1. Digital Forensics 2
Lecture 8:Digital artefacts Presented by : J.Silaa Lecturer: FCI 25 Oct 2017

2. Objectives Introduction Digital artifact types
Common Digital artifact locations
Source location file systems
Alteration
Conclusion

3. Digital artifact
Digital artifact is an artifact that is of a digital nature or creation. For example, a gif is such an artifact.
Digital Forensics Focuses on preservation against undesired or unintended alteration when data is introduced in a digital process by an involved technique and technology.
Digital artifact content
can be of any content types including
text, audio, video, image, animation or a
combination

4. Digital artifact types
The following artifacts can be extracted from various locations
Office documents, Registries, Important System files encrypted files , pictures ,videos
mobile apps SQLite databases
instant messenger charts,Social network charts(FaceBook,twitter etc),charts from multi-player online games and
Web Artifacts such as s,browsing history, bookmarks, and cookies from Firefox, Chrome, and IE

5. Common Digital artifact locations
All imaginable source of data
Storage device- Hard drives and removable media
Disk images EnCase(including Ex01).FTK,X-
Ways,raw(DD),SMART
Logical images- L01,Lx01
Mobile devices - iPhone/iPad,Android and Blackberry backups
Mobile dumps – UFED dumps,JTAG/chip-off dumps
Virtual machines- VMWare,Virtual PC,Virtual Box,XenServer,cloud
Volatile memory- Live RAM dumps
Fragmented memory set (analysis with
belkaCarving)
Virtual memory – Hibernation files and page files
SMART Disk Image Converter - Convert your disk image to various file types.
JTAG =Joint Test Action Group
UFED Reader is a software tool which allows users to share analysis reports with other authorized personnel including colleagues,
other investigators, lawyers etc. Features Include: - Advanced Analyzing Capabilities: Search and Entity bookmark functionalities

6. Artifacts:Source location file systems
FAT,FAT16,FAT32,extFAT
NTFS
HFS,HFS+
APFS
Ext1,ext2,ext3
YAFFS,YAFFS2
JFFS2
Etc
The Mac OS Extended Volume Hard Drive Format, otherwise known as HFS+, is the file system found
on Mac OS 8.1 and later, including Mac OS X. It is an upgrade from the original Mac OS Standard
Format known as HFS (HFS Standard), or Hierarchical File System, supported by Mac OS 8.0 and earlier.
Apple File System (APFS) is a proprietary file system for macOS, iOS, tvOS and watchOS, developed
and deployed by Apple Inc. It aims to fix core problems of HFS+ (also called Mac OS Extended), APFS’s
predecessor on these operating systems
Yaffs (Yet Another Flash File System) is an open-source file system specifically designed to be fast,
robust and suitable for embedded use with NAND and NOR Flash. It is widely used with Linux, RTOSs,
or no OS at all, in consumer devices and critical infrastructure.
JFFS2 is a log-structured file system designed for use on flash devices in embedded systems.
Rather than using a kind of translation layer on flash devices to emulate a normal hard drive,
as is the case with older flash solutions, it places the filesystem directly on the flash chips.

7. Digital artifacts alteration
, memorhi, cabling malfunctions, etc., corrupts data.
Are vulnerable to;
Editing: resampling, resizing and rotations
Transformation
Image enhancement: smoothing, contrasting
algorithm flaws such as decoding/encoding audio
or video,
Lossy Compression
Pixelization or aliasing
Software malfunctions -Algo flaws such as
decoding/encoding audio or video
Texture corruption and T-vertices in 3D graphics,
and pixelization in MPEG compressed video.
Aliasing: Digital imprecision generated in the process of converting analog information into digital space
is due to the limited granularity of digital numbering space. In computer graphics, aliasing is seen as pixilation

8. Conclusion
Comay be genera a result of the use
lossy compression techniques.
To establish a sound forensics evidence its necessary to know the source/location of digital artefacts
Digital artifacts like any other forensics evidences are susceptible to alteration
One example is the artifacts seen in JPEG and MPEG compression
algorithms that produce compression artifacts.
Aliasing: Digital imprecision generated in the process of converting analog information into digital space
is due to the limited granularity of digital numbering space. In computer graphics, aliasing is seen as pixilation .
Rolling shutter, the line scanning of an object that is moving too fast for the image sensor to capture a unitary image.
Error diffusion: poorly-weighted kernel coefficients result in undesirable visual artifacts

9. Reference https://www.youtube.com/watch?v=ZA4kAAeuCw0&t=2312s
Rivest, Shamir, and Adelma :RSA encryption