Nhien-An Le-Khac

Remote access tools (RATs), such as AnyDesk, are increasingly used for both legitimate enterprise management and illicit activities, including fraud and data theft. This dual use poses unique challenges for forensic professionals in distinguishing lawful from harmful usage. Although recent studies have examined RATs artefacts, the scope has remained confined to independent artefact analysis with limited correlation and a lack of a structured investigative framework. Therefore, this paper presents a systematic forensic framework for analysing various aspects and correlating evidence across multiple sources for AnyDesk-related incidents in Windows environments, highlighting its relevance for cyber investigations. We first analyse forensic artefacts produced by AnyDesk, including logs, registry keys, prefetch files, and volatile memory remnants. Then, through targeted data collection and correlation of system and browser artefacts, we reconstruct timelines of user and session activities. This methodology is validated via a simulated incident of unauthorised access and data exfiltration, demonstrating the importance of session metadata, remote client IDs, and file transfer indicators. In addition, we present open-source and custom tools that were used to automate the forensic process with various aspects, including support and artefacts coverage. We also extend our discussion of the proposed framework to address potential implications in legal or ethical scenarios, as well as considerations for advanced prospects such as anti-forensics threats and AI-driven investigation. This research advances the emerging field of remote access forensics by providing professionals with a reliable and justifiable method for examining AnyDesk-related cases in both corporate and criminal settings.

Concept drift—changes in the underlying data distribution over time—poses a significant challenge to machine learning systems deployed in dynamic environments. While numerous drift detection methods have been developed for structured data such as tabular and time-series streams, concept drift in image data remains an underexplored area due to the unstructured and high-dimensional nature of visual information. This survey presents the first comprehensive review of concept drift detection methods tailored for image data streams. We propose a novel taxonomy that categorizes existing approaches based on key properties such as image feature handling, detection strategy, detection level, concept drift cause, and evaluation considerations. Through the lens of this taxonomy, we analyze 14 representative concept drift detection methods designed for image data, highlighting current approaches to the field, their strengths and limitations. Based on this analysis, we outline promising future research directions to advance the field of concept drift detection in image-based systems.

Digital forensics faces unprecedented challenges with the emergence of digital twins and metaverse technologies. This paper presents the first comparative analysis between blockchain-based and traditional database systems for managing digital twin evidence in forensic investigations. We conducted controlled experiments comparing the Ethereum blockchain with IPFS storage against traditional SQL databases for digital twin evidence management. Our findings reveal that while blockchain provides superior data integrity and immutability, crucial for forensic applications, traditional databases offer better performance consistency. The blockchain implementation showed faster average storage times but higher variability in retrieval operations. Both systems maintained forensic integrity through hash verification, though blockchain's immutable nature provides additional security guarantees essential for legal proceedings. This research contributes to the development of robust digital forensic methodologies for emerging technologies in the metaverse era.

The rapid advancement of generators (e.g., StyleGAN, Midjourney, DALL-E) has produced highly realistic synthetic images, posing significant challenges to digital media authenticity. These generators are typically based on a few core architectural families, primarily Generative Adversarial Networks (GANs) and Diffusion Models (DMs). A critical vulnerability in current forensics is the failure of detectors to achieve cross-generator generalization, especially when crossing architectural boundaries (e.g., from GANs to DMs). We hypothesize that this gap stems from fundamental differences in the artifacts produced by these \textbf{distinct architectures}. In this work, we provide a theoretical analysis explaining how the distinct optimization objectives of the GAN and DM architectures lead to different manifold coverage behaviors. We demonstrate that GANs permit partial coverage, often leading to boundary artifacts, while DMs enforce complete coverage, resulting in over-smoothing patterns. Motivated by this analysis, we propose the \textbf{Tri}archy \textbf{Detect}or (TriDetect), a semi-supervised approach that enhances binary classification by discovering latent architectural patterns within the "fake" class. TriDetect employs balanced cluster assignment via the Sinkhorn-Knopp algorithm and a cross-view consistency mechanism, encouraging the model to learn fundamental architectural distincts. We evaluate our approach on two standard benchmarks and three in-the-wild datasets against 13 baselines to demonstrate its generalization capability to unseen generators.