Browsing by Author "David, Anne"

Now showing 1 - 4 of 4
  • Thumbnail Image
    ItemOpen Access
    Smurf : A reliable method for contextualising social media artefacts
    (2020-02) David, Anne; Morris, S; Appleby-Thomas, Gareth J.
    This research aims to evaluate whether artefacts other than the content of user com munication on social media can be used to attribute actions or relationships to a user. Social Media has enhanced the way users communicate on the Internet; providing the means for users to share content in real-time, and to establish connections and social relationships with like-minded individuals. However, as with all technology, social media can be leveraged for disagreeable and/or unlawful activities such as cyber bullying, trolling, grooming, or luring. There are reported cases where evidence from social media was used to secure convictions; for example, the tragic cases of Ashleigh Hall in 2009 and Kayleigh Haywood in 2015. The social media evidence e.g. the messages sent to the victim to arrange a meet up was used to link the suspect to the victim, and attribute actions to the suspect; in addition to other physical evidence presented as part of the case. Investigations with elements of social media is growing within digital forensics. This reinforces the need for a technique that can be used to make inferences about user actions and relationships, especially during a live triage investigation where the information needs to be obtained as quickly as possible. This research evaluates the use of live triage in the investigation of social media interactions, in order to determine the reliability of such a technique as a means of contextualising user activity, and attributing relationships or actions to a user. This research also evaluates the reliability of artefacts other than the actual content exchanged on social media; in the event that the content of communication is not immediately accessible/available to the investigator. To achieve this, it was important to break down the events that occur before, during and after user activity on social media; followed by the determination of what constitutes communication content in the context of this research. This research makes the following contributions: establishes a method for the cat egorisation of social media artefacts based on perceived user activity; communication content was characterised, thus highlighting evidential data of interest from user social media activity; the criteria for assessing the reliability of social media artefacts in a live triage investigation was proposed; a novel framework for social media investigation was developed with a Proof of Concept (PoC) to test its viability. The PoC demonstrates that it is possible to attribute actions or relationships to a user, using artefacts other than the actual content exchanged on social media.
  • Thumbnail Image
    ItemOpen Access
    Social Media User Relationship Framework (SMURF)
    (Association of Digital Forensics, Security and Law, 2021-02-16) David, Anne; Morris, Sarah; Appleby-Thomas, Gareth J.
    The use of social media has spread through many aspects of society, allowing millions of individuals, corporate as well as government entities to leverage the opportunities it affords. These opportunities often end up being exploited by a small percentage of the user community who use it for objectionable or unlawful activities; for example, trolling, cyber bullying, grooming, luring. In some cases, these unlawful activities result in investigations where swift retrieval of critical evidence required in order to save a life. This paper presents a proof of concept (PoC) framework for social media user attribution. The framework aims to provide digital evidence that can be used to substantiate user activity in live triage investigations. This paper highlights the use of live triage as a viable technique for the investigation of social media activity, contextualizing user activity and attributing actions to users. It discusses the reliability of artefacts other than the communications content as a means of drawing inferences about user social media activity, taking into account the proportionality and relevance of such evidence
  • Thumbnail Image
    ItemOpen Access
    A two-stage model for social network investigations in digital forensics
    (Association of Digital Forensics, Security and Law, 2020-08-20) David, Anne; Morris, Sarah; Appleby-Thomas, Gareth J.
    This paper proposes a two-stage model for identifying and contextualizing features from artefacts created as a result of social networking activity. This technique can be useful in digital investigations and is based on understanding and the deconstruction of the processes that take place prior to, during and after user activity; this includes corroborating artefacts. Digital Investigations are becoming more complex due to factors such as, the volume of data to be examined; different data formats; a wide range of sources for digital evidence; the volatility of data and the limitations of some of the standard digital forensic tools. This paper highlights the need for an approach that enables digital investigators to prioritize social network artefacts to be further analysed; determine social connections in the context of an investigation e.g. a user’s social relationships, how recovered artefacts came to be, and how they can successfully be used as evidence in court
  • Thumbnail Image
    ItemOpen Access
    We're making a list and we're checking it twice, gonna find out what makes digital forensic examiners suffice
    (Wiley, 2023-04-30) Morris, Sarah; Hadgkiss, Melissa; David, Anne; Guinness, John; Frewin, Charles
    Digital forensic examinations have grown in breadth and depth at a currently unsustainable rate. Digital Investigations now feature in around 90% of criminal cases, demonstrating that digital evidence is crucial to forensic investigations. Due to the high number of cases, most law enforcement units have significant backlogs of devices waiting for analysis. As the field of Digital Investigation has grown, it is no longer solely related to criminal investigations, with the techniques also supporting civil, private, and corporate activities. Given the evident challenges, it is logical that more digital forensic experts are needed to keep pace with the field's complexities and demands. Identifying what characteristics and skills make a digital forensic expert enables an evaluation to ensure that any new staff are fit for purpose. There is a growth in academic, civil, corporate, and intelligence-based activity within the field. Each area defines their standards, field scope, and expertise level. Still, as any case has the potential to become a matter of criminal investigation, surely the focus needs to be on the standards required to ensure evidence is admissible for that purpose. As expertise levels can vary, it is also necessary to challenge the level at which an expert is defined and the implications of this decision. By identifying what makes an expert in this unique forensic science area, it is possible to explore the potential challenges the field faces in obtaining, retaining, and training staff.