Towards Automation in Digital Investigations : Seeking Efficiency in Digital Forensics in Mobile and Cloud Environments

Cybercrime and related malicious activity in our increasingly digital world has become more prevalent and sophisticated, evading traditional security mechanisms. Digital forensics has been proposed to help investigate, understand and eventually mitigate such attacks. The practice of digital forensics, however, is still fraught with various challenges. Some of the most prominent of these challenges include the increasing amounts of data and the diversity of digital evidence sources appearing in digital investigations. Mobile devices and cloud infrastructures are an interesting specimen, as they inherently exhibit these challenging circumstances and are becoming more prevalent in digital investigations today. Additionally they embody further characteristics such as large volumes of data from multiple sources, dynamic sharing of resources, limited individual device capabilities and the presence of sensitive data. These combined set of circumstances make digital investigations in mobile and cloud environments particularly challenging. This is not aided by the fact that digital forensics today still involves manual, time consuming tasks within the processes of identifying evidence, performing evidence acquisition and correlating multiple diverse sources of evidence in the analysis phase. Furthermore, industry standard tools developed are largely evidence-oriented, have limited support for evidence integration and only automate certain precursory tasks, such as indexing and text searching. In this study, efficiency, in the form of reducing the time and human labour effort expended, is sought after in digital investigations in highly networked environments through the automation of certain activities in the digital forensic process. To this end requirements are outlined and an architecture designed for an automated system that performs digital forensics in highly networked mobile and cloud environments. Part of the remote evidence acquisition activity of this architecture is built and tested on several mobile devices in terms of speed and reliability. A method for integrating multiple diverse evidence sources in an automated manner, supporting correlation and automated reasoning is developed and tested. Finally the proposed architecture is reviewed and enhancements proposed in order to further automate the architecture by introducing decentralization particularly within the storage and processing functionality. This decentralization also improves machine to machine communication supporting several digital investigation processes enabled by the architecture through harnessing the properties of various peer-to-peer overlays. Remote evidence acquisition helps to improve the efficiency (time and effort involved) in digital investigations by removing the need for proximity to the evidence. Experiments show that a single TCP connection client-server paradigm does not offer the required scalability and reliability for remote evidence acquisition and that a multi-TCP connection paradigm is required. The automated integration, correlation and reasoning on multiple diverse evidence sources demonstrated in the experiments improves speed and reduces the human effort needed in the analysis phase by removing the need for time-consuming manual correlation. Finally, informed by published scientific literature, the proposed enhancements for further decentralizing the Live Evidence Information Aggregator (LEIA) architecture offer a platform for increased machine-to-machine communication thereby enabling automation and reducing the need for manual human intervention.

A Comparison of Geo-tagging in Mobile Internet Browsing Applications on iOS and Android.

Nowadays there is almost no crime committed without a trace of digital evidence, and since the advanced functionality of mobile devices today can be exploited to assist in crime, the need for mobile forensics is imperative. Many of the mobile applications available today, including internet browsers, will request the user’s permission to access their current location when in use. This geolocation data is subsequently stored and managed by that application's underlying database files. If recovered from a device during a forensic investigation, such GPS evidence and track points could hold major evidentiary value for a case. The aim of this paper is to examine and compare to what extent geolocation data is available from the iOS and Android operating systems. We focus particularly on geolocation data recovered from internet browsing applications, comparing the native Safari and Browser apps with Google Chrome, downloaded on to both platforms. All browsers were used over a period of several days at various locations to generate comparable test data for analysis. Results show considerable differences not only in the storage locations and formats, but also in the amount of geolocation data stored by different browsers and on different operating systems.

Metodologie e tecniche per l'analisi forense di dispositivi di telefonia mobile

Studio che approfondisce e compare le diverse metodologie e tecniche utilizzabili per l'analisi di dispositivi di telefonia cellulare, in particolar modo smartphone, nel contesto di indagini di mobile device forensics

Privacy-Preserving Optimal Meeting Location Determination on Mobile Devices

Equipped with state-of-the-art smartphones and mobile devices, today's highly interconnected urban population is increasingly dependent on these gadgets to organize and plan their daily lives. These applications often rely on current (or preferred) locations of individual users or a group of users to provide the desired service, which jeopardizes their privacy; users do not necessarily want to reveal their current (or preferred) locations to the service provider or to other, possibly untrusted, users. In this paper, we propose privacy-preserving algorithms for determining an optimal meeting location for a group of users. We perform a thorough privacy evaluation by formally quantifying privacy-loss of the proposed approaches. In order to study the performance of our algorithms in a real deployment, we implement and test their execution efficiency on Nokia smartphones. By means of a targeted user-study, we attempt to get an insight into the privacy-awareness of users in location-based services and the usability of the proposed solutions.

Quantification and source identification of atmospheric particulate polycyclic aromatic hydrocarbons and their dry deposition fluxes at three sites in Salvador Basin, Brazil, impacted by mobile and stationary sources

The present work has aimed to determine the 16 US EPA priority PAH atmospheric particulate matter levels present in three sites around Salvador, Bahia: (i) Lapa bus station, strongly impacted by heavy-duty diesel vehicles; (ii) Aratu harbor, impacted by an intense movement of goods, and (iii) Bananeira village on Maré Island, a non vehicle-influenced site with activities such as handcraft work and fisheries. Results indicated that BbF (0.130-6.85 ng m-3) is the PAH with highest concentration in samples from Aratu harbor and Bananeira and CRY (0.075-6.85 ng m-3) presented higher concentrations at Lapa station. PAH sources from studied sites were mainly of anthropogenic origin such as gasoline-fueled light-duty vehicles and diesel-fueled heavy-duty vehicles, discharges in the port, diesel burning from ships, dust ressuspension, indoor soot from cooking, and coal and wood combustion for energy production.

Experimental results on the nonlinear H(infinity) control via quasi-LPV representation and game theory for wheeled mobile robots

In this paper, nonlinear dynamic equations of a wheeled mobile robot are described in the state-space form where the parameters are part of the state (angular velocities of the wheels). This representation, known as quasi-linear parameter varying, is useful for control designs based on nonlinear H(infinity) approaches. Two nonlinear H(infinity) controllers that guarantee induced L(2)-norm, between input (disturbances) and output signals, bounded by an attenuation level gamma, are used to control a wheeled mobile robot. These controllers are solved via linear matrix inequalities and algebraic Riccati equation. Experimental results are presented, with a comparative study among these robust control strategies and the standard computed torque, plus proportional-derivative, controller.

The role of mobile belts for the longevity of deep cratonic lithosphere: The crumple zone model

Many Archean cratons are surrounded by Proterozoic mobile belts that have experienced episodes of tectonic re-activation over their lifetimes. This suggests that mobile belt lithosphere may be associated with long lived, inherited weakness. It is proposed that the proximity of this weakness can increase the longevity of deep Archean lithosphere by buffering Archean cratons from mantle derived stresses. The physical plausibility of this idea is explored through numerical simulations of mantle convection that include continents and allow for material rheologies that model the combined brittle and ductile behavior of the lithosphere. Within the simulations, the longevity of deep cratonic lithosphere does increase if it is buffered by mobile belts that can fail at relatively low stress levels.

The generation of H-1-NMR-detectable mobile lipid in stimulated lymphocytes: Relationship ts cellular activation, the cell cycle, and phosphatidylcholine-specific phospholipase C

Mobile Lipids detected using H-1-NMR in stimulated lymphocytes were correlated with cell cycle phase, expression of the interleukin-2 receptor alpha and proliferation to assess the activation status of the lymphocytes. Mobile lipid levels, IL-2R alpha expression and proliferation increased after treatment with PMA and ionomycin. PMA or ionomycin stimulation alone induced increased IL-2R alpha expressiom but not proliferation, PMA- but not ionomycin-stimulation generated mobile lipid, Treatment with anti-CD3 antibody did not increase IL-2R alpha expression or proliferation but did generate increased amounts of mobile lipid, The cell cycle status of thymocytes treated with anti-CD3, PMA or ionomycin alone indicated an. accumulation of the cells in the G(1) phase of the cell cycle, The generation of mobile lipid was abrogated in anti-CD3 antibody-stimulated thymic lymphocytes but not in splenic lymphocytes, using a phosphatidylcholine-specific phospholipase C (PC-PLC) inhibitor which blocked cells in the G(1)/S phase of the cell cycle, This suggests that the H-1-NMR-detectable mobile Lipid may be generated in anti-CD3 antibody-stimulated thymic lymphocytes by the action of PC-PLC activity via the catabolism of PC, in the absence of classical signs of activation. (C) 1997 Academic Press.

Can Mobile Units Improve the Strategies for Cervical Cancer Prevention?

Cervical cancer is a serious public health problem in women in developing countries because of absence or ineffectiveness of screening programs. Several biases to access medical care and inequity of public health system in a continental country like Brazil limit the implementation of adequate programs to appropriately prevent the cervical cancer. Therefore, the aim of this study was to evaluate the results of applying the mobile unit (MU) for cervical cancer screening. From May 2003 to May 2004, a cervical cancer screening was offered to women aged 20-69 years, residing in 19 municipal districts of the Barretos county region, in Sao Paulo. Out of the 9,560 examination available, 2,964 (31%) women underwent screening. The medium distance traveled by the MU was 45 km. The medium time spent by women in the MU for completion of the questionnaire and doing the exam was 20 minutes. It was observed that 17.0% of women screened had never had the test or had not had it repeated within the last 3 years. The negative response was more common among women aged 20 to 29 years and 60 to 69 years and among women with less schooling and lower socio-economic income (P < 0.05). MU can significantly overcome the chronic deficiency of public health system accessibility offering opportunity to these women to participate in screening programs. Diagn. Cytopathol. 2010;38:727-730. (C) 2009 Wiley-Liss, Inc.

Program for Prostate Cancer Screening Using a Mobile Unit: Results From Brazil

OBJECTIVES To evaluate the initial results of a prostate cancer screening program using mobile units in Brazil. METHODS Since 2004, we have conducted a program of prostate cancer screening using mobile units across 231 municipalities from 6 Brazilian states. RESULTS A total of 17 571 men were evaluated by clinical history, digital rectal examination (DRE), and serum free and total prostate-specific antigen (PSA) levels. The recommendations for biopsy were a PSA level of >= 4.0 ng/mL, DRE findings suspicious for cancer, or a PSA level of 2.5-4.0 ng/mL with a percent-free PSA level <15%. The biopsy protocol included 12 biopsy cores from the peripheral zone, 2 from the transition zone, and additional sampling of suspicious areas. The cumulative cancer detection rate was 3.7%. The main indication for biopsy was a PSA level of >= 4.0 ng/mL (51.2%), with a positive predictive value (PPV) of 44.1%. Another 19.7% of biopsied men had suspicious DRE findings with a normal PSA level (PPV 23.5%). A percent-free PSA level of <15% in men with a PSA level of 2.5-4.0 ng/mL and normal DRE findings yielded a PPV of 31.1%. The PPV was greater (70.9%) for the 7.1% of men with both suspicious DRE findings and a PSA level of >4.0 ng/mL. Most cancers were Stage T1-T2 (93.4%), and the percentage of Gleason score of >= 7 was 32.5%. The proportion of insignificant cancers according to Epstein`s criteria was 13.5%. CONCLUSIONS A mobile prostate cancer screening unit enabled an underserved population to gain access to specialized care through the public healthcare system. The cancer detection rate in this population was similar to those from international studies. UROLOGY 76: 1052-1057, 2010. (C) 2010 Published by Elsevier Inc.