Self-Forensics Through Case Studies of Small-to-Medium Software Systems

• Published in: 2009 Fifth International Conference on IT Security Incident Management and IT Forensics pp. 128 - 141
• Main Authors: Mokhov, S.A., Vassev, E.
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01-09-2009
• Subjects: Context modeling; context-aware forensic computing; Cryptolysis; Data structures; Decision making; Distributed computing; DMARF; Encoding; Forensic Lucid; Forensics; GIPSY; Hardware; intensional programming; Java; JDSF; Open source software; self-forensics; Software systems; specification
• ISBN: 076953807X; 9780769538075
• DOI: 10.1109/IMF.2009.19

The notion and definition of self-forensics was introduced by Mokhov to encompass software and hardware capabilities for autonomic and other systems to record their own states, events, and others encoded in a forensic form suitable for (potentially automated) forensic analysis, evidence modeling and specification, and event reconstruction for various system components. For self-forensics, ldquoself-dissectionrdquo is possible for analysis using a standard language and decision making if the system includes such a self-forensic subsystem. The self-forensic evidence is encoded in a cyberforensic investigation case and event reconstruction language, Forensic Lucid. The encoding of the stories depicted by the evidence comprise a context as a first-class value of a Forensic Lucid ldquoprogramrdquo, after which an investigator models the case describing relationships between various events and pieces of information. It is important to get the context right for the case to have a meaning and the proper meaning computation, so we perform case studies of some small-to-medium, distributed and not, primarily academic open-source software systems. In this work, for the purpose of implementation of the small self-forensic modules for the data structures and event flow, we specify the requirements of what the context should be for those systems. The systems share in common the base programming language - Java, so our self-forensic logging of the Java data structures and events as Forensic Lucid context specification expressions is laid out ready for an investigator to examine and model the case.