Antonio Pooe

Les Labuschagne

Cognitive Approaches for Digital Forensic Readiness Planning

Keywords: Digital forensic readiness, digital evidence, cognitive approaches

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

From the perspective of law enforcement agencies, the forensic process begins when a crime has been committed or when a crime has been discovered and reported [START_REF]Digital Crime and Forensic Science in Cyberspace[END_REF]. Forensic readiness enables organizations to preempt the occurrence of crimes by gathering evidence in advance and, in doing so, derive benefits in instances where prosecution becomes an issue and limit their risks [START_REF] Hoolachan | Organizational handling of digital evidence[END_REF].

The organizational requirement to gather and use digital evidence has been recognized in a number of studies (see, e.g., [START_REF] Cohen | Distributed forensics and incident response in the enterprise[END_REF][START_REF] Hoolachan | Organizational handling of digital evidence[END_REF]). These studies stress the importance of a structure to maintain the integrity of forensic evidence. In particular, Yasinsac and Manzano [START_REF] Manzano | Policies to enhance computer and network forensics[END_REF] note that organizational policies play a critical role in providing the needed structure. Yasinsac and Manzano also propose six categories of policies to facili-tate digital forensic investigations. The categories are designed to help organizations deter digital crime and position themselves to respond to attacks by improving their ability to conduct investigations. The six categories of policies that facilitate digital forensic investigations are:

1. Retaining Information: Policies that relate to the storage of information by an organization.

2. Planning the Response: Policies that guide an organization's plans for responding to incidents and situations.

Training:

Policies that address the training of staff members and others affiliated with an organization.

Accelerating the Investigation:

Policies that address the operational aspects of investigations.

Preventing Anonymous Activities:

Policies that address an organization's proactive efforts against fraud.

6. Protecting the Evidence: Policies that address the handling and protection of evidence and other vital data.

From the above discussion, the concept of digital forensic readiness has two main objectives: (i) maximizing the ability to collect credible digital evidence (Categories 1, 2, 5 and 6 above); and (ii) minimizing the cost of digital forensics during incident response (Categories 3 and 4). While this reinforces the importance of cohesive policies in organizations, the problem with the categorization is that it suggests that organizations must have all six policies in place, which may result in possible duplication and/or conflicting policy statements. Furthermore, it may lead to confusion in identifying the authority/governing policy for facilitating digital investigations. While the policies are important, they alone do not guarantee a holistic digital forensic readiness plan.

Because of the potential policy conflicts, our study used mixed methods interviews [START_REF] Cresswell | Designing and Conducting Mixed Methods Research[END_REF] as a means to develop a holistic digital forensic readiness plan. The interviews were employed as an exploratory research tool to gather information from subject matter experts and to capture real-world experiences with the goal of identifying key components for consideration.

Research Design

Mixed method research is a design with philosophical assumptions and various methods of inquiry [START_REF] Cresswell | Designing and Conducting Mixed Methods Research[END_REF]. The philosophical assumptions guide the direction of the collection and analysis of data while the combination of qualitative and quantitative methods of inquiry in a single or series of studies offers a better understanding of research problems than each approach on its own [START_REF] Teddlie | Foundations of Mixed Methods Research: Integrating Quantitative and Qualitative Approaches in the Social and Behavioral Sciences[END_REF].

The intent of the two-phase exploratory design is that the results of the first method (qualitative) can help develop or inform the second method (quantitative) [START_REF] Cresswell | Designing and Conducting Mixed Methods Research[END_REF]. This is based on the premise that an exploration may be needed for one or more reasons, which takes into account the possibility that measures or instruments are not available, variables are unknown and no guiding framework or theory exists.

This design is used because it enables the exploration of a phenomenon in detail and the development and testing of the resulting conceptual model [START_REF] Cresswell | Designing and Conducting Mixed Methods Research[END_REF][START_REF] Teddlie | Foundations of Mixed Methods Research: Integrating Quantitative and Qualitative Approaches in the Social and Behavioral Sciences[END_REF]. The use of the design in this study helps validate qualitative data with quantitative results.

Interviews were used as the data collection method. In mixed methods research, open-ended qualitative interviews (INT-QUAL) are featured more frequently than closed-ended quantitative interviews (INT-QUAN). Qualitative interviews are usually non-directive and general ("tell me about your school"). On the other hand, quantitative interviews are structured and closed-ended ("which of the following describes the food in your school cafeteria -very good, good, bad, very bad") [START_REF] Teddlie | Foundations of Mixed Methods Research: Integrating Quantitative and Qualitative Approaches in the Social and Behavioral Sciences[END_REF].

Types of Interviews

Patton [START_REF] Patton | Qualitative Research and Evaluation Methods[END_REF] defined four types of open-ended interviews, ranging from the least structured (informal conversational interviews) to the more structured (general interview-guided approaches) to the most structured (standardized open-ended interviews). He also described closed fixedresponse interviews but does not advocate their use. The four types of open-ended interviews are: Type 1: Informal Conversational Interviews: Questions emerge from the immediate context and are asked in the natural course of the interview. The question topics and wording are not predetermined.

Type 2: General Interview Guide Approaches: Topics and issues are specified in advance in outline form. The interviewer decides the sequence and working of questions in the course of the interview. For purposes of this study, a mixture of Type 1 and Type 3 open-ended interviews was used. Teddie and Tashakkori [START_REF] Teddlie | Foundations of Mixed Methods Research: Integrating Quantitative and Qualitative Approaches in the Social and Behavioral Sciences[END_REF] state that researchers who select the INT-QUAL strategy may use any of the open-ended interview approaches and potentially combine the interview types. They suggest the following sequence of interview techniques:

Start with the unstructured informal conversational interview approach to build rapport and elicit spontaneous responses.

Move to the interview guide approach, which provides a more comprehensive outline of topics, but still maintains a conversational tone.

Finish with the highly structured, standardized open-ended interview approach, which greatly increases response comparability.

Our study began with an unstructured informal conversational interview approach, followed by a highly structured, standardized open-ended interview approach. The questions were formulated based on a literature survey conducted in 2011 [START_REF] Pooe | A conceptual model for digital forensic readiness[END_REF].

Interviews

This section discusses the criteria used to select the interviewees, the communication channels used to conduct the interviews and the ethical considerations related to the interview process.

The interviewees were selected based on three criteria: Individuals from the private sector and law enforcement were selected in order to emphasize the multi-disciplinary aspects of the domain and to capture a broad range of views from subject matter experts involved in different aspects of the digital forensic process.

Individuals with experience in digital law and/or digital forensics were selected to ensure that the input gathered was not biased and addressed the technical and legal dimensions of digital forensics.

Individuals who had been practicing digital forensics in South

Africa for a period of no less than three years were selected. Since the context of the study was South Africa, it was important to identify subject matter experts with experience in the geographical context.

These criteria ensured that the interviewees would provide a mixture of opinions based on their experiences in their different working environments.

Studies have shown that, while open-ended interviews are typically conducted in a face-to-face manner, they may also be conducted by telephone or over the Internet [START_REF] Salmons | Online Interviews in Real Time[END_REF][START_REF] Teddlie | Foundations of Mixed Methods Research: Integrating Quantitative and Qualitative Approaches in the Social and Behavioral Sciences[END_REF].

A total of seven interviews were conducted using three channels: four interviews were conducted face-to-face, one was conducted over the phone and two over the Internet. Due to the volume of data collected during the interviews, the ATLAS.ti tool [START_REF]ATLAS.ti Scientific Software Development, A world of data in your hand[END_REF] was used to process and analyze the data.

Interview Results

This section describes the results of the seven interviews. All the interviewees met the selection criteria. Table 1 summarizes the interviewee profiles.

We now provide a summary of some of the questions, the responses received and the interviewees that were in agreement. Based on the responses, cognitive approaches to digital forensic readiness planning were used to develop a conceptual model.

Question 1: Should South African organizations be concerned about digital crimes?

The responses to this question revealed the following opinions:

-Digital crimes are on the increase (All).

-The intangible nature of data in an electronic format causes people to lower their defenses (INT1, INT4, INT7).

-Modern criminals are technologically literate and have access to good legal representation (INT1, INT2, INT3).

-Immaturity of the digital forensics profession allows criminals to go free (INT5).

-Following correct investigative processes to preserve evidence is important (INT6).

Question 2: Which three types of digital crimes do you find to be the most prevalent?

The following crimes were found to be prevalent:

-Financial crimes (All).

-Child pornography (INT4, INT5, INT6, INT7).

-419 scams (INT4, INT6).

-Malware-related crimes (INT1, INT2).

-Intellectual property theft (INT1, INT5).

-Hacking and illegal access (INT2, INT3).

-Internet misuse (INT5).

Question 3: Which sector do you find to be the most targeted?

The responses indicated the following sectors:

-Banking/financial sector (All).

-Large corporations (INT2, INT4, INT7).

-Individuals (INT2, INT3).

-Mining (INT4).

-Businesses (INT5).

Question 4: Have you noted any challenges regarding the prosecution of digital crimes?

The following challenges were noted:

-Knowledge of digital forensic principles is lacking among the stakeholders (All).

- -Lack of resources (INT2, INT7).

Question 5: Do you or your organization have a digital forensic model that has been adopted? All the respondents indicated that they use their own entity-specific model, which may differ from those used by other organizations.

Question 6: Does electronic evidence provide sufficient assurance of non-manipulation? Provided that the correct processes were followed, the respondents were of the opinion that electronic evidence can be relied upon.

Question 7: Is there a standard process for electronic evidence gathering?

All the respondents indicated that, while processes adopted in their individual organizations were similar, no process standards specific to South Africa exist.

Question 8: Does the law adequately position the acceptable use of and/or extent to which electronic evidence can be used in civil or criminal proceedings? All the respondents referred to the Electronic Communications and Transactions (ECT) Act of 2002 as legislation that makes it possible to present electronic evidence in a South African court of law. However, the following contradictions were noted:

-Existing laws support the ECT Act (INT4, INT5, INT7).

-Discrepancies exist between the ECT Act and existing laws (INT2).

Question 9: Does the law cater to the complexities of modern IT devices?

All the respondents indicated that the law lagged behind technology. While the ECT Act was found to be strong legislation, the respondents indicated that it needed periodic review.

Question 10: What are the factors that contribute to electronic evidence being rendered inadmissible? All the respondents pointed to digital forensic processes and procedures as a good foundation for ensuring the admissibility of evidence.

Question 11: Have you noted any challenges that prevent digital crime investigators from correctly applying a digital forensic model or framework?

Data Analysis and Interpretation

This section discusses the application of the data analysis method and presents the results of the analysis.

The data analysis was conducted by transcribing each interview and reading each transcript repeatedly to identify the codes for each question answered by the interviewees. Techniques from immersion/crystallization and constant comparison (grounded theory) were applied to assist in developing the initial and final codes [START_REF] Corbin | Basics of Qualitative Research: Techniques and Procedures for Developing Grounded Theory[END_REF]. The iterative reading process made it possible for focus/immersion to be applied to each question and for the emergence/crystallization of themes to take place. Differences in findings (codes and themes) were also resolved using the iterative process. The process resulted in three environments: corporate, industry and legislative.

Corporate Environment

The correlation of the interview results yielded the following key findings and analyses:

Organizational Culture: A large proportion of organizations were found to have a habit/culture of ignoring/overlooking small crimes. Additionally, organizations were found to invest the least amount of resources to address the risk of digital crimes. Also, a lack of awareness about digital crime prevention and detection was found to exist. These findings suggest that, by creating a culture of no tolerance to crime and taking action on reported crimes, an organization can significantly reduce its risk exposure to digital crimes.

Policies: Interviewees noted that a general lack of governance, policies and procedures relating to fraud risk management existed in many of the organizations with which they had been in contact. These findings support existing literature (as discussed earlier in this study) on the importance of policies as they relate to achieving digital forensic readiness.

Communication Channels: The reporting of digital crimes was found to be low. The causes mentioned included a culture of "sweeping things under the carpet" along with ignorance, and the lack of education and law enforcement effectiveness.

These findings suggest that encouraging and supporting open dialog, coupled with crime reporting mechanisms can positively impact organizational culture.

Emerging Risks: The following areas of risk were identified:

-The intangible aspect of technology causes people to lower their defenses. This is evident in the various types of whitecollar crimes committed using technology.

-Modern criminals are technologically literate and have access to financial and other resources, including good legal representation.

-Criminals are quick to exploit innovations in mobile technology.

-The digital forensic industry is not sufficiently mature, enabling criminals to take advantage of ambiguities in global legislative structures.

-Digital forensic investigators often do not follow due process, which contributes to the low prosecution rate of digital crimes.

The findings suggest the importance of being cognizant about emerging risks because they affect the nature of controls and mitigation strategies that organizations employ.

Crime Trends: Respondents were of the opinion that digital crimes are on the increase and will affect all current and future users of technology. The high prevalence of crime is attributed to legislative gaps.

These findings suggest that increased awareness of crime trends can aid organizations in focusing their attention and resources on high risk areas.

Industry Environment

The correlation of the interview results yielded the following key findings and analyses:

Standards: The absence of standards for digital forensics was identified as an inhibiting factor to the prosecution of digital crimes. An open culture of information sharing was noted as necessary to promote the maturity of the digital forensic profession. Specific to a digital forensic model, this should not be legislation but, instead, recommended guidelines that enable and support the legal process while being sufficiently flexible to accommodate advances and changes in legislation and technology.

These findings suggest that establishing governance structures is an important step to building quality digital forensic case law and professionalizing the digital forensic industry.

Methodology: While digital forensic investigation methodologies exist, there is a need for a single point of reference. This extends to the need for consistency in country-specific standards, processes and methodology. Awareness of research-based methodologies and their alignment to legislation was also found to be necessary.

These findings suggest that standardization can encourage consistency, conformity, compliance and increase competitiveness in the digital forensic profession.

Education: A lack of cohesion between academics and practitioners was found to exist. While interviewees noted that no single qualification is a prerequisite to qualify as a digital forensic practitioner, specialized training and a balance of education and experience were found to be necessary. A digital forensic model was also found to be essential to guide training efforts.

These findings suggest that the ideal qualification requirements for digital forensic practitioners are formal education coupled with advanced training in a field of specialization.

Training: Training of all stakeholders was noted as essential. In particular, emphasis was placed on legal requirements as superseding technical processes. Some practitioners lack an understanding of the legal requirements and/or incorrectly apply technical knowledge.

These findings suggest the need to expose digital forensic investigators to a balanced training curriculum that covers all related disciplines.

Development: There was a lack of continued professional development for individuals in the investigation value chain, including prosecutors, judges and digital forensics practitioners across all sectors.

These findings suggest the need for organizations to employ qualified digital forensic investigators and provide continuous education and career development in order to ensure that investigators are equipped with the skills necessary to handle modern digital crimes.

Legislative Environment

The correlation of the interview results yielded the following key findings and analyses:

Legislative Culture: A lack of consideration of digital crimes exists among some judges and prosecutors; this was attributed to high caseloads and limited resources. The creation of special interest groups and special courts could introduce positive changes.

These findings suggest the need for a culture of cooperation between organizations, law enforcement and prosecuting authorities.

eLaw Development: Specific to South African legislation on electronic evidence [START_REF]Republic of South Africa, Electronic Communications and Transactions Act 2002[END_REF], the findings indicate that the key strengths of the law are robust legislation and good baselines. On the other hand, the findings also suggest that the law imposes low penalties, there is limited awareness and understanding of the law, and considerable complexity in its use of technical terminology. Lastly, the South African legislation on electronic evidence was perceived as being adequate to cover technological advances over the next ten to twenty years. These findings suggest the need for continuous review and development of legislation relating to digital crimes in order to close the gap (of relevance) between technology and the law.

Awareness:

The findings suggest that the judiciary is presented with challenges that result in a reluctance to prioritize digital evidence. High caseloads and a lack of awareness of digital forensic processes and methodologies exist. Interviewees pointed to a need for a change in culture. Training and awareness were suggested as effective drivers to implement this change.

These findings point to the importance of digital forensic awareness initiatives as a means to reduce the reluctance to prioritize digital crimes and increase confidence levels when prosecuting crimes.

Cognitive Approaches

From the breadth of responses and the associated analysis, it is clear that the development of a digital forensic readiness plan extends beyond the realm of an organization. The corporate, industry and legislative environments each have properties that must be considered when developing a digital forensic readiness plan. These properties are presented in Figure 1. The corporate environment has properties within an organization's control that must be aligned with and support the organization's digital forensic readiness plan. The corporate environment operates within the limitations of the industry environment, which, in turn, is influenced by the limitations of the legislative environment. A critical component of a digital forensic readiness plan is to establish a cooperation strategy that ensures that digital forensic cases can progress seamlessly from their inception in a corporate environment to their conclusion in a court of law (legislative environment), following relevant guidelines in the industry environment to ensure that the integrity of evidence is maintained.

Legislative Environment

Conclusions

This study has sought to investigate cognitive approaches that aid in developing digital forensic readiness plans. The study reveals that developing a digital forensic readiness plan is a task that involves many factors beyond the realm of a single organization. The factors are presented in the form of a conceptual model for organizations to use in process planning to achieve digital forensic readiness. By focusing on the lessons learned from experience, the study provides cognitive approaches to digital forensic readiness that can be used by individuals who wish to explore this topic further as well as by organizations that desire to enhance their ability to respond to security incidents while maintaining the integrity of evidence and keeping investigative costs low.

Our future research will examine digital forensic readiness as it relates to specific contexts such as mobile devices, wireless networks, public key infrastructures and cloud computing.

Type 3 :

 3 Standardized Open-Ended Interviews: The exact wording and sequence of questions are determined in advance. All the interviewees are asked the same basic questions in the same order. Questions are worded in a completely open-ended format. Type 4: Closed Fixed-Response Interviews: Questions and response categories are determined in advance. The responses are fixed. The respondent chooses from among the fixed responses.

  Lack of understanding of legal requirements (INT1, INT3, INT4, INT5, INT6).

Figure 1 .

 1 Figure 1. Cognitive approaches for digital forensic readiness planning.

Table 1 .

 1 Interviewee profiles.

	Interviewee	Experience	Law	Private	Management
		> 3 Years	Enforcement	Sector	Position
	INT1	Yes	Yes	No	Yes
	INT2	Yes	Yes	Yes	Yes
	INT3	Yes	No	Yes	Yes
	INT4	Yes	Yes	Yes	Yes
	INT5	Yes	No	Yes	Yes
	INT6	Yes	Yes	No	Yes
	INT7	Yes	Yes	Yes	Yes

All the respondents indicated that a single point of reference was needed. Other points noted were:

-South Africa needs a specific model ( INT5,INT7).

-The model must enable and support legal processes (INT7).

-The model must be flexible (INT5). -Lack of cooperation (INT5).

Question 14: Do you think state prosecutors are sufficiently trained to do their work?

All the respondents opined that a training need exists for state prosecutors.

Question 15: What do you think should be done to increase the prosecution rate of digital crimes in South Africa?

The responses included:

- -More research focused on digital forensics (INT1, INT6).

-Compulsory reporting requirements (INT1, INT5).

-A new law of evidence for electronic crimes (INT2).

-Define processes and a model (INT4).


Aleksandar Valjarevic

Hein Venter

A HARMONIZED PROCESS MODEL FOR DIGITAL FORENSIC INVESTIGATION READINESS

Keywords:

Digital forensic readiness enables an organization to prepare itself to perform digital forensic investigations in an efficient and effective manner. The benefits include enhancing the admissibility of digital evidence, better utilization of resources and greater incident awareness. However, a harmonized process model for digital forensic readiness does not currently exist and, thus, there is a lack of effective and standardized implementations of digital forensic readiness within organizations. This paper presents a harmonized process model for digital forensic investigation readiness. The proposed model is holistic in nature and properly considers readiness and investigative activities along with the interface between the two types of activities.

Introduction

We are living in an information society where we depend heavily on information systems and information technology. Therefore, we also depend on information systems security, specifically the confidentiality, integrity and availability of data, services and systems. These facts, combined with the increasing rate of information security incidents, make the field of digital forensics even more important.

Methods and process models for the digital forensic investigation process (DFIP) have been developed mostly by practitioners and forensic investigators based on their expertise and experience. The initial goal was to increase the effectiveness and efficiency of investigations, not necessarily to achieve harmonization or standardization. The same is true for the digital forensic investigation readiness process (DFIRP). There is no international standard that formalizes DFIP or DFIRP. However, at the time of writing this paper, an effort to standardize DFIP and DFIRP has been initiated by us within the International Standardization Organization (ISO). At this time, the standard is in its third working draft and is titled "ISO/IEC 27043 Information Technology -Security Techniques -Investigation Principles and Processes" [START_REF]International Standards Organization and International Electrotechnical Commission, ISO/IEC 27043 -Information Technology -Security Techniques -Digital Evidence Investigation Principles and Processes[END_REF]. Note that ISO/IEC 27043 is considering DFIRP as an integral part of DFIP and, ultimately, DFIRP should be contained within DFIP, i.e., within a single holistic DFIP model.

The focus of this paper is on a DFIRP implementation, not on the entire holistic implementation of DFIP as described in ISO/IEC 27043. The fundamental problem is that no harmonized DFIRP currently exists. This means that organizations do not have clear guidance on how to implement digital forensic investigation readiness.

Guidelines provided by a DFIRP model could enable organizations to better utilize their resources and achieve better results when implementing digital forensic readiness and when performing digital forensic investigations. The DFIRP model would help raise awareness and enhance training efforts related to digital forensic readiness and digital forensic investigations. Moreover, the model could enhance the quality of incidence response and investigations, and the admissibility of digital evidence.

Background

This section provides an overview of previous work related to digital forensic readiness, and models and processes used to achieve digital forensic readiness. This discussion is important because the existing digital forensic readiness models are inputs to the proposed harmonized model. Indeed, the proposed model attempts to harmonize existing models.

Digital forensics is the use of scientifically-derived and proven methods for the identification, collection, transport, storage, analysis, presentation and distribution and/or return and/or destruction of digital evidence derived from digital sources, while obtaining proper authorization for all actions, properly documenting all actions, interacting with the physical investigation, preserving evidence and the chain of evidence, for the purpose of facilitating or furthering the reconstruction of events found to be criminal, or helping anticipate unauthorized actions that may disrupt operations [START_REF] Valjarevic | Harmonized digital forensic investigation process model[END_REF]. Digital forensic readiness is the ability of an organization to maximize its potential to use digital evidence while minimizing the costs of an investigation [START_REF] Tan | Forensic readiness: Strategic thinking on incident response[END_REF].

Tan [START_REF] Tan | Forensic readiness: Strategic thinking on incident response[END_REF] has identified several factors that affect digital forensic readiness: how logging is done, what is logged, intrusion detection, digital forensic acquisition and digital evidence handling. Yasinsac and Manzano [START_REF] Manzano | Policies to enhance computer and network forensics[END_REF] have proposed six policy areas to facilitate digital forensic readiness: retaining information, planning the response, training, accelerating the investigation, preventing anonymous activities and protecting evidence. Wolfe-Wilson and Wolfe [START_REF] Wolfe-Wilson | Management strategies for implementing forensic security measures[END_REF] emphasize the need for an organization to have procedures in place to preserve digital evidence in the event that a digital forensic investigation must be conducted.

Rowlingson [START_REF] Rowlingson | A ten step process for forensic readiness[END_REF] defines a number of goals for digital forensic readiness: gather admissible evidence legally and without interfering with business processes, gather evidence targeting the potential crimes and disputes that may adversely impact an organization, allow an investigation to proceed at a cost in proportion to the incident and ensure that the evidence makes a positive impact on the outcome of a legal action. Rowlingson's approach is closely related to our DFIRP model. His key activities when implementing digital forensic readiness are to: define the business scenarios that require digital evidence, identify the available sources and different types of potential evidence, determine the evidence collection requirements, establish a capability for securely gathering legally admissible evidence, establish a policy for secure storage and handling of potential evidence, implement monitoring to detect and deter major incidents, specify circumstances when escalation to a full investigation should be launched, train staff in incident awareness so that they understand their roles in the digital evidence process and the legal sensitivity of evidence, document an evidence-based case that describes the incident and its impact, and ensure legal review to facilitate actions in response to the incident.

Since the first Digital Forensic Research Workshop (DFRWS) [START_REF] Palmer | A Road Map for Digital Forensic Research[END_REF], the need for a standard framework for digital forensics has been acknowledged by the digital forensics community. A framework for digital forensics must be flexible enough to support future technologies and different types of incidents. Therefore, it needs to be both simple and abstract. However, if it is too simple and too abstract, then it is difficult to create tool requirements and test procedures for the various phases [START_REF] Carrier | An event-based digital forensic investigation framework[END_REF].

Several researchers have proposed digital forensic models that include forensic readiness as a phase. However, to the best of our knowledge, no DFIRP model has as yet been proposed.

Carrier and Spafford [START_REF] Carrier | Getting physical with the digital investigation process[END_REF] have proposed a digital investigation process model comprising seventeen phases divided into five groups, one of the groups focusing on forensic readiness; this group incorporates two phases, the operation readiness phase and the infrastructure readiness phase. Mandia, et al. [START_REF] Mandia | Incident Response and Computer Forensics[END_REF] have also proposed a digital investigation process model that includes a readiness phase, known as the pre-incident preparation phase. Beebe and Clark [START_REF] Beebe | A hierarchical, objectives-based framework for the digital investigations process[END_REF] have proposed a hierarchical, objectives-based framework for digital investigations, which includes a preparation phase; this phase encompasses activities designed to achieve digital forensic readiness.

Harmonized DFIRP Model

This section describes the proposed harmonized DFIRP model that is intended to provide guidance on implementing digital forensic readiness.

Aims and Policy

The harmonized DFIRP model has certain aims that are collectively drawn from previous work in the area [START_REF] Carrier | An event-based digital forensic investigation framework[END_REF][START_REF] Manzano | Policies to enhance computer and network forensics[END_REF][START_REF] Palmer | A Road Map for Digital Forensic Research[END_REF][START_REF] Rowlingson | A ten step process for forensic readiness[END_REF][START_REF] Tan | Forensic readiness: Strategic thinking on incident response[END_REF][START_REF] Wolfe-Wilson | Management strategies for implementing forensic security measures[END_REF]. In particular, the harmonized DFIRP model should:

Maximize the potential use of digital evidence.

Minimize the costs incurred in digital investigations.

Minimize the interference to and prevent the interruption of business processes.

Preserve or improve the current level of information security.

The fourth aim listed above was not identified in previous work. We believe that this aim is essential when implementing forensic readiness, and even more so when creating a DRIFP model. The first two aims concentrate on the efficiency of investigations and the third aim focuses on non-interference with business processes. Omitting the fourth aim could leave room for flaws in the overall information security status of an organization.

An example of such a flaw is when an organization, based on the first three aims, decides to collect logs from its information systems and maintain them at a central location. However, the organization does not implement security mechanisms to protect the data from compromise or dissemination. A holistic approach that applies information systems security mechanisms to forensic readiness is vital. In fact, forensic readiness should have built-in security features and security should not merely be an add-on.

Model Description

This section describes the proposed DFIRP model in detail. Unlike related work [START_REF] Beebe | A hierarchical, objectives-based framework for the digital investigations process[END_REF] that uses the term "phases," we use the term "processes" in line with ISO terminology [4].

The harmonized model comprises three distinctive process groups: (i) planning processes group; (ii) implementation processes group; and (iii) assessment processes group. Figure 1 shows the three process groups.

The planning processes group includes all the model processes that are concerned with planning activities, including the scenario definition process, source identification process, planning pre-incident collection process, planning pre-incident analysis process, planning incident detection process and architecture definition process. These processes are shown in Figure 2.

The implementation processes group includes only the implementation processes and a link to the harmonized DFIP [START_REF] Valjarevic | Harmonized digital forensic investigation process model[END_REF]. The implementation processes group includes the following processes: implementing architecture definition process, implementing pre-incident collection process, implementing pre-incident analysis process and implementing incident detection process. These processes, which are shown in Figure 2, are concerned with the implementation of the results of the planning processes.

The assessment processes group includes two processes, the assessment of implementation process and the implementation of assessment results process. The harmonized process model also introduces a novel addition to the process model -the concept of parallel actions. We define parallel actions as the principles that should be translated into actions throughout the DFIRP model. As shown in Figure 1, these actions run in parallel with model processes. The actions are described in more detail later in the paper.

The processes are defined at a high level in order to be used as a model for different types of digital forensic investigations. We do not attempt to prescribe the exact details of each process. Many different types of digital forensic investigations exist, such as live forensics, cloud forensics, network forensics and mobile phone forensics. The detailed procedures for each process should be defined for each specific type of digital forensic investigation. However, defining all these procedures is outside the scope of this paper. The proposed model should, therefore, be used as an "umbrella model" for the various types of digital forensic investigations. The detailed procedures are left to be implemented by other standards and by the digital forensic community.

Model Application Environment

We use a hypothetical banking environment to illustrate the harmonized model and its component processes. We assume that the four aims of digital forensic readiness must be achieved at a particular branch of a bank.

The information system at the bank branch has the following components:

Two workstations (personal computers) that run a banking application. Access to the workstation operating system and the banking application uses single-factor, password-based authentication. The banking application is a web-based, thin-client application. An application log is stored locally on the client and centrally on the bank server.

Two digital cameras that record the activities of employees at the workstations.

Two digital cameras that record activities at the branch.

One networked video recorder that records data from all four cameras.

One switch that connects the workstations, cameras and networked video recorder in a local-area network (LAN).

A router that connects the branch LAN to the bank's wide-area network (WAN).

Certain policies are defined for the information system. The policies specify how the system should function:

Networked video recorder data is backed up and taken off-site once a day.

Clients are identified manually by inspecting their identity documents (IDs). Each transaction at a bank counter is authorized by a banking client's signature. The signature must be compared with the signature on the banking client's ID. The ID with the banking client's signature is scanned and archived in a central location.

Model Processes

This section describes the processes in the harmonized model along with their inputs and outputs.

Scenario Definition Process. This process involves the examination of all scenarios that may require digital evidence. The input to this process includes all the information regarding system architecture, system technology (hardware and software), policies, procedures and business processes. The input also includes the DFIRP aims. We refer to this set of inputs as "pre-known system inputs."

Similar inputs exist for all the other processes in the model. For example, the pre-known system inputs may include the network topology, specifications of models and hardware components, specifications of firmware, operating systems and applications for each piece of hardware, information security policies governing system use and the descriptions of the business use of the system to which the model is applied.

The output of this process is a set of scenario definitions. The scenarios may correspond to information security incidents such as the unauthorized use of resources. They may also correspond to events that require digital forensic investigations, such as the use of a computer to distribute child pornography.

During the scenario definition process, a risk assessment should be performed for each scenario separately. A risk assessment helps identify the possible threats, vulnerabilities and related scenarios where digital evidence might be required. Based on the assessed risk from certain threats, vulnerabilities or scenarios, the later processes can be used to better decide on the measures necessary to achieve forensic readiness, taking into account the risk levels, costs and benefits of the possible measures in order to reduce the identified risk. For example, a better decision can be made about the need to centrally collect and process all system log data in order to improve digital forensic readiness. In addition, the risk assessment would help determine the protection mechanisms needed for the centralized storage of log data, such as firewalls, link encryption, storage data encryption and change tracking.

An example scenario is the misuse of the banking application, where the application is used to steal credit card information. Another scenario is a complaint from a client claiming that he did not withdraw money from his account at the branch at a certain date.

The scenario definition process is a logical start for the DFIRP implementation because proper scenario analysis lays the foundation for all subsequent processes. After this initial process, it is necessary to specify all the possible sources of digital evidence based on the defined scenarios.

Source Identification Process. During this process, it is necessary to identify all the possible sources of digital evidence in the information system. Note that, for reasons of simplicity, inputs are represented as single arrows in Figure 1. The output of the process is the possible sources of evidence, e.g., registry files, temporary Internet files, email archives and application logs. Some of the identified sources of evidence might not be available. For example, access logging may be not implemented in the information system. In such cases, methods for making the identified sources available and the use of alternative sources should be explored.

In our hypothetical information system, the possible sources of evidence based on the identified scenarios are: Data from the two workstations, especially banking application logs, temporary Internet files, text editor logs, email stored on the workstations, traces of deleted files and traces of modified files.

Banking application logs stored at the bank's data center.

Banking transaction data, such as signed transaction documents, stored at a central location.

Video recordings from the networked video recorder.

Backed-up data from the networked video recorder.

After the possible evidentiary sources have been identified, it is necessary to specify how these sources should be handled. This is accomplished using the planning pre-incident collection process and the planning pre-incident analysis process.

Planning Pre-Incident Collection Process. During this process, procedures are defined for pre-incident collection, storage and manipulation of data that represents possible digital evidence. Note that the data collection period is determined based on a risk assessment. For example, this could mean determining how often an organization would save the application log to a central repository to ensure the integrity of log data in the event that the application is compromised. The collection, storage and manipulation of data must conform to digital forensic principles (e.g., chain of custody and evidence preservation) so that the digital evidence is admissible in a court of law. Also, the data retention period should be determined based on two factors: (i) risk assessment; and (ii) previous experience regarding incident detection, data quantity, network capacity and other matters that could influence the cost or efficiency of the process.

In the case of the hypothetical banking information system, the collection procedures for possible sources are: Collection of images of workstations is to be performed once a week. Images are to be stored off-site, securely and safely to preserve evidence. They are to be retained for a period of one year.

Collection of banking application logs stored locally, temporary Internet files and text editors logs is to be performed daily. The data is to be sent via the network connection to the central repository. The data is to be retained for a period of five years.

Deleting emails from the email server is forbidden. The emails are to be retained for a longer period of time, depending on the prevailing laws and regulations.

Banking application logs and banking transactions data stored centrally are to be backed-up daily. Backed-up data is to be retained for a period of ten years.

Video recordings from the networked video recorder are to be streamed to a central networked video recorder and retained for a period of two years.

Backed-up data from the networked video recorder is to be retained for a period of two years. An intrusion prevention system is to be used to collect LAN network traffic data and traffic data to/from the WAN. This data is to be stored at a central location and retained for a period of one month.

Planning Pre-Incident Analysis Process. This process defines procedures for pre-incident analysis of data representing possible digital evidence. The aim of the analysis is to enable incident detection. Therefore, the procedures defined in this process must include exact information on how incidents are detected and the behavior that constitutes each incident.

The tasks of data analysis and incident detection are often outside the scope of target information systems (information systems that might come under a digital forensic investigation). Therefore, we recommend that this process defines an interface between the information system and a monitoring system that analyzes data in order to detect incidents.

In the case of our hypothetical banking information system, it would be necessary to have custom scripts or commercial software (e.g., for change tracking, intrusion detection and business intelligence) to analyze the information collected (both locally and centrally) in order to detect anomalies and possible incidents. Information security best practices should be taken into consideration as well as bank business processes and policies.

Planning Incident Detection Process. Since the main goal of the planning pre-incident analysis process is to enable incident detection, the next logical process is the planning incident detection process. The output of this process includes the actions to be performed after an incident is detected, especially collecting the information to be passed to the digital forensic investigation process. The information should also include pre-known system inputs, results from all DFIRP processes and data gathered and generated during the implementation process.

In the case of our hypothetical banking information system, when an incident is detected via pre-incident analysis, the information gathered by relevant software (e.g., for change tracking, intrusion detection and business intelligence) should be automatically sent to the bank's central information system and should trigger incident response activities.

Architecture Definition Process. This process involves the definition of an information system architecture for the information system that is to be forensic ready. The process draws on the results of all the previous processes. The process is introduced in order to implement better forensic readiness by taking into account all relevant matters when redefining the system architecture. The aim is to customize the system architecture to accommodate the four DFIRP aims.

In the case of our hypothetical information system, the architecture definition would include decisions to store no application data locally, to introduce automated document reading and biometric identification to verify customer identity, and to introduce three-factor authentication for workstations and applications (e.g., PINs, biometrics and smart cards).

Implementation Processes Group. This group implements the results of all the previous processes. Although the processes compris-ing this group are distinctive, they are presented in one section, unlike the other processes that are presented separately. This is because all the processes in the implementation processes group are concerned with the implementation of results from the planning processes group. All these processes represent the implementation of technical or nontechnical measures defined in the other processes.

In practice, the measures defined in the architecture definition process should be implemented. This is followed by the pre-incident collection, pre-incident analysis and incident detection processes.

A clear difference exists between the processes in the implementation processes group (Figure 2) and the processes in the planning processes group. The difference is that, for example, the process listed as implementing pre-incident collection in the planning processes group is tasked with defining what data is collected and how it is collected; on the other hand, the implementing pre-incident collection process of the implementation processes group is tasked with implementing the results of the implementing pre-incident collection process, including digital evidence collection.

It is important that the roles of the various people in the system are considered. People represent users. However, people are also custodians and owners of information system components. The procedures must include relevant information for all the people involved with the system. Also, training and awareness sessions must be conducted for all people involved with the information system.

The output of the implementation processes group is an information system that is finally forensically ready. This process represents an interface to the DFIP; in fact, it straddles the tasks of readiness and investigation.

Assessment of Implementation Process. After forensic readiness been implemented, it is necessary to start the assessment process. This process examines the results of the implementation of forensic readiness to determine if it conforms to the DFIRP aims.

During this process, a legal revision should be carried out for all procedures, measures and architectures defined when implementing the model. The revision should show whether or not there is conformity with the legal environment and digital forensic principles in order to ensure evidence admissibility.

In the case of our hypothetical banking information system, the assessment process would take the form of an internal audit or external audit. The goals of the audit would be to check if the implementation conforms to the results of the planning processes group and the four DFIRP aims.

Implementation of Assessment Results

Process. This process is concerned with implementing the conclusions from the previous process. The process is optional because it is possible that no actions are needed based on the results of the assessment of implementation process.

During this process, it is necessary to decide on recommendations for changes in one or more of the previous processes. The main decision here is whether to go back to one of the planning processes or to go back to an implementation process based on the results of the implementation assessment process.

Parallel Actions

This section discusses the actions that must run in parallel with the processes. The parallel actions are defined as the principles that should be translated into actions in the DFIRP. Examples are the principle that evidentiary integrity must be preserved throughout the process and that the chain of evidence must be preserved. These principles are found in existing DFIP models [START_REF] Rowlingson | A ten step process for forensic readiness[END_REF][START_REF] Tan | Forensic readiness: Strategic thinking on incident response[END_REF][START_REF] Valjarevic | Harmonized digital forensic investigation process model[END_REF].

The parallel actions in the DFIRP model are: preserving the chain of evidence, preserving evidence, defining information flow, documentation and obtaining authorization (Figure 2). These actions are implementations of well-established principles of digital forensics.

The actions run in parallel with all the other processes to ensure the admissibility of digital evidence. Parallel actions also enhance the efficiency of an investigation. Some actions defined by other researchers, such as obtaining authorization and preparing documentation, run across several processes.

Preserving the Chain of Evidence. All legal requirements must be complied with and all actions involving digital evidence must be properly documented in order to preserve the chain of evidence and the integrity of evidence. This principle must be followed throughout the DFIRP.

Preserving Evidence. The integrity of the original digital evidence must be preserved. This is achieved using strict procedures from the time that the incident is detected to the time that the investigation is closed. The procedures must ensure that the original evidence is not changed and, even more importantly, they must guarantee that no opportunity for evidence tampering arises during the entire investigation.

Information Flow. It is important to identify and describe all information flows so that they can be supported and protected. An example information flow is the exchange of digital evidence between two investigators. This information flow could be protected using a public key infrastructure to preserve confidentiality, timestamping to identify the different investigators, and authenticating the evidence to protect its integrity.

A defined information flow should exist between each of the processes and between the various stakeholders, including investigators, managers and external organizations. For example, there should be defined information flows between investigators and managers of the information system being investigated, including obtaining authorizations from the managers (system owners or system custodians), and informing managers about security incidents, their possible consequences and the required actions.

Documentation. Every action performed should be documented to preserve the chain of evidence, and to increase efficiency, resource utilization and the likelihood of a successful investigation. This would, for example, include documenting how the information obtained during pre-incident collection has been stored and processed, along with all the persons who have had access to the information.

Obtaining Authorization. Proper authorization should be obtained for every action that is performed. Depending on the action, the authorization may have to come from government entities, system owners, system custodians and/or principals.

Conclusions

The proposed model harmonizes existing efforts related to DFIRP models. It has a broader scope than digital forensic readiness processes and existing digital forensic process models. The broader scope is manifested by the definition of additional processes such as the planning pre-incident data analysis process, architecture definition process and assessment processes.

The processes in the harmonized model are well-defined in terms of scope and functions. The processes deal with all the matters covered by existing models as well as matters that are outside the scope of existing models, such as customizing the architecture definition of a target information system to achieve the digital forensic readiness goals. In fact, customizing the architecture definition is a novel concept that contributes to a more holistic approach to digital forensic readiness.

Another novel concept is the incorporation of actions based on digital forensic principles that are performed in parallel with processes in the harmonized model. These parallel actions enhance the efficiency of investigations and ensure the admissibility of digital evidence.

Using the harmonized DFIRP model provides several benefits. These include improved admissibility of digital evidence, reduced human errors and omissions during the DFIRP, and better resource utilization when implementing digital forensic readiness and conducting digital forensic investigations. Also, the harmonized DFIRP model can improve the overall security of an information system by raising awareness about specific incidents and alternative scenarios.

Our future work will apply the harmonized model to a functional system and measure its conformance with the four DFIRP aims, both before and after the implementation. Future work will also involve defining an interface between the harmonized DFIRP model and a DFIP model to achieve a holistic and harmonized DFIP model. Initial work related to these topics and others is discussed in [START_REF]International Standards Organization and International Electrotechnical Commission, ISO/IEC 27043 -Information Technology -Security Techniques -Digital Evidence Investigation Principles and Processes[END_REF].


Stephen Esposito

Gilbert Peterson

Creating Super Timelines in Windows Investigations

Keywords: Windows forensics, events, artifacts, super timelines

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Computers and digital devices are ubiquitous, as a result these devices are often present at crime scenes or are used to commit crimes. This makes the devices valuable sources of evidence in criminal investigations. One of the key tasks when examining a device is to understand how the temporal nature of the relevant data items correlate with each other. For example, while it is important to identify when a virus first appeared in a network, it is also important to understand how other temporal data items correlate with the arrival of the virus, such as the users that were logged in and their activities at the time of the infection. Connecting these temporal items together creates a timeline of events that can explain and confirm the details of an incident to include who, what, where and when.

This paper discusses how a timeline of events can be developed and processed into a concise listing, and subsequently analyzed to correlate temporal items and produce knowledge about how an incident occurred. Four queries are presented that help convert raw file and event log timestamps to a general timeline of what the user and executing processes were doing on a Windows system during the period of interest. The results of testing the queries on a simulated incident demonstrate a significant reduction in the number of data items to be evaluated, which greatly reduces the evidence analysis and correlation time.

Related Work

Creating a timeline of the various events that occurred during an incident is one of the key tasks performed by a digital forensic practitioner [START_REF] Guojonsson | Mastering the Super Timeline with log2timeline[END_REF]. Several tools have been developed for extracting temporal artifacts from specific data sources. For example, fls [START_REF] Carrier | The Sleuth Kit[END_REF] extracts filesystem metadata while RegRipper [START_REF] Carvey | RegRipper[END_REF] and yaru [START_REF] Tzworks | Yet Another Registry Utility (yaru)[END_REF] extract Windows registry details that can identify the ordering of events. Pasco [START_REF] Jones | Pasco v.1.0[END_REF] and Web Historian [START_REF] Mandiant | Web Historian[END_REF] are web history extraction tools that parse Internet histories. EnCase and FTK also provide search functionality to find timestamp information, but neither tool has a super timeline capability [START_REF] Olsson | Computer forensic timeline visualization tool[END_REF]. The two tools produce a narrow view of user activities, requiring the practitioner to manually standardize, connect and correlate the data to produce a quality super timeline.

Instead of running each tool individually, the log2timeline tool can be used to extract all the artifacts and more in order to produce a single super timeline for analysis. The tool engages a Perl script to parse a file structure and artifacts. The tool has several input and output modules that enable it to be used in a variety of operating system environments. The practitioner identifies the operating system when executing log2timeline and the tool automatically uses all the modules available for the operating system.

The SIMILE output module [START_REF]The JFK assassination timeline with Dutch timeline labels[END_REF] is a key log2timeline module. The module provides output in a standardized format that enables a SIMILE widget to read and display a moving timeline of information. While this may seem like an ideal way to view log2timeline output, it is difficult to use the tool to view more than 200 items because the SIMILE widget loads and operates very slowly. Because of this limitation, a better option is to produce the output as a comma separated value (CSV) file. This format simplifies the importation of data to a database.

Timestamp Anti-Forensics

An important issue to discuss at this stage is the possibility of antiforensic tools being used to alter timestamp data. For example, the Timestomp [START_REF] Foster | Timestomp[END_REF] tool can alter the modification, access and creation (MAC) timestamps in the $STANDARD INFORMATION attribute of a master file table (MFT) entry, albeit not the four timestamps present in the $FILE NAME attribute. An attacker intending to cover his tracks can use Timestomp to alter the timestamps of incriminating files. This makes the creation of an accurate timeline much more difficult.

If tampering is suspected, all eight timestamps in the MFT, the file metadata timestamps and the recently-used registry keys should be correlated to identify tampering. It is also important to search for traces of the execution of tools such as Timestomp and any artifacts that may reside in the filesystem.

Timeline Artifact Analysis

Temporal data analysis comprises the collection and extraction of artifacts, correlation of the artifacts, and the determination of when an activity occurred. Our collection and extraction process involves generating an image of the hard drive and executing the log2timeline tool on the image to extract timestamp data.

The log2timeline CSV output file was imported into a Microsoft Access database with the fields shown in Table 1. SQL queries were developed to produce timelines of the temporal artifacts that correlate the timestamp data, which were subsequently used to reconstruct the timeline of events that occurred just before, during and after the incident. SQL queries providing the following information were developed to aid a digital forensic practitioner in correlating artifacts: All user activities (items not associated with a user are excluded).

Web history traffic with user login and logoff times.

-Refined query with keyword search.

-Additional refined query to add a user. Documents recently accessed by a user.

All login, logoff and program execution times within a specific timeframe.

The SQL queries were designed for reusability and to reduce the time and effort required to investigate potentially hundreds of thousands of

User Program Activity Query

If no information is available about an incident, then a listing of the users and what each user did on the system is a good way to begin the search for information. The user program activity query gives the practitioner an overall view of a user's general activity. The query displays artifacts like the user assist registry key, which is created when the user executes a program such as Notepad. But it does not display operating system artifacts such as MFT and prefetch artifacts for the same execution of Notepad. If there is no user associated with a timestamp, then log2timeline places a "-" in the user field, which the query uses to identify non-user events.

A user program activity query has the following format:

SELECT L2t.[date], L2t.[time], L2t.[source], L2t.[sourcetype], L2t.[type], L2t.[user], L2t.[short], L2t.[desc], L2t.[filename], L2t.[notes], L2t.[format], L2t.[extra] FROM L2t WHERE ((NOT (L2t.[user])="-")) ORDER BY L2t.[date] DESC, L2t.[time] DESC;

User Web History Query

Digital forensic practitioners are often required to investigate incidents involving the intentional or unintentional access to an inappropriate or unauthorized website. In such a situation, a practitioner would be interested in extracting web history artifacts to identify the websites accessed by a user. The login and logoff events corresponding to the user can be found by querying for the audit log event IDs 528 and 538 in a Windows XP system, and the event IDs 4624 and 4647 in a Windows 7 system. Web history artifacts may be found by searching for artifacts for which the source is logged as WEBHIST. The following query uses the term (filename) Like "*Security/528;*" to search for Security/528; anywhere in an artifact.

SELECT date, time, source, user, filename FROM log2timeline WHERE (source = "WEBHIST") OR ((filename) Like "*Security/528;*") OR ((filename) Like "*Security/538;*") ORDER BY date DESC, time DESC; This is different from only using source = "WEBHIST" because the resulting query will only find artifacts where the source is logged exactly as WEBHIST.

Recent Document Access Query

Other important information relates to documents "touched" by a user. In a Windows system, whenever a file or resource is touched by a user, a link file is created in the user's recently accessed folder. The following query for all recent documents can provide useful information about user activities in an investigation:

Processes Executed During User Login Timeframe Query

After a user or timeframe has been identified, a query for artifacts of executable programs during a user's login timeframe allows a practitioner to focus on the main activity on the computer. Once the practitioner understands the user's activities, the query can be expanded to include all the artifacts during the timeframe in order to add correlative temporal artifacts to the timeline. The basic query for executable artifacts in a specific timeframe is: This query displays the executable programs ("*.exe*") and user login and logoff times ("*528*" or "*538*") from 27 April 2012 between the times 17:50:52 and 18:21:08. To expand the artifact listing to display all the artifacts during a given timeframe, the digital forensic professional can use the same query, but remove the section of the statement that displays the executable programs ((File Description) Like "*.exe*").

Test Results

The test data involved a scripted Windows XP incident created with specific activities. In the incident, Miss Scarlet logged into a Windows XP system at 17:50. She opened the Notepad program and then the Calculator program. After closing both programs, she inserted a USB memory stick and ran the program ProcessList.exe, which spawned two programs: (i) ProcessHacker.exe, which she could see running on the desktop; and (ii) Services2000.exe, which she could not see running in the background. Services2000.exe corresponds to a Netcat program in listener mode that waits for a hacker to connect to the system. When the Netcat connection is established, a command shell is passed to the hacker allowing him access to Miss Scarlet's Windows XP system. Miss Scarlet left ProcessHacker.exe running on the desktop and ran the Solitaire program. She played one game of Solitaire then logged off the system at 18:21.

This incident centers around a file named HateLetter.txt containing text that appears to be generated by the user logged in as Miss Scarlet and addressed to Mr. Boddy. The text says that "[she has] had enough of his antics and is going to kill him." The question is whether or not the file was created by Miss Scarlet.

The log2timeline tool was executed on a dd image of the simulated incident to perform the data collection of temporal artifacts required to construct a super timeline. The dd image was mounted with Mount Image Pro version 4. The log2timeline tool parsed each artifact to an output file. The log2timeline output was imported into a database with the fields shown in Table 1. Several queries were then executed. The initial queries had a general scope, such as listing the login and logoff times of all users, and when executable programs began and ended execution. The results of these queries provide a digital forensic practitioner with a repeatable starting point for the incident. Because a specific timeframe based on the investigation was set, the super timeline could be narrowed down and the analysis could focus on artifacts that can be correlated in order to determine what happened. When multiple different artifacts, such as the user assist registry key, last accessed time of the file and audit log process begin time, all correlate to the same file and time, then the corresponding process can be confirmed to have executed during a specific timeframe.

Executing Processes and User Login Timeframe Activity

Based on the incident description, the executing processes and user login timeframe query focused on all programs that executed during Miss Scarlet's login time (i.e., like .exe).

The highlighted row in Figure 1 corresponds to when Miss Scarlet's Windows environment began by creating the Explorer.exe process (PID 1928) with parent PID 332. The figure shows that the program ProcessList.exe was executed by Miss Scarlet, and that two additional programs were also executed within two seconds (6:00:06 to 6:00:08). This is suspicious behavior because the three programs were executed during a very short period of time, and only ProcessList.exe ran from a user directory while the other two programs ran from a temporary directory.

Examination of the three processes in question (highlighted area) reveals that ProcessList.exe (PID 908) ran from Miss Scarlet's environment since its parent process is 1928. The two questionable programs, ProcessHacker.exe (PID 1612) and Services2000.exe (PID 1824) are child processes of ProcessList.exe because their parent PID is 908, the PID assigned to ProcessList.exe.

More suspicion is raised when the cmd.exe file is examined. As highlighted by the arrows, the command prompt began at 18:05:54 creating the event ID 592, and the process ended when event ID 593 was logged at 18:16:01. The command prompt has a parent PID of 1824, which means it was spawned by Services2000.exe. All the files and events associated with this ten minute duration that the command prompt ran are now suspect.

The user program activity query reduced the number of entries from 303,000 to 3,000. This saves the digital forensic practitioner from having to sift through a massive number of artifacts. Note that, because Miss Scarlet did not use a browser, web history information would not be present during this time.

Recent Document Activity

Figure 2 shows the user assist keys from the time ProcessList.exe began (18:00:06) through the time the command prompt process ended (18:16:01). The user assist keys are in the registry HKCU"Software"Microsoft"Windows"CurrentVersion"Explorer"UserAssist, which logs when a user accesses objects. The arrow points to where ProcessList.exe began executing. The bold lines show where the command prompt process began executing. The highlighted line identifies the time when the file HateLetter.txt was accessed. This file was created at 18:09 and then modified again at 18:11. Since the file in question, HateLetter.txt, was created and modified during the window when the command prompt process was active, and the file has no owner attributes, this file was likely created by the command prompt process and not by Miss Scarlet. Additionally, Miss Scarlet did not run a command prompt nor did she run Notepad to create file HateLetter.txt during this timeframe, placing even more suspicion on the command prompt process.

Summary

A variety of simple and complex queries can be created based on the evidence collected for an incident. The queries discussed above demonstrate how evidence can be quickly discovered using simple queries and how a practitioner can progress through a more complex, yet granular, examination of the artifacts. These queries enable the practitioner to reduce hundreds of thousands of artifacts to roughly one hundred artifacts or less, helping focus the investigation on the artifacts of interest.

Conclusions

Queries of the output of a tool such as log2timeline can be used very effectively to produce super timelines of events in incidents involving Windows systems. The super timelines provide excellent overviews of the events that occurred before, during and after the incidents of interest. Four reusable queries were presented for extracting concise timeline artifacts that allow a digital forensic professional to decisively determine the activities involved in incidents. The queries can dramatically decrease the number of artifacts that need to be examined by digital forensic professionals -in the simulated incident, the number of artifacts was reduced from 303,000 to 100.

The approach presented in this paper does not incorporate auto correlation methods that could be used to fuse multiple timestamps associated with a single event; this is an important area for future exploration because of the variety of timestamps with different temporal resolutions that must be accounted for when creating a super timeline. Another area for future research involves the creation of an interactive visualization of the log2timeline output that would provide a means to view details at multiple levels of abstraction.

The views expressed herein are those of the authors and do not reflect the official policy or position of the U.S. Air Force, U.S. Department of Defense or the U.S. Government.

  SELECT date, time, source, user, file_description FROM log2timeline WHERE (((date)=#4/27/2012#) AND ((time)>#17:50:52# AND (time)<#18:21:8#) AND ((source = "Event Log") AND ((file_description) Like "*528*" OR (file_description) Like "*538*")) OR (((date)=#4/27/2012#) AND ((time)>#17:50:52# AND (time)<#18:21:8#) AND ((file_description) Like "*.exe*")) ORDER BY Date DESC, Time DESC;

Table 1 .

 1 Data items in the log2timeline CSV file.

	Field Name	Data Type
	ID	AutoNumber
	date	Date/Time
	time	Date/Time
	timezone	Text
	MACB	Text
	source	Text
	sourcetype	Text
	type	Text
	user	Text
	host	Text
	short	Memo
	file description Memo
	version	Number
	filename	Memo
	inode	Number
	notes	Memo
	format	Text
	extra	Text
	artifacts. The keywords and time frames may change, but the queries
	would remain the same.


Ç Ae ¹ Ë È À Ê

Stéphane Popinet

Stéphane Zaleski

Introduction

Sonoluminescence, the phenomenon by which sound is turned into light was first documented in the 1930's by German scientists studying the catalysing effect of sound waves on chemical reactions. Using ultrasound transducers invented during the First World War, H.Frenzel and H.Schultes of the university of Köln reported in 1934 light emission from clouds of cavitating bubbles generated in their solution. Their first interpretation of the phenomenon is now called triboluminescence. They suggested electric surface charges could be generated during the strong oscillations of collapsing bubbles. Electric sparks would then be the cause of light emission. Several other researchers studied this problem and looked for possible light emission mechanisms. It is currently believed that high temperatures are reached in the bubbles due to compression during the collapse. This would then explain both the catalysing effect of ultrasound and the measured spectra corresponding to temperatures up to 3000 • K.

However, due to the complexity of the dynamics of these large clouds of cavitating bubbles it was difficult to extract more information from the experiments and a theoretical model was difficult to find. In 1988, F. Gaitan and L. Crum managed to trap a single sonoluminescing bubble at the antinode of a stationary ultrasound wave [START_REF] Gaitan | Sonoluminescence and bubble dynamics for a single, stable, cavitation bubble[END_REF]. Their discovery renewed the interest in the study of the mechanisms of sonoluminescence because the phenomenon was very stable allowing the different parameters of singlebubble sonoluminescence to be studied in detail.

The apparatus for single bubble sonoluminescence is very simple. Usually two piezo-electric transducers are glued diametrally opposite one another on a spherical glass sphere (around 10 cm in diameter). A driving current of around 25 kHz frequency (depending on the resonant frequency of the container) generates a standing sound wave with an amplitude of around 1 atmosphere. A bubble can be levitated at the antinode of the sound wave. The force counteracting gravity is called the Bjerknes force and is an average of the driving pressure gradient over one acoustic cycle. When the pressure falls, the bubble expands and the force due to the pressure gradient (-v∇P where v is the volume of the bubble) is greater than during the collapse phase, giving rise to a net force over one cycle. For certain values of the bubble radius and the amplitude of the acoustic forcing, this force counterbalances gravity and the bubble is on average stationary. Not all trapped bubbles sonoluminesce however and the phenomenon appears to be very sensitive to a variety of parameters. One important discovery made by Gaitan and Crum was the need for partially degassed water. This could appear surprising at first. One would think that a bubble in degassed water would tend to dissolve and ultimately disappear, whereas single-bubble sonoluminescence has been observed to last for several minutes even hours. The beginning of an explanation is given by the phenomenon of rectified diffusion. When the bubble expands the pressure inside decreases and air dissolved in water flows in. The reverse occurs during contraction, but the surface is smaller giving rise to a positive net mass inflow. This can compensate for the loss due to classical diffusion. A number of theoretical studies of the parameter range for stability of this process have been conducted [START_REF] Holt | Observation of stability boundaries in the parameter space of single bubble sonoluminescence[END_REF][START_REF] Brenner | Bubble shape oscillations and the onset of sonoluminescence[END_REF][START_REF] Brenner | Acoustic energy storage in single bubble sonoluminescence[END_REF] and this theory accounts satisfactorily for the experimental observations.

The light intensity itself appears very sensitive to temperature [START_REF] Barber | Sensitivity of sonoluminescence to experimental parameters[END_REF], and gas composition [START_REF] Hiller | Effects of noble gas doping in singlebubble sonoluminescence[END_REF][START_REF] Hiller | Observation of isotope effects in sonoluminescence[END_REF].

Cooling the liquid from 20 • C to 1 • C increases the light intensity by a factor of 200, at which point the light spot is clearly visible even with ambient light. Another striking feature of the light emission is the brevity of the emitted pulses. The light emission is indeed not continuous and occurs once during each acoustic cycle with a phase shift. Trying to characterize the light emission mechanism S. Putterman and B. Barber measured the duration of the pulses to be less than 50 picoseconds [START_REF] Barber | Observation of synchronous picosecond sonoluminescence[END_REF]. They had to use the fastest photo-multipliers at their disposal and this duration is only an upper bound. This is obviously extremely short (one millionth of the acoustic period) and emphasizes the extremely high concentration of energy which occurs.

The spectrum of light emission reveals another strange feature [START_REF] Hiller | Spectrum of synchronous picosecond sonoluminescence[END_REF]. The maximum of intensity appears to be beyond ultraviolet which suggests that very high temperatures are reached (50,000 • K and higher). These available spectral measurements were made using quartz containers, but due to the cutoff wavelength of water, no data regarding the exact location of the maximum of intensity are available yet. This, together with the brevity of the light pulses suggests that the hypothesis of compressional heating retained as the mechanism for multiple-bubble sonoluminescence does not hold for single-bubble sonoluminescence. This hypothesis leads to temperatures of around 5000 • K and pulses duration of 20 nanoseconds (500 times too long).

Lead by these considerations, H.P. Greenspan and A. Nadim [START_REF] Greenspan | On sonoluminescence of an oscillating gas bubble[END_REF] and C. Wu and P.H. Roberts [START_REF] Wu | Shock-wave propagation in a sonoluminescing gas bubble[END_REF] proposed an explanation based on a shock-wave hypothesis. As the bubble collapses, the bubble walls eventually reach supersonic speed, launching a spherical shock wave in the gas. It is known from Guderley's self-similarity solution ( [START_REF] Witham | Linear and non-linear waves[END_REF], pp. 196-198) that in the ideal case the Mach number tends to infinity as the radius of the spherical shock wave tends to zero. Obviously in the real case the stability of the shock wave will limit this growth but this theory accounts well for the high temperatures and brevity of the light emission.

This theory relies however on the hypothesis of spherical symmetry. Following the arguments given by A. Prosperetti [START_REF] Prosperetti | A new mechanism for sonoluminescence[END_REF], there are strong reasons to believe that the bubble can not remain spherical during the collapse phase. Due to the asymmetry induced by gravity, the bubble will actually oscillate slightly around its equilibrium position along the vertical axis. During the collapse phase momentum conservation implies the formation of a high velocity jet oriented in the direction of motion. This is analogous to what happens for cavitation bubbles in the neighborhood of a solid wall. Due to the asymmetry induced by the solid wall, a high-velocity jet concentrating the momentum of the collapsing (and moving) bubble forms and eventually hits the wall. This is thought to be the explanation for cavitation damage.

The shockwave hypothesis may still be right however, but probably depends on the shape history of the bubble and the resulting shape of the shock wave [START_REF] Evans | Instability of converging shock waves and sonoluminescence[END_REF]. If the bubble is still spherical enough, the shockwave will remain spherical and stable for long enough for the gas to reach high temperatures. On the other hand, if the bubble is already deformed, the hypothesis of a spherical shock wave does not hold anymore. As an alternative explanation A. Prosperetti proposes the jet impact to be responsible for the light emission.

The phenomenon of single-bubble sonoluminescence is thus largely unexplained. The mechanism of light emission itself is unknown and the motion and shape of the bubble when it reaches its minimum radius (thought to be less than one micron) is very difficult to measure experimentally due to its brevity and small size.

These considerations lead us to consider the feasability of a numerical simulation of a bubble in the sonoluminescence regime. All the numerical models developed to date are based on one-dimensional formulations and we are not aware of any two or three-dimensional Navier-Stokes simulations. Ideally a numerical model would give information on the shape of the emitted shock wave or on the formation of a high velocity jet.

Numerical method

All the results presented here are computed using a free-surface version of the code described in [START_REF] Manservisi | Two front tracking algorithms for 2d interface problems[END_REF][START_REF] Popinet | A front tracking algorithm for the accurate representation of surface tension[END_REF]. The pressure in the bubble is considered to be uniform and is given by an appropriate equation of state. In all the calculations presented we assume an isothermal pressure law (p = p 0 V /V 0 , where V is the bubble volume). In the liquid phase, the full incompressible axisymmetric Navier-Stokes equations are solved using a projection method. The velocity and pressure fields are discretized on a staggered, fixed, Cartesian and regular mesh (figure 1). The code is first order in time and second-order in space. The Poisson-like pressure equation is solved using multigrid-accelerated Gauss-Seidel relaxations [START_REF] Press | Multigrid methods for boundary value problems[END_REF].

The interface is discretized using a set of marker points linked by cubic splines. This description allows the precise knowledge of the position and curvature of the interface, necessary to include the surface tension terms. As in all free-surface codes [START_REF] Harlow | Numerical calculation of time-dependent viscous incompressible flow of fluid with free surface[END_REF][START_REF] Chan | A computer study of finite-amplitude water waves[END_REF][START_REF] Nichols | Improved free surface boundary conditions for numerical incompressible-flow calculations[END_REF][START_REF] Hirt | Volume of fluid VOF method for the dynamics of free boundaries[END_REF], the most delicate point is the treatment of free-surface boundary conditions. The pressure on the interface on the fluid side is given by

p = p i + σκ + µn.D.n, (1)
where p i is the pressure in the bubble, σ the surface tension coefficient, κ the curvature, µ the dynamic viscosity, n the normal to the interface and D the deviatory part of the stress tensor. Using the irregular stars scheme described in [START_REF] Chan | A computer study of finite-amplitude water waves[END_REF] and the splines description of the interface, one can impose this condition during the relaxation of the pressure equation.

As we use a fixed grid to solve the Navier-Stokes equations, we need to extrapolate the velocity field far enough inside the bubble to get the velocity values necessary for the marker points advection and for the resolution of the Navier-Stokes equations on the fluid boundary (figure 1). Moreover, this must be done while fulfilling the zero tangential stress interface boundary condition

t.D.n = 0, ( 2
)
where t is the tangent to the interface. This is quite difficult to achieve but fitting two-dimensional polynomials through the points with the constraint given by (2) gives satisfactory results [START_REF] Manservisi | Two front tracking algorithms for 2d interface problems[END_REF].

The marker points are advected using a simple bilinear interpolation scheme and a redistribution is done at every time step to insure a uniform distribution as the bubble deforms. As underlined in [START_REF] Popinet | A front tracking algorithm for the accurate representation of surface tension[END_REF] the computational time needed by the marker part of the algorithm scales as 1/n where n is the number of grid points along one dimension and is then negligible for reasonable domain sizes (64 × 64 and up). All the calculations presented were done on a 200 MHz IBM compatible PC running Linux. The achieved typical speed is approximately 30,000 grid points/second.

Bubble dynamics and stability

As we have seen, sonoluminescence is certainly closely linked to cavitation even if the length scales involved are very different (millimeters for cavitation, micrometers for sonoluminescence). Interest in cavitation dates back to the First World War with cavitation around ship or submarines propellers. Rayleigh solved in 1917 the problem of the collapse of an empty spherical cavity in a large mass of liquid and showed the radius R(t) to obey the relation

R R + 3 2 ( Ṙ) 2 = p(R) -p ∞ ρ , ( 3
)
where ρ is the liquid density, p ∞ is the pressure in the liquid far from the bubble and p(R) is the pressure in the liquid at the bubble boundary. Plesset extended this relation to include viscous effects and surface tension [START_REF] Plesset | Bubble dynamics and cavitation[END_REF]

R R + 3 2 ( Ṙ) 2 = 1 ρ p i -p ∞ - 2σ R - 4µ R Ṙ , (4)
where the pressure in the gas at the bubble wall p i may be a function of time as well as the pressure at infinity p ∞ . This equation is often referred to as the Rayleigh-Plesset equation. The choice of an appropriate equation of state for the gas inside the bubble is necessary to close the system. As a first approximation, a polytropic law of the form p i = p 0 (R/R 0 ) 3κ with κ constant is convenient (κ = 1 for an isothermal gas, κ = γ if adiabatic). The Rayleigh-Plesset equation has been shown experimentally to give a good description of the behavior of a sonoluminescing bubble. Several researchers made laser scattering measurements of the evolution of the radius of the bubble with time which are well fitted by Rayleigh-Plesset equations where the pressure at infinity and the equilibrium radius R 0 = 2σ/(p i -p ∞ ) are adjustable parameters [START_REF] Barber | Sensitivity of sonoluminescence to experimental parameters[END_REF]. An example of the solution of the Rayleigh-Plesset equation for parameters typical of sonoluminescence is given figure 2. As we see the behavior of the bubble is quite complex. The first growth of the is followed by a violent collapse and several rebounds before the next expansion. Experimentally, the light is shown to be emitted during the first and most violent collapse. Using the Rayleigh-Plesset equation one can investigate the linear stability of non-spherical bubbles. Using spherical harmonics the bubble shape can be described as

S(r, θ, φ, t) = r -R(t) - n,m a nm Y m n (θ, φ), (5)
where S(r, θ, φ, t) = 0 is the equation of the bubble surface, R(t) is the instantaneous average radius and a nm (t) is the amplitude of the spherical harmonic component [START_REF] Plesset | Bubble dynamics and cavitation[END_REF]. Plesset & Mitchell were able to solve the equation for the a nm in the case of a fixed pressure difference p i -p ∞ . While it appears that the perturbations tend to a finite value in the case of an expansion of the bubble (due to the stabilizing effect of the divergence of the streamlines), the contraction is shown to be unconditionally unstable for all modes. In this case, the perturbation a n is shown to be proportional to R -1/4 exp ±icn 1/2 R -5/2 dt , where c is a constant. The linear theory thus predicts a growth proportional to R -1/4 with a superposed oscillation of increasing frequency. We should note however that this theory neglected both the viscosity and the surface tension which have both a stabilizing effect. This is true however only for small scales and will act mainly on short wavelengths (high n).

This unconditional instability of a contracting bubble is a major problem for numerical simulations. The growth in R -1/4 will not only affect any initial deviation from sphericity but also all the numerical errors introduced at each time step. While the initial perturbations are part of the physics of the problem, one does not want the numerical errors to become dominant.

Results

Rayleigh-Plesset oscillations of a bubble in an acoustic field

A first test relevant to sonoluminescence is the radial oscillation of a spherical bubble far from any boundaries. In this case the spherically symmetric Rayleigh-Plesset equation gives the evolution of the radius with time. An axisymmetric simulation should reproduce a similar behavior of the radius. Figure 3 illustrates such a simulation. The viscosity of the liquid is that of water and the surface tension coefficient is that for water/air. The equilibrium radius is 5 microns, the amplitude of the acoustic forcing is 0.5 atmosphere, frequency is 30 kHz.

We must note that the pressure forcing is only 0.5 atmosphere. In typical sonoluminescence conditions it should be close to one atmosphere, leading to much higher compression ratios as in figure 2. We have not implemented yet the adaptative grid refinement necessary to deal with radii varying from 100 to 1 microns as happens in sonoluminescence conditions.

Collapse of an empty cavity (cavitation bubble) near a solid wall

As seen above, we are interested in bubble deformations and particularly jet formation in the case of non-symmetrical flows. A case of particular interest is the collapse of a cavity near a wall, as happens during cavitation phenomena. Beautiful high-speed films of this phenomenon have been realized by W. Lauterborn [START_REF] Lauterborn | Cavitation bubble dynamics[END_REF][START_REF] Van Dyke | An album of fluid motion[END_REF], using laser-generated vapor bubbles in water. M.S. Plesset & R.P. Chapman showed that the experimental results were well fitted by their boundary-integral calculations of a collapsing bubble [START_REF] Plesset | Collapse of an intially spherical vapour cavity in the neighbourhood of a solid boundary[END_REF] (neglecting both viscosity and surface tension).

Figure 4 shows the results of such a collapse and looks very similar to those obtained by M.S. Plesset & R.B. Chapman [START_REF] Plesset | Collapse of an intially spherical vapour cavity in the neighbourhood of a solid boundary[END_REF]. A detailed comparison is not possible however, the simulation by Plesset & Chapman being a boundary integral calculation neglecting both viscosity and surface tension. The velocity after jet formation reaches 130 m/s, which is in agreement with their results.

Conclusion

In this paper, we have underlined the potential of full Navier-Stokes numerical simulations for the investigation of bubble dynamics problems. The case of sonoluminescence and cavitation are particularly relevant. Numerical simulations can potentially give useful information where experiments are difficult to perform. The analogy between sonoluminescence and cavitation, through the theory of jet formation of A. Prosperetti, can lead to interesting links between these phenomena. However, the unconditional physical instability of collapsing bubbles is a difficult challenge for numerical computations.

First results have been presented, including radial oscillations of a spherical bubble and jet formation for a cavitation bubble (with realistic physical parameters). These results are only preliminary and the simulation code requires further development but is already usable for the investigation of cavitation process. As far as sonoluminescence is concerned, the large spread of time and space scales make the simulation difficult and requires the use of adaptative grid refinement schemes. However, if the simulations can show that with realistic parameters, a jet really appears early enough during the compression phase, this will trigger interest for new theories trying to explain sonoluminescence.

Figure 1 :

 1 Figure 1: Mesh and discretization of the velocity and pressure fields. The marker points as well as the connecting cubic splines are represented. The light arrows are extrapolated values of the velocity field. The squares indicate the location of the pressure discretization when the pressure equation is solved.

Figure 2 :

 2 Figure 2: Solution of the Rayleigh-Plesset equation for parameters typical of sonoluminescence. Equilibrium radius: 2.5 µm, pressure amplitude: 1.25 atmospheres, frequency: 30 kHz.

Figure 3 :

 3 Figure3: Evolution of the radius with time for oscillations of an axisymmetric bubble in an acoustic field. The equilibrium radius is 5 microns, the amplitude of the acoustic forcing is 0.5 atmosphere, frequency is 30 kHz.

1 Figure 4 :Figure 5 :

 145 Figure 4: left: Collapse of an empty cavity near a wall. The interface markers are represented for different times. The bubble is initially spherical, the closest point being half a radius from the wall. The initial bubble diameter is 0.33 millimeters, the surrounding fluid is water and the surface tension coefficient is water/air: 0.07 kg.s -2 . The times represented are as follows (in µs). 1: 7.55, 2: 10.59, 3: 12.59, 4: 13.51, 5: 14.28, 6: 14.71, 7: 14.88, 8: 15.03, 9: 15.11. right: Boundary-integral simulation of the collapse by M.S. Plesset & R.B. Chapman.