Can computer forensic tools be trusted in digital investigations?

Area of Science:

• Computer Forensics
• Digital Investigation
• Cybersecurity

Background:

• Digital evidence is crucial in legal proceedings.
• File system anti-forensic (AF) techniques aim to obstruct digital investigations.
• The effectiveness of computer forensic tools (CFTs) against AF attacks is not fully understood.

Purpose of the Study:

• To evaluate the capability of leading CFTs to detect various file system AF attacks.
• To determine if CFTs can extract complete and credible digital evidence when AF attacks are present.
• To identify the limitations of current CFTs in combating AF techniques.

Main Methods:

• A six-stage forensic tool testing methodology based on black-box testing principles was employed.
• Four leading CFTs were evaluated against eleven different file system AF attacks.
• Experiments focused on the ability of CFTs to identify and overcome AF attack implementations.

Main Results:

• Most file system AF attacks went undetected by the evaluated CFTs.
• Only a small subset of AF attacks were identified by all tested CFTs.
• AF attacks exploit basic file system features and can even target CFTs.

Conclusions:

• Digital evidence extracted by CFTs may be incomplete and lack credibility due to undetected AF attacks.
• Practitioners and researchers should not solely depend on CFTs for evidence extraction.
• Urgent research is needed to enhance CFTs' resilience against AF attacks and ensure evidence integrity.