Integrated digital forensic process model

For the past decade, digital forensics has been the subject of scientific study, and as a result it has become an established research and application field. One of the foundational methods in which the researchers in the field have attempted to comprehend the scientific basis of this discipline has been to develop models which reflect their observations. Various process models have been developed describing the steps and processes to follow during a digital forensic investigation. This paper provides a detailed review of 11 published papers representing digital forensic process models. The aim of this review is to gain background knowledge of the existing research on the digital forensic investigation process models and the problems associated with those models.

Digital forensics has become an important part of legal proceedings by providing digital evidence. As more information could be extracted from a website, the number of criminal activities involving web applications increases and it becomes more crucial for digital investigators to conduct analysis properly. Therefore, a suitable process model is highly needed to ease the operation of investigating web attack incidents. This study proposes a digital forensic process model for web attack investigations in the defence and security sector. A total of twelve (12) existing digital forensic process models have been evaluated to develop a new digital forensic process model, which is applicable to be used in Malaysia's defence and security sector. The research methodology that is being utilized to develop the model is a qualitative method to gather more data to support the new digital forensic process model for the defence and security sector. The new model is expected to benefit the sectors in processing web attack incidents and ensure that the phases taken in the process can be used to find evidence and assist web attack investigation for reference in daily operations.

A formal process model is needed to enable digital forensic practitioners in following a uniform approach and to enable courts of law in determining the reliability of digital evidence presented to them. Such a model also needs to be generic in that it can be applicable in the different fields of digital forensics including law enforcement, corporates and incident response. There does not currently exist such a comprehensive process model that is both formal and generic. To address these shortcomings, this paper proposes a model that is formal in that it can enable the digital forensic practitioners in following a uniform approach when carrying out investigations and that is generic in that it can be applied in the different environments of digital forensics.

In the case of digital forensic investigations, the potential digital evidence captured, the analysis, interpretation, and attribution must ultimately be presented in the form of expert reports, depositions, and testimony in any legal proceedings. If the presentation and interpretation of the potential digital evidence is conducted correctly, it is much easier and useful in apprehending the attacker and stands a much greater chance of being admissible in the event of a prosecution. Wrongly presented and interpreted potential digital evidence data might create loopholes for perpetrators to exploit, thus, making it hard to convict and prosecute them. Existing digital forensic investigation process models have provided guidelines for identifying and preserving potential digital evidence captured from a crime scene. However, the extent to which such potential digital evidence may be admissible in a court of law remains a challenge to investigators. This is backed up by the fact that there are currently no standardised guidelines for even presenting the most common representations of digital forensic evidence. Therefore, in the authors' opinion, methodologies and specifications need to be developed in the field of digital forensics with the ability to effectively enhance the potential digital evidence presentation and interpretation in any legal proceedings. In this paper, therefore, we present a step-by-step framework in an attempt to propose high-level guidelines for enhancing the potential digital evidence presentation in any legal proceedings. Such a framework will be helpful to digital forensic experts, for example, in structuring investigation findings as well as in identifying relevant patterns of events to be incorporated during the presentation of potential digital evidence. The framework will also assist law enforcement agencies, for example, to determine, with less effort, the validity, weight and admissibility of any potential digital evidence presented. However, it should be noted that the purpose of this paper is not to replace any of the extensive and known evidence presentation principles, but serves as a survey of the state of the art of the research area while proposing harmonised and high-level guidelines for enhancing the presentation of potential digital evidence in legal proceedings.

The budding progress and relevance of digital information technology in quite a few areas of business, engineering, medical, agricultural and scientific studies are resulting in data explosion coined by the term “big data”. The dependency on digital media drives and devices has enlarged the dimensions of data formation and storage exponentially around the world, with a need of keeping a record of what data is accumulated and how the data is exercised. So it has raised an alarm of security for the data asset. To discover the pattern of interest leading to a decision from these voluminous data has put forth a challenge for the law enforcement and investigative agencies. Also, tracing such type of misutilization of digital technology in a big data age from the perspective of digital forensics requires minute bit-level examination and observations to locate the digital evidence that explains how maliciously nefarious activities have been done and by whom with the possible extent of the damage. The forensic examination and analysis in such a big data era requires appropriate digital investigation model with the application of tools, techniques and methodologies to boost decision-making and diagnostic process for advanced outfitted competence in digital forensic investigation with the intent of assembling valuable evidence from it. So, the need of the hour is to have a holistic outlook of the big data challenges and opportunities for its application in the digital forensic domain with the goal of making full-bodied investigation pronouncements. Much work has been done to model digital investigation as well as digital evidence but a comprehensive correlated and aggregated merging of voluminous data coming from different heterogeneous sources along with timely and accurate detection and analysis is the need of the hour. This chapter depicts the trends of digital forensics served for big data and the challenges of evidence acquisition, and further suggests the revision of the existing fusion-based digital investigation model by highlighting the formalization, quick detection and timely accurate analysis of digital evidence from multiple sources simultaneously. The modification adopted the inclusion of look-up table into the architecture with the application of data fusion to practice voluminous data effectually.

Recent high profile court trials around the world, including South Africa, have highlighted the importance of forensic science evidence in court. They have also show what can happen when forensic science is handled poorly in court leading to incorrect convictions or acquittals. Most often the problems have been linked to the qualifications, training, competency and experience of the forensic practitioners who examined and analysed the evidence. With digital forensics being recognised as a forensics science and criminal trials such as Casey Anthony and Julia Amero dominated by errors in the digital forensics process attributed to the examiners, it is crucial to understand what the current situation is in South Africa with regards local digital forensic practitioners, so as to identify any strengths or shortcomings which could impact on digital evidence in a court of law. The research focused on understanding the academic qualifications, digital forensics training, competency, and experience of South African digital forensic practitioners. General trends were identified through the research showing that South African digital forensic practitioners often lacked the necessary academic qualifications, training, competency and experience required of a digital forensics practitioner, raising concerns about the quality of digital forensics practice in South Africa. When contrasted against international standards, the research identified areas of improvement, and suggested potential remedial actions to address the situation.

BCFL logging: An approach to acquire and preserve admissible digital forensics evidence in cloud ecosystem

Being related to law and state-of-the-art technology, digital forensics needs more discipline than traditional forensics. The variety of types of crimes, distribution of networks and complexity of information and communication technology, add to the complexity of the process of digital investigations. A rigorous and flexible process model is needed to overcome challenges and obstacles in this area. In this paper we propose a digital forensics process, called "two-dimensional evidence reliability amplification process model", which presents a detailed digital forensic process model in five main phases and different roles to perform it. At the same time, this iterative process addresses four essential tasks as the umbrella activities that are applicable across all phases and sub-phases. We have also developed a hypothetical solution based on intersection of events and exploit mathematical operations and symbols for making an algorithm to increase the reliability of evidence. This process model is detailed enough to describe the investigation process so that it could possibly provide a guideline that investigators can take advantage of it during a forensics investigation process.

The advancement in information technology has changed our life significantly. No doubt, the Internet, smartphones, and social media have connected people and society. It has contributed to various aspects of our daily life. However, there is also a dark side of cyberspace, that is, cybercrime. It is becoming a global threat and needs technological solutions to combat. Whenever there is a crime, there is a law to curb the crime. The role of digital forensics is to understand the 'Who, What, Where and Why' of the incident. Digital forensics is a scientific process to collect, analyze, and present the evidence in a court of law. As it is used to link the person with criminal activities, it is crucial that the entire process of investigation be trustworthy. Managing the digital evidence and maintaining the chain of custody and integrity of digital evidence are utmost important. This chapter discusses the applications of blockchain technology to address the challenging issues faced by the digital investigation process and forensic readiness. The chapter also discusses the legal issues and admissibility of blockchain-based evidence in a court of law.

Digital forensics investigators have access to a wide variety of tools, both commercial and open source, which assist in the preservation and analysis of digital evidence. Unfortunately, most current digital forensics tools fall short in several ways. First, they are unable to cope with the ever-increasing storage capacity of target devices. As capacities grow into hundreds of gigabytes or terabytes, the traditional approach of utilizing a single workstation to perform a digital forensics investigation against a single evidence source, such as a hard drive, will become completely intractable. Further, huge targets will require more sophisticated analysis techniques, such as automated categorization of images. We believe that the next generation of digital forensics tools will employ high-performance computing, more sophisticated evidence discovery and analysis techniques, and better collaborative functions to allow digital forensics investigators to perform investigations much more efficiently than they do today. This chapter examines the next generation of digital forensics tools.

The usage of digital technology in the digital forensic investigation has grown in tandem with the rising importance of technology today. Too many incidences of digital and physical crime which is the focus of the world nowadays. To gather the finest evidence and investigative outcomes, a digital forensic model must be established. This study included a review of the literature on digital forensics and models established in digital forensics. According to the findings, the majority of research involves broad inquiries and procedures that overlap. Furthermore, no model has been developed to design a systemic inquiry. In this study, we propose a methodology for digital forensic examination to address this issue. This model combines several of the previous models and adds some new variables that are relevant to the study. Keywords: Due Diligence, Threats, Forensic Analysis, Preparation, Readiness, Cyber Security, BOOK Chapter ǀ Research Nexus in IT, Law, Cyber Security & Forensics. Open Access. Distributed Free Citation: Jonas Takyi Asamoah (2022): Exploring Lack of Due Diligence as a Threat to Forensic Analysis Preparation and Readiness Book Chapter Series on Research Nexus in IT, Law, Cyber Security & Forensics. Pp 307-314 www.isteams.net/ITlawbookchapter2022. dx.doi.org/10.22624/AIMS/CRP-BK3-P49

Due to businesses’ growing use of IoT services in their day-to-day operations and the increased use of smart devices, digital forensic investigations involving such systems will need increasingly sophisticated digital evidence collection and processing. The majority of IoT systems are composed of disparate software and hardware components, which may pose security and privacy concerns. Recently, blockchain technology was presented as one of the options for achieving IoT security via the use of an immutable ledger, a decentralized architecture, and strong cryptographic primitives. Integrating blockchain platforms with IoT-based applications, on the other hand, poses a number of difficulties owing to the trustworthiness, integrity, and real-time responsiveness of IoT data. However, certain IoT devices may be incompatible with existing blockchain-based IoT forensic methods for additional digital evidence processing owing to their usage of conventional hash. A critical feature of cryptographic hash functions is that even if just one bit of the input is altered, the output acts pseudo-randomly, making it impossible to identify identical files. However, in the field of computer forensics, it is essential to locate comparable files (e.g., various versions of a file); therefore, we need a hash function that preserves similarity. It is getting more difficult to establish how forensic investigators might utilize traces from such devices. To effectively deal with IoT digital forensics applications, this article presents an improved blockchain-based IoT digital forensics architecture that uses the fuzzy hash to construct the Blockchain’s Merkle tree in addition to the conventional hash for authentication. Fuzzy hashing enables the identification of potentially damning documents that might otherwise remain undiscovered using conventional hashing techniques. By comparing blocks/files to all nodes in the blockchain network using fuzzy hash similarity, the digital forensics investigator will be able to verify their authenticity. To support the proof of concept, we simulated the suggested model.

Along with the diverse types of electronic goods and digital evidence, techniques have also developed in conducting digital forensic investigations. Another effect is the increase in types and types of tools for conducting digital forensic investigations. The problem is the increasing number of digital forensic tools is not always developed in conjunction with the manual book. So this is what makes the investigator to check the tool to make it suitable for investigations. Choosing the right tool is very important in the investigation process, because each stage of the forensic investigation process has a different treatment for each of its staging. Seeing these conditions, then in this paper we make a system design to facilitate investigators in choosing the right digital forensic tool and in accordance with using an expert system. The design system shows that it’s still needed to confirm to an expert to get a match output if there is a new rule. Later this system will be implemented with website technology.

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

Scope of Managing Knowledge in Digital Forensics