ABSTRACT

FORENSICS

Digital Forensics is often solely associated with the areas of attribution in the aftermath of a cyber-attack, as well as the discovery of hidden and the restoration of deleted files, either due to malicious attempts or simply because of errors by a legitimate user.

Still, digital forensics possesses many aspects that are not covered by current large-scale research and could be useful in order to thwart acts of cyberterrorism and cybercrime. Efficient methods for enabling cheap and fast digital investigations could not only lead to a much faster attribution of attacks with subsequent countermeasures (reactive, as well as proactive with respect to follow-up attacks), which would in itself be a valuable issue in order to reduce the expected motivation and increase the danger for cybercriminals. Accessible forensic methods could also be used in order to even detect attacks, especially considering instances of data and system manipulation. With respect to data theft and industrial espionage, methods for data leak detection and comprehensive audit & control mechanisms could help reduce the danger of espionage and exfiltration attacks by making the data thief more easily detectable.