Review and Assessment of the Existing Digital Forensic Investigation Process Models

Abstract

This review paper assesses the existing body of knowledge associated with digital forensic investigation process models. To this end, eleven of the existing models are critically reviewed and evaluated against an assessment criteria, namely the Daubert Test, to determine which models have taken the most scientific approach. This review and assessment reveal that the authors of these models have developed their models based on their own personal experience and on an ad-hoc basis. The critical review and assessment also reveal that there does not exist a comprehensive model encompassing the entire digital investigative process that is formal in that it synthesizes, harmonizes and extends the previous models, and that is generic in that it can be applied in the different fields of law enforcement, commerce and incident response.

Digital Forensics Study of a Cloud Storage Client: A Dropbox Artifact Analysis

“…For the preparation stage, the hardware and software tools needed for the investigation are identified. The next stage is to preserve the data that would be analyzed [21,22]. The rooting is done.…”

Blockchain and Clinical Trial

“…The results of our critical review of the previous DFIPMs have been presented in our previous studies such as in [6], [9], [13,14]. Therefore, since this research paper builds upon our previous studies, we have borrowed some information in the Introduction and Background Sections of this paper from those studies, with references being made to those past studies.…”

“…Presenting the review and assessment of these models is outside the scope of this paper. The reader, instead, is encouraged to refer to the studies presented in [6], [9,10,11], [13,14] to consult this review.…”

“…Such tools and methodologies must also adhere to some standards of practice and be accepted by other investigators operating in the field [3,4,5]. Nevertheless, the field of digital forensics still lacks both consensus and formal process models that the courts can employ to determine the reliability of the digital evidence presented to them [2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18]. The absence of agreements associated with DFIPMs has been widely acknowledged also by other researchers [6,7,8,9,10], [14,15,16], [18,19].…”

Making Decision on Sharing Forensic Data with the Fuzzy Logic Approach

“…Research by [12] demonstrates several classical digital forensic investigation models and shows that the majority of models present and focus on a very similar process: Collection, Examination, Analysis and Reporting of evidence which is all conducted in one laboratory [13].…”