Volume 57, Issue 6 - Special Issue: From IT Forensics to Forensic Computing / Felix C. Freiling

With the ever increasing number of crimes in which computers or other digital devices are used, digital forensics plays an increasingly important role in today's jurisdiction. The acquisition and investigation of the devices is done by forensic experts, whose reports and personal explanations then form the basis of justice. Because of this great responsibility of the experts, the quality of their investigations has to meet the highest standards. Historically, forensic computing (as digital forensics) developed pragmatically, driven by specific technical needs. Indeed, in comparison with other forensic sciences the field still is rather immature and has many deficits, such as the unclear terminology used in court. In this paper, we introduce notions of (digital) evidence, characteristic evidence, and (characteristic) counter evidence, as well as the definitions of two fundamental forensic reconstruction problems. We show the relation of the observability of the different types of evidence to the solvability of those problems. By doing this, we wish to exemplify the usefulness of formalization in the establishment of a precise terminology. While this will not replace all terminological shortcomings, it (1) may provide the basis for a better understanding between experts, and (2) helps to understand the significance of different types of digital evidence to answer questions in an investigation.

Handling bulk data (e. g. some terabytes of data) is a issue in contemporary digital forensics. Separating relevant data structures from irrelevant ones resembles finding the needle in the haystack. The article at hand presents and assesses automatic hash-based techniques to preprocess the input data with the goal to facilitate the investigator's job. We discuss concepts like blacklisting and whitelisting based on cryptographic hash functions and approximate matching, respectively. In case of two established process models for a lab and an on-site investigation, respectively, we describe how to jointly use these techniques to automatically get a pointer to the needle.

Whenever security researchers find an exploitable vulnerability in software, they face several options: Common examples are contacting the author, maintainer or vendor of the software in private (limited disclosure), publishing information on the vulnerability – possibly with a proof-of-concept of how to exploit it – (full disclosure), a combination of both (responsible disclosure), or even selling information on the vulnerability to third parties. In this article, I will discuss the legal obligations and the legal limitations to the various, typical options available to IT security researchers, with a specific focus on how they may comply with German and European criminal law.

Nowadays, website owners, advertisers, and data vendors can draw on a variety of techniques to track users on the Web. Here, the tracking range can vary from single websites to long-term browsing sessions across several websites and devices. Even though they are widely used, most of these techniques have in common that they are not familiar to average and even web-minded users. Therefore, most users are not able to realize the magnitude of web tracking and its consequences, not to mention to resist tracking. In times of rising concerns about data protection and privacy, this paper is intended to illustrate how web tracking works and which standard techniques are commonly used. The paper also provides an outlook on promising new tracking techniques based on behavioral biometrics. Furthermore, since browser forensics is already a subject to digital investigations, the usefulness of tracking techniques for forensic purposes and their applicability in light of the principle of proportionality is discussed. Finally, possible countermeasures and their effectiveness are indicated.

In his seminal work on file system forensic analysis, Brian Carrier defined the notion of essential data as “those that are needed to save and retrieve files.” He argues that essential data is therefore more trustworthy, than other data in the system since it has to be correct in order for the user to use the file system. In many practical settings, however, it is unclear whether a specific piece of data is essential because either file system specifications are ambiguous or the importance of a specific data field depends on the operating system that processes the file system data. We therefore revisit Carrier's definition and show that there are two types of essential data: While strictly essential corresponds to Carrier's definition, partially essential refers to application specific interpretations. We further provide an opinion regarding the legal usefulness of our definition.

Using the Internet to involve citizens in decision-making represents both a promise and a challenge. The PhD program “Fortschrittskolleg Online Participation” brings together more than a dozen PhD students from six different disciplines with practitioners from local administration and consulting companies that initiate and implement real-world participatory processes on the Internet. This article introduces the program's main research aims and provides a summary of its structure that represents a response to the challenges of such a multi- and transdisciplinary research effort.

There is a growing interest in retaining and analyzing metadata. Motivated by this trend, the dissertation studies the potential for surveillance via the Domain Name System, an important infrastructure service on the Internet. Three fingerprinting techniques are developed and evaluated. The first technique allows a resolver to infer the URLs of the websites a user visits by matching characteristic patterns in DNS requests. The second technique allows to determine operating system and browser of a user based on behavioral features. Thirdly, and most importantly, it is demonstrated that the activities of users can be tracked over multiple sessions, even when the IP address of the user changes over time. In addition, the dissertation considers possible countermeasures. Obfuscating the desired hostnames by sending a large number of dummy requests (so-called range queries), turns out to be less effective than believed so far. Therefore, more appropriate techniques (mixing queries, pushing popular queries, and extended caching of results) are proposed in the thesis. The results raise awareness for an overlooked threat that infringes the privacy of Internet users, but they also contribute to the development of more usable and more effective privacy enhancing technologies.