Cluster computing has become an inevitable part of data processing as the huge volume of data being produced from different sources like online social media, IoT, mobiledata, sensor data, black box ...data and so on increases in an exponentially fast manner. Distributed File System defines different methods to distribute, read and eliminate the files among different cluster computing nodes. It is found that popular distributed file systems such as Google File System and Hadoop Distributed File System store metadata centrally. This creates a chance for a Single Point of Failure that arises the need for backup and alternative solutions to recover the metadata on the failure of the metadata server. Also, the name node server is built using expensive and reliable hardware. For small and medium clusters, it is not cost effective to maintain expensive name node server. Even though cheap commodity hardware may substitute the name node functionality, they are prone to hardware failure. This paper proposes a novel distributed file system to distribute files over a cluster of machines connected in a Peer-to-Peer network. The most significant feature of the file system is its capability to distribute the metadata using distributed consensus, using hash values. Although the distributed metadata is visible to the public, the methodology ensures that it is immutable and irrefutable. As part of the in-depth research, the proposed file system has been successfully tested in the Google Cloud Platform. Also, the basic operations like read, write, and delete on Distributed File System with distributed metadata are compared with that of Hadoop Distributed File System based on distribution time on the same cluster setup. The novel distributed file system provides better results compared to the existing methodologies.
Malware Crimes are ubiquitous nowadays. One of the challenges faced by Cyber Forensics Investigators is to retrieve the details of a suspicious program, which might be malware, from a computer. ...Another challenge is that anti-forensics techniques are often adopted by criminals after committing cybercrimes to hide the presence of suspicious programs and their associated details. In such cases, footprints of the suspicious programs and the related details may be deleted or overwritten from the Suspect's computer. This paper presents a detailed procedure to reconstruct or retrieve crucial information related to those suspicious programs from various sources on a Windows Computer. This type of analysis reveals the traces of these programs from their remnants available on a computer. This paper describes methodologies for examining the storage media as well as random access memory content of the Suspect's computer to retrieve such footprints. It also includes the steps for analyzing various Windows 10 artefacts that may hold the footprints of malware even after it is deleted or overwritten from the original location. The paper also explains the results of experiments conducted to identify the traces of suspicious executables which are deleted or still existing on the Computer.
Detection of spoofed mails Jayan, Aparna; Dija, S.
2015 IEEE International Conference on Computational Intelligence and Computing Research (ICCIC),
12/2015
Conference Proceeding, Journal Article
Cyber forensics deals with the collection of digital artifacts from digital devices that can be presented in the court as evidence. There are many areas of cyber forensics. Some of these are Disk ...Forensics, Network Forensics, Mobile Forensics, Database Forensics, etc. This paper mainly focuses on E-mail Forensics coming under network forensics. Emails are highly vulnerable to attacks. Email spoofing is the major one among many forms of email-based attacks. Detecting email spoofing is an important challenge in email forensic investigation. In this paper, different methods to detect spoofing by analyzing the mail header are discussed.
Forensic Analysis of Google Chrome Cache Files Suma, G S; Dija, S; Pillai, Arun T
2017 IEEE International Conference on Computational Intelligence and Computing Research (ICCIC),
2017-December
Conference Proceeding
Internet Forensics has become an indispensable part of Cyber Forensics. This is due to the rapid growth in the number of cybercrimes which are related to Internet usage. These crimes vary from ...malware crimes to crimes related to use of Social Media, banking transactions and other financial services. In these type of crimes, the browser files which are generated by different web browsers, should be analyzed. Among the different artifacts left by web browsers, the most relevant file in forensic investigation is the cache file as it stores important cyber forensics information of frequently visited websites. Investigators can obtain a clear picture of visited websites, loaded pictures and other objects using the information stored in the cache files. The paper describes the structure of cache files created by Google Chrome in detail. The results obtained in this way can provide forensically sound information in cybercrime investigation. Advanced analysis of java scripts and other objects obtained in this way provide crucial evidence in proving different types of cybercrimes including malware crimes.
The Mac Operating System is a fork of UNIX OS that is widely used in Apple's computers known as Mac Books. The availability of tools for macOS forensics are in scarce. In addition to this, the macOS ...provides extra security to the user, which in turn leads to difficulties in forensic analysis. Nowadays the macOS is gaining popularity among cyber criminals because of its unique features. Hence there is a need for analyzing mac Systems in depth. The artefacts left out by the suspect must be retrieved and analyzed as part of cyber forensics investigation. The data from these artefacts are analyzed based on its forensic relevance. This paper presents a methodology for live forensics in macOS system. This involves acquisition of crucial artifacts from a suspect's machine and analyzing it later in an investigator's machine.
Cloud storage and Social Media Applications can be accessed by using various Web and Portable Browsers. These applications available in Windows 10 Operating System. The cloud storage and social media ...applications allow its users to share their personal information, ideas, and files through their respective accounts. Because of this, the cloud storage and social media platforms has become a target for criminals to commit different type of cybercrimes. In order to identify the criminal activities, the traces of evidence which are present in user's machine by the use of these applications need to be extracted and analyzed. In this paper, potential locations of evidence in the Windows10 machines related to social media and cloud storage are collected and analyzed to find artifact locations and their details.
Nowadays, Memory Forensics is more acceptable in Cyber Forensics Investigation because malware authors and attackers choose RAM or physical memory for storing critical information instead of hard ...disk. The volatile physical memory contains forensically relevant artifacts such as user credentials, chats, messages, running processes and its details like used dlls, files, command and network connections etc. Memory Forensics involves acquiring the memory dump from the Suspect's machine and analyzing the acquired dump to find out crucial evidence with the help of windows pre-defined kernel data structures. While retrieving different artifacts from these data structures, finding the network connections from Windows 7 system's memory dump is a very challenging task. This is because the data structures that store network connections in earlier versions of Windows are not present in Windows 7. In this paper, a methodology is described for efficiently retrieving details of network related activities from Windows 7 x64 memory dump. This includes remote and local IP addresses and associated port information corresponding to each of the running processes. This can provide crucial information in cyber crime investigation.
Cyber forensics is the process of seizure, acquisition and analysis of digital evidence. Development of cyber forensics tools is often challenging as more and more variations of digital devices are ...marketed rapidly and new cyber crime scenarios are reported frequently. If the team follows a traditional development method with a long planning phase, the product will be obsolete by the time it is released. So the product development teams should follow agile development methods that can ensure quick release and efficient change management. In this paper, we present the need to adopt agile methodology of project management in the development of Cyber Forensic Tools through a sample case study.
Multilingual search in cyber forensic analysis Koshy, Jisha Ninan; Gonsalvez, Dagma D.; Dija, S. ...
2013 IEEE International Conference on Computational Intelligence and Computing Research,
12/2013
Conference Proceeding
In the present day scenario, large amount of information and data is being stored in the form of digital documents. Cyber forensics analysis tools need to deal with large volumes of data retrieved ...from the suspect's hard disk. Searching for relevant evidence from such vast volumes is not an easy task. Analyzing such massive volumes of data manually is impractical. It is obvious that the cyber investigator would need the help of forensic analysis software tools for this purpose. Besides, a number of multilingual documents may be present in the seized media. Especially in a country like India, the analysts may come across multilingual documents very often. Thus, there arises a need to provide support for multilingual search in cyber forensic analysis tools. Not many forensic analysis tools provide multilingual search facility. In this paper, we have discussed the need of multilingual search in forensic tools. Besides, we have also discussed the approach we used in order to attain this objective in our analysis tool.
Nowadays, most of the reported cybercrimes use the Internet. It is seen that Web Browsers leave forensically sound footprints of Internet browsing activities on the computer's storage media. The ...traces once retrieved stand as crucial hints that help the investigator to reconstruct various events that the suspect has done. However, the usage of private or portable web browsers prevents the creation of those files on the Suspect's Computer. This makes the job of investigators more challenging. But, the remnants of browsing activities done using any web browser is recorded in the Physical Memory of the Computer. Hence, analyzing the Physical Memory Dump of the suspect's machine, collected as part of Live Forensics, may provide lots of forensically sound evidence related to the Internet-related activities in a cybercrime investigation. This information provides highly crucial information which can render hints in the investigation process. One of the most important features of any Cyber Forensics Analysis Tool is keyword searching. But identifying and finalizing the keywords to be searched during the analysis process in a particular Cyber Crime is always challenging for the investigators. The task of retrieving searched keywords is crucial as it directly provides the criminal background of the Suspect if any. This information enables cyber forensics investigators to conduct a focused approach while analyzing the evidence. This paper mainly presents a novel methodology for the reconstruction of searched keywords from the Physical Memory Dump collected from the Suspect's Windows 10 Computers. A methodology for retrieving keywords from the browser files generated by Web Browsers in the storage media has also been described. The keywords retrieved in this way helps the Investigators to identify the associated highly crucial information during the deep-dive analysis of the storage media in Offline Forensic Analysis.
