Search results for "forensics"

Copy-move Forgery Detection via Texture Description

2010

Copy-move forgery is one of the most common type of tampering in digital images. Copy-moves are parts of the image that are copied and pasted onto another part of the same image. Detection methods in general use block-matching methods, which first divide the image into overlapping blocks and then extract features from each block, assuming similar blocks will yield similar features. In this paper we present a block-based approach which exploits texture as feature to be extracted from blocks. Our goal is to study if texture is well suited for the specific application, and to compare performance of several texture descriptors. Tests have been made on both uncompressed and JPEG compressed image…

A roadmap towards improving managed security services from a privacy perspective

2014

Published version of an article in the journal: Ethics and Information Technology. Also available from the publisher at: http://dx.doi.org/10.1007/s10676-014-9348-3 This paper proposes a roadmap for how privacy leakages from outsourced managed security services using intrusion detection systems can be controlled. The paper first analyses the risk of leaking private or confidential information from signature-based intrusion detection systems. It then discusses how the situation can be improved by developing adequate privacy enforcement methods and privacy leakage metrics in order to control and reduce the leakage of private and confidential information over time. Such metrics should allow fo…

Automatic Timeline Construction and Analysis For Computer Forensics Purposes

2014

International audience; To determine the circumstances of an incident, investigators need to reconstruct events that occurred in the past. The large amount of data spread across the crime scene makes this task very tedious and complex. In particular, the analysis of the reconstructed timeline, due to the huge quantity of events that occurred on a digital system, is almost impossible and leads to cognitive overload. Therefore, it becomes more and more necessary to develop automatic tools to help or even replace investigators in some parts of the investigation. This paper introduces a multi-layered architecture designed to assist the investigative team in the extraction of information left in…

An Ontology-Based Approach for the Reconstruction and Analysis of Digital Incidents Timelines

2015

International audience; Due to the democratisation of new technologies, computer forensics investigators have to deal with volumes of data which are becoming increasingly large and heterogeneous. Indeed, in a single machine, hundred of events occur per minute, produced and logged by the operating system and various software. Therefore, the identification of evidence, and more generally, the reconstruction of past events is a tedious and time-consuming task for the investigators. Our work aims at reconstructing and analysing automatically the events related to a digital incident, while respecting legal requirements. To tackle those three main problems (volume, heterogeneity and legal require…

Detection of Duplicated Regions in Tampered Digital Images by Bit-Plane Analysis

2009

In this paper we present a new method for searching duplicated areas in a digital image. The goal is to detect if an image has been tampered by a copy-move process. Our method works within a convenient domain. The image to be analyzed is decomposed in its bit-plane representation. Then, for each bitplane, block of bits are encoded with an ASCII code, and a sequence of strings is analyzed rather than the original bit-plane. The sequence is lexicographically sorted and similar groups of bits are extracted as candidate areas, and passed to the following plane to be processed. Output of the last planes indicates if, and where, the image has been altered.

Forensic multidimesnional reconstruction as based on post-mortem image examination and spherical photography

2017

The aim of the paper is to present the methods of creating multi-dimensional reconstructions used in modern forensic medicine and state-of-the-art autopsy technique. Making use of the computer tomography technology and sophisticated software by the forensic pathologists allows a new standard of quality to be introduced into the forensic medical examination and hitherto unprecedented effects to be obtained. These developments significantly enhance the information available to the expert, particularly in case where an incident involved the use of firearms, the presence of foreign object in the body of the deceased, or advanced decay of the corps. Furthermore, the paper touches upon a subject …

Unmixing methods in novel applications of spectral imaging

2014

Hypervisor-assisted Atomic Memory Acquisition in Modern Systems

2019

Reliable memory acquisition is essential to forensic analysis of a cyber-crime. Various methods of memory acquisition have been proposed, ranging from tools based on a dedicated hardware to software only solutions. Recently, a hypervisor-based method for memory acquisition was proposed (Qi et al., 2017; Martignoni et al., 2010). This method obtains a reliable (atomic) memory image of a running system. The method achieves this by making all memory pages non-writable until they are copied to the memory image, thus preventing uncontrolled modification of these pages. Unfortunately, the proposed method has two deficiencies: (1) the method does not support multiprocessing and (2) the method does…

A new resonant Laser-SNMS system for environmental ultra-trace analysis: Installation and optimization

2017

Abstract Localization, analysis and mobility of radioactive contaminated particles is of major concern for assessment of contamination threads and nuclear forensics. For this purpose, a new resonant Laser-SNMS system was developed and set up at the Institute for Radioecology and Radiation Protection for spatially resolved ultra-trace analysis of low concentrated radionuclides directly on environmental samples. This paper describes the adaption and combination of a dedicated Ti:sapphire laser system with a commercial TOF-SIMS instrument for resonant Laser-SNMS. The project includes computer simulations for optimization of the TOF analyzer. Results on synthetic uranium and technetium samples …

Creating modern blue pills and red pills

2019

The blue pill is a malicious stealthy hypervisor-based rootkit. The red pill is a software package that is designed to detect such blue pills. Since the blue pill was originally proposed there has been an ongoing arms race between developers that try to develop stealthy hypervisors and developers that try to detect such stealthy hypervisors. Furthermore, hardware advances have made several stealth attempts impossible while other advances enable even more stealthy operation. In this paper we describe the current status of detecting stealth hypervisors and methods to counter them. peerReviewed