A Forensic Traceability Index in Digital Forensic Investigation

Abstract

<p> <span>Digital crime inflicts immense damage to users and systems and now it has reached a level of sophistication that makes it difficult to track its sources or origins especially with the advancements in modern computers, networks and the availability of diverse digital devices. Forensic has an important role to facilitate investigations of illegal activities and inappropriate behaviors using scientific methodologies, techniques and investigation frameworks. Digital forensic is developed to investigate any digital devices in the detection of crime. This paper emphasized on the research of traceability aspects in digital forensic investigation process. This includes discovering of complex and huge volume of evidence and connecting meaningful relationships between them. The aim of this paper is to derive a traceability index as a useful indicator in measuring the accuracy and completeness of discovering the evidence. This index is demonstrated through a model (<i>TraceMap</i>) to facilitate the investigator in tracing and mapping the evidence in order to identify the origin of the crime or incident. In this paper, tracing rate, mapping rate and offender identification rate are used to present the level of tracing ability, mapping ability and identifying the offender ability respectively. This research has a high potential of being expanded into other research areas such as in digital evidence presentation.</span><span></span> </p

Integrated management model of the corporate digital forensic investigation

“…Therefore, KPI metrics concepts from another research area must be adopted to build the CDFI KPI metric system. However, some metrics in the DF investigative process have already been proposed, such as the Forensic Traceability Measurement by authors Siti R. Selamat et al [3]. Daniel Ayers [13] makes suggestions for the measurement of the computer forensic tools' efficacy and performance, including the following parameters: absolute (T) and relative (T1) speed; completeness (%); accuracy (100 %); reliability (100 %); auditability (%); repeatability (%); and limitations of first-generation tools (Y/N).…”

“…In the acquisition phase of the CDFI process there are two aspects: (1) physical acquisition or collection of the DE sources, and (2) logical acquisition of the potential DE, retrieving them from a forensic image/clone in the post-mortem model applied in this model. In big data and cloud computing environments, the diversity of devices and locations generates a huge volume of DE that is not easily identified and traced [3]. In the acquisition and analysis phases of the CDFI process, forensic tools must be scientifically proved, legally accepted and performed by qualified DF experts responsible for the integrity of the DE.…”

“…Just as any process can be decomposed according to purpose, such as implementation, analysis, improvement, etc., the decomposition of the DF investigative process can be into four phases [12], five [2], or more [3]. In this research, the main purpose of the integrated CDFI process model decomposition is to avoid failed investigation and to improve CDFI procedures.…”

“…Otherwise, admissibility of DE at trial does not depend so much on the acquisition but on the legality of the seizure, legality of the search, and relevance of the DD for the case. The DE, coming from many types of digital devices, can be easily modified and damaged, since it [3]: (1) is dispersed through the computer's traces; (2) is barely readable to humans; (3) gives a partial view of an incident/crime; (4) comprises abstractions of certain events; (5) is volatile and easily altered; and (6) must be retrieved from different sources and created by corroborative digital traces.…”

“…Michael W. Andrew [2] has introduced the concepts of efficiency and accuracy as the central issues in the DF analysis phase. Authors Siti R. Selamat, et al [3] introduce an original Trace Map Model to facilitate the investigator in tracing and mapping the rate of evidence and offender identification. Mapping the DF investigation framework process, defined with between 3 and 21 phases, with activities and outputs for each phase, in order to optimize the whole DF investigation process, is suggested by Siti R. Selamat et al [4].…”