Front Cover

Contemporary Digital Forensic Investigations of Cloud and Mobile Applications

Copyright

Contents

Contributors

About the Editors

Chapter 1 Contemporary Digital Forensics Investigations of Cloud and Mobile Applications

References

Chapter 2 Forensics Analysis of Android Mobile VoIP Apps

1 Introduction

2 Related Work

3 Experimental Setup

3.1 Phase I: Setup Phase—First Iteration

3.2 Phase II: Logical Acquisition

3.3 Phase III: Identification and Analysis—Second Iteration

4 Results and Discussion

4.1 Viber Artifacts

4.2 Skype Artifacts

4.3 WhatsApp Artifacts

5 Conclusion and Future Work

References

Chapter 3 Investigating America Online Instant Messaging Application: Data Remnants on Windows 8.1 Client Machine

1 Introduction

2 Related Work

3 Research Methodology

4 AIM Forensics

4.1 Installation of the AIM 7 Client Application

4.2 Logins

4.3 Buddy Lists

4.4 Conversations and Transferred Files

4.5 IM Logs

4.6 Buddy Icons

4.7 “What is Happening” Messages

4.8 Uninstallation of AIM Client Software

5 Conclusion and Future Work

References

Chapter 4 Forensic Investigation of Social Media and Instant Messaging Services in Firefox OS: Facebook, Twitter, Google+, ...

1 Introduction

2 Methodology

3 Experiment Setup

3.1 Preparing the Host Machine for Acquisition Process and Analysis Work

3.2 Acquisition of Phone Image and Memory Image

3.3 Installing the Phone With Targeted Application

3.4 Executing the Activities and Documenting All Steps Taken

3.5 Comparing Base Images With Activities Images

4 Discussion and Analysis

4.1 Social Media Investigation

4.1.1 Social Media Phone Image

4.1.2 Social Media Phone and Memory Images

4.2 Instant Messaging Investigation

4.2.1 Instant Messaging Phone Image

4.2.2 Instant Messaging Phone and Memory Images

5 Conclusion

References

Chapter 5 Network Traffic Forensics on Firefox Mobile OS: Facebook, Twitter, and Telegram as Case Studies

1 Introduction

2 Experiment Setup

2.1 Preparing Virtual Machines

2.2 Executing Activities

2.3 Capturing Network Activities

2.4 Conducting Network Analysis

3 Discussion and Analysis

3.1 Network Analysis of Facebook

3.2 Network Analysis on Twitter

3.3 Network Analysis on Telegram

4 Conclusion and Future Works

References

Chapter 6 Mobile Phone Forensics: An Investigative Framework Based on User Impulsivity and Secure Collaboration Errors

1 Introduction

2 Review of Related Work

3 Experiment Design

4 Results and Discussion

4.1 Familiarity With Smartphones Security

4.2 Cognitive Impulsivity

5 Forensics Investigation Guideline

6 Limitations

7 Conclusion and Further Research

References

Chapter 7 Performance of Android Forensics Data Recovery Tools

1 Introduction

2 Related Work

3 Experiment Setup

4 Results and Discussions

5 Conclusion and Future Works

References

Chapter 8 Honeypots for Employee Information Security Awareness and Education Training: A Conceptual EASY Training Model

1 Introduction

2 Experiment Setup

3 Findings: Dionaea

3.1 Breakdown of Attacks by Time of Day

3.2 Breakdown of Attacks by IP Address

3.3 Malware Captured by Dionaea

4 Findings: Kippo

4.1 Top 10 Passwords Attempted

4.2 Top 10 IP Connections

4.3 Top 10 Successful Commands

4.4 Files Downloaded

5 A Conceptual EASY Training Model

5.1 Engaging Stakeholders

5.2 Acceptable Behavior

5.3 Simple Teaching Method

5.4 Yardstick

6 Conclusion and Future Work

Acknowledgments

References

Chapter 9 Implications of Emerging Technologies to Incident Handling and Digital Forensic Strategies: A Routine Activity Th...

1 Introduction

2 Background and Related Work

2.1 Emerging Technologies and Threats

2.2 Routine Activity Theory

2.3 Related Work

3 Methodology

3.1 Data Collection

3.2 Data Analysis

4 Cyber Threat Landscape From a Rat Perspective

4.1 Motivation

4.2 Opportunity

4.3 Guardianship

5 Discussion

6 Conclusion and Future Work

Appendix 1 Questionnaire Items

References

Chapter 10 Forensic Readiness: A Case Study on Digital CCTV Systems Antiforensics

1 Introduction

2 Our Proposed Antiforensics Framework for Digital CCTV Systems

2.1 An Overview of Digital CCTV Systems

2.2 Development of Antiforensics Framework for Digital CCTV Systems

3 Case Studies

3.1 Test-Device-DVR1

3.2 Test-Device-DVR2

3.3 Test-Device-iPhone

3.4 Prototype Tool

4 Conclusion

References

Chapter 11 Forensic Visualization: Survey and Future Research Directions

1 Introduction

2 Digital Forensics

2.1 Examples of Cases Involving Evidence From Portable Devices

2.2 Challenges

3 Visualization is Key

3.1 Related Work

3.2 Popular Commercial Forensic and e-Discovery Software

4 Forensic Visualization Selection Criteria

4.1 Identified Forensic Visualization Possibilities

5 Conclusion and Future Research

References

Chapter 12 Investigating Storage as a Service Cloud Platform: pCloud as a Case Study

1 Introduction

1.1 Related Work

2 Research Methodology

2.1 Experimental Setup

2.1.1 Windows

2.1.2 Android

2.1.3 iOS

2.1.4 Ubuntu

3 Analysis and Findings

3.1 Windows Browser-Based Experiments

3.1.1 Upload

3.1.2 Install and Login

3.2 Windows app-Based Experiments

3.2.1 Install and Login

3.2.2 Delete

3.2.3 Uninstall

3.3 Android app-Based Experiments

3.3.1 Install and Login

3.3.2 Upload

3.3.3 Uninstall

3.4 iOS-Based Experiments

3.4.1 Upload and Uninstallation

3.5 Ubuntu app-Based Experiments

4 Network Traffic

5 Conclusion

References

Chapter 13 Cloud Storage Forensics: Analysis of Data Remnants on SpiderOak, JustCloud, and pCloud

1 Introduction

2 Research Methodology

2.1 Cloud Forensic Framework

2.2 Experiment Setup

2.2.1 Windows

2.2.2 iOS

3 Findings: SpiderOak

3.1 Observations: SpiderOak's Account Created Using the Respective Browsers

3.2 Observations: SpiderOak's Application Program

3.3 Observations: Uninstalling SpiderOak's Application Program

3.4 Observations: Downloading From SpiderOak Using the Respective Browsers

3.5 Observations: Browsing and Downloading From SpiderOak's iOS App

4 Findings: JustCloud

4.1 Observations: JustCloud's Account Created in Using IE the Respective Browsers

4.2 Observations: JustCloud's Application Program

4.3 Observations: Uninstalling JustCloud's Application Program

4.4 Observations: Downloading From JustCloud Using the Respective Browsers

4.5 Observations: Browsing and Downloading From JustCloud's iOS App

5 Finding: pCloud

5.1 Observations: pCloud's Account Created in Using IE the Respective Browsers

5.2 Observations: pCloud's Application Program

5.3 Observations: Uninstalling pCloud's Application Program

5.4 Observations: Downloading From pCloud Using the Respective Browsers

5.5 Observations: Browsing and Downloading From pCloud's iOS App

6 Conclusion and Future Work

References

Chapter 14 Residual Cloud Forensics: CloudMe and 360Yunpan as Case Studies

1 Introduction

1.1 Contribution

2 Research Methodology

2.1 Experimental Setup

2.1.1 Windows 8.1 Client Application Based

2.2 Windows 8.1 Browser Based

2.3 Android KitKat 4.4.2 Client Application Based

2.4 Apple iOS 8.0 Client Application Based

3 Results and Discussion

3.1 Evidence Source Identification and Preservation

3.2 Evidence Collection

3.3 Examination and Analysis

3.3.1 Cloud Service: CloudMe

Windows 8.1—Client Application Based

Windows 8.1—Web Browser Based

Upload—Live Memory/Browser Cache

Open/View—Live Memory

Download—Live Memory/Browser Cache

Delete—Live Memory

Android KitKat 4.4.2—Client Application Based

Apple iOS 8.0—Client Application Based

3.3.2 Cloud Service: 360Yunpan

Windows 8.1—Client Application Based

Windows 8.1—Web Browser Based

Upload—Live Memory/Browser Cache

Upload—Network Traffic

Open/View—Live Memory/Browser Cache

Open/View—Network Traffic

Download—Live Memory

Download—Network Traffic

Delete—Live Memory

Delete—Network Traffic

Android KitKat 4.4.2—Client Application Based

Apple iOS 8.0—Client Application Based

4 Reporting and Presentation

4.1 Cloud Service: CloudMe

4.2 Cloud Service: 360Yunpan

5 Conclusion

References

Chapter 15 An Android Cloud Storage Apps Forensic Taxonomy

1 Introduction

2 Experiment Setup

3 Discussion

4 Results

4.1 Database

4.2 Storage

4.2.1 Pictures

4.2.2 Documents

4.2.3 Web Files

4.2.4 Audio

5 Conclusion and Future Works

Appendix 1 List of Application Versions

Appendix 2 Dataset List (EDRM)

Appendix 3 Retrieved Artifacts

Appendix 4 Network Traffic

References

Index

Back Cover