based on Network

于志宏,刘喆,赵阔,努尔布力,史光坤,胡亮

DOI: https://doi.org/10.3321/j.issn:1671-5489.2008.04.029

2008-01-01

Abstract:In order to solve the problems existed in static forensics technology,this paper presents the design and implementation of a dynamic computer forensics system based on network.Compared with the traditional tools of the system,it performs the work of gathering evidence in advance before criminal action has occurred or in the process of crime so as to avoid the evidence chain lost caused by evidence not scout timely.It can improve the efficiency of the work of gathering evidence;enhance data integrity and timeliness of evidence.This paper describes the architecture,function and work flow,and the implementation of main functions of the core module technology.
RESEARCH ON TCT-BASED ADAPTABILITY OF FORENSIC TOOLS AND ITS SOLUTIONS

Zhai Haohao,Shi Wenchang,Liang Bin,Wan Liang

DOI: https://doi.org/10.3969/j.issn.1000-386x.2012.11.003

2012-01-01

Abstract:The development of software and hardware technologies leads to the malfunction of computer forensic tools in real-world application,which hinders the activities of forensic investigations.With the open-source TCT software as a typical forensic tool-kit,in the paper,through experiments,we observe the problems that forensic tools meet in practical application.We dig the resources of the problems and propose solutions to them.The purpose of the paper is to find effective ways to solve the adaptability problems for forensic tools.
Summary of Computer Forensics

胡亮,王文博,赵阔

DOI: https://doi.org/10.3969/j.issn.1671-5896.2010.04.009

2010-01-01

Abstract:With the development of network technology,computer crimes are increasing.As an interdiscipline of law and computer science,computer forensic becomes an essential part in society.We outline the emergence and development of forensic science,introduce the basic forensic principal and analyze several typical forensic models or tools,to understand the forensic precisely.
Forensic Analysis of Popular Chinese Internet Applications

Ying Yang,Kam-Pui Chow,Lucas Hui,Chunxiao Wang,Lijuan Chen,Zhenya Chen,Jenny Chen

DOI: https://doi.org/10.1007/978-3-642-15506-2_20

2010-01-01

Abstract:When the Digital Evidence Search Kit (DESK) was first used in Mainland China, it was found to be inadequate because it did not support criminal investigations involving popular Internet applications such as QQ, MSN and Foxmail. This paper discusses the enhancements made to DESK to conduct forensic analyses of QQ, MSN and Foxmail.
Taxonomy of Digital Forensics: Investigation Tools and Challenges

Nikita Rana,Gunjan Sansanwal,Kiran Khatter,Sukhdev Singh

DOI: https://doi.org/10.48550/arXiv.1709.06529

2017-08-17

Abstract:In today's world of computers, any kind of information can be made available within few clicks for different endeavors. The information may be tampered by changing the statistical properties and can be further used for criminal activities. These days, Cyber crimes are happening at a very large scale, and possess big threats to the security of an individual, firm, industry and even to developed countries. To combat such crimes, law enforcement agencies and investment institutions are incorporating supportive examination policies, procedures and protocols to address the complete investigation process. The paper entails a detailed review of several cyber crimes followed by various digital forensics processes involved in the cyber crime investigation. Further various digital forensics tools with detail explanation are discussed with their advantages, disadvantages, challenges, and drawbacks. A comparison among all the selected tools is also presented. Finally the paper recommends the need of training programs for the first res ponder and judgement of signature based image authentication.

Computers and Society,Cryptography and Security
Digital Forensic Tools And Techniques For Handling Digital Evidence

Khairunnisak Khairunnisak,Wahyu Widodo

DOI: https://doi.org/10.31598/jurnalresistor.v6i1.1266

2023-04-30

Jurnal RESISTOR (Rekayasa Sistem Komputer)

Abstract:The development of information security issues in many sectors makes the skill of mastering digital forensic highly needed. Digital forensic is recently used not only to support legal proceedings but also to investigate many incidents like digital data manipulation, site hacking, and terrorism. In mastering the skill of digital forensic, investigators should have knowledge about the techniques and tools that will be used. This research is proposed to help investigators in enhancing and developing their skills in revealing the content of digital evidence with the result reviews from each area in the forensic field. The review in this study is based on the focus of the forensic area by giving detailed information about the functions, limitations, and advantages as well as the specific techniques of forensics that leads to the techniques of live forensic or static forensic. This research also discusses the non-technical things that affect the performance of forensic investigation including operational activities, investigated activities, and legal elements. Thus, the result of this research is expected to be beneficial for helping investigators in determining the appropriate tools to investigate the digital evidence. The further research can develop the activities of anti-forensics that can hinder the investigation processes.
DDCFS: A Distributed Dynamic Computer Forensic System Based on Network

Liang Hu,Kuo Tang,Guangkun Shi, Nurbol,Kuo Zhao

DOI: https://doi.org/10.1109/ICICTA.2009.729

2009-01-01

Abstract:With the increasing development of information technology, the computer crime problem is getting even serious. However traditional computer forensic that employs the static investigation after security events has inherent limitations. The authenticity, effectiveness and timeliness of the evidence are difficult to meet real needs. In order to solve the existing problems which static forensics technology has, this paper presents the design and implementation of DDCFS: a distributed dynamic computer forensics system based on network. Comparing with the traditional tools of the forensic system, it employs the work of gathering evidences of criminal actions before they occur or just they are ongoing, which avoid the evidence chain lose caused by traditional static forensic. It can improve the efficiency of the work of gathering evidences; enhance data integrity and timeliness of evidences. This paper describes the architecture, function and forensic procedure of DDCFS, and the implementation of the core module.
Research of Requirement Based Computer Forensics Process

Bo SUN,Yu-Fang SUN,Xiang-Feng ZHANG,Bin LIANG

DOI: https://doi.org/10.3969/j.issn.1002-137X.2005.02.004

2005-01-01

Computer Science

Abstract:Research regarding digital forensic technologies has become more active with the recent increases in illegal accesses to computer system. Many researchers only focus on the techniques or tools for evidence detecting and evi- dence analyzing,overlooking key fundamentals. And the important part in digital forensic key fundamentals includes the development of standards,definitions and methodologies.This paper explores the development of the digital foren- sics,compares and contrasts several forensics periods,and specially explores the development of the digital forensics process. Based on them,trying to develop sound digital forensics system which fits for our contry.
Practical Tools for Digital Image Forensic Authentication

Jinhua Zeng,Wei Lu,Rui Yang,Xiulian Qiu

DOI: https://doi.org/10.1007/978-981-10-1536-6_59

2016-01-01

Abstract:In this paper, we introduced the state-of-the-art techniques for digital image forensic authentication. A novel system was presented which consisted of the advanced tools for digital image forensic authentication. The tools offered in the system had the functions including the image file header analysis, device identification, re-compression analysis, copy-paste detection, resampling analysis, etc. The system performance has been tested under practical cases of forensic image examination. The experimental data and results have proven the advancement of the proposed system which could be widely applied in forensic image examination and other forensic applications.
Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

JI Yu-chen,FU Xiao,SHI Jin,LUO Bin,ZHAO Zhi-hong

DOI: https://doi.org/10.3969/j.issn.1000-3428.2014.01.068

2014-01-01

Abstract:According to characteristics of computer intrusion forensic evidence, such as easy revise, easy loss, numerous sources, multifarious content, this paper discusses the current developing states about intrusion event reconstruction, analyzes intrusion event reconstruction source from the system layer object/event and the operate system layer object/event, and introduces the main intrusion event reconstruction tools. It reviews the existing methods for intrusion event reconstruction, including log analysis based on timestamp, semantic integrity checking, tracking technologies based on operate system layer object, event reconstruction models based on finite state machine and so on, evaluates their performance in terms of several metrics, such as reconstruction efficiency, false positives rate, credibility of evidence, authenticity of evidence, reconstruction environment, and summarizes the pros and cons of each method. Some important future research directions in the field of intrusion event reconstruction of computer intrusion forensic are discussed.
Quick Searching Algorithms in Computer Forensics

LI Yan,QIU Wei-dong,LU Zhi-xu,WANG Xing-nan

DOI: https://doi.org/10.3969/j.issn.1009-8054.2010.04.034

2010-01-01

Abstract:The key to computer forensics is to find out the potential electronic evidence quickly and accurately. In this paper, some methods for how to extract in-depth electronic evidence from the hard disk are discussed, and the efficiencies of several pattern matching algorithms are compared(including BF, KMP, BM and BMH algorithms) under different buffer sizes. This could serve as a theoretical foundation for practical computer forensic cases.
Computer Forensics and Advanced Methodology

Dr. Oghene Augustine Onome,

DOI: https://doi.org/10.35940/ijese.g2552.0611723

2023-06-30

International Journal of Emerging Science and Engineering

Abstract:The field of computer forensics emerged in response to the substantial increase in computer-related crimes occurring annually. This rise in criminal activity can be attributed to the rapid expansion of the internet, which has provided perpetrators with increased opportunities for illicit actions. When a computer system is compromised and an intrusion is detected, it becomes crucial for a specialized forensics team to investigate the incident with the objective of identifying and tracing the responsible party. The outcome of such forensic efforts often leads to legal action being taken against those accountable for the wrongdoing. The methodology employed in computer forensics continually evolves alongside advancements in crime approaches, particularly as attackers leverage emerging technologies. To ensure the accuracy of forensic investigations, it is imperative that the scientific knowledge underlying the forensic process be complemented by the integration of technological tools. A plethora of hardware and software options are available to facilitate the analysis and interpretation of forensic data, thereby enhancing the efficiency and effectiveness of investigations. While the fundamental objectives of computer forensics primarily involve the seamless preservation, identification, extraction, documentation, and analysis of data, the widespread adoption of this discipline is contingent upon the law enforcement community's ability to keep pace with advancements in computing technology. Furthermore, the prevalence of diverse computer devices resulting from the emergence of microcomputer technology also plays a crucial role in shaping the field of computer forensics. This research paper aims to provide a comprehensive overview of computer forensics, encompassing advanced methodologies and detailing various technology tools that facilitate the forensic process. Specific areas of focus include the analysis of encrypted drives, disk analysis techniques, analysis toolkits, investigations involving volatile memory, and the examination of captured network packets. By exploring these aspects, this paper aims to contribute to the existing body of knowledge in the field of computer forensics and support practitioners in their pursuit of effective investigative techniques.
Tools and techniques for Network Forensics

Natarajan Meghanathan,Sumanth Reddy Allam,Loretta A. Moore

DOI: https://doi.org/10.48550/arXiv.1004.0570

2010-04-05

Abstract:Network forensics deals with the capture, recording and analysis of network events in order to discover evidential information about the source of security attacks in a court of law. This paper discusses the different tools and techniques available to conduct network forensics. Some of the tools discussed include: eMailTrackerPro to identify the physical location of an email sender; Web Historian to find the duration of each visit and the files uploaded and downloaded from the visited website; packet sniffers like Etherea to capture and analyze the data exchanged among the different computers in the network. The second half of the paper presents a survey of different IP traceback techniques like packet marking that help a forensic investigator to identify the true sources of the attacking IP packets. We also discuss the use of Honeypots and Honeynets that gather intelligence about the enemy and the tools and tactics of network intruders.

Networking and Internet Architecture
The General Digital Forensics Technologies Based on Linux

Wei Liu,Wen Liang Duan,Zhi Hong Tian,Dong Lan

DOI: https://doi.org/10.4028/www.scientific.net/amm.644-650.1992

2014-01-01

Applied Mechanics and Materials

Abstract:Digital forensics technologies based on Linux have been popular issue now. It is very necessary to get a general and effective digital forensics method on Linux for its wide usage. It gives a set of general methods in this paper. It combines the static forensics and dynamic forensics according to the different form of data and verifies the validity of these methods with the help from kinds of open source forensics tools.
A Computer Forensic System Based on Multi-Leveled Marks Mining

Zhou Jie,Wu Jiangjiang,Wang Zhiying,Ren Jiangchun

DOI: https://doi.org/10.1109/anthology.2013.6784874

2013-01-01

Abstract:With the rapid development of information technology, computer crimes become very serious. However, traditional computer forensic has inherent limitations. Any modification, edit, removal, or cover, whether are caused by external force or human factors of electronic evidence, are difficult to distinguish technically. To solve these problems, we have implemented a computer forensic system based on multi-leveled marks mining to mine the marks as wide as possible, as soon as possible, and to fix evidence information supporting anti-repudiation. This paper describes the architecture and key technology of the computer forensic system in detail, as well as system implementation and experimental analysis.
A Feature Comparison of Modern Digital Forensic Imaging Software

Jiyoon Ham,Joshua I. James

DOI: https://doi.org/10.48550/arXiv.2001.00301

2020-01-02

Computers and Society

Abstract:Fundamental processes in digital forensic investigation, such as disk imaging, were developed when digital investigation was relatively young. As digital forensic processes and procedures matured, these fundamental tools, that are the pillars of the reset of the data processing and analysis phases of an investigation, largely stayed the same. This work is a study of modern digital forensic imaging software tools. Specifically, we will examine the feature sets of modern digital forensic imaging tools, as well as their development and release cycles to understand patterns of fundamental tool development. Based on this survey, we show the weakness in current digital investigation fundamental software development and maintenance over time. We also provide recommendations on how to improve fundamental tools.

Tool Set of Computer Forensics

A Survey of Digital Passive Lossless Forensics on Forged and Altered Document

Analysis of Network Forensics System and Its Tools

Discussion on Computer Forensics

Study of system about digital Forensics Technology

Design and Implementation of Dynamic Computer Forensics System Based on Network

RESEARCH ON TCT-BASED ADAPTABILITY OF FORENSIC TOOLS AND ITS SOLUTIONS

Summary of Computer Forensics

Forensic Analysis of Popular Chinese Internet Applications

Taxonomy of Digital Forensics: Investigation Tools and Challenges

Digital Forensic Tools And Techniques For Handling Digital Evidence

DDCFS: A Distributed Dynamic Computer Forensic System Based on Network

Research of Requirement Based Computer Forensics Process

Practical Tools for Digital Image Forensic Authentication

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

Quick Searching Algorithms in Computer Forensics

Computer Forensics and Advanced Methodology

Tools and techniques for Network Forensics

The General Digital Forensics Technologies Based on Linux

A Computer Forensic System Based on Multi-Leveled Marks Mining

A Feature Comparison of Modern Digital Forensic Imaging Software