Software forensics

This article possibly contains original research. Please improve it by verifying the claims made and adding inline citations. Statements consisting only of original research should be removed. (December 2020) (Learn how and when to remove this template message)

|

Software forensics is the science of analyzing software source code or binary code to determine whether intellectual property infringement or theft occurred.[1] It is the centerpiece of lawsuits, trials, and settlements when companies are in dispute over issues involving software patents, copyrights, and trade secrets. [citation needed]Software forensics tools can compare code to determine correlation, a measure that can be used to guide a software forensics expert.

## Contents

* 1 Past methods of software forensics
* 2 Copyright infringement
* 3 Trade secret protection and infringement
* 4 Patent infringement
* 5 Objective facts before subjective evidence
* 6 See also
* 7 References

## Past methods of software forensics

Past methods of code comparison included hashing, statistical analysis, text matching, and tokenization. These methods compared software code and produced a single measure indicating whether copying had occurred. However, these measures were not accurate enough to be admissible in court because the results were not accurate, the algorithms could be easily fooled by simple substitutions in the code,[citation needed] and the methods did not take into account the fact that code could be similar for reasons other than copying.[2]

## Copyright infringement

Following the use of software tools to compare code to determine the amount of correlation, an expert can use an iterative filtering process to determine that the correlated code is due to third-party code, code generation tools, commonly used names, common algorithms, common programmers, or copying. If the correlation is due to copying, and the copier did not have the authority from the rights holder, then copyright infringement occurred.

## Trade secret protection and infringement

Software can contain trade secrets, which provide a competitive advantage to a business. To determine trade secret theft, the same tools and processes can be used to detect copyright infringement. If code was copied without authority, and that code has the characteristics of a trade secret—it is not generally known, the business keeps it secret, and its secrecy maintains its value to the business—then the copied code constitutes trade secret theft.

Trade secret theft can also involve the taking of code functionality without literally copying the code. Comparing code functionality is a very difficult problem that has yet to be accomplished by any algorithm in reasonable time. For this reason, finding the theft of code functionality is still mostly a manual process.

## Patent infringement

As with trade secret functionality, it is not currently possible to scientifically detect software patent infringement, as software patents cover general implementation rather than specific source code. For example, a program that implements a patented invention can be written in many available programming languages, using different function names and variable names and performing operations in different sequences. There are so many combinations of ways to implement inventions in software that even the most powerful modern computers cannot consider all combinations of code that might infringe a patent. This work is still left to human experts using their knowledge and experience, but it is a problem that many in software forensics are trying to automate by finding an algorithm or simplifying process.

## Objective facts before subjective evidence

One important rule of any forensic analysis is that the objective facts must be considered first. Reviewing comments in the code or searching the Internet to find information about the companies that distribute the code and the programmers who wrote the code are useful only after the objective facts regarding correlation have been considered. Once an analysis has been performed using forensic tools and procedures, analysts can then begin looking at subjective evidence like comments in the code. If the information in that subjective evidence conflicts with the objective analysis, analysts need to doubt the subjective evidence. Fake copyright notices, open source notifications, or programmer names that were added to source code after copying took place, in order to disguise the copying, are not uncommon in real-world cases of code theft.

## See also

* Cryptocurrency tracing
* Blockchain analysis

## References

1. ↑ Polpaya, Vinod (2014-03-31) (in en). Judiciary-Friendly Forensics of Software Copyright Infringement. IGI Global. pp. 58. ISBN 978-1-4666-5805-9. https://books.google.com/books?id=ldxGAwAAQBAJ&dq="Software+forensics"&pg=PA58.
2. ↑ Gladyshev, Pavel; Goel, Sanjay; James, Joshua; Markowsky, George; Johnson, Daryl (2022-06-03) (in en). Digital Forensics and Cyber Crime: 12th EAI International Conference, ICDF2C 2021, Virtual Event, Singapore, December 6-9, 2021, Proceedings. Springer Nature. pp. 41. ISBN 978-3-031-06365-7. https://books.google.com/books?id=rEtzEAAAQBAJ&dq="Software+forensics"&pg=PA40.

* v
* t
* e

Digital forensics

Branches|

* Computer forensics
* Mobile device forensics
* Network forensics
* Database forensics

Hardware|

* Forensic disk controller

Software|

* ADF Solutions Digital Evidence Investigator
* EnCase
* Foremost
* FTK
* Registry Recon
* PTK Forensics
* The Sleuth Kit
* The Coroner's Toolkit
* COFEE
* HashKeeper
* Xplico

Certification|

* Certified Forensic Computer Examiner (CFCE)
* Global Information Assurance Certification

Processes|

* Digital forensic process
* Data acquisition
* Digital evidence
* eDiscovery
* Anti-computer forensics

Organisations|

* National Software Reference Library
* American Society of Digital Forensics & eDiscovery
* Department of Defense Cyber Crime Center
* National Hi-Tech Crime Unit (NHTCU)
* Australian High Tech Crime Centre (AHTCC)

People|

* Mary Aiken
* Annie Antón
* Rebecca Bace
* Josh Brunty
* Eoghan Casey
* Hany Farid
* Simson Garfinkel
* Clifford Stoll
* Erik Laykin
* Robert Zeidman

Glossary of digital forensics terms

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Software forensics. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Software_forensics&oldid=4228968"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template