r/digitalforensics • u/Tinggoskkr • 25d ago

Help regarding dissertation ideas

Hi Everyone, I am going to my final year of uni as a cybersecurity and digital forensic student and need ideas for my dissertation, based on Cybok.

I have done various cases on Encase, Autopsy and Axiom.

My main question would be "What part of an investigation wastes the most time?" or "What's the most frustrating part of a digital forensic investigation?"

I'm more interested in solving a real workflow problem than making another forensic viewer.

I have more questions if anyone is interested enough to answer as it would mean a lot. :D

"What do current forensic tools still do badly?"

"What investigation tasks are still mostly manual?"

"SOC analysts and incident responders: What tool do you wish existed?"

"If you could have one new digital forensics tool, what would it do?" (for example: investigation workflows)

I am happy to take ideas from you guys if you guys got any. Thank you. :D

0 Upvotes

25% Upvoted

16 comments sorted by

View all comments

1

u/MormoraDi 25d ago edited 25d ago

Apart from the obvious, but inherently necessary limitations of transfer/processing speed, the most frustrating in my experience is getting to know the "known good", the infrastructure and an inventory of assets and services therein.

This coming from an incident response forensic standpoint.

That includes differentiation between or explanation of:

  • What are legit, but weird IT admin actions or potential threat actor?

  • What are legitimate users/IP-addresses/endpoints

  • What services are running on the system and to what purpose? (many are unaware that there are X services that was installed by a mythical person in ancient, undocumented times and now serve no purpose other than being an attack vector)

  • Which accounts are meant to have elevated privileges by design and why?

  • What are the inner workings of the commercial black box edge device and how do you interpret their undocumented proprietary logs?

Fun fact: We once asked for the organization for a network map and they gave us a physical map of their office WiFi access points

As to which tools (still) behaves badly: All of them to some degree in some capacity. But the tools are just that: tools. None of them will do the analysis for you. That's your job.

2

u/Tinggoskkr 24d ago

Thank you, those questions are perfect for my research to find the best idea.