@InProceedings{10.1007/978-3-030-05487-8_5,
author="Singh, Avinash
and Ikuesan, Adeyemi R.
and Venter, Hein S.",
editor="Breitinger, Frank
and Baggili, Ibrahim ",
title="Digital Forensic Readiness Framework for Ransomware Investigation",
booktitle="Digital Forensics and Cyber Crime",
year="2019",
publisher="Springer International Publishing",
address="Cham",
pages="91--105",
abstract="Over the years there has been a significant increase in the exploitation of the security vulnerabilities of Windows operating systems, the most severe threat being malicious software (malware). Ransomware, a variant of malware which encrypts files and retains the decryption key for ransom, has recently proven to become a global digital epidemic. The current method of mitigation and propagation of malware and its variants, such as anti-viruses, have proven ineffective against most Ransomware attacks. Theoretically, Ransomware retains footprints of the attack process in the Windows Registry and the volatile memory of the infected machine. Digital Forensic Readiness (DFR) processes provide mechanisms for the pro-active collection of digital footprints. This study proposed the integration of DFR mechanisms as a process to mitigate Ransomware attacks. A detailed process model of the proposed DFR mechanism was evaluated in compliance with the ISO/IEC 27043 standard. The evaluation revealed that the proposed mechanism has the potential to harness system information prior to, and during a Ransomware attack. This information can then be used to potentially decrypt the encrypted machine. The implementation of the proposed mechanism can potentially be a major breakthrough in mitigating this global digital endemic that has plagued various organizations. Furthermore, the implementation of the DFR mechanism implies that useful decryption processes can be performed to prevent ransom payment.",
isbn="978-3-030-05487-8"
}
2018
Novel digital forensic readiness technique in the cloud environment
@article{Kebande_2017,
doi = {10.1080/00450618.2016.1267797},
url = {https://doi.org/10.1080%2F00450618.2016.1267797},
year = 2017,
month = {jan},
publisher = {Informa {UK} Limited},
pages = {1--40},
author = {Victor R. Kebande and H. S. Venter},
title = {Novel digital forensic readiness technique in the cloud environment},
journal = {Australian Journal of Forensic Sciences}
}
2018
On digital forensic readiness in the cloud using a distributed agent-based solution: issues and challenges
@article{Kebande_2016,
doi = {10.1080/00450618.2016.1194473},
url = {https://doi.org/10.1080%2F00450618.2016.1194473},
year = 2016,
month = {jun},
publisher = {Informa {UK} Limited},
pages = {1--30},
author = {Victor R. Kebande and H.S. Venter},
title = {On digital forensic readiness in the cloud using a distributed agent-based solution: issues and challenges},
journal = {Australian Journal of Forensic Sciences}
}
2018
Windows registry harnesser for incident response and digital forensic analysis
@article{Singh_2018,
doi = {10.1080/00450618.2018.1551421},
url = {https://doi.org/10.1080%2F00450618.2018.1551421},
year = 2018,
month = {dec},
publisher = {Informa {UK} Limited},
pages = {1--17},
author = {Avinash Singh and Hein S. Venter and Adeyemi R. Ikuesan},
title = {Windows registry harnesser for incident response and digital forensic analysis},
journal = {Australian Journal of Forensic Sciences}
}
2017
Digital forensic application requirements specification process
