Skip to main content
Article
Preliminary forensic analysis of the Xbox one
Digital Investigation
  • Jason Moore, University of New Haven
  • Ibrahim Baggili, University of New Haven
  • Andrew Marrington, Zayed University
  • Armindo Rodrigues, University of New Haven
ORCID Identifiers

0000-0002-3839-6675

Document Type
Conference Proceeding
Publication Date
1-1-2014
Abstract

Video game consoles can no longer be viewed as just gaming consoles but rather as full multimedia machines, capable of desktop computer-like performance. The past has shown that game consoles have been used in criminal activities such as extortion, identity theft, and child pornography, but with their ever-increasing capabilities, the likelihood of the expansion of criminal activities conducted on or over the consoles increases. This research aimed to take the initial step of understanding the Xbox One, the most powerful Microsoft console to date. We report the outcome of conducting a forensic examination of the Xbox One, and we provide our Xbox One data set of hard drive images and unique files so that the forensic community may expand upon our work. The Xbox One was found to have increased security measures over its predecessor (Xbox 360). The encryption of the data and the new file types introduced made it difficult to discern potential digital evidence. While these added security features caused great difficulty in forensically acquiring digital forensic artifacts, some important and interesting digital evidence was gathered using open-source tools. We were able to find digital evidence such as times that the user initially set up the console, and times when the system was restored or shutdown. We were also able to determine what games and applications had been downloaded along with when the games were played. Finally, through our network forensic experiments, we were able to determine that various applications had different levels of security and that game traffic was encrypted.

Publisher
Digital Forensic Research Workshop
Disciplines
Keywords
  • Computer forensics,
  • Computer games,
  • Crime,
  • Cryptography,
  • Digital forensics,
  • Electronic crime countermeasures,
  • Hard disk storage,
  • Human computer interaction,
  • Network security,
  • Games,
  • Hard drives,
  • NTFS,
  • Video game consoles,
  • Xbox one,
  • Computer crime
Scopus ID

84904612806

Creative Commons License
Creative Commons Attribution-NonCommercial-No Derivative Works 4.0 International
Indexed in Scopus
Yes
Open Access
Yes
Open Access Type
Hybrid: This publication is openly available in a subscription-based journal/series
Citation Information
Jason Moore, Ibrahim Baggili, Andrew Marrington and Armindo Rodrigues. "Preliminary forensic analysis of the Xbox one" Digital Investigation Vol. 11 Iss. 2 (2014) p. S57 - S65 ISSN: <p><a href="https://v2.sherpa.ac.uk/id/publication/issn/1742-2876" target="_blank">1742-2876</a></p>
Available at: http://works.bepress.com/andrew-marrington/1/