nach oben

2009 | Buch

Kapitel lesen Erstes Kapitel lesen

Forensics in Telecommunications, Information and Multimedia

Second International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009, Revised Selected Papers

herausgegeben von: Matthew Sorell

Verlag: Springer Berlin Heidelberg

Buchreihe : Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

Enthalten in: Springer Professional "Wirtschaft+Technik" , Springer Professional "Technik" , Springer Professional "Wirtschaft"

Einloggen, um Zugang zu erhalten

Über dieses Buch

The Second International Conference on Forensic Applications and Techniques in Telecommunications, Information and Multimedia (e-Forensics 2009) took place in Adelaide, South Australia during January 19-21, 2009, at the Australian National Wine Centre, University of Adelaide. In addition to the peer-reviewed academic papers presented in this volume, the c- ference featured a significant number of plenary contributions from recognized - tional and international leaders in digital forensic investigation. Keynote speaker Andy Jones, head of security research at British Telecom, outlined the emerging challenges of investigation as new devices enter the market. These - clude the impact of solid-state memory, ultra-portable devices, and distributed storage – also known as cloud computing. The plenary session on Digital Forensics Practice included Troy O’Malley, Que- sland Police Service, who outlined the paperless case file system now in use in Que- sland, noting that efficiency and efficacy gains in using the system have now meant that police can arrive at a suspect’s home before the suspect! Joseph Razik, represe- ing Patrick Perrot of the Institut de Recherche Criminelle de la Gendarmerie Nati- ale, France, summarized research activities in speech, image, video and multimedia at the IRCGN. The plenary session on The Interaction Between Technology and Law brought a legal perspective to the technological challenges of digital forensic investigation.

Inhaltsverzeichnis

Frontmatter

A Novel Handwritten Letter Recognizer Using Enhanced Evolutionary Neural Network

Abstract

This paper introduces a novel design for handwritten letter recognition by employing a hybrid back-propagation neural network with an enhanced evolutionary algorithm. Feeding the neural network consists of a new approach which is invariant to translation, rotation, and scaling of input letters. Evolutionary algorithm is used for the global search of the search space and the back-propagation algorithm is used for the local search. The results have been computed by implementing this approach for recognizing 26 English capital letters in the handwritings of different people. The computational results show that the neural network reaches very satisfying results with relatively scarce input data and a promising performance improvement in convergence of the hybrid evolutionary back-propagation algorithms is exhibited.

Fariborz Mahmoudi, Mohsen Mirzashaeri, Ehsan Shahamatnia, Saed Faridnia

Forensics for Detecting P2P Network Originated MP3 Files on the User Device

Abstract

This paper presents how to detect MP3 files that have been downloaded from peer-to-peer networks to a user hard disk. The technology can be used for forensics of copyright infringements related to peer-to-peer file sharing, and for copyright payment services. We selected 23 indicators, which show peer-to-peer history for a MP3 file. We developed software to record the indicator values. A group of selected examinees ran the software on their hard disks. We analyzed the experimental results, and evaluated the indicators. We found out that the performance of the indicators varies from user to user. We were able to find a few good indicators, for example related to the number of MP3 files in one directory.

Heikki Kokkinen, Janne Nöyränen

Image Encryption Using Chaotic Signal and Max–Heap Tree

Abstract

In this paper, a new method is proposed for image encryption using chaotic signals and Max-Heap tree. In this method, Max-Heap tree is utilized for further complexity of the encryption algorithm, higher security and changing the amount of gray scale of each pixel of the original image. Studying the obtained results of the performed experiments, high resistance of the proposed method against brute-force and statistical invasions is obviously illustrated. Also, the obtained entropy of the method which is about 7.9931 is very close to the ideal amount of 8.

Fariborz Mahmoudi, Rasul Enayatifar, Mohsen Mirzashaeri

Investigating Encrypted Material

Abstract

When encrypted material is discovered during a digital investigation and the investigator cannot decrypt the material then s/he is faced with the problem of how to determine the evidential value of the material. This research is proposing a methodology of extracting probative value from the encrypted file of a hybrid cryptosystem. The methodology also incorporates a technique for locating the original plaintext file. Since child pornography (KP) images and terrorist related information (TI) are transmitted in encrypted format the digital investigator must ask the question Cui Bono? – who benefits or who is the recipient? By doing this the scope of the digital investigation can be extended to reveal the intended recipient.

Niall McGrath, Pavel Gladyshev, Tahar Kechadi, Joe Carthy

Legal and Technical Implications of Collecting Wireless Data as an Evidence Source

Abstract

The collection of digital devices for forensic analysis is an area that requires constant revision. New technologies and connectivity options change what devices are able to hold electronic evidence and also the methods needed to secure it. This work focuses on the development of an 802.11-based wireless networking (Wi-Fi) forensic analysis tool that can aid in the identification and collection of evidence by identifying the presence of wireless networks and the devices to which they are attached. Specifically, this paper seeks to discuss the potential legal and technical challenges faced in the development of a wireless forensic tool.

Benjamin Turnbull, Grant Osborne, Matthew Simon

Medical Image Authentication Using DPT Watermarking: A Preliminary Attempt

Abstract

Secure authentication of digital medical image content provides great value to the e-Health community and medical insurance industries. Fragile Watermarking has been proposed to provide the mechanism to authenticate digital medical image securely. Transform Domain based Watermarking are typically slower than spatial domain watermarking owing to the overhead in calculation of coefficients. In this paper, we propose a new Discrete Pascal Transform based watermarking technique. Preliminary experiment result shows authentication capability. Possible improvements on the proposed scheme are also presented before conclusions.

M. L. Dennis Wong, Antionette W. -T. Goh, Hong Siang Chua

Robust Correctness Testing for Digital Forensic Tools

Abstract

In previous work, the authors presented a theoretical lower bound on the required number of testing runs for performance testing of digital forensic tools. We also demonstrated a practical method of testing showing how to tolerate both measurement and random errors in order to achieve results close to this bound. In this paper, we extend the previous work to the situation of correctness testing.

The contribution of this methodology enables the tester to achieve correctness testing results of high quality from a manageable number of observations and in a dynamic but controllable way. This is of particular interest to forensic testers who do not have access to sophisticated equipment and who can allocate only a small amount of time to testing.

Lei Pan, Lynn M. Batten

Surveillance Applications of Biologically-Inspired Smart Cameras

Abstract

Biological vision systems are capable of discerning detail and detecting motion in a wide range of highly variable lighting conditions. We describe the real-time implementation of a biological vision model using a high dynamic range video camera and a General Purpose Graphics Processing Unit (GPGPU) and demonstrate the effectiveness of the implementation in two surveillance applications: dynamic equalization of contrast for improved recognition of scene detail; and the use of biologically-inspired motion processing for the detection of small or distant moving objects in a complex scene.

Kosta Haltis, Lee Andersson, Matthew Sorell, Russell Brinkworth

The Development of a Generic Framework for the Forensic Analysis of SCADA and Process Control Systems

Abstract

There is continuing interest in researching generic security architectures and strategies for managing SCADA and process control systems. Documentation from various countries on IT security does now begin to recommendations for security controls for (federal) information systems which include connected process control systems. Little or no work exists in the public domain which takes a big picture approach to the issue of developing a generic or generalisable approach to SCADA and process control system forensics. The discussion raised in this paper is that before one can develop solutions to the problem of SCADA forensics, a good understanding of the forensic computing process, and the range of technical and procedural issues subsumed with in this process, need to be understood, and also agreed, by governments, industry and academia.

Jill Slay, Elena Sitnikova

FIA: An Open Forensic Integration Architecture for Composing Digital Evidence

Abstract

The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture (FIA) which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of integrating evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.

Sriram Raghavan, Andrew Clark, George Mohay

Distinguishing between Camera and Scanned Images by Means of Frequency Analysis

Abstract

Distinguishing the kind of sensor which has acquired a digital image could be crucial in many scenarios where digital forensic techniques are called to give answers. In this paper a new methodology which permits to determine if a digital photo has been taken by a camera or has been scanned by a scanner is proposed. Such a technique exploits the specific geometrical features of the sensor pattern noise introduced by the sensor in both cases and by resorting to a frequency analysis can infer if a periodicity is present and consequently which is the origin of the digital content. Experimental results are presented to support the theoretical framework.

Roberto Caldelli, Irene Amerini, Francesco Picchioni

Developing Speaker Recognition System: From Prototype to Practical Application

Abstract

In this paper, we summarize the main achievements made in the 4-year PUMS project during 2003-2007. The emphasis is on the practical implementations, how we have moved from Matlab and Praat scripting to C/C++ implemented applications in Windows, UNIX, Linux and Symbian environments, with the motivation to enhance technology transfer. We summarize how the baseline methods have been implemented in practice, how the results are utilized in forensic applications, and compare recognition results to the state-ofart and existing commercial products such as ASIS, FreeSpeech and VoiceNet.

Pasi Fränti, Juhani Saastamoinen, Ismo Kärkkäinen, Tomi Kinnunen, Ville Hautamäki, Ilja Sidoroff

A Preliminary Approach to the Forensic Analysis of an Ultraportable ASUS Eee PC

Abstract

Subnotebooks, or ‘netbooks, are a relatively new consumer market but one that continues to grow significantly worldwide. The aim of this paper is to analyse one of the leading subnotebooks, the ‘ASUS Eee PC’ from a forensics perspective. Specifically, the work investigates current image creation methods for making image of Eee PCs Solid State Drive and it analyses forensically important artefacts.

Trupti Shiralkar, Michael Lavine, Benjamin Turnbull

A Provable Security Scheme of ID-Based Threshold Decryption

Abstract

This paper presents an ID-based threshold decryption scheme and proves that it is selective chosen ciphertext secure without random oracles based on solving decisional (t,q,ε) − − BDHI problem assumption.

Wang Xue-Guang, Chai Zhen-Chuan

Analysis of Sensor Photo Response Non-Uniformity in RAW Images

Abstract

The focus of this paper is a review of a digital camera identification technique proposed by Lukas et al [1], and a modification of the denoising filter, allowing it to be used for raw sensor data. The approach of using raw sensor data allows analysis of the noise pattern separate from any artefacts introduced by on-board camera processing. We use this extension for investigating the reliability of the technique when using different lenses between the same camera and between cameras of the same manufacturer.

Simon Knight, Simon Moschou, Matthew Sorell

Audit Log for Forensic Photography

Abstract

We propose an architecture for an audit log system for forensic photography, which ensures that the chain of evidence of a photograph taken by a photographer at a crime scene is maintained from the point of image capture to its end application at trial. The requirements for such a system are specified and the results of experiments are presented which demonstrate the feasibility of the proposed approach.

Timothy Neville, Matthew Sorell

Authenticating Medical Images through Repetitive Index Modulation Based Watermarking

Abstract

In this work we propose a Repetitive Index Modulation (RIM) based digital watermarking scheme for authentication and integrity verification of medical images. Exploiting the fact that many types of medical images have significant background areas and medically meaningful Regions Of Interest (ROI), which represent the actual contents of the images, the scheme uses the contents of the ROI to create a content-dependent watermark and embeds the watermark in the background areas. Therefore when any pixel of the ROI is attacked, the watermark embedded in the background areas will be different from the watermark calculated according to the attacked contents, making the authentication unsuccessful. Because the creation of the watermark is content-dependent and the watermark is only embedded in the background areas, the proposed scheme can actually protect the content without distorting it.

Chang-Tsun Li, Yue Li

Cyber Forensics Ontology for Cyber Criminal Investigation

Abstract

We developed Cyber Forensics Ontology for the criminal investigation in cyber space. Cyber crime is classified into cyber terror and general cyber crime, and those two classes are connected with each other. The investigation of cyber terror requires high technology, system environment and experts, and general cyber crime is connected with general crime by evidence from digital data and cyber space. Accordingly, it is difficult to determine relational crime types and collect evidence. Therefore, we considered the classifications of cyber crime, the collection of evidence in cyber space and the application of laws to cyber crime. In order to efficiently investigate cyber crime, it is necessary to integrate those concepts for each cyber crime-case. Thus, we constructed a cyber forensics domain ontology for criminal investigation in cyber space, according to the categories of cyber crime, laws, evidence and information of criminals. This ontology can be used in the process of investigating of cyber crime-cases, and for data mining of cyber crime; classification, clustering, association and detection of crime types, crime cases, evidences and criminals.

Heum Park, SunHo Cho, Hyuk-Chul Kwon

Decomposed Photo Response Non-Uniformity for Digital Forensic Analysis

Abstract

The last few years have seen the applications of Photo Response Non-Uniformity noise (PRNU) - a unique stochastic fingerprint of image sensors, to various types of digital forensic investigations such as source device identification and integrity verification. In this work we proposed a new way of extracting PRNU noise pattern, called Decomposed PRNU (DPRNU), by exploiting the difference between the physical andartificial color components of the photos taken by digital cameras that use a Color Filter Array for interpolating artificial components from physical ones. Experimental results presented in this work have shown the superiority of the proposed DPRNU to the commonly used version. We also proposed a new performance metrics, Corrected Positive Rate (CPR) to evaluate the performance of the common PRNU and the proposed DPRNU.

Yue Li, Chang-Tsun Li

Detection of Block Artifacts for Digital Forensic Analysis

Abstract

Although the metadata, such as the header, of a piece of media carries useful information, the metadata may be tampered with for various purposes. It is therefore desirable in the context of forensic analysis that investigators are able to infer properties and information about a piece of media directly from its content without any reference to the metadata. The block size of the block operations that a piece of media has undergone can provide useful clue about the trustworthiness of the metadata and in turn reveals the integrity of the media. In this work, we proposed a novel block artifact detection method for inferring the block size of block-wise operations, such as JPEG compression, that has been applied to the media under investigation. Based on the assumption that block operation create disparities across block boundaries and those boundaries form straight lines, our method exploits the fact that intra-block variance tend to be less than inter-block variance and if most of the pixels along the same vertical line or horizontal line exhibit this relationship then the straight line is believed to be the block boundary.

Chang-Tsun Li

Vocal Forgery in Forensic Sciences

Abstract

This article describes techniques of vocal forgery able to affect automatic speaker recognition system in a forensic context. Vocal forgery covers two main aspects: voice transformation and voice conversion. Concerning voice transformation, this article proposes an automatic analysis of four specific disguised voices in order to detect the forgery and, for voice conversion, different ways to automatically imitate a target voice. Vocal forgery appears as a real and relevant question for forensic expertise. In most cases, criminals who make a terrorist claim or a miscellaneous call, disguise their voices to hide their identity or to take the identity of another person. Disguise is considered in this paper as a deliberate action of the speaker who wants to conceal or falsify his identity. Different techniques exist to transform one’s own voice. Some are sophisticated as software manipulation, some others are simpler as using an handkerchief over the mouth. In voice transformation, the presented work is dedicated to the study of disguise used in the most common cases. In voice conversion, different techniques will be presented, compared, and applied on an original example of the French President voice.

Patrick Perrot, Mathieu Morel, Joseph Razik, Gérard Chollet

International Workshop on e-Forensics Law

Complying across Continents: At the Intersection of Litigation Rights and Privacy Rights

Abstract

This paper addresses the issues and challenges facing multinational corporations when they become involved in litigation that crosses international borders. The conflict of litigation discovery rights and individual privacy rights in different international jurisdictions can present a very challenging situation for litigants. This paper addresses the conflict inherent between litigation discovery rights versus individual privacy rights and how different nations deal with this conflict. The authors offer several pre-litigation recommendations for those corporations that anticipate the possibility of litigation involving parties in more than one international jurisdiction.

Milton H. Luoma, Vicki M. Luoma

Digital Identity – The Legal Person?

Abstract

This paper examines the concept of digital identity which the author asserts is now evident in the United Kingdom as a consequence of the Identity Cards Act (UK) 2006 and the National Identity Scheme it establishes. The nature and functions of the concept, particularly the set of information which constitutes an individual’s transactional identity, are examined. The paper then considers the central question of who, or what, is the legal person in a transaction i.e. who or what enters into legal relations. The analysis presents some intriguing results which were almost certainly not envisaged by the legislature. The implications extend beyond the United Kingdom to similar schemes in other jurisdictions, and to countries, like Australia, which may implement such a scheme.

Clare Sullivan

Surveillance and Datenschutz in Virtual Environments

Abstract

Virtual environments are becoming more and more accepted, and part of the everyday online experience for many users. This offers new potential for both surveillance and data mining. Some of the techniques used are discussed in this paper.

However, such activities may in many countries conflict with the legal framework in place, for example with the German Federal Data Protection Act (Datenschutzgesetz). This point is illustrated by means of comparisons with real-world collection of personal data scenarios such as telephone tapping or video surveillance.

Sabine Cikic, Fritz Lehmann-Grube, Jan Sablatnig

Erratum to: Forensics in Telecommunications, Information and Multimedia

Abstract

Erratum to: M. Sorell (Ed.) Forensics in Telecommunications, Information and Multimedia DOI: 10.1007/978-3-642-02312-5

The book was inadvertently published with an incorrect name of the copyright holder. The name of the copyright holder for this book is: © ICST Institute for Computer Science, Social Informatics and Telecommunications Engineering. The book has been updated with the changes.

Matthew Sorell

Backmatter

Titel: Forensics in Telecommunications, Information and Multimedia
herausgegeben von: Matthew Sorell
Verlag: Springer Berlin Heidelberg
Electronic ISBN: 978-3-642-02312-5
Print ISBN: 978-3-642-02311-8
DOI: https://doi.org/10.1007/978-3-642-02312-5