Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand
The digital forensic tools used by law enforcement agencies for forensic investigations are mostly proprietary and commercially expensive; although open-source tools are used, the investigations conducted with such tools are not verified by reputable organisations, and hence, users are reluctant to...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-06-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/12/5928 |
| _version_ | 1797490346781835264 |
|---|---|
| author | Zawar Shah Arkar Kyaw Hong Phat Truong Imdad Ullah Andrew Levula |
| author_facet | Zawar Shah Arkar Kyaw Hong Phat Truong Imdad Ullah Andrew Levula |
| author_sort | Zawar Shah |
| collection | DOAJ |
| description | The digital forensic tools used by law enforcement agencies for forensic investigations are mostly proprietary and commercially expensive; although open-source tools are used, the investigations conducted with such tools are not verified by reputable organisations, and hence, users are reluctant to practice such tools. To address this issue, we experimentally evaluate three open-source forensic tools based on various requirements recommended by the National Institute of Standards and Technology (NIST) framework for forensic investigation. The experimental setup consists of a forensic workstation, write-blocker, and purchased USB hard drives investigated via digital forensic imaging tools, i.e., DC3DD, DCFLDD, and Guymager. We create various test cases, which distribute USB hard drives in different groups and investigate the functional and optional requirements of NIST along with recovering and analysing remnant data. We evaluate these forensic tools by analysing the log information, following, anonymously (to ensure that data were not disclosed or misused during or after the investigations) collecting, examining, and classifying the remnant data restored from the USB hard drives. We observe that the percentage of hardware resources usage and the processing time of each tool are remarkably different, e.g., Guymager was the fastest tool and met all the functional requirements in each test case, but it utilised more CPU and memory resources than DC3DD, DCFLDD. We note that 88.23% of the USB hard drives contained sensitive personal or business information (e.g., personal photos, bank transactions, and contracts). Subsequently, the remnant data analysis shows that consumers in New Zealand are unaware of personal data security and the associated vulnerabilities of data leakages. |
| first_indexed | 2024-03-10T00:31:40Z |
| format | Article |
| id | doaj.art-96963ff272cf4e9ba575d76bddf02b77 |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-10T00:31:40Z |
| publishDate | 2022-06-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-96963ff272cf4e9ba575d76bddf02b772023-11-23T15:24:47ZengMDPI AGApplied Sciences2076-34172022-06-011212592810.3390/app12125928Forensic Investigation of Remnant Data on USB Storage Devices Sold in New ZealandZawar Shah0Arkar Kyaw1Hong Phat Truong2Imdad Ullah3Andrew Levula4Department of Information Technology, Sydney International School of Technology and Commerce, Sydney, NSW 2000, AustraliaSchool of Information Technology, Wellington Institute of Technology (WelTec), Wellington 5012, New ZealandSchool of Information Technology, Whitireia Community Polytechnic, Auckland 5022, New ZealandCollege of Computer Engineering and Sciences, Prince Sattam Bin Abdulaziz University, Al-Kharj 11942, Saudi ArabiaDepartment of Information Technology, Sydney International School of Technology and Commerce, Sydney, NSW 2000, AustraliaThe digital forensic tools used by law enforcement agencies for forensic investigations are mostly proprietary and commercially expensive; although open-source tools are used, the investigations conducted with such tools are not verified by reputable organisations, and hence, users are reluctant to practice such tools. To address this issue, we experimentally evaluate three open-source forensic tools based on various requirements recommended by the National Institute of Standards and Technology (NIST) framework for forensic investigation. The experimental setup consists of a forensic workstation, write-blocker, and purchased USB hard drives investigated via digital forensic imaging tools, i.e., DC3DD, DCFLDD, and Guymager. We create various test cases, which distribute USB hard drives in different groups and investigate the functional and optional requirements of NIST along with recovering and analysing remnant data. We evaluate these forensic tools by analysing the log information, following, anonymously (to ensure that data were not disclosed or misused during or after the investigations) collecting, examining, and classifying the remnant data restored from the USB hard drives. We observe that the percentage of hardware resources usage and the processing time of each tool are remarkably different, e.g., Guymager was the fastest tool and met all the functional requirements in each test case, but it utilised more CPU and memory resources than DC3DD, DCFLDD. We note that 88.23% of the USB hard drives contained sensitive personal or business information (e.g., personal photos, bank transactions, and contracts). Subsequently, the remnant data analysis shows that consumers in New Zealand are unaware of personal data security and the associated vulnerabilities of data leakages.https://www.mdpi.com/2076-3417/12/12/5928forensic investigationcomputer crimedigital devicesdata leakagedata security |
| spellingShingle | Zawar Shah Arkar Kyaw Hong Phat Truong Imdad Ullah Andrew Levula Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand Applied Sciences forensic investigation computer crime digital devices data leakage data security |
| title | Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand |
| title_full | Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand |
| title_fullStr | Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand |
| title_full_unstemmed | Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand |
| title_short | Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand |
| title_sort | forensic investigation of remnant data on usb storage devices sold in new zealand |
| topic | forensic investigation computer crime digital devices data leakage data security |
| url | https://www.mdpi.com/2076-3417/12/12/5928 |
| work_keys_str_mv | AT zawarshah forensicinvestigationofremnantdataonusbstoragedevicessoldinnewzealand AT arkarkyaw forensicinvestigationofremnantdataonusbstoragedevicessoldinnewzealand AT hongphattruong forensicinvestigationofremnantdataonusbstoragedevicessoldinnewzealand AT imdadullah forensicinvestigationofremnantdataonusbstoragedevicessoldinnewzealand AT andrewlevula forensicinvestigationofremnantdataonusbstoragedevicessoldinnewzealand |