A Comparison of Cloud Storage Technologies as Sources of Digital Evidence - Büter, Regine; Engst, German; Esser, Kai; Freiling, Felix; Friedrich, Kay; Friedrich, Tim; Hammer, Andreas; Heine, Lukas; Heinlein, Lukas; Korn, Oliver; Minuth, Christian; Müller, Manuel; et al. (2022)
Due to their ease of use and their reliability, managed storage services "in the cloud" have become a standard way to store personal files for many users. In fact, many apps on mobile devices use local storage on the client merely as a cache for data that is fully stored on a remote server. Consequently, data from cloud storage services is an increasingly valuable source of digital evidence in forensic investigations. This document presents the results of a student project that was performed at Friedrich-Alexander-Universität Erlangen-Nürnberg in the winter term 2021/22. Six groups of students analyzed the most relevant network storage technologies (Samba, Nextcloud, Dropbox, Google Drive, OneDrive, iCloud) regarding two questions: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition in any way? The two questions refer to critical aspects of forensic evidence collection, namely in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. In the concluding discussion we compare the different technologies and develop a taxonomy of storage services that can be used to assess other cloud storage services with regarding the evidental value of data acquired from them.<br
Keywords: auditability; cloud forensics; forensic soundness; interference; taxonomy

A Functional Classification of Forensic Access to Storage and its Legal Implications - Hammer, Andreas; Ohlig, Mathis; Geus, Julian; Freiling, Felix (Proceedings of the 12th International Conference on IT Security Incident Management & IT Forensics, 2023)
Due to their ease of use and their reliability, managed storage services in the cloud have become a standard way to store files for many users. Consequently, data from cloud storage services and remote file systems in general is an increasingly valuable source of digital evidence in forensic investigations. In this respect, two questions appear relevant: (1) What effect does data acquisition by the client have on the data stored on the server? (2) Does the technology support delayed verification of data acquisition? The two questions refer to critical aspects of forensic evidence collection, namely in what way does evidence collection interfere with the evidence, and how easy is it to prove the provenance of data in a forensic investigation. We formalize the above questions and use this formalization to classify common storage services. We argue that this classification has direct consequences with regard to the probative value of data acquired from them. We therefore discuss the legal implications of this classification with regard to probative value so that IT expert witnesses can adapt their procedures during evidence acquisition and legal practitioners know how to assess such procedures and the evidence obtained through them from cloud storage services.<br
Keywords: cloud forensics; Auditability; Interference; probative value; taxonomy; legal implications

Analyse verbreiteter Anwendungen zum Lesen von elektronischen Büchern - Benenson, Zinaida; Berger, Frederik; Cherepantsev, Anatoliy; Datsevich, Sergey; Do, Long; Eckert, Moritz; Elsberger, Tassilo; Freiling, Felix; Frinken, Marius; Glameyer, Hendrik; Hafner, Steffen; Hagenhoff, Svenja; et al. (2019)
Der Marktanteil elektronischer Bucher (E-Books) am Buchmarkt wächst beständig. Um E-Books zu rezipieren, benötigt man spezielle Leseumgebungen, die als Software (im Browser oder als eigene Anwendung) oder als Spezialgerät (E-Reader) realisiert sein können. Diese Leseumgebungen sind geeignet, Daten über das Leseverhalten zu sammeln. Im Rahmen einer universitären Lehrveranstaltung wurden die Software-Leseumgebungen der beiden deutschen Marktführer Kindle und Tolino untersucht. Der vorliegende Bericht fasst die Ergebnisse dieser Analysen zusammen. Das Ergebnis ist eine umfassende Bestandsaufnahme der digitalen Spuren, die durch die Benutzung der Programme entstehen. Betrachtet wurden die zum Untersuchungszeitpunkt aktuellen Versionen der jeweiligen Webanwendungen und Android-Apps sowie des Kindle-Windows-Clients. Die Ergebnisse entstanden im Rahmen einer Übung zur Vorlesung "Fortgeschrittene forensische Informatik II" im Wintersemester 2018/19 an der Friedrich-Alexander-Universität Erlangen-Nürnberg (FAU), die gemeinsam durchgeführt wurde vom Lehrstuhl fur Informatik 1 und dem Institut für Buchwissenschaft an der FAU.

Fit for Forensics: Taxonomy and Common Model for Forensic Analysis of Fitness Trackers - Hammer, Andreas; Geus, Julian; Nicolai, Florian; Schütz, Philip; Fein, Christofer; Freiling, Felix (Proceedings of the 13th International Conference on IT Security Incident Management & IT Forensics, 2024)

Increasing Street Credibility: Cartography-aware Forensic Analysis of GNSS Trace Validity - Hammer, Andreas; Cerny, Christian; Jung, Christoph; Eichenmüller, Christian; Freiling, Felix (Proceedings of the 13th International Conference on IT Security Incident Management & IT Forensics, 2024)

Key extraction-based lawful access to encrypted data: Taxonomy and survey - Lindenmeier, Christian; Hammer, Andreas; Gruber, Jan; Röckl, Jonas; Freiling, Felix (Forensic Science International: Digital Investigation, 2024)
The rise of end-to-end encryption has enabled end-users to protect their data to a point that classical techniques of lawful access (seizure of devices, wiretaps) are futile. While there is a heated discussion about regulating the access primitive to end-user devices for law enforcement, little attention is given to the technical design of how evidence should be collected. This is especially critical during remote surveillance, as law enforcement may have unrestricted access to end-user devices over longer periods of time. In this paper, we propose the novel category of key extraction-based lawful interception (KEX-LI), meaning that instead of directly accessing plaintext data, law enforcement only extracts the necessary key material from end-user devices, thus minimizing the requirements of data extraction on end-user devices. When subsequently collecting encrypted data (e.g., via wiretapping), law enforcement can use these keys for decryption. We structure and survey the state-of-the-art of key extraction techniques, thus embedding KEX-LI in the broader context of device forensics. Furthermore, we describe specific requirements for a practical solution to conduct KEX-LI and evaluate currently available technical implementations. Our results are intended to help practitioners select the most suitable techniques as well as to identify research gaps.
Created from Fastlane, Scopus look-up
Keywords: Encrypted data; Key extraction; Lawful access; Memory acquisition; Taxonomy

On NVD Users’ Attitudes, Experiences, Hopes and Hurdles - Wunder, Julia; Corona, Alan; Hammer, Andreas; Benenson, Zinaida (Digital Threats: Research and Practice, 2024)