Cyber And Digital Forensic Investigations: A Law Enforcement Practitioner’s Perspective

Foreword by David A. “Dave” Dampier
Foreword by Marcus K. Rogers
Acknowledgements
Contents
Editors and Contributors
The Increasing Importance of Digital Forensics and Investigations in Law Enforcement, Government and Commercial Sectors
	1 Introduction
	2 Organisation of This Book
Defending IoT Devices from Malware
	1 Introduction
	2 Related Work
	3 Analysing of IoT Malware
		3.1 Mirai Malware Analysis
		3.2 Qbot Malware Analysis
		3.3 Comparison of Mirai and Qbot
		3.4 Conclusion of Mirai and Qbot Research
	4 Adopted Approach for IoT Malware Analysis
		4.1 Process
		4.2 Securing the Webserver
	5 Experiments and Discussion
	6 Conclusion and Future Work
	References
Digital Forensic Investigation of Internet of Thing Devices: A Proposed Model and Case Studies
	1 Introduction
	2 Related Work
	3 Problem Statement
	4 Proposed IoT Forensic Model
		4.1 Planning/Preparation
		4.2 Device Identification and Selection
		4.3 Acquire Evidence and Preservation
		4.4 Analysis
		4.5 Report
	5 Experiment Platforms—IoT Lab
		5.1 IoT Hardware
		5.2 Network Sniffing and Data Communication Acquiring
		5.3 IoT Software
	6 Example Use Cases
		6.1 Scenario 1: Raspberry PI
		6.2 Scenario 2: Smart House
	7 Conclusion and Future Work
	References
Forensic Investigation of Ransomware Activities—Part 1
	1 Introduction
	2 Background
		2.1 Evolution of Ransomware
		2.2 Stages of a Ransomware Attack
	3 SamSam Analysis
		3.1 Infection Vector and Preamble to Deploying Ransomworm
		3.2 The Ransomware Component
		3.3 Payment
		3.4 Summary
	4 WannaCry Technical Analysis
		4.1 WannaCry Introduction
		4.2 WannaCry Dropper Details
		4.3 The Worm Component
		4.4 Ransomware Component
		4.5 Encrypted DLL
		4.6 Summary
	5 Ransomworms in the Future
		5.1 Epidemiology
		5.2 A Note on IoT
	6 Conclusion and Future Work
	References
Forensic Investigation of Ransomware Activities—Part 2
	1 Introduction
		1.1 Evolution of Ransomware
		1.2 Types of Ransomware
		1.3 Contribution
	2 Analysis and Detection of Ransomware
		2.1 Crypto-Ransomware Behaviour and Activity
		2.2 Analysis and Detection of Ransomware
	3 Proposed Approach
		3.1 Analysis of zCrypt
		3.2 Design of the Proposed Approach
	4 Evaluation of Proposed Approach
		4.1 Evaluation Methodology
		4.2 Evaluation Results
		4.3 Discussion
	5 Conclusions
	References
CCTV Forensics in the Big Data Era: Challenges and Approaches
	1 Introduction
	2 CCTV Forensics: A Literature Review
	3 CCTV Forensic Challenges Within the Context of Big Data
	4 Proposed CCTV Forensic Approach
	5 Case Studies
		5.1 Case Study 1—GANZ DVR C-MPDVR-16
		5.2 Case Study 2—Swann DVR4-2500
		5.3 Case Study 3—Operation Baron
	6 Conclusion and Further Work
	References
Forensic Investigation of PayPal Accounts
	1 Introduction
	2 Related Work
	3 Problem Statement
	4 Adopted Approach
		4.1 Web Browser Monitoring Approach
		4.2 Computer Forensics Approach
		4.3 Experimental Procedure
	5 Experimental Results and Analysis
		5.1 Web Browser Monitoring
		5.2 Monitoring the Account Usage
		5.3 Computer Forensic Approach
	6 Conclusion
	References
Digital Forensic Approaches for Cloud Service Models: A Survey
	1 Introduction
	2 Related Work
	3 Methodology and Evaluation Criteria Catalogue
	4 Digital Forensics in IaaS
	5 Digital Forensics in PaaS
	6 Digital Forensics in SaaS
	7 Comparison of Digital Forensic Approaches
	8 Discussion and Conclusion
	9 Future Work
	References
Long Term Evolution Network Security and Real-Time Data Extraction
	1 Introduction
	2 Related Work
	3 Problem Statement and Challenges
	4 Proposed Approach
		4.1 IMSI Catching
		4.2 Proposed Approach
	5 Experiments and Findings
		5.1 Testing Platforms
		5.2 Scenario 1: Unencrypted GSM Calls
		5.3 Scenario 2: Unencrypted SMS Text Messaging
		5.4 Scenario 3: Basic Web Surfing
		5.5 Scenario 4: Skype
		5.6 Scenario 5: Leap Card Android Application
		5.7 Scenario 6: Ebay on IOS 10.2
	6 Discussion
	7 Conclusion and Future Work
	References
Towards an Automated Process to Categorise Tor’s Hidden Services
	1 Introduction
	2 Literature Survey
	3 Problem Statement
	4 Adopted Approach
		4.1 Setting up the Hidden Service
		4.2 Web Scraping
		4.3 Categorisation
		4.4 Self-regulation
	5 Evaluation
		5.1 Performance
		5.2 Analysis of Hidden Services
	6 Conclusion and Future Works
	References
The Bitcoin-Network Protocol from a Forensic Perspective
	1 Introduction
	2 Background
		2.1 Bitcoin Transaction Communication
		2.2 Bitcoin Network Protocol
	3 Related Work
		3.1 Current State of Network Forensic
		3.2 Current State of Bitcoin Network Research
	4 Methodology
		4.1 Preparation
		4.2 Collection
		4.3 Preservation
		4.4 Examination
		4.5 Analysis
		4.6 Investigation
		4.7 Presentation
		4.8 Limitation and Scope
	5 Experiment
		5.1 Experimental Environment
		5.2 The Dataset
		5.3 Bitcoin Messages of Interests
		5.4 Discussion
	6 Conclusion and Future Work
	References
So, What’s Next?
	1 Concluding Remarks