Towards Automation in Digital Investigations : Seeking Efficiency in Digital Forensics in Mobile and Cloud Environments

Cybercrime and related malicious activity in our increasingly digital world has become more prevalent and sophisticated, evading traditional security mechanisms. Digital forensics has been proposed to help investigate, understand and eventually mitigate such attacks. The practice of digital forensics, however, is still fraught with various challenges. Some of the most prominent of these challenges include the increasing amounts of data and the diversity of digital evidence sources appearing in digital investigations. Mobile devices and cloud infrastructures are an interesting specimen, as they inherently exhibit these challenging circumstances and are becoming more prevalent in digital investigations today. Additionally they embody further characteristics such as large volumes of data from multiple sources, dynamic sharing of resources, limited individual device capabilities and the presence of sensitive data. These combined set of circumstances make digital investigations in mobile and cloud environments particularly challenging. This is not aided by the fact that digital forensics today still involves manual, time consuming tasks within the processes of identifying evidence, performing evidence acquisition and correlating multiple diverse sources of evidence in the analysis phase. Furthermore, industry standard tools developed are largely evidence-oriented, have limited support for evidence integration and only automate certain precursory tasks, such as indexing and text searching. In this study, efficiency, in the form of reducing the time and human labour effort expended, is sought after in digital investigations in highly networked environments through the automation of certain activities in the digital forensic process. To this end requirements are outlined and an architecture designed for an automated system that performs digital forensics in highly networked mobile and cloud environments. Part of the remote evidence acquisition activity of this architecture is built and tested on several mobile devices in terms of speed and reliability. A method for integrating multiple diverse evidence sources in an automated manner, supporting correlation and automated reasoning is developed and tested. Finally the proposed architecture is reviewed and enhancements proposed in order to further automate the architecture by introducing decentralization particularly within the storage and processing functionality. This decentralization also improves machine to machine communication supporting several digital investigation processes enabled by the architecture through harnessing the properties of various peer-to-peer overlays. Remote evidence acquisition helps to improve the efficiency (time and effort involved) in digital investigations by removing the need for proximity to the evidence. Experiments show that a single TCP connection client-server paradigm does not offer the required scalability and reliability for remote evidence acquisition and that a multi-TCP connection paradigm is required. The automated integration, correlation and reasoning on multiple diverse evidence sources demonstrated in the experiments improves speed and reduces the human effort needed in the analysis phase by removing the need for time-consuming manual correlation. Finally, informed by published scientific literature, the proposed enhancements for further decentralizing the Live Evidence Information Aggregator (LEIA) architecture offer a platform for increased machine-to-machine communication thereby enabling automation and reducing the need for manual human intervention.

Organohalogen contaminants in wildlife from the Yangtze River Delta : Development of methods and assessments of legacy and emerging persistent organic pollutants

Rapid economic development has occurred during the past few decades in China with the Yangtze River Delta (YRD) area as one of the most progressive areas. The urbanization, industrialization, agricultural and aquaculture activities result in extensive production and application of chemicals. Organohalogen contaminants (OHCs) have been widely used as i.e. pesticides, flame retardants and plasticizers. They are persistent, bioaccumulative and pose a potential threat to ecosystem and human health. However, limited research has been conducted in the YRD with respect to chemicals environmental exposure. The main objective of this thesis is to investigate the contamination level, distribution pattern and sources of OHCs in the YRD. Wildlife from different habitats are used to indicate the environmental pollution situation, and evaluate selected matrices for use in long term biomonitoring to determine the environmental stress the contamination may cause. In addition, a method is developed for dicofol analysis. Moreover, a specific effort is made to introduce statistic power analysis to assist in optimal sampling design. The thesis results show extensive contamination of OHCs in wildlife in the YRD. The occurrences of high concentrations of chlorinated paraffins (CPs) are reported in wildlife, in particular in terrestrial species, (i.e. short-tailed mamushi snake and peregrine falcon). Impurities and byproducts of pentachlorophenol products, i.e. polychlorinated diphenyl ethers (PCDEs) and hydroxylated polychlorinated diphenyl ethers (OH-PCDEs) are identified and reported for the first time in eggs from black-crowned night heron and whiskered tern. High concentrations of octachlorodibenzo-p-dioxin (OCDD) are determined in these samples. The toxic equivalents (TEQs) of polychlorinated dibenzo-p-dioxin (PCDDs) and polychlorinated dibenzofurans (PCDFs) are at mean levels of 300 and 520 pg TEQ g-1lw (WHO2005 TEQ) in eggs from the two bird species, respectively. This is two orders of magnitude higher than European Union (EU) regulation limit in chicken eggs. Also, a novel pattern of polychlorinated biphenyls (PCBs) with octa- to decaCBs, contributing to as much as 20% of total PCBs therein, are reported in birds. The legacy POPs shows a common characteristic with relatively high level of organochlorine pesticides (i.e. DDT, hexacyclohexanes (HCHs) and Mirex), indicating historic applications. In contrast, rather low concentrations are shown of industrial chemicals such as PCBs and polybrominated diphenyl ethers (PBDEs). A refined and improved analytical method is developed to separate dicofol from its major decomposition compound, 4,4’-dichlorobenzophenone. Hence dicofol is possible to assess as such. Statistic power analysis demonstrates that sampling of sedentary species should be consistently spread over a larger area to monitor temporal trends of contaminants in a robust manner. The results presented in this thesis show high CPs and OCDD concentrations in wildlife. The levels and patterns of OHCs in YRD differ from other well studied areas of the world. This is likely due to the extensive production and use of chemicals in the YRD. The results strongly signal the need of research biomonitoring programs that meet the current situation of the YRD. Such programs will contribute to the management of chemicals and environment in YRD, with the potential to grow into the human health sector, and to expand to China as a whole.