Integrated digital forensic process model

Abstract

The Information and Communications Technology (ICT) environment constitutes an integral part of our daily lives. Individual computer users and large corporate companies are increasingly dependent on services provided by ICT. These services range from basic communication to managing large databases with corporate client information. Within these ICT environments something is bound to go wrong for a number of reasons, which include an intentional attack on information services provided by an organisation. These organisations have in turn become interested in tracing the root cause of such an incident with the intent of successfully prosecuting a suspected malicious user.Digital forensics has developed significantly towards prosecuting such criminals. The volumes of information and rapid technological developments have contributed to making simple investigations rather cumbersome. In the digital forensics community a number of digital forensic process models have been proposed encapsulating a complete methodology for an investigation. Software developers have also greatly contributed toward the development of digital forensics tools. These developments have resulted in divergent views on digital forensic investigations. This dissertation presents the IDFPM -Integrated Digital Forensic Process Model.The model is presented after examining digital forensic process models within the current academic and law enforcement literature. An adapted sequential logic notation is used to represent the forensic models. The terminology used in the various models is examined and standardised to suit the IDFPM. Finally, a prototype supports a limited selection of the IDFPM processes, which will aid a digital forensic investigator. There are a great many things about architecture that are hidden from the untrained eye.-Frank Gehry Acknowledgements• Thank you God for giving me the strength, wisdom, endurance and the patience to do this, despite the constant challenges.• I would like to thank my mother and father, Gary and Magsie, for their constant support, love and encouragement. Thank you for always listening and giving much needed advice. I would also like to thank my brothers Jonathan and Alexander, and sister Vanessa for their enthusiasm. None of this would have been possible without your support.• Thank you Prof Jan Eloff who has insisted that I complete this milestone in my life.Thank you for pushing me through the difficult times with your knowledge and experience. Thank you Prof Mariki Eloff for your soft and kind words that inspired me to see this through. You have both become great friends in this journey.• Thank you Prof Kourie, Prof Olivier, Prof Venter and Prof Carsten for listening when I asked questions, guiding me toward possible answers. Your help is highly appreciated.• My friends and colleagues in the ICSA lab over the past number of years. Thank you Emmanuel Adigun, Kamil Reddy, Maciej Rossudowski, Marco Slaviero, NeilCroft, Johann Fourie, Francois Mouton, Pedro de Souza and Waldo Delport. You have all tau...

Forensically ready digital identity management systems, issues of digital identity life cycle and context of usage

“…There are various process models to describe the steps and processes to follow during digital forensic investigations. During such investigations, it is not only the digital evidence itself that needs to prevail in a court of law; the process followed and terminology used should also be rigorous and generally accepted within the digital forensic community (Kohn et al, 2013). In this article, integrated DFIM (Kohn et al, 2013) is assumed as a DFIM having a four-step model in order to identify and prioritise DI lifecycle parameters by considering contexts of usage for DFIs.…”

“…During such investigations, it is not only the digital evidence itself that needs to prevail in a court of law; the process followed and terminology used should also be rigorous and generally accepted within the digital forensic community (Kohn et al, 2013). In this article, integrated DFIM (Kohn et al, 2013) is assumed as a DFIM having a four-step model in order to identify and prioritise DI lifecycle parameters by considering contexts of usage for DFIs. The four steps of the model are as follows: the readiness phase (the goal of this phase is to ensure that the operations and infrastructure are able to fully support an investigation), the deployment phase (the purpose is to provide a mechanism for an incident to be detected and confirmed), the physical crime investigation phase (the goal of this is to collect and analyse the physical evidence and reconstruct the actions that took place during the incident), and digital crime scene investigation phase (the goal is to collect and analyse the digital evidence obtained from the physical investigation phase and through any other future means).…”

Reviewing Existing Forensic Models to Propose a Cyber Forensic Investigation Process Model for Higher Educational Institutes

“…[7] In 2003, Brian D. Carrier and Eugene H. Spafford integrated the digital investigation to physical forensic investigation process. They introduced a concept of digital crime scene in a virtual environment created with the help of soft and hardware.…”

“…This model organizes the investigatory process to five groups and 17 phases (figure 4). [7] The readiness phase emphasizes on the inclination of the operational and infrastructural support. The deployment phase provides mechanism to detect and confirm an incident or event.…”

Onto-Engineering: A Conceptual framework for Integrating Requirement Engineering Process with scientifically tuned Digital Forensics Ontologies

“…Example of processes models include: Integrated Digital Forensic Process Model (IDPM) by Kohn, Eloff MM and Eloff JP [31], and a Cloud Forensic Readiness as a Service (CFRaaS) by Kebande and Venter [32].…”