Dr Sarah Morris
Digital Forensics Research Portfolio
Research Publications ~ 2012
Virtual Crime: Forensic Artefacts from Second Life
Second Life is an online virtual environment which is populated by users from all over the world. The virtual environment is split into a variety of public and private areas; these provide avatars with a chance to explore a wide range of environments and interact with other users. There is also an opportunity for users to create personalised environments; organisations such as the BCS have created customised environments to assist with education and training. Over the past few years the media has highlighted various legal cases involving virtual worlds; these cases cover both civil and criminal activities such as adultery, stalking and simulated child molestation. An analyst may potentially have an investigation where they need to understand the activity which goes on in a virtual environment and how to recover potential evidence. Digital Forensic Analysts may require training as they may not be familiar with how virtual worlds work and the types of digital artefacts left by their use. Previous research into Digital Forensics on Virtual Environments has primarily focused on their use to provide scenario based education. Little research has yet been published on methodologies for identifying artefacts relating to activities in virtual environments.
This paper highlights the requirement to provide focused training on both the criminal activity and digital artefacts relating to the use of virtual environments. The paper also describes a series of experiments that were conducted to ascertain the artefacts left after using Second Life. The experiments were conducted in virtual machines and aimed to replicate typical interaction between a user’s avatar and the Second Life environment. This paper provides useful reference material for an analyst during an investigation, as it describes the artefacts identified as a result of this research. Finally this paper uses the results of this research to provide a basis for a discussion on the educational requirements for investigating crime in virtual environments.
Morris, S; (2012); "Virtual Crime: Forensic Artefacts from Second Life"; Proceedings from 6th Cybercrime Forensics Education & Training. Canterbury Christ Church University, Canterbury, UK