A visual approach to interpreting NAND flash memory

The research described in this paper proposes methods for visually interpreting the content of raw NAND flash memory images into higher level visual artefacts of assistance in reverse engineering and interpreting flash storage formats. A novel method of reverse engineering the structure and layout of individual memory locations within NAND flash images, based on injecting a known signal into a test NAND environment is also proposed. Omissions in the current theory of operation of flash, in particular the role of flash memory controllers in transforming the raw NAND are identified, clarifying the cause of variations seen between images taken using pseudo physical and raw physical techniques. The effectiveness of the approach is validated against raw NAND images from YAFFS2 based Android phones, taken via JTAG and chip-off methods.     

Data fragment forensics for embedded DVR systems

A recent increase in the prevalence of embedded systems has led them to become a primary target of digital forensic investigations. Embedded systems with DVR (Digital Video Recorder) capabilities are able to generate multimedia (video/audio) data, and can act as vital pieces of evidence in the field of digital forensics.To counter anti-forensics, it is necessary to derive systematic forensic techniques that can be used on data fragments in unused (unallocated) areas of files or images. Specifically, the techniques should extract meaningful information from various types of data fragments, such as non-sequential fragmentation and missing fragments overwritten by other data.This paper proposes a new digital forensic system for use on video data fragments related to DVRs. We demonstrate in detail special techniques for the classification, reassembly, and extraction of video data fragments, and introduce an integrated framework for data fragment forensics based on techniques described in this paper.     

Forensic analysis of video file formats

Video file format standards define only a limited number of mandatory features and leave room for interpretation. Design decisions of device manufacturers and software vendors are thus a fruitful resource for forensic video authentication. This paper explores AVI and MP4-like video streams of mobile phones and digital cameras in detail. We use customized parsers to extract all file format structures of videos from overall 19 digital camera models, 14 mobile phone models, and 6 video editing toolboxes. We report considerable differences in the choice of container formats, audio and video compression algorithms, acquisition parameters, and internal file structure. In combination, such characteristics can help to authenticate digital video files in forensic settings by distinguishing between original and post-processed videos, verifying the purported source of a file, or identifying the true acquisition device model or the processing software used for video processing.     

IoT forensics: Exploiting log records from the DAHUA technology CCTV systems

CCTV surveillance systems are ubiquitous IoT appliances. Their forensic examination has proven critical for investigating crimes. DAHUA Technology is a well-known manufacturer of such products. Despite its global market share, research regarding digital forensics of DAHUA Technology CCTV systems is scarce and currently limited to extracting their video footage, overlooking the potential presence of valuable artifacts within their log records. These pieces of evidence remain unexploited by major commercial forensic software, yet they can hide vital information for an investigation. For instance, these log records document user actions, such as formatting the CCTV system's hard drive or disabling camera recording. This information can assist in attributing nefarious actions to specific users and hence can be invaluable for understanding the sequence of events related to incidents. Therefore, in this paper, several DAHUA Technology CCTV systems are thoroughly analyzed for these unexplored pieces of evidence, and their forensic value is presented.     

Setting the stage: Arnold Schwarzenegger and video games prepare for battle in the United States Supreme Court

Video games often feature a character that evolves into an iconic superhero. In a strange twist of fate, the video game medium will have the opportunity to become a superhero itself. The recording, comic book, and movie industries have rallied around video games as the case of Arnold Schwarzenegger vs. Entertainment Merchants Association and Entertainment Software Association reaches the Supreme Court of the United States. The case concerns a 2005 California ban on the sale of violent video games to minors. The law was later overturned by the District Court and the 9th Circuit Court on appeal. At issue is whether the law violates the First Amendment of the Constitution. Do video games deserve the full protection of the Constitution as a legitimate form of speech, or should it be limited due to its alleged effects on the psychological well-being of minors? This Article will look at the impact this case may have when it reaches the Supreme Court, an analysis of the issues that will be argued, and the history of legislation involving violent video games.     

Cookie信息取证方法简述

本文综述了计算机取证中涉及Cookie取证方面的基础知识和应用技术。分别从Cookie基本常识、Cookie存在的安全方面问题、Cookie获取方法、Cookie相关软件工具和Cookie缓存文件信息获取5个方面进行了综述。     

A comparison of forensic evidence recovery techniques for a windows mobile smart phone

Acquisition, decoding and presentation of information from mobile devices is complex and challenging. Device memory is usually integrated into the device, making isolation prior to recovery difficult. In addition, manufacturers have adopted a variety of file systems and formats complicating decoding and presentation.A variety of tools and methods have been developed (both commercially and in the open source community) to assist mobile forensics investigators. However, it is unclear to what extent these tools can present a complete view of the information held on a mobile device, or the extent the results produced by different tools are consistent.This paper investigates what information held on a Windows Mobile smart phone can be recovered using several different approaches to acquisition and decoding. The paper demonstrates that no one technique recovers all information of potential forensic interest from a Windows Mobile device; and that in some cases the information recovered is conflicting.     

视频图像侦查中视频信息内容分析初探

视频信息内容分析是视频图像侦查的重要内容之一。围绕案件相关要素来搜寻和发现涉案的视频图像资料,能为视频信息内容分析提供良好的基础。然后紧密围绕涉案人员图像、涉案车辆图像、涉案物品图像进行分析,并将获取的相关信息应用与侦查实践。     

计算机取证技术研究

随着信息技术的发展,电子证据逐渐成为一种新的诉讼证据。作为计算机领域和法学领域的一门交叉学科,计算机取证正逐渐成为人们研究与关注的焦点,如计算机取证的概念、原则、步骤以及计算机取证的相关技术、计算机取证的发展方向等。     

海量电子数据审查的实现路径

有效解决海量电子数据审查这一难题,既是一线办案检察官面临的急迫需求,也是工程技术领域长久未能实现突破的领域。实践中,既要平衡电子数据量大与办案时限紧张之间的矛盾,还要面临检察官主动审查运用电子数据的意识低、相关专业技术人员力量薄弱以及缺乏相关的专业指引等突出问题。通过梳理司法办案通用模型,研究司法诉讼对电子数据价值挖掘的精准需求场景,利用人工智能和大数据技术建立与完善检察办案审查证据的知识图谱,实现对电子数据蕴含诉讼价值的深度和高效挖掘,是突破该问题的有益思考。