FIDI: Intelligent Data Analysis for Digital Forensics

Project FIDI

The research project FIDI is concerned with developing novel methods for digital forensics and fighting cybercrime. As part of the project, we aim at bringing together concepts from computer security, machine learning, and system simulation to automatically extract characteristic traces from digital data. We plan to apply our methods in different real-world applications, such as the triage of hard-disk images, the analysis of mobile phones, and the dissection of malicious software.

The project has officially started in February 2018 and has a running time of three years. It is funded by the German Federal Ministry of Education and Research. The project consortium consists of Technische Universität Braunschweig, ERNW Research, and Friedrich-Alexander-Universität Erlangen-Nürnberg.

FIDI is supported by the following investigating authorities: Bundeskriminalamt (BKA), Bundesamt für Sicherheit in der Informationstechnik (BSI), Polizeidirektion Göttingen with LKA Niedersachsen and Polizeiinspektion Braunschweig.

Further Information

Additional information are available in German on the corresponding webpage of the German Federal Ministry of Education and Research (BMBF).

Consortium

Technische Universität Braunschweig

The TU Braunschweig was founded in 1745 and belongs to the TU9, the nine leading technical-oriented universities in Germany. The Institute of System Security at TU Braunschweig conducts research on computer and network security, including the detection of attacks, the analysis of malicious code, and the discovery of vulnerabilities. A special emphasis is put on the combination of computer security and machine learning, which allows for developing security systems that learn from data and adapt to changing threats.

TUBS

ERNW Research

ERNW is an independent IT Security service provider based in Heidelberg, Germany. Since its founding in 2001, our focus has been on consulting and testing in all areas of IT security, unallied from outside shareholders and a need to sell products. This independence and self-accountability drives us, as a company, to adhere to a higher standard of professional conduct and development. ERNW Research GmbH is part of the ERNW Universe and performs technical research projects and offers various services in the area of incident analysis, malware analysis and medical device security.

ernw

Friedrich-Alexander-Universität Erlangen-Nürnberg

Founded in 1743, FAU is a strong research university with an international perspective and one of the largest universities in Germany, with about 40.000 students. Research at the Security Lab at the Department of Computer Science is structured around the landscape of cybercrime with its three main groups of actors (attackers, users and investigators) and their main activities and deficits: attack and evasion for attackers, awareness and education for victims, evidence extraction and analysis for investigators.

fau

Associated Partners

Bundeskriminalamt (BKA), OE 1 - Technisch Operativer Service
Bundesamt für Sicherheit in der Informationstechnik (BSI), Referat CK 24 – Technische Analyse
Polizeidirektion Göttingen mit Einbindung LKA Niedersachsen
Polizeiinspektion Braunschweig

Publications

One key to rule them all: Recovering the master key from RAM to break Android's file-based encryption
Tobias Groß, Marcel Busch and Tilo Müller.
Proc. of the Eighth Annual DFRWS Europe 2021, March 2021.
Forensic Analysis of the Resilient File System (ReFS) Version 3.4.
Paul Prade, Tobias Groß and Andreas Dewald.
Proc. of the Seventh Annual DFRWS Europe 2020, June 2020.
Systematic Analysis of Browser History Evidence.
Tobias Groß, Richard Dirauf and Felix Freiling.
Proc. of 13th International Conference on Systematic Approaches to Digital Forensic Engineering (SADFE), May 2020.
On the Security and Applicability of Fragile Camera Fingerprints.
Erwin Quiring, Matthias Kirchner and Konrad Rieck.
Proc. of 24th European Symposium on Research in Computer Security (ESORICS), September 2019.
Web-based Cryptojacking in the Wild.
Marius Musch, Christian Wressnegger, Martin Johns and Konrad Rieck.
Proc. of 14th International Conference on Availability, Reliability and Security (ARES), August 2019.
Analyzing Android’s File-Based Encryption: Information Leakage through Unencrypted Metadata.
Tobias Groß, Matanat Ahmadova and Tilo Müller.
Proc. of 14th International Conference on Availability, Reliability and Security (ARES), August 2019.
False Sense of Security: A Study on the Effectivity of Jailbreak Detection in Banking Apps.
Ansgar Kellner, Micha Horlboge, Konrad Rieck and Christian Wressnegger.
Proc. of 4th IEEE European Symposium on Security and Privacy (EuroS&P), June 2019.
TypeMiner: Recovering Types in Binary Programs using Machine Learning.
Alwin Maier, Hugo Gascon, Christian Wressnegger and Konrad Rieck.
Proc. of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), June 2019.
New Kid on the Web: A Study on the Prevalence of WebAssembly in the Wild.
Marius Musch, Christian Wressnegger, Martin Johns and Konrad Rieck.
Proc. of 16th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA), June 2019.
Advances in Forensic Data Acquisition
Felix Freiling, Tobias Groß, Tobias Latzo, Tilo Müller, Ralph Palutke
IEEE Design & Test, Vol. 35(5), 63-74, October 2018