0018-9162/12/$31.00 © 2012 IEEE Published by the IEEE Computer Society DECEMBER 2012 25 rough equivalent of today’s file allocation table (FAT) or $Bitmap. A consultant systems programmer came in to show us how to recover the files by reconstructing the VTOC based upon the prior morning’s routine printout of the hard drive contents (yes, we made such a printout every day or two). Since we could...

In this paper, the authors investigate the prospect of using multi-resolution histograms (MRH) in conjunction with digital image forensics, particularly in the detection of two kinds of copy-move manipulations, i.e., cloning and splicing. To the best of the authors’ knowledge, this is the first work that uses the same feature in both cloning and splicing forensics. The experimental results show...

The collection of electronic data as evidence of crime is an important responsibility given to law enforcement. The technical constraints of this task are arguably far less significant than usability and economic ones, since police officers are non-specialists and police departments face significant budgetary limitations. In this position paper, we consider the economics of digital evidence rec...

Th is essay discusses some of the principal challenges facing the emerging discipline of digital forensics. Most of the challenges have a scientific basis-understanding the needs and limitations caused by changes in the scope and pace of information technology. Others are engineering in nature, requiring the construction of new software and hardware to enable the collection, retention and exami...

This paper discusses the concept of a virtual digital forensic laboratory, which incorporates networked examination and storage machines, secure communications, multi-factor authentication, role-based access control, and case management and digital asset management systems. Laboratory activities such as the examination, storage and presentation of digital evidence can be geographically distribu...

Sandbox applications can be used as anti-forensics techniques to hide important evidence in the digital forensics investigation. There is limited research on sandboxing technologies, and existing researches are focusing technology itself. The impact of sandbox