Difference between revisions of "Main Page"

From ForensicsWiki
Jump to: navigation, search
m
m (WIKI NEWS)
Line 16: Line 16:
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
 
<h2 style="margin:0; background-color:#ffff33; font-size:120%; font-weight:bold; border:1px solid #afa3bf; text-align:left; color:#000; padding-left:0.4em; padding-top:0.2em; padding-bottom:0.2em;"> Featured Forensic Research </h2>
  
<small>JAN 2012</small>
+
<small>Mar 2012</small>
 
    
 
    
 
<bibtex>
 
<bibtex>
@article{10.1109/CIS.2011.180,
+
@inproceedings{Balasubramaniyan:2010:PUS:1866307.1866320,
author = {Vrizlynn L.L. Thing and Tong-Wei Chua and Ming-Lee Cheong},
+
author = {Balasubramaniyan, Vijay A. and Poonawalla, Aamir and Ahamad, Mustaque and Hunter, Michael T. and Traynor, Patrick},
title = {Design of a Digital Forensics Evidence Reconstruction System for Complex and Obscure Fragmented File Carving},
+
title = {PinDr0p: using single-ended audio features to determine call provenance},
journal ={Computational Intelligence and Security, International Conference on},
+
booktitle = {Proceedings of the 17th ACM conference on Computer and communications security},
volume = {0},
+
series = {CCS '10},
isbn = {978-0-7695-4584-4},
+
year = {2010},
year = {2011},
+
isbn = {978-1-4503-0245-6},
pages = {793-797},
+
location = {Chicago, Illinois, USA},
doi = {http://doi.ieeecomputersociety.org/10.1109/CIS.2011.180},
+
pages = {109--120},
publisher = {IEEE Computer Society},
+
numpages = {12},
address = {Los Alamitos, CA, USA},
+
url = {http://doi.acm.org/10.1145/1866307.1866320},
}
+
doi = {http://doi.acm.org/10.1145/1866307.1866320},
 +
acmid = {1866320},
 +
publisher = {ACM},
 +
address = {New York, NY, USA},
 +
keywords = {VoIP, call fingerprinting, provenance, telephony},
 +
}
 +
 
 
</bibtex>
 
</bibtex>
Fragmented file carving is an important technique in Digital Forensics to recover files from their fragments in the absence of the file system allocation information. In this paper, we proposed a system design for solving the fragmented file carving problem taking into consideration, conditions of real-life fragmentation scenarios. We developed our evidence reconstruction and recovery system, and carried out experiments, to evaluate the capability in detecting and recovering obscured evidence. The results showed that our system is able to achieve a higher efficiency and accuracy (e.g. 1.5 minutes for the reconstruction of each highly fragmented and deleted (obscured) image in its entirety or 100% recovery), when compared with the commercial recovery system, Adroit Photo Forensics (e.g. 2.8 minutes and 6.3 minutes for a partial image recovery or failure in recovery, respectively).
+
The recent diversification of telephony infrastructure allows users to communicate through landlines, mobile phones and VoIP phones. However, call metadata such as Caller-ID is either not transferred or transferred without verification across these networks, allowing attackers to maliciously alter it. In this paper, we develop PinDr0p, a mechanism to assist users in determining call provenance — the source and the path taken by a call. Our techniques detect and mea- sure single-ended audio features to identify all of the applied voice codecs, calculate packet loss and noise profiles, while remaining agnostic to characteristics of the speaker’s voice (as this may le- gitimately change when interacting with a large organization). In the absence of verifiable call metadata, these features in combina- tion with machine learning allow us to determine the traversal of a call through as many as three different providers (e.g., cellular, then VoIP, then PSTN and all combinations and subsets thereof) with 91.6% accuracy. Moreover, we show that once we identify and characterize the networks traversed, we can create detailed fin- gerprints for a call source. Using these fingerprints we show that we are able to distinguish between calls made using specific PSTN, cellular, Vonage, Skype and other hard and soft phones from loca- tions across the world with over 90% accuracy. In so doing, we provide a first step in accurately determining the provenance of a call.
 +
 
 
(See also [[Past Selected Articles]])
 
(See also [[Past Selected Articles]])
  

Revision as of 17:43, 4 March 2012

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 712 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2012-feb-25: We continue to have problems with our hosting provider and are in the process of identifying a new one. Thank you for your patience.

Featured Forensic Research

Mar 2012

Balasubramaniyan, Vijay A., Poonawalla, Aamir, Ahamad, Mustaque, Hunter, Michael T., Traynor, Patrick - PinDr0p: using single-ended audio features to determine call provenance
Proceedings of the 17th ACM conference on Computer and communications security pp. 109--120, New York, NY, USA,2010
http://doi.acm.org/10.1145/1866307.1866320
Bibtex
Author : Balasubramaniyan, Vijay A., Poonawalla, Aamir, Ahamad, Mustaque, Hunter, Michael T., Traynor, Patrick
Title : PinDr0p: using single-ended audio features to determine call provenance
In : Proceedings of the 17th ACM conference on Computer and communications security -
Address : New York, NY, USA
Date : 2010

The recent diversification of telephony infrastructure allows users to communicate through landlines, mobile phones and VoIP phones. However, call metadata such as Caller-ID is either not transferred or transferred without verification across these networks, allowing attackers to maliciously alter it. In this paper, we develop PinDr0p, a mechanism to assist users in determining call provenance — the source and the path taken by a call. Our techniques detect and mea- sure single-ended audio features to identify all of the applied voice codecs, calculate packet loss and noise profiles, while remaining agnostic to characteristics of the speaker’s voice (as this may le- gitimately change when interacting with a large organization). In the absence of verifiable call metadata, these features in combina- tion with machine learning allow us to determine the traversal of a call through as many as three different providers (e.g., cellular, then VoIP, then PSTN and all combinations and subsets thereof) with 91.6% accuracy. Moreover, we show that once we identify and characterize the networks traversed, we can create detailed fin- gerprints for a call source. Using these fingerprints we show that we are able to distinguish between calls made using specific PSTN, cellular, Vonage, Skype and other hard and soft phones from loca- tions across the world with over 90% accuracy. In so doing, we provide a first step in accurately determining the provenance of a call.

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics



You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.