Quantitative evaluation of the results of digital forensic investigations: a review of progress

Abstract

Unlike conventional forensics, digital forensics does not at present generally quantify the results of its investigations. It is suggested that digital forensics should aim to catch-up with other forensic disciplines by using Bayesian and other numerical methodologies to quantify its investigations' results. Assessing the plausibility of alternative hypotheses (or propositions, or claims) which explain how recovered digital evidence came to exist on a device could assist both the prosecution and the defence sides in criminal proceedings: helping the prosecution to decide whether to proceed to trial and helping defence lawyers to advise a defendant how to plead. This paper reviews some numerical approaches to the goal of quantifying the relative weights of individual items of digital evidence and the plausibility of hypotheses based on that evidence. The potential advantages enabling the construction of cost-effective digital forensic triage schemas are also outlined. KEY POINTS The absence of quantified results from digital forensic investigations, unlike those of conventional forensics, is highlighted. A number of approaches towards quantitative evaluation of the results of digital forensic investigations are reviewed. The significant potential benefits accruing from such approaches are discussed.

Adaptive Observability for Forensic-Ready Microservice Systems

“…where parameter e i ∈ [1, ∞) represents the scale of importance of potential digital evidence, specified as probative value. In particular, probative value is defined as the degree of significance of digital evidence used to decide whether the evidence supports a particular hypothesis in a legal case [36]. Formally, let E i denote the set of probative values for microservice i.…”

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

“…In this context, creating interoperable and auditable forensic procedures is a hard task, especially due to the lack of standardised reporting mechanisms. Moreover, qualitative aspects such as the outcomes and conclusions supported by the forensic analysis are often not reported accurately in an attempt to balance between technicality and comprehensibility, hindering the robustness of the findings [196]- [198]. Of particular relevance is the communication and readability of such reports, especially if these are to be interpreted by law practitioners, judges, and other stakeholders who do not always have the necessary technical background about the forensic tools nor the underlying technologies analysed [199], [200].…”

“…The above implies the development of advanced machine learning and AI algorithms and tools that will underpin future digital forensics investigations. An important part of these systems is undoubtedly understanding the scope of the investigation and the explainability of the results [257], which is critical to assess the impact of current investigations and quantify their effectiveness [198], a critical step to ensure the implementation of the proper measures. The latter is a crucial part of AI and machine learning modules that have to be introduced as in order for a piece of evidence to be admissible in a court of law, one has to justify not only how and from where it has been collected but to also prove the relevance to the case, how it was used, and why it is linked with the rest of the evidence.…”

A Novel Digital Forensic Framework for Data Breach Investigation

“…The investigation process is highly dependent on the device type and environment used, which means that digital forensics has more than one branch because digital devices can include traditional computers, mobile devices, and network devices such as routers [28]. Furthermore, the continual emergence of new types of cybercrime necessitates adaptive investigation process models, new technology, and cutting-edge techniques to combat these incidents [29], [30]. The most significant objective of digital forensics is to gather evidence to respond to the 5Ws and How (5WH) questions: what occurred, who was involved, and when, where, why, and how an incident occurred.…”