Cognitive and human factors in digital forensics: Problems, challenges, and the way forward

Unpacking workplace stress and forensic expert decision-making: From theory to practice

Workplace stress can affect forensic experts' job satisfaction and performance, which holds financial and other implications for forensic service providers. Therefore, it is important to understand and manage workplace stress, but that is not simple or straightforward. This paper explores stress as a human factor that influences forensic expert decision-making. First, we identify and highlight three factors that mitigate decisions under stress conditions: nature of decision, individual differences, and context of decision. Second, we situate workplace stress in forensic science within the Challenge-Hindrance Stressor Framework. We argue that stressors in forensic science workplaces can have a positive or a negative impact, depending on the type, level, and context of stress. Developing an understanding of the stressors, their sources, and their possible impact can help forensic service providers and researchers to implement context-specific interventions to manage stress at work and optimize expert performance.

Digital evidence strategies for digital forensic science examinations

Given the size and complexity of many digital forensic science device examinations, there is a need for practitioners to formally and strategically determine a course of conduct which allows them to undertake the most robust and efficient examination possible. This work outlines both the need for practitioners to have a digital evidence strategy (DES) when tackling any given examination scenario, how to construct one and the concerns which exist when no formal DES is in place. Approaches to DES development are examined and the context to which they should be deployed are analysed, with focus being on the use of DESs at the examination/processing stage of the investigative workflow. Finally, a 'DES skeleton' is offered to guide practitioners as they seek to create their own DES.

Digital Forensics AI: Evaluating, Standardizing and Optimizing Digital Evidence Mining Techniques

The impact of AI on numerous sectors of our society and its successes over the years indicate that it can assist in resolving a variety of complex digital forensics investigative problems. Forensics analysis can make use of machine learning models’ pattern detection and recognition capabilities to uncover hidden evidence in digital artifacts that would have been missed if conducted manually. Numerous works have proposed ways for applying AI to digital forensics; nevertheless, scepticism regarding the opacity of AI has impeded the domain’s adequate formalization and standardization. We present three critical instruments necessary for the development of sound machine-driven digital forensics methodologies in this paper. We cover various methods for evaluating, standardizing, and optimizing techniques applicable to artificial intelligence models used in digital forensics. Additionally, we describe several applications of these instruments in digital forensics, emphasizing their strengths and weaknesses that may be critical to the methods’ admissibility in a judicial process.

An "order of data acquisition" for digital forensic investigations

Data acquisition is a fundamental stage of the digital forensic workflow, where without it, it may not be possible to conduct many criminal inquiries effectively. While any investigative team may want access to all digital data available, it is no longer an approach that is considered justifiable or proportionate in all cases. There is now an increasing narrative highlighting the invasiveness of digital data acquisition processes and their impact upon privacy, with calls to ensure greater scrutiny is placed upon their use. This work proposes the "Order of Data Acquisition" which defines 10 digital data acquisition methods that are available to practitioners as a part of a forensic examination, derived from a review of existing literature and best practice acquisition approaches, and arranged by their "invasiveness." Each method is discussed with examples provided in order to clarify and formalize the process of determining a suitable acquisition method in every case while acknowledging privacy invasion concerns. Finally, conclusions are drawn.

A formalized model of the Trace

This work proposes a formalized model, grounded in forensic science, to support a unified understanding of the Trace across scientific disciplines. The model is precisely defined in mathematical terms that reflect the dynamics of an offense as expressed in Locard's Exchange principle. Specifically, this mathematical approach represents the Trace as the modification of a Scene, subsequently perceptible, resulting from the Event under investigation. Examples are provided to illustrate how this conceptualization applies to forensic science, including DNA and digital evidence. Broader implications of this model are presented in the context of COVID-19, emphasizing the value of cohesive scientific study of the Trace. The aim of this work is to stimulate more formalized study of the Trace, both from tangible and abstract perspectives, and to strengthen forensic science as a whole.

PRECEPT-4-Justice: A bias-neutralising framework for digital forensics investigations

Software invisibly permeates our everyday lives: operating devices in our physical world (traffic lights and cars), effecting our business transactions and powering the vast World Wide Web. We have come to rely on such software to work correctly and efficiently. The generally accepted narrative is that any software errors that do occur can be traced back to a human operator's mistakes. Software engineers know that this is merely a comforting illusion. Software sometimes has bugs, which might lead to erratic performance: intermittently generating errors. The software, hardware and communication infrastructure can all introduce errors, which are often challenging to isolate and correct. Anomalies that manifest are certainly not always due to an operator's actions. When the general public and the courts believe the opposite, that errors are usually attributable to some human operator's actions, it is entirely possible for some hapless innocent individual to be blamed for anomalies and discrepancies whose actual source is a software malfunction. This is what occurred in the Post Office Horizon IT case, where unquestioning belief in the veracity of software-generated evidence led to a decade of wrongful convictions. We will use this case as a vehicle to demonstrate the way biases can influence investigations, and to inform the development of a framework to guide and inform objective digital forensics investigations. This framework, if used, could go some way towards neutralising biases and preventing similar miscarriages of justice in the future.

What does a digital forensics opinion look like? A comparative study of digital forensics and forensic science reporting practices

This study explores digital forensics (DF) reporting practices and compares the results with other forensic science disciplines. Forty reports were obtained from a quasi-experiment involving DF examiners, and a quantitative content analysis was performed to determine which conclusion types they applied and which content they included with relevance to the credibility of the reported results. A qualitative analysis was performed to examine the certainty expressions used in the conclusions. The results were compared to a study of eight forensic science disciplines performed by Bali et al. [24,26]. The results show that the DF examiners tend to present their conclusions either as Categorical conclusion or Strength of support (SoS) conclusion types and that they address source, activity, and offence level issues in their conclusions. The content analysis indicates deficiencies in DF reporting practices, and several of the challenges seem to be shared with other FS disciplines. The analysis of certainty expressions showed that a plethora of expressions was used, and that they lacked reference to an established framework. The results indicate that more research on DF evaluation and reporting practices is necessary and justifies a need for enhanced focus on quality control and peer review within the DF discipline.

Introduction of the ARDS—Anti-Ransomware Defense System Model—Based on the Systematic Review of Worldwide Ransomware Attacks

We live in a world of digital information communication and digital data storage. Following the development of technology, demands from the user side also pose serious challenges for developers, both in the field of hardware and software development. However, the increasing penetration of the Internet, IoT and digital solutions that have become available in almost every segment of life, carries risks as well as benefits. In this study, the authors present the phenomenon of ransomware attacks that appear on a daily basis, which endangers the operation and security of the digital sphere of both small and large enterprises and individuals. An overview of ransomware attacks, the tendency and characteristics of the attacks, which have caused serious financial loss and other damages to the victims, are presented. This manuscript also provides a brief overview of protection against ransomware attacks and the software and hardware options that enhance general user security and their effectiveness as standalone applications. The authors present the results of the study, which aimed to explore how the available software and hardware devices can implement digital user security. Based on the results of the research, the authors propose a complex system that can be used to increase the efficiency of network protection and OS protection tools already available to improve network security, and to detect ransomware attacks early. As a result, the model of the proposed protection system is presented, and it can be stated that the complex system should be able to detect ransomware attacks from either the Internet or the internal network at an early stage, mitigate malicious processes and maintain data in recoverable state.

Interpol review of digital evidence 2016 - 2019

This review paper covers the forensic-relevant literature in digital evidence from 2016 to 2019 as a part of the 19th Interpol International Forensic Science Managers Symposium. The review papers are also available at the Interpol website at: https://www.interpol.int/content/download/14458/file/Interpol Review Papers 2019.pdf