A metamodel for mobile forensics investigation domain

Abstract

With the rapid development of technology, mobile phones have become an essential tool in terms of crime fighting and criminal investigation. However, many mobile forensics investigators face difficulties with the investigation process in their domain. These difficulties are due to the heavy reliance of the forensics field on knowledge which, although a valuable resource, is scattered and widely dispersed. The wide dispersion of mobile forensics knowledge not only makes investigation difficult for new investigators, resulting in substantial waste of time, but also leads to ambiguity in the concepts and terminologies of the mobile forensics domain. This paper developed an approach for mobile forensics domain based on metamodeling. The developed approach contributes to identify common concepts of mobile forensics through a development of the Mobile Forensics Metamodel (MFM). In addion, it contributes to simplifying the investigation process and enables investigation teams to capture and reuse specialized forensic knowledge, thereby supporting the training and knowledge management activities. Furthermore, it reduces the difficulty and ambiguity in the mobile forensics domain. A validation process was performed to ensure the completeness and correctness of the MFM. The validation was conducted using two techniques for improvements and adjustments to the metamodel. The last version of the adjusted metamodel was named MFM 1.2.

Interpol review of digital evidence 2016 - 2019

“…Ali et al. [ 65 ] developed a Mobile Forensic Metamodel for mobile forensics based on a metamodel that identifies common concepts. It simplifies the investigation process and enables investigation teams to capture and reuse specialised forensic knowledge that, in turn, supports training and knowledge management.…”

“…Association indicates the functional relationship between the concepts; Specialisation represents the hierarchies between concepts; and, aggregation represents relationships between concepts that comprised of other concepts. The model underwent two rounds of validation: 1) comparison to ensure that all concepts of other mobile forensic models are represented in the metamodel, and 2) frequency to determine the importance of each concept to the metamodel [ 65 ]. The metamodel provides a guideline to domain users through the various concepts and who can then find decision solutions from semantic models.…”

A novel principle to validate digital forensic models

“…During the last decade specific DFMs developed by Hitchcock et al (2016), Kaur et al (2018), Ali et al (2017), Zia et al (2017), andLutui (2016) targeting certain areas of digital forensics such as digital triage, network forensics, mobile forensics, and Internet of Things (IoT) forensics respectively. To increase the e ectiveness and e ciency of IoT investigations Oriwoh et al (2013) propose 1-2-3 Zones in conjunction with Next-Best-Thing Triage (NBT) model where necessary by maximising the utilisation of time to ensure relevant evidence is identified and acquired.…”

Impact of the different level of transformational leadership on the employees’ performance: A case study of the ADNOC

“…Most organizations' crimes were coming from authorized employees such as Steal data, fraud, and money laundering, and so on. Several works have been proposed to reveal the employees' crimes in the literature (Ali et al, 2015;Al-Dhaqm et al, 2014;2016a;2016b;Aldhaqm et al, 2015;Ngadi et al, 2012).…”