Real-time digital forensics and triage

Roussev, Vassil; Quates, Candice; Martell, Robert E.

doi:10.1016/j.diin.2013.02.001

Cited by 67 publications

(47 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The first stage, in which many potential sources of digital evidence for specific information are reviewed, is alternatively referred to as survey or triage. The same idea that triage is part of forensic examination, is supported in later works [4][5][6][7][8].…”

Section: Introductionmentioning

confidence: 69%

See 1 more Smart Citation

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

2017

View full text Add to dashboard Cite

Digital triage is the first investigative step of the forensic examination. The digital triage comes in two forms, live triage and post-mortem triage. The primary goal of the live triage is a rapid extraction of an intelligence from the potential sources. The live triage raises legitimate concerns. The post-mortem triage is conducted in the laboratory and its main goal is ranking of the seized devices for the possible existence of the relevant evidence. The digital triage has the potential to quickly identify items that are likely to contain the evidential data. Therefore, it is a solution to the problem of case backlogs. However, existing methods and tools of the digital triage have limitations, especially, in the forensic context. Nevertheless, we have no better solution for the time being. In this paper, we critically review published research works and the proposed solutions for digital triage. The review is divided into four sections as follows: live triage, post-mortem triage, mobile device triage, and triage tools. We conclude that many challenges are awaiting for the developers in creating methods and tools of digital triage in order to keep pace with the development of new technologies.

show abstract

Section: Introductionmentioning

confidence: 69%

“…There are many other definitions of triage, which slightly differ depending on the attributed qualities [7][8][9][10][11][12]. The diversity of triage definitions reflects the variety of the views and indicates the immaturity of the field.…”

Section: Introductionmentioning

confidence: 99%

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

2017

View full text Add to dashboard Cite

show abstract

“…The regulation might also extend towards expressing the investigative results, given the extensive set of potential outcomes and the threat of data alternation or elimination especially in environments with a high degree of volatility. Considering also the threat to the resultant interpretations imposed by the anti-forensics actions (Simmons, Jones, & Simmons, 2011), the regulative aspects might provide the contours of an investigative strategy that incorporates both the hypothesis-based approach (Carrier, 2006;Casey, 2011) and the © 2015 ADFSL often necessary real-time digital forensics triage (Roussev, Quates, & Martell, 2013). By abstracting the characteristics of the investigative strategy, the deviations from the accepted norms identified with the interpretative bias, contingency and favoritism can be more easily recognized and eliminated.…”

Section: A Comparison In Respect To Examination and Conclusionmentioning

confidence: 99%

Rules of professional responsibility in digital forensics: A comparative analysis

Sharevski

2015

JDFSL

View full text Add to dashboard Cite

The Committee on Identifying the Needs of Forensic Sciences Community (2009) accentuates the establishment of a uniform code of ethics emphasizing the importance of enforceability in strengthening the role that the forensic science plays within the criminal justice system. Equally pertinent to the domain of digital forensics, this imperative entails a research commitment in comparing and contrasting the respective codes of ethics to illustrate their variety, specificity and enforceability to inform the discussion on the associated regulative aspects. Accordingly, this paper reviews the professional regulation inaugurated in both the US and international digital forensics arena giving a detailed perspective on the consolidation of the practice.

show abstract

“…Triaging a live system is one approach, where data are assessed for their evidence value [9,10], outside the laboratory, prior to the recovery of a HDD and its forensic examination. The process of triage avoids data being written to the HDD through the use of external storage, typically a USB memory device, to contain the executable triage code and the resulting data recovered.…”

Section: Virtual Machinesmentioning

confidence: 99%

A lightweight software write-blocker for virtual machine forensics

Tobin

Le-Khac

Kechadi

2016

2016 Sixth International Conference on Innovative Computing Technology (INTECH)

View full text Add to dashboard Cite

Abstract-The integrity of any original evidence is fundamental to a forensic examination. Preserving the integrity of digital evidence is vitally important as changing just one bit among perhaps gigabits of data, will irrevocably alter that data and cast doubt on any evidence extracted. In traditional digital forensics write-blockers are used to preserve the integrity of that evidence and prevent changes from occurring, but virtual machine forensics presents more difficult challenges to address. Access to the digital storage device will probably not be possible, typically the only accessible storage will be a virtual hard disk drive. This will have the same integrity issues as those of a real device, but with the added complication that it is not possible to use a hardware write-blocker to prevent changes to those data. For this reason it is important to explore how to implement write-blocking mechanisms on a virtual device. In this paper we present an implementation of a software write-blocker and show how we can use it to be compliant with the 2 nd ACPO principle on digital evidence.

show abstract

Real-time digital forensics and triage

Cited by 67 publications

References 9 publications

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

Rules of professional responsibility in digital forensics: A comparative analysis

A lightweight software write-blocker for virtual machine forensics

Contact Info

Product

Resources

About