Analisa Kinerja Aplikasi Digital Forensik Autopsy untuk Pengembalian Data menggunakan Metode NIST SP 800-86

Isi Artikel Utama

Dedek Julian
Tata Sutabri

Abstrak

Salah satu kasus kejahatan digital yang kerap terjadi adalah pencurian data, seperti informasi transaksi, hingga data penting milik perusahaan, pelaku pencurian akan menghapus berkas untuk menghilangkan jejak sehingga perlu dilakukan pencarian dan pengembalian data yang telah dihapus untuk dijadikan bukti digital, kegiatan ini biasa disebut digital forensik. Aplikasi digital forensik berbayar dijual dengan harga yang cukup mahal, sehingga salah satu alternatifnya adalah autopsy, yang merupakan aplikasi investigasi berbasis open source dan dapat melakukan pengembalian data. Penelitian ini bertujuan untuk menganalisis kinerja aplikasi autopsy dalam melakukan pengembalian 70 berkas dengan jenis dokumen, video dan gambar sebagai bukti digital berdasarkan pada skenario kasus kejahatan pencurian data dengan flashdisk yang telah diformat. NIST SP 800-86 dipilih sebagai metode penelitian karena memiliki tahapan yang sederhana dan sesuai dengan tema penelitian, tahapan dalam metode tersebut dimulai dari pengumpulan barang bukti, melakukan analisa isi flashdisk dengan aplikasi autopsy, mencari dan mengembalikan berkas temuan, hingga memvalidasi berkas dengan hash compare. Laporan hasil analisis menunjukkan bahwa aplikasi autopsy berhasil mengembalikan sebanyak 81,42% dari data yang telah dihapus dan dapat dijadikan bukti berdasarkan skenario kasus kejahatan yang telah dibuat, berkas yang berhasil dikembalikan yaitu 10 DOCX, 10 XLSX, 10 PDF, 6 TXT, 1 MP3, 10 MP4, dan 10 PNG.

Unduhan

Data unduhan belum tersedia.

Rincian Artikel

Cara Mengutip
Julian, D., & Sutabri, T. (2023). Analisa Kinerja Aplikasi Digital Forensik Autopsy untuk Pengembalian Data menggunakan Metode NIST SP 800-86. Jurnal Informatika Terpadu, 9(2), 136–142. https://doi.org/10.54914/jit.v9i2.984
Bagian
Artikel

Referensi

Y. Bellini and T. Sutabri, “Sistem Pakar Mendeteksi Tindak Pidana Cyber Crime untuk Penanganan Komputer Forensik Menggunakan Backward Chaining,” JDTI, vol. 6, no. 1, p. 42, Mar. 2023, doi: 10.32502/digital.v6i1.5619.

T. Sutabri, Konsep Sistem Informasi. Andi, 2012. [Online]. Available: https://books.google.co.id/books?id=uI5eDwAAQBAJ

T. Sutabri, Analisis Sistem Informasi. Andi, 2012. [Online]. Available: https://books.google.co.id/books?id=ro5eDwAAQBAJ

N. Sulisrudatin, “Analisa Kasus Cybercrime Bidang Perbankan Berupa Modus Pencurian Data Kartu Kredit,” jihd, vol. 9, no. 1, Jun. 2014, doi: 10.35968/jh.v9i1.296.

E. F. Thalib and K. L. Maswari, “Perlindungan Hukum terhadap Data Pribadi Perusahaan Akibat Penyalahgunaan Data Digital Oleh Karyawan Perusahaan,” Prosiding Seminar Nasional FH UNMAS Denpasar : Urgensi dan Implikasi RUU Perlindungan Keamanan Kerahasiaan Data Diri Berbasis Digitalisasi, vol. 1, no. 1, pp. 55–66, Oct. 2020.

I. Riadi, A. Fadlil, and M. I. Aulia, “Investigasi Bukti Digital Optical Drive Menggunakan Metode National Institute of Standard and Technology (NIST),” RESTI, vol. 4, no. 5, pp. 820–828, Oct. 2020, doi: 10.29207/resti.v4i5.2224.

Y. Andi Putra and T. Sutabri, “Analisis Penyadapan pada Aplikasi Whatsapp Dengan Menggunakan Metode Sinkronisasi Data,” Blantika, vol. 2, no. 1, pp. 11–20, Feb. 2023, doi: 10.57096/blantika.v2i1.8.

A. Yudhana, I. Riadi, and I. Anshori, “Analisis Bukti Digital Facebook Messenger Menggunakan Metode Nist,” ITJRD, vol. 3, no. 1, pp. 13–21, Aug. 2018, doi: 10.25299/itjrd.2018.vol3(1).1658.

D. T. Yuwono, A. Fadlil, and S. Sunardi, “Performance Comparison of Forensic Software for Carving Files using NIST Method,” Jurnal Teknologi dan Sistem Komputer, vol. 7, no. 3, pp. 89–92, Jul. 2019, doi: 10.14710/jtsiskom.7.3.2019.89-92.

S. U. Lubis, “Implementasi Metode MD5 untuk Mendeteksi Orisinalitas File Audio,” KOMIK, vol. 3, no. 1, Nov. 2019, doi: 10.30865/komik.v3i1.1620.

N. Nasirudin, S. Sunardi, and I. Riadi, “Analisis Forensik Smartphone Android Menggunakan Metode NIST dan Tool MOBILedit Forensic Express,” JIUP, vol. 5, no. 1, p. 89, Mar. 2020, doi: 10.32493/informatika.v5i1.4578.

I. Riadi, R. Umar, and I. M. Nasrulloh, “Analisis Forensik Digital pada Frozen Solid State Drive Dengan Metode National Institute Of Justice (NIJ),” ELINVO, vol. 3, no. 1, pp. 70–82, Jul. 2018, doi: 10.21831/elinvo.v3i1.19308.

I. Riadi, S. Sunardi, and S. Sahiruddin, “Analisis Forensik Recovery pada Smartphone Android Menggunakan Metode National Institute Of Justice (NIJ),” JURTI, vol. 3, no. 1, p. 87, Jun. 2019, doi: 10.30872/jurti.v3i1.2292.

R. Umar, A. Yudhana, and M. N. Fadillah, “Perbandingan Tools Forensik Pada Aplikasi Dompet Digital,” JIKO, vol. 6, no. 2, p. 242, Sep. 2022, doi: 10.26798/jiko.v6i2.621.

W. Pranoto, I. Riadi, and Y. Prayudi, “Perbandingan Tools Forensics pada Fitur TRIM SSD NVMe Menggunakan Metode Live Forensics,” ITJRD, vol. 4, no. 2, Feb. 2020, doi: 10.25299/itjrd.2020.vol4(2).4615.

I. Riadi, Sunardi, and Sahiruddin, “Perbandingan Tool Forensik Data Recovery Berbasis Android Menggunakan Metode NIST,” Jurnal Teknologi Informasi dan Ilmu Komputer (JTIIK), vol. 7, no. 1, pp. 197–204, Jan. 2020, doi: 10.25126/jtiik.202071921.

                                                                  ADOConnection.CacheExecute(3600, SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2]) % line  132, file: DAO.inc.php
                                                               DAO.retrieveCached(SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2], 3600) % line   91, file: ArticleSearchDAO.inc.php
                                                            ArticleSearchDAO.getPhraseResults(Object:Journal, Array[1], null, null, , 500, 1) % line  202, file: SubmissionSearch.inc.php
                                                         SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[1], , null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                      SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[4], , null, null, 500, 1) % line  195, file: SubmissionSearch.inc.php
                                                   SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[4], null, null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[3], null, null, null, 500, 1) % line  133, file: SubmissionSearch.inc.php
                                             SubmissionSearch._getMergedArray(Object:Journal, Array[1], null, null) % line  264, file: SubmissionSearch.inc.php
                                          SubmissionSearch.retrieveResults(Object:Request, Object:Journal, Array[1], null, null, null, Object:DBResultRange, Array[1]) % line   92, file: RecommendBySimilarityPlugin.inc.php
                                       RecommendBySimilarityPlugin.callbackTemplateArticlePageFooter(Templates::Article::Footer::PageFooter, Array[3]) % line  107, file: HookRegistry.inc.php
                                    HookRegistry.call(Templates::Article::Footer::PageFooter, Array[3]) % line 1256, file: PKPTemplateManager.inc.php
                                 PKPTemplateManager.smartyCallHook(Array[1], Object:Smarty_Internal_Template) % line   43, file: 5344c657d475ac490e5be9e38a89fff34c6138fd^1c372c95cd85572e0fbc9a53d0323a0b229cfc78_0.app.frontendpagesarticle.tpl.php
                              content_65c1deb46686f2_94134883(Object:Smarty_Internal_Template) % line  123, file: smarty_template_resource_base.php
                           Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) % line  114, file: smarty_template_compiled.php
                        Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) % line  216, file: smarty_internal_template.php
                     Smarty_Internal_Template.render(false, 1) % line  232, file: smarty_internal_templatebase.php
                  Smarty_Internal_TemplateBase._execute(Object:Smarty_Internal_Template, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null, 1) % line  134, file: smarty_internal_templatebase.php
               Smarty_Internal_TemplateBase.display(frontend/pages/article.tpl, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null) % line  924, file: PKPTemplateManager.inc.php
            PKPTemplateManager.display(frontend/pages/article.tpl) % line  292, file: ArticleHandler.inc.php
         ArticleHandler.view(Array[1], Object:Request) % line  391, file: PKPRouter.inc.php
      PKPRouter._authorizeInitializeAndCallRequest(Array[2], Object:Request, Array[1], false) % line  231, file: PKPPageRouter.inc.php
   PKPPageRouter.route(Object:Request) % line  143, file: Dispatcher.inc.php
Dispatcher.dispatch(Object:Request) % line  281, file: PKPApplication.inc.php
PKPApplication.execute() % line   68, file: index.php
                                                                  ADOConnection.CacheExecute(3600, SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2]) % line  132, file: DAO.inc.php
                                                               DAO.retrieveCached(SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2], 3600) % line   91, file: ArticleSearchDAO.inc.php
                                                            ArticleSearchDAO.getPhraseResults(Object:Journal, Array[1], null, null, , 500, 1) % line  202, file: SubmissionSearch.inc.php
                                                         SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[1], , null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                      SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[4], , null, null, 500, 1) % line  195, file: SubmissionSearch.inc.php
                                                   SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[4], null, null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[3], null, null, null, 500, 1) % line  133, file: SubmissionSearch.inc.php
                                             SubmissionSearch._getMergedArray(Object:Journal, Array[1], null, null) % line  264, file: SubmissionSearch.inc.php
                                          SubmissionSearch.retrieveResults(Object:Request, Object:Journal, Array[1], null, null, null, Object:DBResultRange, Array[1]) % line   92, file: RecommendBySimilarityPlugin.inc.php
                                       RecommendBySimilarityPlugin.callbackTemplateArticlePageFooter(Templates::Article::Footer::PageFooter, Array[3]) % line  107, file: HookRegistry.inc.php
                                    HookRegistry.call(Templates::Article::Footer::PageFooter, Array[3]) % line 1256, file: PKPTemplateManager.inc.php
                                 PKPTemplateManager.smartyCallHook(Array[1], Object:Smarty_Internal_Template) % line   43, file: 5344c657d475ac490e5be9e38a89fff34c6138fd^1c372c95cd85572e0fbc9a53d0323a0b229cfc78_0.app.frontendpagesarticle.tpl.php
                              content_65c1deb46686f2_94134883(Object:Smarty_Internal_Template) % line  123, file: smarty_template_resource_base.php
                           Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) % line  114, file: smarty_template_compiled.php
                        Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) % line  216, file: smarty_internal_template.php
                     Smarty_Internal_Template.render(false, 1) % line  232, file: smarty_internal_templatebase.php
                  Smarty_Internal_TemplateBase._execute(Object:Smarty_Internal_Template, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null, 1) % line  134, file: smarty_internal_templatebase.php
               Smarty_Internal_TemplateBase.display(frontend/pages/article.tpl, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null) % line  924, file: PKPTemplateManager.inc.php
            PKPTemplateManager.display(frontend/pages/article.tpl) % line  292, file: ArticleHandler.inc.php
         ArticleHandler.view(Array[1], Object:Request) % line  391, file: PKPRouter.inc.php
      PKPRouter._authorizeInitializeAndCallRequest(Array[2], Object:Request, Array[1], false) % line  231, file: PKPPageRouter.inc.php
   PKPPageRouter.route(Object:Request) % line  143, file: Dispatcher.inc.php
Dispatcher.dispatch(Object:Request) % line  281, file: PKPApplication.inc.php
PKPApplication.execute() % line   68, file: index.php
                                                                  ADOConnection.CacheExecute(3600, SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2]) % line  132, file: DAO.inc.php
                                                               DAO.retrieveCached(SELECT 				o.submission_id, 				MAX(s.context_id) AS journal_id, 				MAX(i.date_published) AS i_pub, 				MAX(p.date_published) A..., Array[2], 3600) % line   91, file: ArticleSearchDAO.inc.php
                                                            ArticleSearchDAO.getPhraseResults(Object:Journal, Array[1], null, null, , 500, 1) % line  202, file: SubmissionSearch.inc.php
                                                         SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[1], , null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                      SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[4], , null, null, 500, 1) % line  195, file: SubmissionSearch.inc.php
                                                   SubmissionSearch._getMergedPhraseResults(Object:Journal, Array[4], null, null, null, 500, 1) % line  147, file: SubmissionSearch.inc.php
                                                SubmissionSearch._getMergedKeywordResults(Object:Journal, Array[3], null, null, null, 500, 1) % line  133, file: SubmissionSearch.inc.php
                                             SubmissionSearch._getMergedArray(Object:Journal, Array[1], null, null) % line  264, file: SubmissionSearch.inc.php
                                          SubmissionSearch.retrieveResults(Object:Request, Object:Journal, Array[1], null, null, null, Object:DBResultRange, Array[1]) % line   92, file: RecommendBySimilarityPlugin.inc.php
                                       RecommendBySimilarityPlugin.callbackTemplateArticlePageFooter(Templates::Article::Footer::PageFooter, Array[3]) % line  107, file: HookRegistry.inc.php
                                    HookRegistry.call(Templates::Article::Footer::PageFooter, Array[3]) % line 1256, file: PKPTemplateManager.inc.php
                                 PKPTemplateManager.smartyCallHook(Array[1], Object:Smarty_Internal_Template) % line   43, file: 5344c657d475ac490e5be9e38a89fff34c6138fd^1c372c95cd85572e0fbc9a53d0323a0b229cfc78_0.app.frontendpagesarticle.tpl.php
                              content_65c1deb46686f2_94134883(Object:Smarty_Internal_Template) % line  123, file: smarty_template_resource_base.php
                           Smarty_Template_Resource_Base.getRenderedTemplateCode(Object:Smarty_Internal_Template) % line  114, file: smarty_template_compiled.php
                        Smarty_Template_Compiled.render(Object:Smarty_Internal_Template) % line  216, file: smarty_internal_template.php
                     Smarty_Internal_Template.render(false, 1) % line  232, file: smarty_internal_templatebase.php
                  Smarty_Internal_TemplateBase._execute(Object:Smarty_Internal_Template, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null, 1) % line  134, file: smarty_internal_templatebase.php
               Smarty_Internal_TemplateBase.display(frontend/pages/article.tpl, null, 5344c657d475ac490e5be9e38a89fff34c6138fd, null) % line  924, file: PKPTemplateManager.inc.php
            PKPTemplateManager.display(frontend/pages/article.tpl) % line  292, file: ArticleHandler.inc.php
         ArticleHandler.view(Array[1], Object:Request) % line  391, file: PKPRouter.inc.php
      PKPRouter._authorizeInitializeAndCallRequest(Array[2], Object:Request, Array[1], false) % line  231, file: PKPPageRouter.inc.php
   PKPPageRouter.route(Object:Request) % line  143, file: Dispatcher.inc.php
Dispatcher.dispatch(Object:Request) % line  281, file: PKPApplication.inc.php
PKPApplication.execute() % line   68, file: index.php