Tampering with digital evidence is hard: The case of main memory images

Schneider J, Wolf J, Freiling F (2020)

Publication Language: English

Publication Type: Conference contribution, Conference Contribution

Publication year: 2020

Publisher: Elsevier

Conference Proceedings Title: Forensic Science International: Digital Investigation

Event location: Virtual GB

URI: https://www.sciencedirect.com/science/article/pii/S2666281720300196

DOI: 10.1016/j.fsidi.2020.300924

Open Access Link: https://authors.elsevier.com/sd/article/S2666-2817(20)30019-6

Abstract

Tampered digital evidence may jeopardize its correct interpretation. To assess the risks in a court of law, it is helpful to quantify the necessary effort to perform a convincing manipulation of digital evidence. Based on a sequence of controlled experiments with graduate students and digital forensics professionals, we study the effort to manipulate copies of main memory taken during a digital investigation. Confirming previous results on hard disc image tampering, manipulating main memory dumps can be considered hard in the sense that most forgeries were successfully detected. However, while the effort to detect a manipulation is generally bounded by the tampering effort, some forgeries fooled the analysts and caused analysis effort that was higher than the manipulation effort. The detection effort by graduate students, however, was generally higher than that of professionals. We study different manipulation and detection approaches and their success. Overall, tampering with main memory dumps appears to be harder than tampering with hard disc images but the probability to fool an analyst is higher too.

Authors with CRIS profile

Janine Schneider Graduiertenkolleg 2475 Cyberkriminalität und Forensische Informatik Julian Wolf Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen) Felix Freiling Lehrstuhl für Informatik 1 (IT-Sicherheitsinfrastrukturen)

Related research project(s)

Cyberkriminalität und forensische Informatik (Cybercrime) Oct. 1, 2019 - March 31, 2024

How to cite

APA:

Schneider, J., Wolf, J., & Freiling, F. (2020). Tampering with digital evidence is hard: The case of main memory images. In Elsevier (Eds.), Forensic Science International: Digital Investigation. Virtual, GB: Elsevier.

MLA:

Schneider, Janine, Julian Wolf, and Felix Freiling. "Tampering with digital evidence is hard: The case of main memory images." Proceedings of the DFRWS EU 2020, Virtual Ed. Elsevier, Elsevier, 2020.

BibTeX: Download