Evaluation of Digital Forensic Process Models With Respect to Digital Forensics as a Service

Headnote

Abstract: Digital forensic science is very much still in its infancy, but is becoming increasingly invaluable to investigators. A popular area for research is seeking a standard methodology to make the digital forensic process accurate, robust, and efficient. The first digital forensic process model proposed contains four steps: Acquisition, Identification, Evaluation and Admission. Since then, numerous process models have been proposed to explain the steps of identifying, acquiring, analysing, storage, and reporting on the evidence obtained from various digital devices. In recent years, an increasing number of more sophisticated process models have been proposed. These models attempt to speed up the entire investigative process or solve various of problems commonly encountered in the forensic investigation. In the last decade, cloud computing has emerged as a disruptive technological concept, and most leading enterprises such as IBM, Amazon, Google, and Microsoft have set up their own cloud-based services. In the field of digital forensic investigation, moving to a cloud-based evidence processing model would be extremely beneficial and preliminary attempts have been made in its implementation. Moving towards a Digital Forensics as a Service model would not only expedite the investigative process, but can also result in significant cost savings - freeing up digital forensic experts and law enforcement personnel to progress their caseload. This paper aims to evaluate the applicability of existing digital forensic process models and analyse how each of these might apply to a cloud-based evidence processing paradigm.

Keywords: digital forensics as a service, digital forensics, process models, cloud computing

1.Introduction

The field of digital forensics has become commonplace due to the increasing prevalence of technology since the late 20th century, and the inevitable relevance of this technology in the conducting of criminal activity. In traditional forensics, the evidence is generally something tangible that could identify the criminal, such as hair, blood or fingerprints. In contrast, digital forensics deals with files and data in digital form extracted from digital devices. Digital forensics is a widely-used term, referring to the identification, acquisition and analysis of digital evidence originating from much more than just computers, such as smartphones, tablets, Internet of Things Devices, or data stored in the cloud.

In the not-so-distant past, most cases involving digital forensic investigation involved criminals using computers, networks or other...