Discovering spoliation of evidence through identifying traces on deleted files in macOS

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)

Abstract

Spoliation of evidence is a critical concern in various crimes such as information leakage, digital sexual crimes, accounting fraud, and copyright infringement. Several traditional digital forensic investigation methods such as recovery, carving, and anti-forensic behavior tracking are used to investigate these crimes. However, as technology has advanced, recovery and carving have become increasingly challenging. Shortly, data recovery will reach its technological limit, and it will be essential to obtain as much circumstantial evidence as possible based on traces of data left in suspect systems. However, no existing method can systematically track the spoliation of evidence; contemporary investigations typically depend solely on investigators’ skills and knowledge. This paper proposes a method to track deleted files by identifying and analyzing various sources that manage file-related metadata in macOS systems.

Original languageEnglish
Article number301502
JournalForensic Science International: Digital Investigation
Volume44
DOIs
Publication statusPublished - 2023 Mar

Bibliographical note

Funding Information:
This work was supported by Police-Lab 2.0 Program( www.kipot.or.kr ) funded by the Ministry of Science and ICT( MSIT , Korea) & Korean National Police Agency( KNPA , Korea). [Project Name: Research on Data Acquisition and Analysis for Counter Anti-Forensics/Project Number: 210121M07].

Funding Information:
This work was supported by Police-Lab 2.0 Program(www.kipot.or.kr) funded by the Ministry of Science and ICT(MSIT, Korea) & Korean National Police Agency(KNPA, Korea). [Project Name: Research on Data Acquisition and Analysis for Counter Anti-Forensics/Project Number: 210121M07].

Publisher Copyright:
© 2023 The Author(s)

Keywords

  • Digital forensics
  • Document forensics
  • e-discovery
  • macOS
  • Spoliation of evidence

ASJC Scopus subject areas

  • Pathology and Forensic Medicine
  • Information Systems
  • Computer Science Applications
  • Medical Laboratory Technology
  • Law

Fingerprint

Dive into the research topics of 'Discovering spoliation of evidence through identifying traces on deleted files in macOS'. Together they form a unique fingerprint.

Cite this