Main Page

From ForensicsWiki
Revision as of 17:43, 4 March 2012 by Simsong (Talk | contribs)

Jump to: navigation, search

This is the Forensics Wiki, a Creative Commons-licensed wiki devoted to information about digital forensics (also known as computer forensics). We currently list a total of 719 pages.

Much of computer forensics is focused on the tools and techniques used by investigators, but there are also a number of important papers, people, and organizations involved. Many of those organizations sponsor conferences throughout the year and around the world. You may also wish to examine the popular journals and some special reports.


WIKI NEWS

2012-feb-25: We continue to have problems with our hosting provider and are in the process of identifying a new one. Thank you for your patience.

Featured Forensic Research

Mar 2012

Balasubramaniyan, Vijay A., Poonawalla, Aamir, Ahamad, Mustaque, Hunter, Michael T., Traynor, Patrick - PinDr0p: using single-ended audio features to determine call provenance
Proceedings of the 17th ACM conference on Computer and communications security pp. 109--120, New York, NY, USA,2010
http://doi.acm.org/10.1145/1866307.1866320
Bibtex
Author : Balasubramaniyan, Vijay A., Poonawalla, Aamir, Ahamad, Mustaque, Hunter, Michael T., Traynor, Patrick
Title : PinDr0p: using single-ended audio features to determine call provenance
In : Proceedings of the 17th ACM conference on Computer and communications security -
Address : New York, NY, USA
Date : 2010

The recent diversification of telephony infrastructure allows users to communicate through landlines, mobile phones and VoIP phones. However, call metadata such as Caller-ID is either not transferred or transferred without verification across these networks, allowing attackers to maliciously alter it. In this paper, we develop PinDr0p, a mechanism to assist users in determining call provenance — the source and the path taken by a call. Our techniques detect and mea- sure single-ended audio features to identify all of the applied voice codecs, calculate packet loss and noise profiles, while remaining agnostic to characteristics of the speaker’s voice (as this may le- gitimately change when interacting with a large organization). In the absence of verifiable call metadata, these features in combina- tion with machine learning allow us to determine the traversal of a call through as many as three different providers (e.g., cellular, then VoIP, then PSTN and all combinations and subsets thereof) with 91.6% accuracy. Moreover, we show that once we identify and characterize the networks traversed, we can create detailed fin- gerprints for a call source. Using these fingerprints we show that we are able to distinguish between calls made using specific PSTN, cellular, Vonage, Skype and other hard and soft phones from loca- tions across the world with over 90% accuracy. In so doing, we provide a first step in accurately determining the provenance of a call.

(See also Past Selected Articles)

Featured Article

Forensic Linux Live CD issues
Forensic Linux Live CD distributions are widely used during computer forensic investigations. Currently, many vendors of such Live CD distributions state that their Linux do not modify the contents of hard drives or employ "write protection." Testing indicates that this may not always be the case. Read More...


Topics



You can help! We have a list of articles that need to be expanded. If you know anything about any of these topics, please feel free to chip in.