Ibrahim Baggili

Andrew Marrington

Yasser Jafar

PERFORMANCE OF A LOGICAL, FIVE-PHASE, MULTITHREADED, BOOTABLE TRIAGE TOOL

Keywords: Triage tool, bootable tool, forensic soundness, performance

This paper describes a five-phase, multi-threaded bootable approach to digital forensic triage, which is implemented in a product called Foren-sics2020. The first phase collects metadata for every logical file on the hard drive of a computer system. The second phase collects EXIF camera data from each image found on the hard drive. The third phase analyzes and categorizes each file based on its header information. The fourth phase parses each executable file to provide a complete audit of the software applications on the system; a signature is generated for every executable file, which is later checked against a threat detection database. The fifth and final phase hashes each file and records its hash value. All five phases are performed in the background while the first responder interacts with the system. This paper assesses the forensic soundness of Forensics2020. The tool makes certain changes to a hard drive that are similar to those made by other bootable forensic examination environments, although the changes are greater in number. The paper also describes the lessons learned from developing Forensics2020, which can help guide the development of other forensic triage tools.

Introduction

Digital forensic triage is a topic of considerable interest to the digital forensics community. In the medical realm, three conditions must be satisfied for triage to occur [START_REF] Iserson | Triage in medicine, Part I: Concept, history and types[END_REF]: (i) a scarcity of health resources; (ii) a triage officer must be able to assess the medical needs of each patient based on a brief examination; and (iii) the triage officer must be able to apply an algorithm or criteria to determine the treatment and treatment priority for each patient.

The practice of medical triage arose from emergency situations in wartime. The earliest medical triage systems date back to the nineteenth century; many scholars attribute the first formal battlefield triage system to Baron Dominique-Jean Larrey, chief surgeon of Napoleon's Imperial Guard. Before medical triage came into existence, wounded soldiers were not treated effectively, sometimes not at all. Soldiers typically helped each other; there was no systematic approach for specialists to provide medical attention, creating a backlog of wounded soldiers.

The same situation frequently occurs when dealing with computer crimes. In the traditional digital forensic model, a computer system is seized and is typically transported to a laboratory where it is forensically imaged and analyzed. The vast majority of digital forensic practitioners state that they have huge case backlogs; often, the processing delays are as much as eight to twelve months [START_REF] Kennedy | How to triage computer evidence: Tackling Moore's law with less[END_REF]. The same problem is encountered with mobile devices [START_REF] Mislan | The growing need for on-scene triage of mobile devices[END_REF]. Delays in the forensic laboratory translate to delays in criminal investigations and court proceedings, resulting in deleterious effects on the course of justice [START_REF] Casey | Investigation delayed is justice denied: Proposals for expediting forensic examinations of digital evidence[END_REF]. The digital forensic case backlogs have prompted research on systematic methodologies for improving the digital forensic process and, more specifically, digital forensic triage models and procedures.

Related Work

A number of traditional models have been developed for digital forensic investigations [START_REF] Beebe | A hierarchical, objectives-based framework for the digital investigations process[END_REF][START_REF] Carrier | Getting physical with the digital investigation process[END_REF][START_REF] Reith | An examination of digital forensic models[END_REF][START_REF] Stephenson | Modeling of post-incident root cause analysis[END_REF]. The traditional models involve a number of phases that focus on collecting evidence from a crime scene and processing the evidence in a laboratory environment [START_REF] Pollitt | An ad hoc review of digital forensic models[END_REF]. These models have influenced the development of digital forensic triage models, primarily by emphasizing the idea of conducting an early inspection of a computer system at a crime scene before bringing it back to the laboratory.

Adelstein [START_REF] Adelstein | MFP: The Mobile Forensics Platform[END_REF] has proposed the use of a mobile forensic platform to facilitate triage without requiring evidence to be brought back to the laboratory. Richards and Roussev [START_REF] Richard | Digital forensics tools: The next generation[END_REF] describe a a conceptually similar triage approach that they call "on-the-spot" forensics. Both approaches demonstrate that significant advantages can be gained during an investigation in terms of the reduction in time and the possibility of obtaining confessions from suspects when inspecting computer systems at the crime scene.

Rogers, et al. [START_REF] Rogers | Computer Forensics Field Triage Process Model[END_REF] have proposed a formal model for digital forensic triage. Their Cyber Forensics Field Triage Process Model (CFFTPM) incorporates an on-site field approach to digital forensic investigations. In particular, the model seeks to: (i) find usable evidence immediately;

(ii) identify the victims at acute risk; (iii) guide the ongoing investigation; (iv) identify the potential charges; and (v) accurately assess the offender's danger to society while preserving the integrity of the evidence for further examination and analysis. Much of the analysis can be performed on scene, where the investigator can generate user profiles, examine the home directory, file properties and registry, create a chronology and search for browser artifacts, email and instant messages [START_REF] Rogers | Computer Forensics Field Triage Process Model[END_REF]. However, one of the main drawbacks of CFFTPM is that it is highly manual and can only be performed by well-trained and experienced digital forensic investigators who can leverage a broad set of forensic tools.

Casey, et al. [START_REF] Casey | Investigation delayed is justice denied: Proposals for expediting forensic examinations of digital evidence[END_REF] propose a three-tiered approach to digital forensic examinations: (i) survey/triage forensic inspection, during which the potential sources of digital evidence are identified; (ii) preliminary forensic examination, during which relevant digital evidence is interpreted for individuals involved in the case (e.g., to assist in interviewing a suspect); and (iii) in-depth forensic examination, during which a full examination (typically, manual and time intensive) is performed to recover all the available digital evidence. The first two stages, triage and preliminary forensic examination, are intended to assist the investigation. The third stage is primarily intended to support the case going to trial [START_REF] Casey | Investigation delayed is justice denied: Proposals for expediting forensic examinations of digital evidence[END_REF]. Most of the well-known digital forensic tools support the third stage, although they may be used to support the other stages (especially the preliminary forensic examination stage).

Forensics2020

The Forensics2020 tool described in this paper was developed as a result of an academia-industry partnership involving the first author and Cryptic Solutions (www.cryptic.co.uk). The tool was built after numerous meetings with digital forensic investigators in Ireland, the United Arab Emirates, the United Kingdom and the United States. During these meetings, law enforcement officers and corporate forensic investigators discussed the challenges they faced with existing tools and the lack of effective, easy-to-use digital forensic triage tools.

The law enforcement officers and corporate investigators were very interested in a digital forensic triage system that could deployed easily. It was highly desirable that the system could be operated by non-experts with minimal training (including first responders at crime scenes). Other important features included an automated system with minimal configuration and input, and the ability to view results while the system was processing evidence. Finally, it was deemed critical that the triage sys-tem operate in a forensically sound manner and always maintain the integrity of the evidence.

These recommendations were used as guidelines when designing and implementing the Forensics2020 tool. The CFFTPM was selected as the underlying framework due to its wide adoption by U.S. law enforcement agencies.

Software Design

The Forensics2020 triage tool was designed to serve as a bootable environment. A bootable environment is a controlled environment where the triage software runs in a known-safe operating system as opposed to running live in the uncontrolled environment of a native operating system. This enhances the trustworthiness of the results; the knownsafe operating system is free from malware and anti-forensic software that may be present in the suspect's system. The bootable forensic examination environment approach is also common to many forensic live CD distributions (e.g., Helix3 Pro) and, thus, has an accepted basis.

However, there are two significant drawbacks to a bootable approach. First, items in memory could potentially be lost during the process of booting into the forensic triage environment. Second, if whole disk encryption is used, then triage will not be possible unless the encryption keys are known to the first responder. A live examination could address both these problems, but it could be subject to interference by malware and other untrusted software running on the suspect's computer system.

The Forensics2020 software is multi-phased and multi-threaded. The software is loaded from a bootable Windows Pre-installation Environment (PE) using a USB stick. The triage process is initiated after a password is entered. At this point, the first responder has the option to un-check a triage phase if it is not to be performed. Forensics2020 has five major automated phases that proceed in sequence. The phases are illustrated in Figure 1 and their details are provided in Table 1. The order of the phases was chosen based on the time it typically takes for each phase to be completed -the first phase is the fastest and the last phase is the slowest (see Figure 5).

Since the Forensics2020 phases are threaded away from the user interface, the first responder can introduce other evidence via the interface and view it while the five triage phases complete in the background. At any time, the first responder can click on any part of the user interface and interact with the tool to view important evidentiary items such as registry keys, web browser history, and iPhone and Blackberry backup structures. Table 1. Forensics2020 phases.

Windows

Phase Description

Phase I: File Information Every file is logically collected from the hard drive along with its file metadata.

Phase II: Camera Data Every photograph is analyzed for EXIF data.

Phase III: Header Information

Every file is analyzed and categorized based on its header, not on its extension.

Phase IV: Software Audit/ Threat Detection

The EXE files are parsed to provide a complete audit of all the software applications on the system. A proprietary algorithm is applied to each of the files to generate a signature. The signature is compared against a threat database if the user chooses to initiate this function.

Phase V: MD5 Hashing Every file is hashed and the hash value is recorded.

The hash values may be used to: (i) verify data integrity; and (ii) check against a hash value dataset that is relevant to the investigation.

Using Forensics2020

While Forensics2020 is operating, the first responder can interact with the user interface to see the results to that point and to request certain types of data. The first responder can search for file types based on their file extensions after Phase I is completed, and can search for file headers after Phase III is complete. The first responder can also filter searches based on files modified, accessed or created on specific dates or within specific time ranges, and can view files in raw format or in a "preview" mode (for supported file types). Figure 2 shows an example Forensics2020 screen that enables a first responder to search for specific types of files.

The first responder can also direct Forensics2020 to gather and view certain types of data from the filesystem. The data includes web browser history, Skype chat logs, iOS and Blackberry backup files, and other data relevant to the case. The first responder can also have the Windows registry mounted and search for particular keys that could reveal hardware devices that were connected to the system and software that was installed on the system.

Experiments

We conducted five experiments to evaluate the efficacy of the Foren-sics2020 triage tool. The first experiment focused on testing the performance of Forensics2020 running on personal computers located in several university computer laboratories (n = 57). Four additional experiments were then conducted to validate the integrity of the hard drives and the files after Forensics2020 was loaded.

Experiment 1

The goal of this experiment was to test the Forensics2020 triage procedure on real computer systems that had been used for general purpose computing instead of computer systems or virtual machines (VMs) with traces of computer activity that were contrived specifically as an experimental dataset. The computers examined in the experiment were physical machines (not VMs) in laboratories that were made available to students for use in their classes, although the students may also have used the computers for personal reasons and for activities only peripherally related to their studies. Each computer may have had several "regular users" who consistently used the computer for their classwork, in addition to dozens of casual users who may have used the computer between classes for any purpose. A computer located in a shared computer laboratory typically has a different usage pattern compared with a computer located at an individual's home. Nevertheless, the computers used in the experiment were real computers with traces of real user activity. As such, they represented the most realistic dataset available for the experiment.

Overall, 26.33 TB of data was analyzed in the experiment; the average hard drive size was 473 GB. To assess the performance of Forensics2020, the tool was run on the test computers and the following times were recorded for each computer: (i) time taken for the tool to load into memory; and (ii) time taken for each of the five phases to complete.

Performance Results: Figure 3 shows the average time (in seconds) for each of the five phases across the entire dataset. It is important to note that Phase II is faster than Phase I because the number of digital images triaged was significantly lower than the number of files found on the computer systems. Other interesting findings are:

-Four computers generated errors during or after the scans.

-Triage failed on one computer due to the condition of the hard drive (1.75% failure rate). -Three failures (5.26% failure rate) were observed during Phase V (MD5 hashing).

-The average time taken to complete all five phases was 5,591 seconds (1 hour, 33 minutes and 11 seconds).

-The maximum time taken to complete all five phases was 10,356 seconds (2 hours, 52 minutes and 36 seconds).

User Data Results: After all the computers were triaged, the results from every triage report were recorded and the data was analyzed accordingly. The following is a summary of the user data results for the 57 computers:

-260,101 software audit entries were detected on the 57 computers.

-40 software audit entries across the 57 computers were identified as possible viruses or malware (0.70 infections per computer).

-On the average, 4,563 software audit entries were detected per computer.

-Only one iPod backup was found.

-525 browsing history entries were detected for Google Chrome on the 57 computers (average of 9.21 entries per computer).

-351 browsing history entries were detected for Mozilla Firefox on the 57 computers (average of 6.15 entries per computer).

-1,408 browsing history entries were detected for Internet Explorer on the 57 computers (average of 24.7 entries per computer).

-3,475 Microsoft Word and Microsoft Excel files were found on the 57 computers (average of 60.96 Word/Excel files per computer).

-On the average, 14 camera models were detected per computer.

-As many as 44 camera models were detected on one of the 57 computers and 150 photo EXIF details were linked to the same computer.

-More than 2,340 photograph EXIF details were detected on the 57 computers.

Experiment 2

The goal of this experiment was to test if Forensics2020 modified the hard drive of a scanned computer.

Equipment:

-A Windows XP laptop with a 160 GB SATA hard drive.

-A Logicube Forensic Dossier hardware imaging and verification device.

-A Forensics2020 bootable USB stick.

Procedure:

1. The hard drive was extracted from the laptop and hashed using the Forensic Dossier device.

2. The Forensics2020 USB stick was inserted into the laptop.

3. The laptop was forced to boot from the Forensics2020 USB stick.

4. Forensics2020 was left running until all the automated phases were completed upon which Forensics2020 was shut down.

5. The hard drive was extracted and hashed again using the Forensic Dossier device.

6. The hash values for the hard drive before and after running Forensics2020 were compared. Results: Table 2 shows that different hash values were obtained for the hard drive before and after running Forensics2020. Additional experiments were required to investigate precisely when the changes occurred.

Experiment 3

The goal of this experiment was to investigate if the hash values changed after the Windows PE operating system was booted but before the laptop hard drive was mounted. The same equipment as in Experiment 2 was used.

Procedure:

1. The hard drive was extracted from the laptop and hashed using the Forensic Dossier device. 2. The Forensics2020 USB stick was inserted into the laptop. 3. The laptop was forced to boot from the Forensics2020 USB stick. 4. Forensics2020 was shut down after the Windows PE operating system was loaded, but before the triage process was started (right before the program splash screen). Thus, the hard drive

was not yet mounted when Forensics2020 was shut down. 5. The hard drive was extracted and hashed again using the Forensic Dossier device. 6. The hash values for the hard drive before and after running Forensics2020 were compared.

Results: As shown in Table 3, the hash values for the hard drive did not change during the experiment; the integrity of the hard drive was maintained. This means that loading Forensics2020 into memory did not cause any hard drive writes. An additional experiment was required to determine if the hash values were changed after the hard drive was mounted.

Experiment 4

The goal of this experiment was to determine if the hard drive retained its integrity after the Windows PE operating system was booted, after Forensics2020 was loaded into memory and after the laptop hard drive was mounted. The same equipment as in Experiment 2 was used.

Procedure:

1. The hard drive was extracted from the laptop and hashed using the Forensic Dossier device. 2. The Forensics2020 USB stick was inserted into the laptop. 3. The laptop was forced to boot from the Forensics2020 USB stick. 4. Forensics2020 was shut down after the Windows PE operating system was loaded and after the triage process was started (right after the program splash screen). Thus, the hard drive was mounted when Forensics2020 was shut down. 5. The hard drive was extracted and hashed again using the Forensic Dossier device. 6. The hash values for the hard drive before and after running Forensics2020 were compared.

Results: Table 4 shows the hash values for the hard drive before and after running Forensics2020. The results show that the hard drive was modified when it was mounted by the bootable Windows PE operating system. Therefore, it can be concluded that the changes were made to the hard drive as soon as it was mounted.

Experiment 5

In order to quantify the changes made by the Windows PE operating system mounting process, a differential analysis was performed on the

Stage Hash

SHA-256 of the hard drive before running Forensics2020

55407B01 4F4847E0 66F25B87 FD24FBDC 73B4969B B94434E6 22CAFAE5 D72E2C17
SHA-256 of the hard drive after running Forensics2020, after the splash screen loaded and after the hard drive was mounted

783C9989 94F7A6A2 103C70DE C6A419ED C2B7B748 84F8B886 7AB31AB5 E2739F17
hard drive images taken before and after running Forensics2020. Differential analysis allows a forensic examiner to focus on the changes brought about as a result of the activity that takes place between the acquisition of an image A and the acquisition of an image B at a subsequent point in time [START_REF] Garfinkel | A general strategy for differential forensic analysis[END_REF].

Equipment:

-A Tableau T14 FireWire 800 IDE Bridge (write blocker).

-A Windows XP "suspect" laptop with a 40 GB IDE hard drive.

-A Windows 7 forensic workstation.

-A Forensics2020 bootable USB stick.

-AccessData FTK 1.71.

-AccessData FTK Imager 3.1.2.0.

Note that no images were acquired in the previous experiments. Instead, the hard drive was merely hashed before and after running Forensics2020. In this experiment, since differential forensic analysis had to be performed, it was necessary to acquire actual images of the "suspect" laptop for examination. Therefore, a write blocker was used instead of the Forensic Dossier device.

Procedure:

1. The hard drive was extracted from the "suspect" laptop.

2. An image of the "suspect" hard drive was acquired using FTK Imager, employing the hardware write blocker to prevent inadvertent writes. 3. The hard drive was replaced in the "suspect" laptop. 4. The Forensics2020 USB stick was inserted into the "suspect" laptop.

5.

The "suspect" laptop was forced to boot from the Foren-sics2020 USB stick. 6. The system was shut down after the Windows PE operating system was loaded and after Forensics2020 was started (right after the program splash screen). Thus, the hard drive was mounted when Forensics2020 was shut down.

7. The hard drive was extracted from the "suspect" laptop.

8. An image of the "suspect" hard drive was acquired using FTK Imager, employing the hardware write blocker to prevent inadvertent writes.

9. The two image files were examined using AccessData FTK.

Using the file filter, known "ignorable" files, OLE files and duplicate files were excluded. Duplicates in FTK are files that already existed when they were discovered -not the files that exist on both images; consequently, it was necessary to sort by whether the item was "primary" as well as to identify only the files that were unique to a particular image or different in each image. This procedure yielded a list of files/items recovered from unallocated space where there were differences in the contents of the two hard drive images.

Results: Consistent with the results of Experiments 3 and 4, the two image files had different hash values. Using the FTK file filter and sorting functionality, a differential analysis was performed on the two images. The following observations are significant:

-The $I30 file in each directory on the "suspect" hard drive was modified when the drive was mounted. $I30 is the NTFS directory index file that employs a B-tree data structure instead of a flat file structure; Windows constantly rebalances the B-tree structures and, thus, modifies the $I30 file. Interested readers are referred to [START_REF] Tilbury | NTFS $I30 index attributes: Evidence of deleted and overwritten files[END_REF] for a discussion of the forensic implications of $I30 files.

-The $LogFile was changed.

-The $MFT was changed.

-The *.log files in C:\Windows\System32\config were modified (to no significant extent).

-The deleted files corresponding to Symantec Anti-Virus were changed.

-Two deleted sets of Virtual PC *.vhd files were modified. When considering the results of Experiment 5, it is important to note that many commonly-used Linux-based bootable forensic examination environments (e.g., Helix3 Pro and Backtrack) also perform mounts that modify filesystem metadata [START_REF] Suhanov | Linux for Computer Investigators: Pitfalls of Mounting Filesystems[END_REF]. Therefore, the issues noted for Forensics2020 are not unique to the product or to the Windows PE operating system -they are problematic for other bootable forensic examination environments as well. Fathy, et al. [START_REF] Fathy | Testing the forensic soundness of forensic examination environments on bootable media[END_REF] conducted an experiment similar to Experiment 5 for three bootable Linux-based forensic examination environments. Their results for Helix3 Pro, Kali and Knoppix are presented alongside the Forensics2020 results in Table 5. The Windows PE drive mounting process for Forensics2020 made the same sorts of changes as seen with Helix3 Pro, Kali and Knoppix, but in much greater quantities. However, the differential analysis revealed that Foren-sics2020 made no changes to the logical filesystem -the userspace files were not modified; only the filesystem metadata was changed. Whether or not this is acceptable from the perspective of forensic soundness is an open question.

Conclusions

The experimental results demonstrate that Forensics2020 is an effective digital forensic triage tool. On the average, files on the hard drive can be enumerated within 398 seconds; the slowest phase, however, is MD5 hashing. The semi-automated and multi-phase implementation enables a first responder to interact with Forensics2020 while digital forensic processes are executing in the background, giving the first responder more control over the investigation. Like other bootable forensic examination environments, Forensics2020 makes certain changes to the hard drive. Differential analysis revealed that Forensics2020 made no changes to userspace files; only the filesystem metadata was modified. However, this result is, nevertheless, a concern from the perspective of forensic soundness.

Future efforts will concentrate on extensive testing of Forensics2020 in real-world investigations. Also, experiments will be undertaken to measure if an automated tool like Forensics2020 actually reduces the time spent on digital forensic investigations [START_REF] James | Measuring accuracy of automated investigation tools and procedures in digital investigations[END_REF]. With respect to forensic soundness, a sector-by-sector comparison of the hard drive before and after the triage process will be conducted to provide better insights into the nature of the changes to digital evidence.

Finally, our experience developing and deploying Forensics2020 have resulted in two key lessons learned with regard to digital forensic triage. First, a multi-threaded, multi-stage approach that enables first responders to interact with the evidence while the system performs its forensic processing is a desirable feature that enhances performance and saves time. The second lesson is that the manner in which the hard drive is mounted by a bootable triage tool is crucial to perceptions of forensic soundness. It could be that small and predictable modifications of a suspect's hard drive would have to be accepted in order to facilitate triage using a bootable examination environment, but the nature and causes of the modifications must be thoroughly documented if the evidence recovered and analyzed by Forensics2020 is to have probative value in court proceedings.

Figure 1 .

 1 Figure 1. High-level Forensics2020 triage process.

Figure 2 .

 2 Figure 2. Forensics2020 screen functionality.

Figure 3 .

 3 Figure 3. Average execution time of each phase across all 57 computers.

Table 2 .

 2 Experiment 2 results.

	Stage	Hash
	SHA-256 of the hard drive before	D8C632E0 D922A8D9 6DCB17C1 3FE8A904
	running Forensics2020	F821726E D405266D 736F0498 00885F3C
	SHA-256 of the hard drive after	D8C21317 E72B5577 0B40FA22 9B203744
	running Forensics2020	FCE916AD 55017326 2B8f88E4 5824B4E6

Table 3 .

 3 Experiment 3 results.

	Stage	Hash
	SHA-256 of the hard drive before	55407B01 4F4847E0 66F25B87 FD24FBDC
	running Forensics2020	73B4969B B94434E6 22CAFAE5 D72E2C17
	SHA-256 of the hard drive after	55407B01 4F4847E0 66F25B87 FD24FBDC
	starting Forensics2020 and abort-	73B4969B B94434E6 22CAFAE5 D72E2C17
	ing before the program splash
	screen loaded

Table 4 .

 4 Experiment 4 results.

Table 5 .

 5 Hard drive changes by bootable forensic examination environments.

	Forensic	Suspected	Altered	Files Altered by Search
	Tool	Alteration File Hashes
	Helix3 Pro	Yes	Yes	$LogFile
				$MFT
				C:\WINDOWS\bootstat.dat
	Kali	Yes	Yes	C:\$I30
				$LogFile
				$MFT
				C:\WINDOWS\bootstat.dat
	Knoppix	Yes	Yes	C:\$I30
				$MFT
				C:\Documents And Settings\
				Administrator\Local Settings\
				$I30
				C:\Program Files\Cisco Packet
				Tracer 5.3.1\sounds\
				simulationTab.wav
	Forensics2020	Yes	Yes	1,667 different hash values

Acknowledgement

The authors wish to acknowledge the collaboration with Cryptic Solutions, especially with David Shearmon, CEO of Cryptic Solutions; and also with David Duke, the developer of Forensics2020.


Stefanie Beyer

Martin Mulazzani

Sebastian Schrittwieser

Markus Huber

Edgar Weippl

Markus Hu- Ber

Towards Fully Automated Digital Alibis with Social Interaction

Keywords:

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Digital forensic techniques are increasingly applied in criminal investigations due to the widespread involvement of computers, smartphones and other modern technologies in crimes. Traces such as MAC timestamps and operating system specific log files left on hard drives and information transmitted over network connections are often combined to produce a holistic reconstruction of events for specific times of interest [START_REF] Buchholz | Design and implementation of Zeitline: A forensic timeline[END_REF][START_REF] Olsson | Computer forensic timeline visualization tool[END_REF]. The resulting digital alibis are routinely presented and examined during investigations and in court proceedings.

This paper describes a framework that fully simulates user interactions and implements the automated creation of digital alibis with special focus on online social interactions such as writing email and sending chat messages. The framework is unique because it engages social in-teractions that have been ignored in previous work. Additionally, the framework is highly configurable and is available under an open source license (github.com/mmulazzani/alibiFramework).

This paper evaluates the framework by comparing it with usage patterns of real world users, demonstrating that digital forensic analysis methods are not reliable if they are specifically targeted. The goal is to raise awareness in the digital forensics community that digital alibis can be forged and, consequently, it is important to always question the reliability of digital alibis.

Background

Digital alibis have played an important role in numerous cases. In one case, Rodney Bradford was charged with armed robbery but was released because digital evidence demonstrated that he was actively using his Facebook account at the time of the crime [START_REF] Juarez | Facebook status update provides alibi[END_REF]. His attorney noted that the digital evidence gave Bradford an "unbeatable alibi" [START_REF] Beltrami | I'm innocent. Just check my status on Facebook[END_REF]. In another case, a suspected murderer was acquitted because digital evidence revealed that he was working on his laptop when the murder took place [START_REF] Castiglione | How to forge a digital alibi on Mac OS X[END_REF][START_REF] Seifer | Alberto Stasi acquitted[END_REF].

A digital forensic analyst is often confronted with multiple hard drives that have been imaged using hardware write blockers [START_REF] Brezinski | Guidelines for Evidence Collection and Archiving[END_REF], and is asked specific questions about user actions that have been or have not been conducted on the associated computers [START_REF] Carrier | File System Forensic Analysis[END_REF]. Meanwhile, the widespread use of modern technologies and devices such as social networks [START_REF] Huber | Social snapshots: Digital forensics for online social networks[END_REF] and smartphones [START_REF] Hoog | Android Forensics: Investigation, Analysis and Mobile Security for Google Android[END_REF][START_REF] Hoog | iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices[END_REF] dramatically increase the amount of digital traces that must be considered even in routine cases. The massive quantity of digital evidence and the accompanying case complexity render automated analysis crucial to extracting information of interest in a reasonable amount of time [START_REF] Garfinkel | Digital forensics research: The next 10 years[END_REF][START_REF] Garfinkel | Digital media triage with bulk data analysis and bulk extractor[END_REF].

Several researchers have focused on the creation of digital alibis [START_REF] Castiglione | The forensic analysis of a false digital alibi[END_REF][START_REF] Santis | Automated construction of a false digital alibi[END_REF]. However, their alibi generators often use proprietary languages such as AutoIt (Windows) or Applescript (OS X) and are, therefore, specific to the underlying operating system (e.g., Windows [START_REF] Castiglione | The forensic analysis of a false digital alibi[END_REF][START_REF] Santis | Automated construction of a false digital alibi[END_REF], OS X [START_REF] Castiglione | How to forge a digital alibi on Mac OS X[END_REF] or Android [START_REF] Albano | On the construction of a false digital alibi on the Android OS[END_REF]). Our framework, on the other hand, is not so operating system specific because it is implemented in Python. Although the implementation was developed for Linux systems because no Linux-specific solutions existed, it is a simple matter to port it to other platforms. Additionally, the configuration parameters were set based on extensive studies of real world users, rendering the alibi generation approach statistically more difficult to detect and the persistently-stored evidence more realistic compared with other approaches.

While other alibi creation approaches attempt to hide their programs using innocuous file names or separate storage devices, our framework is designed to leave no obvious traces. Also, the framework does not employ a file wiper during the post processing phase to remove suspicious traces. The rationale is that a forensic analyst should not be able to determine if the digital evidence artifacts originated from the framework or from a human user. This is accomplished by instrumenting keyboard signals, mouse clicks and other events within the alibi creation framework.

Alibi Creation Framework

The alibi creation framework is intended to simulate user activity as realistically and as thoroughly as possible. To this end, it is necessary to simulate standard user activities such as browsing the web, communicating via email, chatting with instant messaging software and editing documents of various types. The concrete actions performed by the framework should be neither scripted nor predictable; they should be randomized, but still realistic and convincing to digital forensic investigators.

A variety of word lists and online sources such as Google Trends are used as inputs to capture a snapshot of current online interests while simultaneously incorporating specific user preferences. Many facets of computer usage are highly user dependent. For the alibi creation framework to be as realistic as possible, factors such as the social interaction partners for email and chatting, the language of communication and the time delays between actions and usual concurrent actions must be configured in advance. Social interactions, in particular, are vulnerable to traffic analysis because the content of the messages as well as the identities of the communicating parties are of interest. Also, the response times are dependent on message length, and must be considered carefully when simulating social interactions.

The proof-of-concept system was implemented on Ubuntu 12.04 LTS using Python. The core features of the framework were chosen in a similar manner as other approaches in the literature [START_REF] Castiglione | How to forge a digital alibi on Mac OS X[END_REF][START_REF] Castiglione | The forensic analysis of a false digital alibi[END_REF].

The implementation has three main components: (i) scheduler; (ii) program manager; and (iii) social interaction component. The scheduler is responsible for the overall management; it controls startup and triggers the shutdown of all the involved programs. Also, it decides which actions to perform (both local and online) and when to perform them. The program manager runs and manages all applications, including the browser and the email and chat software. The social interaction component incorporates the email manager and a chatbot for instant messaging.

Figure 1 shows the main components of the alibi creation framework. The framework can launch and use local applications by sending key strokes and mouse clicks. It comes pre-configured for the use of several applications: Firefox, gedit, LibreOffice, Thunderbird, Skype and VLC. The Python libraries xautomation, skype4py and the chatbot implementation PyAIML are used for automation. Furthermore, splinter (based on Selenium) is used for the automation of Firefox. Thus, the implementation can browse the web, send and receive email, chat using Skype, open and edit documents (using LibreOffice and gedit) and launch programs such as music players and video players. The frequency and content of alibi events were derived from the forensic analysis of several typical office workstations at our university.

The framework can query Google and follow suggested links, tweet on Twitter and log into Facebook. Also, it can search for YouTube videos and browse websites with random mouse clicks and follow links. New email messages are drafted, received email messages are forwarded, and email responses are sent after reasonable delays. Additionally, it is possible to mark new email messages as read and to delete email messages. The action to be performed is chosen at random; not every email that is read is answered. The subject and content of email can be predefined and stored in lists. The answering of instant messages is supported with the help of a chatbot. Reasonable time delays are implemented based on the response message size and by using random delays. Chat templates are easily adapted via AIML [START_REF] Wallace | The Elements of AIML Style[END_REF]. When the timer of the scheduler expires, the chatbot says goodbye and shuts down. The editing of local documents is implemented by deleting a random amount of content or by randomly inserting predefined text that fits the content of the document. The use of LibreOffice is implemented by simulating key strokes and mouse clicks because no Python bindings for LibreOffice are available.

However, one post-processing step is necessary: Splinter has to use a separate Firefox profile and cannot work directly with the user profile. Therefore, during startup, splinter copies the user profile to /tmp and the user profile is overwritten at shutdown by moving it back. Depending on the user threat model, additional steps might be appropriate.

Evaluation

The implementation was evaluated by comparing its behavior with that of human users. Since the usage of a computer depends heavily on the person using it, the evaluation the implementation focused on demonstrating that the default configuration is reasonable.

Nine human test subjects were asked to use a virtual machine for 30 minutes just like they would use their computers, and the results were compared with a single run of the framework. The test subjects were asked to browse the web, send email, chat, edit documents and to do anything they would normally do.

Sleuth Kit and Autopsy were subsequently applied to the virtual machine images to extract data in a forensic manner. Timestamps were extracted and the files containing user data of interest were inspected manually. Manual analysis was conducted on the browser history places.sqlite of Firefox, the local mailbox files of Thunderbird, and the chat history main.db of Skype to extract timestamps, message content, conversation partners and the time intervals between messages, email and website visits. Network forensics, namely the inspection of network traffic, would have been an alternative approach for evaluation. However, hard drive analysis allows unencrypted information as well as additional information such as local timestamps to be extracted; this motivated the use of the evaluation method. Various metrics were used to compare the framework behavior with that of real users during the 30 minute test period: number of visited websites, durations of website visits and numbers of chat messages sent and received. Figure 2 shows an example timeline of 20 minutes of framework activity. The social interactions can be observed clearly. A total of twelve messages were sent by the social interaction component to various recipients, either as responses in ongoing conversations or as new messages to initiate conversations. The browser was directed to several websites and links were followed to simulate further browsing (not shown in the figure). The browsing activities accessed news sites such as nytimes.com and prominent news stories on the front page; and youtube.com and top videos from the "most popular" section based on random search queries. Local timestamps and history logs were written to disk in all cases. Furthermore, VLC was started and a local video from the hard drive was opened; this is reflected in the timestamps shown in Figure 2.

Test User Survey

Target websites and time patterns were extracted to capture the browsing behavior of the nine volunteers; the most popular websites visited were google.com, facebook.com and various Austrian news sites. On the other hand, the framework used a preconfigured list of websites and randomized Google queries. Nevertheless, four of the five most visited websites by the framework and the users matched. Table 1 shows three extracted time patterns. The test users did not receive any email as a result of the experimental setup, but they were asked to send email messages. On the average, one email message was sent per user. The maximum number of email messages sent by the users was three and the Table 2 provides details about the observed chat behavior. Nearly all the test users conducted chat conversations. There were between seven and 46 outgoing messages and between fifteen and 35 incoming messages. The shortest message was one word long for each user. The maximum number of words in a chat message was 23. The chat message topics depended strongly on the test users; they included health, football and movies, as well as small talk. The response time for chat messages was at least two seconds and at most eight minutes. The average response time was about one minute and four seconds. The users edited or opened one document (.ods or .pdf) during the 30 minute timeframe, which was consistent with the actions of the framework.

Discussion

Table 3 compares the behavior of the alibi framework with that of the test subjects. The browsing behavior of the framework in terms of the number of websites visited is comparable to that of the test users. The time spent on each website is on the average shorter than the time spent by the test users, but this is a parameter that is easily changed in the framework (just like the number of websites to be visited). Some test users spent more than ten minutes at a site but, in general, the time spent by framework on websites generally matches the time spent by the test users. Four of the five most visited websites for the framework and the test users matched, which is a very good result because the websites visited by the framework were configured a priori. However, the actual sites visited by the test users depended strongly on user preferences; this feature will have to be adjusted in the framework. In summary, the framework adequately simulates web surfing activities, but it requires the implementation of a user-specific configuration feature. With regard to chat conversations and the use of the social interaction server, the response time for chat messages matches the expected response time. The framework adequately models the behavior of test users in terms of the response time delays and the fact that not every message is answered.

Limitations and Future Work

One limitation of the prototype is the lack of sophisticated contextual analysis of instant messages. While AIML can be used to generate genuine-looking conversations for short periods of time, a forensic analysis of the conversations would likely reveal the use of a chatbot. While this is definitely a problem in scenarios where the disk is analyzed forensically, the generated alibis would pass network forensic analysis because most protocols (e.g., Skype) implicitly encrypt messages. This limitation is more significant for unencrypted email conversations. Our future work will attempt to identify methods for creating better content-dependent responses.

Another limitation is adaptivity. To forge a digital alibi in a reliable manner, it is necessary to adapt the framework to user preferences. Currently, most of the framework parameters are configured manually and have to be adapted for each user. Ideally, the framework should be able to adapt the parameters automatically. This can be realized by collecting user-specific information from user data or by collecting it over a longer period during a learning phase. It would also be useful to compare long-term runs of the framework with real user data -30 minutes is insufficient to cover all the use cases where digital alibis might be needed. Another future goal for the framework is supporting other operating systems and browsers.

An important point to note is that a user who has insufficient knowledge of the tools and the system could leave undesirable evidence. Therefore, it is essential to continuously update and refine the framework as operating systems and applications change. The current framework does not implement any obfuscation methods to hide its execution. Running the framework from external media as suggested in [START_REF] Castiglione | Automatic, selective and secure deletion of digital evidence[END_REF] could help strengthen the validity of a forged alibi.

Conclusions

The proof-of-concept alibi creation framework demonstrates that it is possible to forge digital alibis that adequately model real user behavior. The framework has the ability -if correctly configured -to simulate browsing, emailing, chatting and document editing behavior. The precise simulation that is obtained depends on the configurations that should, of course, be adapted to user preferences. This requires an intimate knowledge of user behavior and usage patterns. Our future research will focus on adding an automated configuration feature based on existing log files or learning user-specific behavior, with the goal of rendering the framework behavior more indistinguishable from normal human behavior, even after analysis by experienced forensic investigators.

Figure 1 .

 1 Figure 1. Conceptual view of the alibi creation framework.

Figure 2 .

 2 Figure 2. Example timeline of 20 minutes of framework activity.

17:19 17:20 17:21 17:22 17:23 17:24 17:25 17:26 17:27 17:28 17:29 17:30 17:31 17:32 17:33 17:34 17:35 17:36 17:37 1 1 26 8 : 31 : 36 Answer / Send Skype Message 7 Browse to Google, search "java tutorial" Browse to youtube, watch popular video Browse to website nytimes.com Start Firefox, browse to wikipedia Start VLC, watch local video

Table 1 .

 1 Website visit comparison.

		Framework Users
	Number of Websites	11	Min: 1; Max: 12; Avg: 9
	Time on Website (Min)	8 sec	5 sec
	Time on Website (Max) 2 min 16 sec 13 min 5 sec
	Time on Website (Avg)	1 min 52 sec 2 min 50 sec
	minimum was zero. The number of words in an email varied between six
	and 51, with an average of 21. The time between sending email varied
	between one minute and fifteen minutes.

Table 2 .

 2 Observed chat behavior (min/max/avg).

		Framework Users
	Chat Messages Sent	22	(7/46/19)
	Chat Messages Received 23	(15/35/21)
	Chat Message Length	(1/18/8)	(1/23/4)
	Response Time (sec)	(2/175/45)	(2/480/64)

Table 3 .

 3 Overall comparison framework vs. survey users.

	Feature	Framework		Users
	Websites Visited	11	Min: 1	Max: 12
	Website Visit Time	1 min 52 sec	Min: 5 sec Max: 2 min 50 sec
	Most Visited Websites		Matching in 4/5 sites
	Email Messages (sent)	1	Min: 0	Max: 3
	Email Messages (received)	2	Min: 0	Max: 0
	Email Message Length (words) 6	Min: 6	Max: 51
	Email Message Content		Matching in 1/4 topics
	Chat Messages (sent)	22	Min: 7	Max: 46
	Chat Messages (received)	23	Min: 15	Max: 35
	Chat Message Length (words)	Avg: 8	Min: 1	Max: 23
	Response Time	Avg: 45 sec	Min: 2 sec Max: 1 min 4 sec
	Conversation Content		Matching in 2/5 topics
	Opened Documents	1	Min: 0	Max: 2
	Document Types	.ods	.ods, .odt, .pdf


York Yannikos

Lukas Graner

Martin Steinebach

Christian Winter

Data Corpora for Digital Forensics Education and Research

Keywords: Forensic data corpora, synthetic disk images, model-based simulation

de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

A digital forensic investigator must have a broad knowledge of forensic methodologies and experience with a wide range of tools. This includes multi-purpose forensic suites with advanced functionality and good usability as well as small tools for special tasks that may have moderate to low usability. Gaining expert-level skills in the operation of forensic tools requires a substantial amount of time. Additionally, advances in analysis methods, tools and technologies require continuous learning to maintain currency.

In digital forensics education, it is important to provide insights into specific technologies and how forensic methods must be applied to perform thorough and sound analyses. It is also very important to provide a rich learning environment where students can use forensic tools to rigorously analyze suitable test data.

The same is true in digital forensics research. New methodologies and new tools have to be tested against well-known data corpora. This provides a basis for comparing methodologies and tools so that the advantages and shortcomings can be identified. Forensic investigators can use the results of such evaluations to make informed decisions about the methodologies and tools that should be used for specific tasks. This helps increase the efficiency and the quality of forensic examinations while allowing objective evaluations by third parties.

The paper provides an overview of several real-world and synthetic data corpora that are available for digital forensics education and research. Also, it highlights the potential risks and problems encountered when using data corpora, along with the capabilities of existing tools that allow the generation of synthetic data corpora when real-world data is not available. Additionally, the paper describes a custom framework for synthetic data generation and evaluates the performance of the framework.

Available Data Corpora

Several data corpora have been made available for public use. While some of the corpora are useful for digital forensics education and research, others are suited to very specific areas such as network forensics and forensic linguistics. This section presents an overview of the most relevant corpora.

Real Data Corpus

A few real-world data corpora are available to support digital forensics education and research. Garfinkel, et al. [START_REF] Garfinkel | Bringing science to digital forensics with standardized forensic corpora[END_REF] have created the Real Data Corpus from used hard disks that were purchased from around the world. In a later work, Garfinkel [START_REF] Garfinkel | Lessons learned writing digital forensics tools and managing a 30 TB digital evidence corpus[END_REF] described the challenges and lessons learned while handling the Real Data Corpus, which by then had grown to more than 30 terabytes [START_REF] Garfinkel | Lessons learned writing digital forensics tools and managing a 30 TB digital evidence corpus[END_REF]. As of September 2013, the Real Data Corpus incorporated 1,289 hard disk images, 643 flash memory images and 98 optical discs. However, because this corpus was partly funded by the U.S. Government, access to the corpus requires the approval of an institutional review board in accordance with U.S. legislation. Ad-ditional information about the corpus and its access requirements are available at [START_REF] Garfinkel | Digital Corpora[END_REF].

A smaller corpus, which includes specific scenarios created for educational purposes [START_REF] Woods | Creating realistic corpora for security and forensic education[END_REF], can be downloaded without any restrictions. This smaller corpus contains: Three test disk images created especially for educational and testing purposes (e.g., filesystem analysis, file carving and handling encodings).

Four realistic disk image sets created from USB memory sticks, a digital camera and a Windows XP computer.

A set of almost 1,000,000 files, including 109,282 JPEG files.

Five phone images from four different cell phone models.

Mixed data corresponding to three fictional scenarios for educational purposes, including multiple network packet dumps and disk images.

Due to the variety of data it contains, the Real Data Corpus is a valuable resource for educators and researchers in the areas of multimedia forensics, mobile phone forensics and network forensics. To our knowledge, it is the largest publicly-available corpus in the area of digital forensics.

DARPA Intrusion Detection Data Sets

In 1998 and 1999, researchers at MIT Lincoln Laboratory [START_REF] Lippmann | Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation[END_REF][START_REF] Lippmann | The 1999 DARPA off-line intrusion detection evaluation[END_REF]] created a simulation network in order to produce network traffic and audit logs for evaluating intrusion detection systems. The simulated infrastructure was attacked using well-known techniques as well as new techniques that were specially developed for the evaluation. In 2000, additional experiments were performed involving specific scenarios, including two DDoS attacks and an attack on a Windows NT system. The data sets for all three experiments are available at [START_REF]DARPA Intrusion Detection Data Sets[END_REF]; they include network traffic data in tcpdump format, audit logs and filesystem snapshots.

The methodologies employed in the 1998 and 1999 evaluations were criticized by McHugh [START_REF] Mchugh | Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory[END_REF]. McHugh states that the evaluation results miss important details and that portions of the evaluation procedures are unclear or inappropriate. Additionally, Garfinkel [START_REF] Garfinkel | Forensic corpora, a challenge for forensic research[END_REF] points out that the data sets do not represent real-world traffic because they lack complexity and heterogeneity. Therefore, this corpus has limited use in network forensics research.

MemCorp Corpus

The MemCorp Corpus [START_REF] Vidas | MemCorp: An open data corpus for memory analysis[END_REF] contains memory images created from several virtual and physical machines. In particular, the corpus contains images extracted from 87 computer systems running various versions of Microsoft Windows; the images were extracted using common memory imaging tools.

The corpus includes the following images:

53 system memory images created from virtual machines.

23 system memory images created from physical machines with factory default configurations (i.e., with no additional software installed).

11 system memory images created from machines under specific scenarios (e.g., after malware was installed).

This corpus supports education and training efforts focused on memory analysis using tools such as the Volatile Framework [START_REF] Volatilty | The Volatility Framework (code[END_REF]. However, as noted by the corpus creator [START_REF] Vidas | MemCorp: An open data corpus for memory analysis[END_REF], the corpus does not contain images created from real-world systems or images from operating systems other than Microsoft Windows, which reduces its applicability. The creator of the MemCorp Corpus provides access to the images upon request.

MORPH Corpus

Several corpora have been created in the area of face recognition [START_REF] Grgic | Face Recognition Homepage[END_REF]. Since a large corpus with facial images tagged with age information would be very useful for multimedia forensics, we have picked a sample corpus that could be a valuable resource for research (e.g., for detecting of illegal multimedia content like child pornography).

The MORPH Corpus [START_REF] Ricanek | Morph: A longitudinal image database of normal adult age-progression[END_REF] comprises 55,000 unique facial images of more than 13,000 individuals. The ages of the individuals range from 16 to 77 with a median age of 33. Four images on average were taken of each individual with an average time of 164 days between each image.

Facial images annotated with age information are useful for developing automated age detection systems. Currently, no reliable methods (i.e., with low error rates) exist for age identification. Steinebach, et al. [START_REF] Steinebach | FaceHash: Face detection and robust hashing[END_REF] have employed face recognition techniques to identify known illegal multimedia content, but they did not consider age classification.

Enron Corpus

The Enron Corpus introduced in 2004 is a well-known corpus in the area of forensic linguistics [START_REF] Klimt | Introducing the Enron Corpus[END_REF]. In its raw form, the corpus contains 619,446 email messages from 158 executives of Enron Corporation; the email messages were seized during the investigation of the 2001 Enron scandal. After data cleansing, the corpus contains 200,399 messages. The Enron Corpus is one of the most referenced mass collections of realworld email data that is publicly available.

The corpus provides a valuable basis for research on email classification, an important area in forensic linguistics. Klimt and Yang [START_REF] Klimt | The Enron Corpus: A new dataset for email classification research[END_REF] suggest using thread membership detection for email classification and provide the results of baseline experiments conducted with the Enron Corpus. Data sets from the Enron Corpus are available at [START_REF] Cohen | Enron Email Dataset[END_REF].

Global Intelligence Files

In February 2012, WikiLeaks started publishing the Global Intelligence Files, a large corpus of email messages gathered from the intelligence company Stratfor. WikiLeaks claims to possess more than 5,000,000 email messages dated between July 2004 and December 2011. As of September 2013, almost 3,000,000 of these messages have been available for download by the public [START_REF]The Global Intelligence Files[END_REF]. WikiLeaks continues to release new email messages from the corpus on an almost daily basis.

Like the Enron Corpus, the Global Intelligence Files would provide a valuable basis for research in forensic linguistics. However, we are not aware of any significant research conducted using the Global Intelligence Files.

2.7

Computer Forensic Reference Data Sets

The Computer Forensic Reference Data Sets maintained by NIST [START_REF]The CFReDS Project[END_REF] is a small data corpus created for training and testing purposes. The data sets include test cases for file carving, system memory analysis and string search using different encodings.

The corpus contains the following data:

One hacking case scenario.

Two images for unicode string searches.

Four images for filesystem analysis.

One image for mobile device analysis.

One image for system memory analysis.

Two images for verifying the results of forensic imaging tools.

This corpus provides a small but valuable reference set for tool developers. It is also suitable for training in forensic analysis methods.

Pitfalls of Data Corpora

Forensic corpora are very useful for education and research, but they have certain pitfalls.

Solution Specificity: While a corpus is very valuable when developing methodologies and tools that solve research problems in digital forensics, it is difficult to find general solutions that are not somehow tailored to the corpus. Even when a solution is intended to work in general (with different corpora and in the real world), research and development efforts often slowly adapt the solution to the corpus over time, probably without even being noticed by the researchers. For example, the Enron Corpus is widely used by the forensics linguistics community as a single basis for research on email classification. It would be difficult to show that the research results based on this corpus apply to general email classification problems.

This could also become an issue if, for instance, a general methodology or tool that solves a specific problem already exists, and another research group is working to enhance the solution. Using only one corpus during development increases the risk of crafting a solution that may be more effective and efficient than previous solutions, but only when used with that specific corpus.

Legal Issues:

The data in corpora such as Garfinkel's Real Data Corpus created from used hard disks bought from the secondary market may be subject to intellectual property and personal privacy laws. Even if the country that hosts the real-world corpus allows its use for research, legal restrictions could be imposed by a second country in which the research that uses the corpus is being conducted. The worst case is when local laws completely prohibit the use of the corpus.

Relevance: Data corpora are often created as snapshots of a specific scenarios or environments. The data contained in corpora often loses its relevance as it ages. For example, network traffic from the 1990s is quite different from current network traffic -a fact that was pointed out for the DARPA Intrusion Detection Data Sets [START_REF] Garfinkel | Forensic corpora, a challenge for forensic research[END_REF][START_REF] Mchugh | Testing intrusion detection systems: A critique of the 1998 and 1999 DARPA intrusion detection system evaluations as performed by Lincoln Laboratory[END_REF]. Another example is a data corpus containing data extracted from mobile phones. Such a corpus must be updated very frequently with data from the latest devices if it is to be useful for mobile phone forensics. Transferability: Many data corpora are created or taken from specific local environments. The email messages in the Enron Corpus are in English. While this corpus is valuable to forensic linguists in English-speaking countries, its value to researchers focused on other languages is debatable. Indeed, many important properties that are relevant to English and used for email classification may not be applicable to Arabic or Mandarin Chinese.

Likewise, corpora developed for testing forensic tools that analyze specific applications (e.g., instant messaging software and chat clients) may not be useful in other countries because of differences in jargon and communication patterns. Also, a corpus that mostly includes Facebook posts and IRC logs may not be of much value in a country where these services are not popular.

Synthetic Data Corpus Generation

Aside from methodologies for creating synthetic data corpora by manually reproducing real-world actions, little research has been done related to tool-supported synthetic data corpus generation. Moch and Freiling [START_REF] Moch | The Forensic Image Generator Generator[END_REF] have developed Forensig2, a tool that generates synthetic disk images using virtual machines. While the process for generating disk images has to be programmed in advance, the tool allows randomness to be introduced in order to create similar, but not identical, disk images. In a more recent work, Moch and Freiling [START_REF] Moch | Evaluating the Forensic Image Generator Generator[END_REF] present the results of an evaluation of Forensig2 applied to student education scenarios.

A methodology for generating a synthetic data corpus for forensic accounting is proposed in [START_REF] Lundin | A synthetic fraud data generation methodology[END_REF] and evaluated in [START_REF] Lundin Barse | Synthesizing test data for fraud detection systems[END_REF]. The authors demonstrate how to generate synthetic data containing fraudulent activities from smaller collections of real-world data. The data is then used for training and testing a fraud detection system.

Corpus Generation Process

This section describes the process for generating a synthetic data corpus using the model-based framework presented in [START_REF] Yannikos | Model-based generation of synthetic disk images for digital forensic tool testing[END_REF].

Figure 1 presents the synthetic data generation process. The first step in generating a synthetic data corpus is to define the data use cases. For example, in a digital forensics class, where students will be tested on their knowledge about hard disk analysis, one or more suitable disk images would be required for each student. The students would have to search the disk images for traces of malware or recover multimedia data fragments using tools such as Foremost [1] and Sleuth Kit [START_REF] Carrier | The Sleuth Kit[END_REF].

The disk images could be created in a reasonable amount of time manually or via scripting. However, if every student should receive different disk images for analysis, then significant effort may have to be expended to insert variations in the images. Also, if different tasks are assigned to different students (e.g., one student should recover JPEG files and another student should search for traces of a rootkit), more significant variations would have to be incorporated in the disk images.

The second step in the corpus generation process is to specify a realworld scenario in which the required kind of data is typically created. One example is a computer that is used by multiple individuals, who typically install and remove software, and download, copy, delete and overwrite files.

The third step is to create a model to match this scenario and serve as the basis of a simulation, which is the last step. A Markov chain consisting of states and state transitions can be created to model user behavior. The states correspond to the actions performed by the users and the transitions specify the actions that can be performed after the preceding actions.

Scenario Modeling using Markov Chains

Finite discrete-time Markov chains as described in [START_REF] Yannikos | 3LSPG: Forensic tool evaluation by three layer stochastic process-based generation of data[END_REF] are used for synthetic data generation. One Markov chain is created for each type of subject whose actions are to be simulated. A subject corresponds to a user who performs actions on a hard disk such as software installations and file deletions. The states in the Markov chain correspond to the actions performed by the subject in the scenario.

In order to construct a suitable model, it is necessary to first define all the actions (states) that cause data to be created and deleted. The transitions between actions are then defined. Following this, the probability of each action is specified (state probability) along with the probability of each transition between two actions (transition probability); the probabilities are used during the Markov chain simulation to generate realistic data. The computation of feasible transition probabilities given state probabilities can involve some effort, but the process has been simplified in [START_REF] Yannikos | Synthetic data creation for forensic tool testing: Improving performance of the 3LSPG Framework[END_REF].

Next, the number of subjects who perform the actions are specified (e.g., number of individuals who share the computer). Finally, the details of each possible action are specified (e.g., what exactly happens during a download file action or a delete file action).

Model-Based Simulation

Having constructed a model of the desired real-world scenario, it is necessary to conduct a simulation based on the model. The number of actions to be performed by each user is specified and the simulation is then started. At the end of the simulation, the disk image contains synthetic data corresponding to the modeled real-world scenario.

Sample Scenario and Model

To demonstrate the synthetic data generation process, we consider a sample scenario. The purpose for generating the synthetic data is to test how different file carvers deal with fragmented data. The realworld scenario involves an individual who uses an USB memory stick to transfer large amounts of files, mainly photographs, between computers.

In the following, we define all the components in a model that would facilitate the creation of a synthetic disk image of a USB memory stick containing a large number of files, deleted files and file fragments. The resulting disk image would be used to test the ability of file carvers to reconstruct fragmented data.

States: In the sample model, the following four actions are defined as Markov chain states:

1. Add Document File: This action adds a document file (e.g., PDF or DOC) to the filesystem of the synthetic disk image. It is equivalent to copying a file from one hard disk to another using the Linux cp command.

Add Image File:

This action adds an image file (e.g., JPEG, PNG or GIF) to the filesystem. Again, it is equivalent to using the Linux cp command.

3. Write Fragmented Data: This action takes a random image file, cuts it into multiple fragments and writes the fragments to the disk image, ignoring the filesystem. It is equivalent to using the Linux dd for each file fragment.

4. Delete File: This action removes a random file from the filesystem. It is equivalent to using the Linux rm command. Transitions: Next, the transitions between the actions are defined. Since the transitions are not really important in the scenario, the Markov chain is simply constructed as a complete digraph (Figure 2). The state numbers in the Markov chain correspond to the state numbers specified above.

State Probabilities: Next, the probability π i of each action (state) i to be performed during a Markov chain simulation is specified. We chose the following probabilities for the actions to ensure that a large number of files and file fragments are added to the synthetic disk image and only a maximum of about half of the added files are deleted: π = (π 1 , . . . , π 4 ) = (0.2 , 0.2 , 0.4 , 0.2).

State Transition Probabilities: Finally, the feasible probabilities for the transitions between the actions are computed. The framework is designed to compute the transition probabilities automatically. One possible result is the simple set of transition probabilities specified in the matrix: where p ij denotes the probability of a transition from action i to action j.

P = ⎡ ⎢ ⎢ ⎣ 0.

Corpora Generation Framework

The framework developed for generating synthetic disk images is implemented in Java 1.7. It uses a modular design with a small set of core components, a graphical user interface (GUI) and modules that provide specific functionality. The GUI provides a model building interface that allows a model to be created quickly for a specific scenario using the actions available in the framework. Additionally, an image viewer is implemented to provide detailed views of the generated synthetic disk images.

New actions in the framework can be added by implementing a small number of interfaces that require minimal programming effort. Since the framework supports the specification and execution of an abstract synthetic data generation process, new actions can be implemented independently of a scenario for which a synthetic disk image is being created. For example, it is possible to work on a completely different scenario where financial data is to be created in an enterprise relationship management system. The corresponding actions that are relevant to creating the financial data can be implemented in a straightforward matter.

The screenshot in Figure 3 shows the model builder component of the framework. The Markov chain used for generating data corresponding to the sample scenario is shown in the center of the figure (green box).

Framework Evaluation

This section evaluates the performance of the framework. The sample model described above is executed to simulate a computer user who performs write and delete actions on a USB memory stick. The evaluation setup is as follows:

Model: Described in Section 5.3. runs, the file sizes and, therefore, the disk space usage differ. On the average, 57% of the available disk space was used. Figure 5(b) shows the average number of file fragments per file type over all 20 simulation runs. The writing of fragmented data used a dedicated file source containing only pictures; this explains the large numbers of JPEG and PNG fragments.

Figure 6 shows a screenshot of the image viewer provided by the framework. Information such as the data type, fragment size and filesystem status (allocated and deleted) is provided for each block.

Conclusions

The framework presented in this paper is well-suited to scenario-based model building and synthetic data generation. In particular, it provides a flexible and efficient approach for generating synthetic data corpora. The experimental evaluation of creating a synthetic disk image for testing the fragment recovery performance of file carvers demonstrates the utility for the framework. Unlike real-world corpora, synthetic corpora provide ground truth data that is very important in digital forensics education and research. This enables students as well as developers and testers to acquire detailed understanding of the capabilities and performance of digital forensic tools. The ability of the framework to generate synthetic corpora based on realistic scenarios can satisfy the need for test data in applications for which suitable real-world data corpora are not available. Moreover, the framework is generic enough to produce synthetic corpora for a variety of domains, including forensic accounting and network forensics.

Figure 1 .

 1 Figure 1. Generating synthetic data based on a real-world scenario.

Figure 2 .

 2 Figure 2. Markov chain used to generate a synthetic disk image.

Figure 3 .

 3 Figure 3. Screenshot of the model builder.

  Time required for each simulation run.

Figure 4 .

 4 Figure 4. Evaluation results for 20 simulation runs.

  Average number of fragments per file type.

Figure 5 .

 5 Figure 5. Evaluation results for 20 simulation runs.

Figure 6 .

 6 Figure 6. Screenshot of the image viewer.

  Used disk space corresponding to allocated files, deleted files and file fragments.

	Unused Disk Space (%)	100 50	34.77	84.38	54.02	52.06	71.62	74.73	51.52	62.99	68.85	46.47	43.27	59.97	59.89	35.71	58.32	64.11	61.12	39.36	47.41	67.90
		0
		(a)

Acknowledgement

This research was supported by the Center for Advanced Security Research Darmstadt (CASED).

Discrete Simulation Steps: 4,000 actions.

Synthetic Disk Image Size: 2,048 MiB (USB memory stick).

Filesystem: FAT32 with 4,096-byte cluster size.

Add Document File Action: A document (e.g., DOC, PDF or TXT) file is randomly copied from a local file source containing 139 document files.

Add Image File Action: An image (e.g., PNG, JPEG or GIF) file is randomly copied from a local file source containing 752 image files.

Delete File Action: A file is randomly chosen and deleted from the filesystem of the synthetic disk image without overwriting.

Write Fragmented Data Action: An image file is randomly chosen from the local file source containing 752 image files. The file is written to the filesystem of the synthetic disk image using a random number of fragments between 2 and 20, a random fragment size corresponding to a multiple of the filesystem cluster size and randomly-selected cluster-aligned locations for fragment insertion.

Twenty simulations of the model were executed using the setup. After each run, the time needed to completely generate the synthetic disk image was assessed, along with the amount of disk space used, number of files deleted, number of files still available in the filesystem and number of different file fragments written to the image.

Figure 4(a) shows the time required by framework to run each simulation. On the average, a simulation run was completed in 2 minutes and 21 seconds. Figure 4(b) presents an overview of the numbers of files that were allocated in and deleted from the synthetic disk images. Note that the allocated (created) files are shown in light gray while the deleted files are shown in dark gray; the average value is shown as a gray line. On the average, a disk image contained 792 allocated files and 803 deleted files, which are expected due to the probabilities chosen for the actions in the model.

Figure 5(a) shows the used disk space in the synthetic image corresponding to allocated files (light gray), deleted files (gray) and file fragments (dark gray). The used space differs considerably over the simulation runs because only the numbers of files to be written and deleted from the disk image were defined (individual file sizes were not specified). Since the files were chosen randomly during the simulation


Mark Pollitt

Philip Craiger

EDUCATING THE NEXT GENERATION OF CYBERFORENSIC PROFESSIONALS

Keywords: Digital forensics, education, certification, accreditation

This paper provides a historical overview of the development of cyberforensics as a scientific discipline, along with a description of the current state of training, educational programs, certification and accreditation. The paper traces the origins of cyberforensics, the acceptance of cyberforensics as forensic science and its recognition as a component of information security. It also discusses the development of professional certifications and standardized bodies of knowledge that have had a substantial impact on the discipline. Finally, it discusses the accreditation of cyberforensic educational programs, its linkage with the bodies of knowledge and its effect on cyberforensic educational programs.

Introduction

Cyberforensics, also referred to as digital forensics, computer forensics and multimedia forensics, has a relatively short history. A new science, it has displayed rapid growth for several reasons, perhaps the most important of which is the world's increasing reliance on technology for computing and communications. The field changes rapidly due to advances in technology. The most illustrative example is the smartphone, which, unlike cellular phones of the past, is essentially a small, but powerful, personal computer. Although smartphones were introduced about a decade ago, a recent study has found that nearly 60% of American adults own a smartphone [18]. Other new technologies, such as wearable computers (e.g., Google Glass [START_REF] Honan | Glasshole: My year with Google Glass[END_REF]) and life-enhancing technologies (e.g., driverless cars [START_REF] Markoff | Google cars drive themselves, in traffic[END_REF]) will drive the need for educated, trained and certified cyberforensic professionals. This paper explores where the dis-cipline of cyberforensics has been, its current state and what the future may hold.

The first question is: Is cyberforensics a scientific discipline? The best way to answer this question is to observe how other sciences are defined. We suggest the use of Thomas Kuhn's framework. In his book The Structure of Scientific Revolutions [START_REF] Kuhn | The Structure of Scientific Revolutions[END_REF], Kuhn says that "normal science" is defined by a common paradigm. The paradigm is a shared set of theories, practices and models that are acknowledged by the community. The paradigm serves both a research purpose and an educational purpose. The former allows scientists the luxury of relying on a foundation of acknowledged principles, freeing them from having to build a foundation for every new research effort and having to re-articulate the basis of every single element of research. It also serves an important purpose in defining the things that a student must know in order to become a researcher or a practitioner. Ultimately, according to Kuhn, it is the combination of shared models, educational experience and disciplinespecific language that define a mature science.

We posit that cyberforensics is a mature scientific discipline, notwithstanding the fact that as technology changes, so must the discipline. To support this argument, we offer brief histories of the practice of cyberforensics, the accreditation of cyberforensic laboratories and educational programs, and the certification of cyberforensic practitioners. Note that the term "accreditation" describes the process by which an external body determines that a particular, unit, laboratory or educational program meets the requirements of the education and/or practitioner communities, and "certification" is the attestation that an individual meets the standards of a competent practitioner.

Cyberforensics

It is difficult to identify the precise moment that the discipline of cyberforensics started. Perhaps it was shortly after the very first digital computer was invented. But the term "computer forensics" did not come into its own until the 1980s, when the Federal Bureau of Investigation (FBI) and the U.S. Internal Revenue Service (IRS) created small teams of agents to conduct searches of mainframe computers in connection with criminal cases. By the early 1990s, personal computers had become commonplace. Criminal investigators realized that computers were potentially a rich source of evidence. Local, state and federal agencies launched programs to exploit this potential source of evidence. The first training programs for what would be called "computer foren-sic examiners" began at the Federal Law Enforcement Training Center (FLETC) in Glenco, Georgia [START_REF] Pollitt | A history of digital forensics[END_REF].

During the mid 1990s, the explosion of the Internet facilitated many new computer-based crimes. In addition to computer and telecommunications fraud, child pornography became a law enforcement problem of unprecedented size. Online undercover operations, which sought to identify and prosecute subjects who were creating and exchanging child pornography, drove a massive need for cyberforensic examinations. Child pornography and all the other Internet-based crimes accelerated through the millennium and into the current era of global cloud computing [START_REF] Pollitt | A history of digital forensics[END_REF].

Today, with the reality of ubiquitous mobile computing, cloud computing, social networks and other technologies, vast quantities of potential digital evidence are being produced at a phenomenal rate. The use of digital evidence in civil litigation has likewise exploded. Cyberforensic techniques and methodologies have become essential tools in information security and incident response. Cyberforensic examiners require broad and deep technical knowledge as well strong investigative skills.

Origins of Cyberforensics Training

A number of watershed events have steered the disorganized practice of forensics into a scientific discipline. Arguably, the creation of formal training and certification programs laid the first foundation for the discipline. In 1991, the International Association of Computer Investigative Specialists (IACIS) [11] was formed and it soon launched formal efforts to train law enforcement officers in conducting forensic examinations of computers. IACIS also created the first certification program for practitioners [START_REF] Pollitt | A history of digital forensics[END_REF].

The establishment of formal law enforcement units to conduct digital forensic examinations also played a major role in the development of cyberforensics as a discipline. In 1992, the FBI created the Computer Analysis Response Team (CART) at the FBI Laboratory in Quantico, Virginia. This unit, along with similar units in the United States Secret Service (USSS) and the IRS would play important roles in the creation of stakeholder organizations that would develop standards for the nascent discipline. The FBI developed its own training unit and staff at the FBI Academy in Quantico, Virginia, while the USSS, IRS and others developed a robust training facility at FLETC in Glynco, Georgia [START_REF] Pollitt | A history of digital forensics[END_REF].

In the late 1990s, commercial forensic tools became available. Vendors began to offer courses to train new users in the use of their tools and subsequently offered certifications such as EnCase Certified Examiner (EnCE) [START_REF]Guidance Software, Guidance Software[END_REF] and Access Data Certified Examiner (ACE) [1]. Initially, these vendor certifications were the only certifications available outside of law enforcement agencies and other government organizations [START_REF] Pollitt | A history of digital forensics[END_REF].

Cyberforensic Functional Standards

In 1995, some 20 agencies from countries such as the United States, United Kingdom, France, Australia, The Netherlands and Sweden set up the International Organization on Computer Evidence (IOCE) [START_REF]International Organization on Computer Evidence, Guidelines for Best Practice in the Forensic Examination of Digital Technology[END_REF]. This organization would go on to develop and promulgate the principles on which standards would built. The IOCE Principles were developed from principles originally proposed by the Association of Chief Police Officers (ACPO) from the United Kingdom. While the ACPO principles were important, in and of themselves, it was the international consensus obtained by IOCE that was revolutionary. It marked the first time that disparate organizations publicly acknowledged a shared view of the forensic examination process. In 2000, the Group of Eight (G8) Subgroup on High Technology Crime voted to accept the IOCE Principles, thus gaining political recognition of the consensus view of the digital forensic community [START_REF] Pollitt | A history of digital forensics[END_REF].

In 1998, the Scientific Working Group on Digital Evidence (SWGDE) [START_REF]Scientific Working Group on Digital Evidence, Scientific Working Group on Digital Evidence[END_REF] was established. The stated goal of this organization was to develop standards for the governance of digital forensics within the United States. SWGDE also sought to have digital forensics identified as a legitimate forensic laboratory discipline. SWGDE worked with the Association of Crime Laboratory Directors -Laboratory Accreditation Board (ASCLD-LAB) [4] to make digital evidence an accreditable discipline for crime laboratories. In 2003, ASCLD-LAB accredited the first digital evidence unit. As of 2013, ASCLD-LAB had accredited 73 digital evidence laboratories.

Meanwhile, the European forensic science community developed its own working group called the European Network of Forensic Science Institutes -Forensic Information Technology Working Group (ENFSI-FITWG) [7]. This group continues to provide a forum for training and standards development [START_REF] Pollitt | A history of digital forensics[END_REF].

Near the end of the first decade of the 21st century, the United States Government established the National Initiative for Cybersecurity Education (NICE) [START_REF]National Initiative for Cybersecurity Education (NICE)[END_REF]. This initiative sought to identify the knowledge, skills, experience and academic preparation needed for the cybersecurity workforce. The resulting NICE Framework (Version 1.0) identifies seven functional specialty areas. One of the areas is "Investigative Specialty," which has a sub-area dedicated to cyberforensics. In 2013 and 2014, NICE utilized focus groups from the stakeholder communities to further develop the core definitions and duties associated with each specialty area and sub-area. The first author of this paper participated in this activity, and he can attest that the functional standards described above were relied upon heavily in the focus group deliberations. Version 2 of the NICE Framework, incorporating the work of the focus groups, is expected to be promulgated in 2014.

Educational Program Accreditation

A number of organizations focusing on education, training and certification were established to ensure that practitioners would be knowledgeable in the principles and practice of cyberforensics. In 2006, the Technical Working Group on Education -Digital Evidence (TWGED-DE) was created by the National Institutes of Justice. This working group brought together academics (including the second author of this paper) and practitioners to develop a common understanding of the required knowledge and skills for digital forensic practitioners. TWGED-DE produced a document outlining the best practices for cyberforensics education and training [22]. This document has been the basis of much subsequent work in the discipline [8].

In 2008, the American Academy of Forensic Sciences (AAFS), the premier American professional organization for forensic sciences, established its Digital and Multimedia Sciences Section [3]. The section was formed with approximately 40 members. As of 2014, it had nearly 100 members.

Traditional forensic science education programs have existed for many years. However, as a result of the work done by TWGED-DE, AAFS created the Forensic Science Education Program Accreditation Commission (FEPAC) [8] in 2004. FEPAC focuses on the accreditation of digital forensic education programs. In 2012, FEPAC accredited its first master's program in digital evidence at Marshall University.

Recognizing the need for digital forensic practitioners in the U.S. Department of Defense, the Defense Cyber Crime Center (DC3) brought together a number of academics and practitioners to develop a certification and accreditation program for the Department of Defense called the Centers of Digital Forensics Academic Excellence (CDFAE) [5]. The standards, developed by consensus, drew on bodies of knowledge that were previously identified by other organizations, including ASCLD-LAB, TWGED-DE, FEPAC and the Digital Forensics Certification Board (DFCB) [START_REF]Digital Forensics Certification Board, Digital Forensics Certification Board (DFCB)[END_REF]. In 2013, CDFAE accredited its first two-year academic program [5].

In 2012, the Advanced Technology Education Program of the National Science Foundation (NSF-ATE) invested nearly $2 million in the Advanced Cyberforensics Education (ACE) Consortium [START_REF]Advanced Cyberforensics Education Consortium, Advanced Cyberforensics Education (ACE)[END_REF] for the express purpose of developing cyberforensic education programs that meet the needs of government and industry. The authors of this paper are the Principal and Co-Principal Investigators, respectively, of the ACE effort. Key ACE initiatives are to develop and disseminate course curricula (including syllabi, course materials and laboratory exercises) and to conduct faculty training programs that will meet the educational accreditation standards of FEPAC and CDFAE. The goals of ACE are to: (i) ensure that faculty know and teach the core knowledge of the field; (ii) ensure that faculty teach courses that meet the needs of employers; (iii) ensure that academic institutions develop programs that are accreditable; (iv) prepare students for professional certifications; and (v) provide education and training opportunities for displaced professionals.

Practitioner Certification

Similar to the development of standards and accreditations, the certification of cyberforensic practitioners grew organically. The first certification for professionals was likely created by the International Association of Computer Investigative Specialists (IACIS) in 1991. IACIS hosted ab initio training courses that were available only to sworn law enforcement professionals. Since training and certification predated the development of commercial digital forensic software, the courses focused heavily on understanding the operation of computers, operating systems, file systems and applications. Foundational tools such as hex editors were utilized in a methodological way to exploit the practitioner's understanding of the technology for forensic purposes [START_REF]International Organization on Computer Evidence, Guidelines for Best Practice in the Forensic Examination of Digital Technology[END_REF][START_REF] Pollitt | A history of digital forensics[END_REF]. This instituted the paradigm of requiring professional certifications to cover a foundational set of knowledge, a forensic methodology and tool usage.

In the late 1990s, integrated commercial tools such as EnCase [START_REF]Guidance Software, Guidance Software[END_REF] and Forensic Toolkit [1] were sufficiently complex that practitioners required special training to utilize them effectively. Vendors thus began to offer training courses on the use of their tools; the courses were typically two to five days in length. While the vast majority of the training focused on using tools, some basic knowledge was covered to ensure that the participants had a common baseline. At the end of the training courses, the participants were offered the opportunity to take written and practical tests and be "certified" by the vendors. Formal training in these complex tools is necessary and important. Nevertheless, it is abundantly clear that a short tool-centered class does not provide the full range of knowledge and experience that defines a cyberforensic professional.

Over the past decade or so, a number of organizations in addition to IACIS have developed and fostered "professional certifications" that seek to recognize individuals who have broad foundational knowledge as well as adequate practical experience to demonstrate a professional level of competence in the cyberforensics field [START_REF] Pollitt | A history of digital forensics[END_REF][START_REF] Tittel | Best computer forensics certifications for[END_REF] While the certifications differ, they share a common set of requirements. All of them require demonstrated mastery of a core set of knowledge coupled with demonstrated skill and experience. Especially interesting is the fact that the core knowledge required by each of the certifications is remarkably similar. This should not be surprising because many of the individuals who contributed to the development of these certifications also helped set the functional and academic standards that were discussed previously.

Conclusions

Training, education, professional certifications and organizational accreditation have made substantial inroads in the cyberforensics field during the past decade. One might surmise that this is merely a "happy coincidence." However, we posit that, given the wide range of educators, practitioners, managers and government officials involved, the events described in this paper are evidence of the development of a paradigm that corresponds to the concept of "normal science" according to Kuhn [START_REF] Kuhn | The Structure of Scientific Revolutions[END_REF]. Indeed, what has emerged is a common view of the fundamentals that form the basis of cyberforensics, an acknowledged set of processes that constitute the practice of cyberforensics, and an agreed set of norms that define the ethical conduct of cyberforensics.

The future is bright. The cyberforensics community is engaged in an active dialog involving government and industry, academics and prac-titioners, investigators and forensic examiners, as well as certification and accreditation bodies. This collaboration will enable standards to evolve quickly in the dynamic world of technology. No doubt, there will be bumps in the road. But the constant challenges and evolution that characterize "normal science" will continue to strengthen cyberforensics as a scientific discipline.

  . Examples of these professional certifications are the Certified Computer Examiner (CCE) from the International Society of Forensic Computer Examiners (ISFCE) [14], Certified Forensic Computer Examiner (CFCE) from IACIS [11], Digital Forensics Certified Practitioner (DFCP) from DFCB [6] and Certified Cyber Forensics Professional (CCFP) from (ISC) 2 [12]. The authors of this paper were actively involved in developing some of these professional certifications and can vouch for the tremendous difficulty in developing such certifications. In 2014, the DC3 in conjunction with the CDFAE Accreditation Program [5] began to issue certifications to individual students who completed CDFAE-approved academic programs and passed written and practical tests.