Digital Forensic Science Edited by B Suresh Kumar Shetty and Pavanchand Shetty H Digital Forensic Science Edited by B Suresh Kumar Shetty and Pavanchand Shetty H Published in London, United Kingdom Supporting open minds since 2005 Digital Forensic Science http://dx.doi.org/10.5772/intechopen.78450 Edited by B Suresh Kumar Shetty and Pavanchand Shetty H Contributors Rajasree Thanka Raja, Mary Saira Bhanu S, Vladimir Ivanovich Vasilyev, Alexey Vulfin, Liliya Chernyakhovskaya, Salman Iqbal, Soltan Alharbi, Thorsten Floren M.A., Louise Kelly, Swati Sachan, Lei Ni, Fatima Almaghrabi, Richard Allmendinger, Yu-Wang Chen, Petra Perner, Rinaldi Munir, Harlili Harlili, Deepa Salian, Sofia Khatun © The Editor(s) and the Author(s) 2020 The rights of the editor(s) and the author(s) have been asserted in accordance with the Copyright, Designs and Patents Act 1988. All rights to the book as a whole are reserved by INTECHOPEN LIMITED. The book as a whole (compilation) cannot be reproduced, distributed or used for commercial or non-commercial purposes without INTECHOPEN LIMITED’s written permission. Enquiries concerning the use of the book should be directed to INTECHOPEN LIMITED rights and permissions department (permissions@intechopen.com). Violations are liable to prosecution under the governing Copyright Law. Individual chapters of this publication are distributed under the terms of the Creative Commons Attribution 3.0 Unported License which permits commercial use, distribution and reproduction of the individual chapters, provided the original author(s) and source publication are appropriately acknowledged. If so indicated, certain images may not be included under the Creative Commons license. In such cases users will need to obtain permission from the license holder to reproduce the material. More details and guidelines concerning content reuse and adaptation can be found at http://www.intechopen.com/copyright-policy.html. Notice Statements and opinions expressed in the chapters are these of the individual contributors and not necessarily those of the editors or publisher. No responsibility is accepted for the accuracy of information contained in the published chapters. The publisher assumes no responsibility for any damage or injury to persons or property arising out of the use of any materials, instructions, methods or ideas contained in the book. First published in London, United Kingdom, 2020 by IntechOpen IntechOpen is the global imprint of INTECHOPEN LIMITED, registered in England and Wales, registration number: 11086078, 5 Princes Gate Court, London, SW7 2QJ, United Kingdom Printed in Croatia British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library Additional hard and PDF copies can be obtained from orders@intechopen.com Digital Forensic Science Edited by B Suresh Kumar Shetty and Pavanchand Shetty H p. cm. Print ISBN 978-1-83880-259-2 Online ISBN 978-1-83880-260-8 eBook (PDF) ISBN 978-1-83968-742-6 Selection of our books indexed in the Book Citation Index in Web of Science™ Core Collection (BKCI) Interested in publishing with us? Contact book.department@intechopen.com Numbers displayed above are based on latest data collected. For more information visit www.intechopen.com 5,000+ Open access books available 151 Countries delivered to 12.2% Contributors from top 500 universities Our authors are among the Top 1% most cited scientists 125,000+ International authors and editors 140M+ Downloads We are IntechOpen, the world’s leading publisher of Open Access books Built by scientists, for scientists BOOK CITATION INDEX C L A R I V A T E A N A L Y T I C S I N D E X E D Meet the editors Dr. B. Suresh Kumar Shetty is a Professor in the Department of Fo- rensic Medicine at Kasturba Medical College, Mangalore, MAHE, Manipal. He received his Master’s degree at KMC, Manipal, and joined as faculty at KMC, Mangalore, where he has been teach- ing since 2005. He is presently appointed as the Honorary State Medico-Legal Consultant for three districts [Dakshina Kannada, Udupi and Coorg], Government of Karnataka. He has received his certificate in “Analytical Toxicology & Forensic DNA Typing” awarded by the Department of Analytical Toxicology, Amrita Institute of Medical Sciences, Cochin in November 2006, as well as his PG certificate in Torture Medicine [IMA AKN Sinha In- stitute, Patna] in 2011. He completed his MBA [Hospital Administration] from Sikkim Manipal University in 2016. He completed his FAIMER fellowship from MAHE, Ma- nipal in 2018. He has co-authored chapters in 3 books and peer-reviewed papers for 15 reputed national and international journals, contributed articles in local and national newspapers, guided postgraduates in Forensic Medicine and undergraduates in ICMR student projects. He has published more than 80 papers, all national and international research papers in scientific journals. He has organized a number of continued medical education [CME] programs, police training programs, seminars and conferences in the capacity of Organizing Secretary from 2009-2019. He hosted the IAFM National conference in 2013. He was the Organizing Secretary of the 1st Indo-French Forensic International Congress in 2018 and also successfully conducted the 2nd Indo-French Congress in Lyon France as Co-Organizing Secretary in 2019. He has successfully completed international collaborations with Mekelle University and Lyon University, France. He is the advisor for the Centre of Forensic Odontology and Head of the Stu- dents wing of Bio-Ethics, KMC, Mangalore. He has attended scientific sessions in India as well as abroad like Malaysia, Singapore, Vietnam, Thailand, United States of Amer- ica, Hong Kong, Australia, China, Russia, and France. He is the author of “Atlas Book on Forensic Pathology” published by Jayeepe Publisher. Forensic Analysis – Death to Justice by IntechOpen publisher, as well as chapters in books from Nova publisher and IntechOpen publisher. He was nominated by the International Bibliographical Centre, Cambridge, England, Selection Committee and earned a position of TOP 100 Health Professionals in 2009, who have made a significant contribution in their field to en- gender influence on a local, national and international issue and Individual Member of Sydney Forensic Medicine & Science Network, Australia and Asia Pacific Association of Medical Toxicology. He is an active member and Chairman of a registered Non-Gov- ernmental Organization “BELAKU” with a desire and wish to spread light among the youths to change society in the right direction. Dr. Pavanchand Shetty H is an Associate Professor in the Depart- ment of Forensic Medicine, Kasturba Medical College, Mangalore, MAHE, Manipal. He received his Master’s Degree at KMC, Mani- pal and joined as faculty at KMC, Mangalore where he has been teaching since 2011. He is presently appointed as Honorary District Medico-Legal consultant for Dakshina Kannada, Government of Karnataka. He has co-authored a chapter in a book titled NACP- FMT Practical Medico Legal Manual. He has guided postgraduates in Forensic Medi- cine and undergraduates in research projects. He has published more than 25 papers, as well as national and international research papers in scientific journals. He has organized a number of continued medical education (CME) programs, police training programs, seminars and conferences as a part of an organizing team. He was part of the organizing team of the 1st Indo-French Forensic International Congress in 2018 and also successfully conducted the 2nd Indo-French congress in Lyon France as part of organizing team in 2019. He is part of the training members of the Centre of Forensic Odontology. He has attended scientific sessions in India as well as abroad. X Contents Preface X II I Section 1 Digital Forensics - Computer and Network 1 Chapter 1 3 Advancing Automation in Digital Forensic Investigations Using Machine Learning Forensics by Salman Iqbal and Soltan Abed Alharbi Chapter 2 19 Cybersecurity Risk Analysis of Industrial Automation Systems on the Basis of Cognitive Modeling Technology by Vladimir I. Vasilyev, Alexey M. Vulfin and Liliya R. Chernyakhovskaya Chapter 3 37 Application of Chaos-Based Fragile Watermarking to Authenticate Digital Video by Rinaldi Munir and Harlili Harlili Section 2 Digital Forensics - Legal Aspects 53 Chapter 4 55 Legal Framework on Child Pornography: A Perspective by Deepa Salian and Sofia Khatun Section 3 Digital Evidence 67 Chapter 5 69 Novel Methods for Forensic Multimedia Data Analysis: Part I by Petra Perner Chapter 6 101 Data Collection Techniques for Forensic Investigation in Cloud by Thankaraja Raja Sree and Somasundaram Mary Saira Bhanu II Chapter 7 117 Detectability of the Psychotropic Substance Cannabis in Head or Body Hair: Update of Forensic Criminalistics by Thorsten Floren M.A. Chapter 8 131 Novel Methods for Forensic Multimedia Data Analysis: Part II by Petra Perner Chapter 9 159 Explainable Artificial Intelligence for Digital Forensics: Opportunities, Challenges and a Drug Testing Case Study by Louise Kelly, Swati Sachan, Lei Ni, Fatima Almaghrabi, Richard Allmendinger and Yu-Wang Chen XII Preface It is our pleasure to place before you the book Digital Forensic Science . This book makes up a major part of the broad specialty of Digital Forensic Science, comprising mainly of tools and technologies of cyber forensic experts for their future practice. This book is designed to merge a range of new ideas and unique works of authors from topics like fundamental principles of forensic cyber analysis, and protocols and laws related to the digital world. This information is very much-needed for the best of digital forensics. We hope that it will be useful to practitioners of forensic medicine, experts, cyber experts, law makers, investigating authorities, and undergraduate and postgraduate medical school graduates of medicine. The experienced and enthusiastic authors have presented many ideas and innovative approaches. They have given a new outlook to this book and most importantly enabled us to grow and push through many hurdles, in our minds and in the process, and also learn how to edit and publish. We are truly proud of this book. We wish to express our solemn sentiments and sincere thanks to Dr. Aditi S Shetty, Associate Professor, Department of Obstetrics and Gynecology from Kasturba Medical College, Mangalore, Manipal Academy of Higher Education (M.A.H.E), Manipal for her valuable feedback and suggestions while editing this book. We wholeheartedly thank Mr. Mateo Pulko, Author Service Manager, and Ms. Sandra Bakic, Senior Commissioning Editor of IntechOpen, for their constant support and suggestions during the process of editing and thank the entire team of IntechOpen publisher for giving us the unique opportunity in this process. We would like to place our gratitude to our university, the Manipal Academy of Higher Education, Manipal. B. Suresh Kumar Shetty and Pavanchand Shetty H. Manipal Academy of Higher Education, India 1 Section 1 Digital Forensics - Computer and Network 3 Chapter 1 Advancing Automation in Digital Forensic Investigations Using Machine Learning Forensics Salman Iqbal and Soltan Abed Alharbi Abstract In the last few years, most of the data such as books, videos, pictures, medical and even the genetic information of humans are moving toward digital formats. Laptops, tablets, smartphones and wearable devices are the major source of this digital data transformation and are becoming the core part of our daily life. As a result of this transformation, we are becoming the soft target of various types of cybercrimes. Digital forensic investigation provides the way to recover lost or purposefully deleted or hidden files from a suspect’s device. However, current man power and government resources are not enough to investigate the cybercrimes. Unfortunately, existing digital investigation procedures and practices require huge interaction with humans; as a result it slows down the process with the pace digital crimes are committed. Machine learning (ML) is the branch of science that has gov- erns from the field of AI. This advance technology uses the explicit programming to depict the human-like behaviour. Machine learning combined with automation in digital investigation process at different stages of investigation has significant potential to aid digital investigators. This chapter aims at providing the research in machine learning-based digital forensic investigation, identifies the gaps, addresses the challenges and open issues in this field. Keywords: digital forensic investigation, machine learning, evidence extraction, cybercrimes, automated data extraction 1. Introduction Worldwide usage of mobile smart devices has increased dramatically over the past two decades and is becoming the part of our daily life. The term smart device ranges from variety of devices that includes mobile phones, smartphones, tablets, GPS and so on. The popularity of these smart devices is increased significantly due to their processing power, huge storage capabilities and less cost. Consequently, they can hold the enormous amount of commercial and private user’s data. These devices are the essential part of our daily life because they contain private and essential information of users. However, these devices are also vulnerable to attackers and are often becoming the major part of criminal’s activities, IP theft, intrusions, security threats, accidents reconstructions and many more. The number of digital crimes equally increases as the new technologies, i.e. digital devices and Digital Forensic Science 4 internet, increases. As a result, we are becoming the soft target for various types of cybercrimes and digital attacks. The Digital Forensic Research Workshop (DFRWS) has defined digital forensics (DF) as “The use of scientifically derived and proven methods toward the preserva- tion, collection, validation, identification, analysis, interpretation, documentation and presentation of digital evidence derived from digital sources for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or help- ing to anticipate unauthorized actions shown to be disruptive to planned operations”. Todays, DF demands are increasingly important. DF investigation procedures help to capture important information from the compromised device. Nowadays, businesses deeply depend on the digital devices and on the Internet. Capturing the indispensable evidences from these devices is equally important. Digital evidence should be gathered from the system to support or deny some reasoning an investi- gator may have about the incident. It is important to know that how to recover digital evidences which can be interested for investigators. However, current human power and other available resources are not enough to fully investigate the digital crimes on digital devices. Further, existing digital investigation procedures and practices require huge interaction with humans; as a result it slows down the process with the pace digital crimes are committed. In this chapter, we have thoroughly discussed the current advancement of machine learning forensics (MLF) in digital forensic investigation (DFI). We pres- ent the latest surveys in this field and give critique comparisons of these approaches. 1.1 Historical perspective of digital forensic investigations Digital forensic or computer forensic is first presented by 1970 [1]. In the first investigation, the financial fraud is proven from the suspect’s computer. The first prosecuted computer crime was reported in 1996. The computer crime is defined as when the computer is the major effect for offense and facilitates the tool to Figure 1. Taxonomy of digital investigations. 5 Advancing Automation in Digital Forensic Investigations Using Machine Learning Forensics DOI: http://dx.doi.org/10.5772/intechopen.90233 commission a crime [2]. The first prosecuted computer crime was reported in Texas, USA, in 1996 [3] and resulted in a 5-year sentence. In 1990, computer-based digital crimes started to grow with the increasing popularity of the computers and the Internet. The computer forensic is developed as the independent field in the late 1990s and in the early 2000s. The CSI surveys report that almost 46% among the respon- dents were affected by some kind of computer crimes [4]. The 2010 Gallup surveys reports that 11% of the American adult become victim of computer- or Internet- related crimes in their homes. This ratio is 6–8% more than the last 7 years. A survey conducted by “Australian Company Crime Survey” [5], estimated that A$ 2,000,000 financial fraud and information breaches occurs in 2006. Company Crime Survey, its estimated A$ 2,000,000 financial fraud and information breaches in lost revenue. The term digital forensic is used nowadays with the advent of new digital devices with increasing number of frequency of use for investigation purposes ( Figure 1 ). 2. Artificial intelligence (AI), machine learning (ML) and deep learning It’s important to examine how actually AI, ML and deep learning (DL) methods can help in solving the problems of DF and how these methods differentiate with each other’s. a. Artificial intelligence AI is the science of making things smart or the capability of the machines (e.g. visual recognition, NLP, etc.) to perform human tasks. The important point is that AI is not machine learning or smart things. AI can be viewed as the things that can carry the human tasks and make these tasks easy. The AI technology is increasing day by day, and its enormous use also significantly increases the number of malicious activities. Artificial intelligence programs are called intelligent agent. Intelligent agents are used to interact with the environment. The agent uses the technique to identify the environments through its sensors, and then it can take the action to affect the state through its sensors. The important aspects in the AI technologies are how the sensors are used to col- lect the data and how it maps to the actuators; this is how the functions within the agents can perform these consequences. The ultimate goal of the AI is to develop the machine that acts just like humans. This task can be accomplished by only using the learning algorithms to which it is aimed to try to make a sketch of the human brain learnings. AI technologies give very good advantages and have a bright future ahead. However, these technologies are also unavoidably used for execution of some serious crimes that can be dangerous for people. b. Machine learning ML is one of the approaches of AI that uses a system that can be learned by itself from experience. It is not used for only AI purposes such as copying human behav- iour but also needs to reduce the human efforts and time spent to perform the dif- ficult and even the simple tasks. ML can be viewed as a system that can learn from experience and examples rather than from programming. Thus, if the system learns constantly and makes a decision based on the data rather than programming, then it’s called ML. ML is developed as a new technology to provide new functionalities for computers and is used for industry and science. There are many autonomous solutions based on ML for medical science, robotics, engineering and so on. Digital Forensic Science 6 c. Deep learning Deep learning combines the set of techniques used to implement ML methods to recognize patterns of patterns such as image recognition. First of all the system is used to identify the object edges, structure of the object, object type and then the object itself ( Figure 2 ) ( Table 1 ). 3. Approaches to machine learning forensics Usually two main approaches are used to define the ML forensics, that is, induc- tive reasoning and deductive reasoning: Figure 2. Machine learning essentials. Artificial intelligence Machine learning Deep learning Ability of a machine to imitate intelligent human behaviour Application of AI that allows a system to automatically learn and improve from experience Application of ML that uses complex algorithms and deep neural to train a model Originated around the 1950s Originated around the 1960s Originated around the 1970s Represents simulated intelligence in machines Getting machines to make without being programmed Process of using artificial neural networks to solve complex problems Subsets of data science Subset of AI and data science Subset of ML, AI and data science Building machines that are capable of thinking like humans Make machines that can learn through previous experience to solve problems To build neural networks that automatically discovers patterns for feature detection Table 1. Difference between artificial intelligence, machine learning and deep learning.