Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

Casey, Eoghan; Ferraro, Monique Mattei; Nguyen, Lam M.

doi:10.1111/j.1556-4029.2009.01150.x

Cited by 64 publications

(33 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The quantity of crimes that incorporate a digital element has grown also. This explosion in the number of cybercrimes to be investigated has led to pressure on the resources of law enforcement agencies, with backlogs in conducting digital forensic investigations now commonly running into years in many instances (Casey et al, 2009;Lillis et al, 2016).…”

Section: Literature Reviewmentioning

confidence: 99%

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

Scanlon

Lillis

2017

Digital Investigation

View full text Add to dashboard Cite

a b s t r a c tEducation and training in digital forensics requires a variety of suitable challenge corpora containing realistic features including regular wear-and-tear, background noise, and the actual digital traces to be discovered during investigation. Typically, the creation of these challenges requires overly arduous effort on the part of the educator to ensure their viability. Once created, the challenge image needs to be stored and distributed to a class for practical training. This storage and distribution step requires significant time and resources and may not even be possible in an online/distance learning scenario due to the data sizes involved. As part of this paper, we introduce a more capable methodology and system as an alternative to current approaches. EviPlant is a system designed for the efficient creation, manipulation, storage and distribution of challenges for digital forensics education and training. The system relies on the initial distribution of base disk images, i.e., images containing solely base operating systems. In order to create challenges for students, educators can boot the base system, emulate the desired activity and perform a "diffing" of resultant image and the base image. This diffing process extracts the modified artefacts and associated metadata and stores them in an "evidence package". Evidence packages can be created for different personae, different wear-and-tear, different emulated crimes, etc., and multiple evidence packages can be distributed to students and integrated into the base images. A number of additional applications in digital forensic challenge creation for tool testing and validation, proficiency testing, and malware analysis are also discussed as a result of using EviPlant.

show abstract

Section: Literature Reviewmentioning

confidence: 99%

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

Scanlon

Lillis

2017

Digital Investigation

View full text Add to dashboard Cite

show abstract

“…Casey et al [3] define triage in digital forensics as part of forensic examination process. The forensic examination is described as three-tier strategy consisting of three levels: (i) survey/triage forensic inspection, (ii) preliminary forensic examination, and (iii) in-depth forensic examination.…”

Section: Introductionmentioning

confidence: 99%

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

2017

View full text Add to dashboard Cite

Digital triage is the first investigative step of the forensic examination. The digital triage comes in two forms, live triage and post-mortem triage. The primary goal of the live triage is a rapid extraction of an intelligence from the potential sources. The live triage raises legitimate concerns. The post-mortem triage is conducted in the laboratory and its main goal is ranking of the seized devices for the possible existence of the relevant evidence. The digital triage has the potential to quickly identify items that are likely to contain the evidential data. Therefore, it is a solution to the problem of case backlogs. However, existing methods and tools of the digital triage have limitations, especially, in the forensic context. Nevertheless, we have no better solution for the time being. In this paper, we critically review published research works and the proposed solutions for digital triage. The review is divided into four sections as follows: live triage, post-mortem triage, mobile device triage, and triage tools. We conclude that many challenges are awaiting for the developers in creating methods and tools of digital triage in order to keep pace with the development of new technologies.

show abstract

“…The sheer volume of potentially evidence-rich data alongside the complexity involved in accessing and acquiring the data from such a variety of sources leads to extended processing time per case. As a result, digital evidence backlogs are commonplace in law enforcement agencies throughout the world [1,2,3]. These backlogs in local, state and national police forces commonly reach one to two years, and in some extreme cases can exceed four years [3].…”

Section: Introductionmentioning

confidence: 99%

Battling the digital forensic backlog through data deduplication

Scanlon

2016

2016 Sixth International Conference on Innovative Computing Technology (INTECH)

View full text Add to dashboard Cite

Abstract-In recent years, technology has become truly pervasive in everyday life. Technological advancement can be found in many facets of life, including personal computers, mobile devices, wearables, cloud services, video gaming, web-powered messaging, social media, Internet-connected devices, etc. This technological influence has resulted in these technologies being employed by criminals to conduct a range of crimes -both online and offline. Both the number of cases requiring digital forensic analysis and the sheer volume of information to be processed in each case has increased rapidly in recent years. As a result, the requirement for digital forensic investigation has ballooned, and law enforcement agencies throughout the world are scrambling to address this demand. While more and more members of law enforcement are being trained to perform the required investigations, the supply is not keeping up with the demand. Current digital forensic techniques are arduously timeconsuming and require a significant amount of man power to execute. This paper discusses a novel solution to combat the digital forensic backlog. This solution leverages a deduplicationbased paradigm to eliminate the reacquisition, redundant storage, and reanalysis of previously processed data.

show abstract

Investigation Delayed Is Justice Denied: Proposals for Expediting Forensic Examinations of Digital Evidence*

Cited by 64 publications

References 7 publications

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

EviPlant: An efficient digital forensic challenge creation, manipulation and distribution solution

Methods and Tools of Digital Triage in Forensic Context: Survey and Future Directions

Battling the digital forensic backlog through data deduplication

Contact Info

Product

Resources

About