Notions of Hypothesis in Digital Forensics

Tewelde, Segen; Grüner, Stefan; Olivier, Martin S.

doi:10.1007/978-3-319-24123-4_2

Cited by 6 publications

(3 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The term hypothesis in a digital investigation is a conjecture that may refer, for instance, to past events in the lifetime of digital devices [52]. In this paper, we focus on one type of hypothesis On Evidence Preservation Requirements for Forensic-Ready Systems ESEC/FSE'17, September [4][5][6][7][8]2017, Paderborn, Germany relevant to developing forensic-ready systems, the environment construction hypothesis.…”

Section: Hypothesesmentioning

confidence: 99%

On evidence preservation requirements for forensic-ready systems

Alrajeh

Pasquale

Nuseibeh

2017

Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering

View full text Add to dashboard Cite

Forensic readiness denotes the capability of a system to support digital forensic investigations of potential, known incidents by preserving in advance data that could serve as evidence explaining how an incident occurred. Given the increasing rate at which (potentially criminal) incidents occur, designing software systems that are forensic-ready can facilitate and reduce the costs of digital forensic investigations. However, to date, little or no attention has been given to how forensic-ready software systems can be designed systematically. In this paper we propose to explicitly represent evidence preservation requirements prescribing preservation of the minimal amount of data that would be relevant to a future digital investigation. We formalise evidence preservation requirements and propose an approach for synthesising specifications for systems to meet these requirements. We present our prototype implementationbased on a satisfiability solver and a logic-based learner-which we use to evaluate our approach, applying it to two digital forensic corpora. Our evaluation suggests that our approach preserves relevant data that could support hypotheses of potential incidents. Moreover, it enables significant reduction in the volume of data that would need to be examined during an investigation.

show abstract

Section: Hypothesesmentioning

confidence: 99%

On evidence preservation requirements for forensic-ready systems

Alrajeh

Pasquale

Nuseibeh

2017

Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering

View full text Add to dashboard Cite

show abstract

“…Hypotheses formulation is driven by the questions that are asked about the evidence [22,26]. The formulation plays an important role in the examination of evidence [1,2,5].…”

Section: Hypotheses Formulationmentioning

confidence: 99%

Establishing Findings in Digital Forensic Examinations: A Case Study Method

Oyelami

Olivier

2017

Advances in Digital Forensics XIII

Self Cite

View full text Add to dashboard Cite

In digital forensics, examinations are carried out to explain events and demonstrate the root cause from a number of plausible causes. Yin's approach to case study research offers a systematic process for investigating occurrences in their real-world contexts. The approach is well suited to examining isolated events and also addresses questions about causality and the reliability of findings. The techniques that make Yin's approach suitable for research also apply to digital forensic examinations. The merits of case study research are highlighted in previous work that established the suitability of the case study research method for conducting digital forensic examinations. This research extends the previous work by demonstrating the practicality of Yin's case study method in examining digital events. The research examines the relationship between digital evidence-the effect-and its plausible causes, and how patterns can be identified and applied to explain the events. Establishing these patterns supports the findings of a forensic examination. Analytic strategies and techniques inherent in Yin's case study method are applied to identify and analyze patterns in order to establish the findings of a digital forensic examination.

show abstract

“…When a suspect, for example, has a convincing alibi, the attention shifts to other suspects. While one may talk about the detective's theory or hypothesis, the meanings of these words are very different from what a scientist means when using the same words (see, e.g., the critique of Carrier's use of the term hypothesis [21]).…”

Section: Investigations Examinations and Analysesmentioning

confidence: 99%

On a Scientific Theory of Digital Forensics

Olivier¹

2016

IFIP Advances in Information and Communication Technology

Self Cite

View full text Add to dashboard Cite

A suitable theory to serve as scientific grounds for a digital forensic science is still elusive. Such a theory needs to satisfy the demands imposed by science and justify the facts derived as evidence using the theory. A number of grounding theories have been proposed. This chapter revisits three prominent theories, those of Gladyshev, Carrier and Cohen, and: (i) determines the requirements they suggest for a digital forensics theory; (ii) analyzes their primary differences; and (iii) assesses them using the norms that exist for science. This enables us to sketch the outlines of a new theory that better reflects the scientific requirements and the intended application of forensic science in a digital context.

show abstract

Notions of Hypothesis in Digital Forensics

Cited by 6 publications

References 13 publications

On evidence preservation requirements for forensic-ready systems

On evidence preservation requirements for forensic-ready systems

Establishing Findings in Digital Forensic Examinations: A Case Study Method

On a Scientific Theory of Digital Forensics

Contact Info

Product

Resources

About