Forensic Science International: Digital Investigation

FSI Digital Investigation covers a broad array of subjects related to crime and security throughout the computerized world. The primary pillar of this publication is digital evidence and multimedia, with the core qualities of provenance, integrity and authenticity. This publication promotes advances in investigating cybercrimes, cyberattacks and traditional crimes involving digital evidence, using scientific practices in digital investigations, and reducing the use of technology for criminal purposes.

This widely referenced publication promotes innovations and advances in utilizing digital evidence and multimedia for legal purposes, including criminal justice, incident response, cybercrime analysis, cyber-risk management, civil and regulatory matters, and privacy protection. Relevant research areas include forensic science, computer science, data science, artificial intelligence, and smart technology.

This journal is used by investigative agencies and forensic laboratories, computer security teams, practitioners, researchers, developers, and lawyers from industry, law enforcement, government, academia, and the military to share their knowledge and experiences, including current challenges and lessons learned in the following areas:

Research and development: Novel research and development in forensic science, computer science, data science, and artificial intelligence applied to digital evidence and multimedia. New methods to deal with challenges in digital investigations, including applied research into analysing digital evidence and multimedia, exploiting specific technologies, and into preparing for and responding to computer security incidents.

Cyber-criminal investigation: develop new methods of online investigation and analysis of financially motivated cyber-crime such as banking Trojans, phishing, ransomware and other forms of cyber-fraud. In addition, researching future criminal activity involving peer-to-peer payments and crypto currencies.

Hardware Forensics: develop new methods of extracting and analyzing evidence from electronic hardware. This includes analyzing IoT devices, embedded systems, industrial control systems, automobiles, and other systems requiring hardware component access to extract data (e.g., chip-off, debugging interfaces like JTAG, fault injection).

Cyber-risk management: Improved ways of using digital evidence to address security breaches involving information systems, methods to find zero day attacks and to perform cyber threat intelligence. The techniques and findings of digital investigations are essential in drawing post-incident conclusions, which are vital feedback components of the security policy development process, and managing risk appetite.

Case Notes: Brief investigative case studies with practical examples of how digital evidence is being used in digital investigations, forensic analysis, and incident response. Case Notes can also describe current challenges that practitioners are facing in cybercrime and computer security, highlighting areas that require further research, development or legislation. The format for Case Notes is simple and short: case background, any technical or legal challenges, the digital evidence and multimedia involved, processes and/or tools used, and outcomes (e.g., solutions, barriers, need for R&D). Please check the following example for preferred Case Note format: https://www.sciencedirect.com/science/article/pii/S1742287618301713.

Scientific practices: Novel approaches to strengthening the scientific foundation and rigor of digital investigations, and to increasing the reliability of and confidence in processes, analysis methods, results, and conclusions involving digital evidence and multimedia.

Effective practices: Studies that assess new practices in digital investigations and propose effective approaches to handling and processing digital evidence.

Survey papers: Discussion of current methods and future needs relevant to digital investigations, including analysing digital evidence and multimedia from computers, smart technology, mobile phones, memory, malware, network traffic, as well as systems that support enterprises, telecommunications, and satellites. In addition, advanced approaches to analysing digital evidence and multimedia, including novel applications of artificial intelligence and data analytics.Application analysis: Novel approaches to analysing applications on mobile devices and computers from a digital forensic perspective. Analysis may include configuration and log data, network telemetry and cloud storage, live memory artifacts, and indications of compromised and abused applications. Proposed methods should go beyond a single version of an application and be generalized to multiple versions of an application, or a general category of applications (e.g. social networking), on multiple platforms (Android, iOS). In addition, strong work in this area will extend the functionality of an existing open source tool, or provide a new open source tool. Also of interest are approaches to performing validation and quality assurance of forensic software that must be updated frequently to support new applications. Such papers should be structured around investigative questions that are commonly encountered in digital investigations, concentrating on the users and their activities rather than only on technical elements.

Tool reviews: Evaluation and comparison of specialized software and hardware used to preserve, survey, examine, analyse or present digital evidence and multimedia, deepening our understanding of specific tools, and highlight any needed enhancements.

Future challenges: Analysis of new technologies, vulnerabilities and exploits which may create opportunities for criminality and/or computer security incidents, but which require further work in order to determine how their use can be investigated and the evidential opportunities they may create.

Registered reports: Studies that assess methods critically, and evaluating the reliability, statistical power, and reproducibility of results. Such reports can include tests and experiments with negative results, not just positive.

Evidence accessibility: exploring safe, fair, and feasible methods of acquiring digital evidence from protected sources such as DRM, encrypted traffic, encrypted storage, and locked proprietary devices, while taking individual privacy and ethical aspects into consideration.

Author Note: General methods for detecting forgery in digital photographs or videos are not within scope of Forensic Science International: Digital Investigation, and will be rejected without review. To be within scope of this Journal, any novel forgery detection method must be evaluated using datasets that are representative of actual digital investigations. In addition, improvements over existing methods must be clearly demonstrated. It is recommended that authors provide a working implementation of their proposed method to enable others to test it using their own datasets for comparison with existing methods.

Forensic Science International: Digital Investigation was previously published as Digital Investigation (now discontinued).

The Forensic Science International journals offer comprehensive and pioneering coverage within the forensic sciences and beyond, disseminating ground-breaking discoveries, highly specialised research, and foundational science across the family of publications. The FSI portfolio comprises of:
• Forensic Science International
• Forensic Science International: Animals and Environments
• Forensic Science International: Digital Investigation
• Forensic Science International: Genetics
• Forensic Science International: Genetics Supplement Series
• Forensic Science International: Mind and Law
• Forensic Science International: Reports
• Forensic Science International: Synergy