Digital forensics research: The next 10 years

Abstract

Human subjects research CorporaReal data corpus Realistic data a b s t r a c t Today's Golden Age of computer forensics is quickly coming to an end. Without a clear strategy for enabling research efforts that build upon one another, forensic research will fall behind the market, tools will become increasingly obsolete, and law enforcement, military and other users of computer forensics products will be unable to rely on the results of forensic analysis. This article summarizes current forensic research directions and argues that to move forward the community needs to adopt standardized, modular approaches for data representation and forensic processing.

Domain-Specific Optimization in Digital Forensics

“…Our software tool Excavator represents the state-of-the-art in digital forensics data recovery, implementing fragmented file recovery [10,8] and a streambased processing model [11]. Furthermore, our model-driven approach distinguishes itself by allowing high-level specification of elaborate data structures not implemented in popular file carvers.…”

“…Clusters 1, 15, 16 and 20 contain only zeros. The remaining clusters contain three files: F 1 (clusters 2-6), F 2 (fragmented, clusters 7-10 and 17-19) and F 3 (clusters [11][12][13][14].…”

Digital forensic research: current state of the art

“…The volumes and the heterogeneity of digital evidence have called for the application of data reduction techniques by grouping data into larger chunks or by removing known and irrelevant data prior to analysis. Garfinkel [74] also acknowledges the growing volumes of storage devices and makes an additional observation that in the presence of the multiple operating systems, file formats and devices, there is no standard way to examine and analyze all types of digital evidence -this has led to the diversity problem. Besides, with digital investigations often having to deal with multiple sources, investigators are required to examine consistency and correlate the evidence discovered across these sources leading to the consistency and correlation challenge.…”

“…Quantity or Volume problem; and 5. Unified Time-lining problem Digital forensics has developed primarily a reactive field [74] which is a prime cause for these challenges, viz., advancements in digital forensics were triggered by crime first being committed on a computer or any digital device. Consequently, the field apparently seems to follows the trend rather than leading it.…”

“…Lalis et al's article on wearable computing [115] provides a flavor for this changing digital scenario. These advances in digital technology and the relatively gradual progress in digital forensics have resulted in five major challenges [34,74,169]. They are:…”