The most common forensic activity is searching a hard disk for string of data. Nowadays, investigators and analysts are increasingly experiencing large, even terabyte sized data sets when conducting digital investigations. Therefore consecutive searching can take weeks to complete successfully. There are two primary search methods: index-based search and bitwise search. Index-based searching is...

With the increasing scale of digital forensic investigations, there is a need for approaches that are capable of reducing the quantities of data forensic examiners are required to search. Meanwhile, as anti-forensic and encryption techniques evolve, there is an increasing need to capture relevant information from a machine before powering it off. Numerous approaches to live forensic evidence ac...

IMAGE STATISTICAL FRAMEWORKS FOR DIGITAL IMAGE FORENSICS by Patchara Sutthiwan The advances of digital cameras, scanners, printers, image editing tools, smartphones, tablet personal computers as well as high-speed networks have made a digital image a conventional medium for visual information. Creation, duplication, distribution, or tampering of such a medium can be easily done, which calls for...

Digital forensic investigators experience a need for support in their everyday struggle to overcome boundary problems associated with cyber crime investigations. Traditional methods are socio-culturally and physically localised and dependent on strict and historically prescriptive political management. The new internet-worked cyber-world creates unprecedented difficulties for digital forensic i...

A forensic investigation of digital evidence is commonly employed as a post-event response to a serious information security incident. In fact, there are many circumstances where an organisation may benefit from an ability to gather and preserve digital evidence before an incident occurs. Forensic readiness is defined as the ability of an organisation to maximise its potential to use digital ev...

There are a wide range of forensic and analysis tools to examine digital evidence in existence today. Traditional tool design examines each source of digital evidence as a BLOB (binary large object) and it is up to the examiner to identify the relevant items from evidence. In the face of rapid technological advancements we are increasingly confronted with a diverse set of digital evidence and b...

The records maintained by Jump Lists have the potential to provide a rich source of evidence about users’ historic activity to the forensic investigator. The structure and artifacts recorded by Jump Lists have been widely discussed in various forensic communities since its debut in Microsoft Windows 7. However, this feature has more capabilities to reveal evidence in Windows 10, due to its modi...

(EN) We describe an ongoing research project on efficient methods for identification and reconstruction of broken objects among large collections of irregular fragments. Applications include archaeology, art restoration, failure analysis, and other disciplines. Our solution for flat objects uses multi-scale matching and constrained dynamic programming. We are now extending it to curved pottery ...

Memory forensic is important in digital investigation. The forensic is based on the data stored in physical memory that involve memory management and processing time. However, the current forensic tools do not consider the efficiency in terms of storage management and the processing time. This paper shows the high redundancy of data found in the physical memory that cause inefficiency in proces...