Study of Comparison of Digital Forensic Investigation Models

What is Digital Forensics? Forensics - The use of science and technology to investigate and establish facts in criminal or civil courts of law. Forensics - The use of science and technology to investigate and establish facts in criminal or civil courts of law. Computer forensics is a branch of forensic science pertaining to legal evidence found in computers and digital storage mediums. Computer forensics is also known as Digital Forensics. Computer forensics is a branch of forensic science pertaining to legal evidence found in computers and digital storage mediums. Computer forensics is also known as Digital Forensics. Ref:

► Inculpatory Evidence – Supports a given theory ► Exculpatory Evidence – Contradicts a given theory ► Evidence of Tampering – Shows that the system was tampered with to avoid identification Types of Evidence Ref: T. Lillard Consulting, Inc. 2002

Computer Forensics Methodologies consist of Three Basic Components ► Acquiring the evidence while ensuring that the integrity is preserved; ► Authenticating the validity of the extracted data, which involves making sure that it is as valid as the original ► Analyzing the data while keeping its integrity. Ref: Kruse II, Warren and Jay, G. Heiser (2002) Computer Forensics: Incident Response Essentials. Addison-Wesley

The Forensics Process Model ► Collection ► Examination ► Analysis ► Reporting Ref: National Institute of Justice. (July 2001) Electronic Crime Scene Investigation. A Guide for First Responders.

The Abstract Digital Forensics Model ► Identification ► Preparation ► Approach strategy ► Preservation ► Collection ► Examination ► Analysis ► Presentation ► Returning evidence Ref: Mark Reith, Clint Carr and Gregg Gunsch.(2002)An Examination of Digital Forensic Models International Journal of Digital Evidence, Fall 2002,Volume 1, Issue 3

Pollitt 1995 Ref: Pollitt, M. “Computer Forensics: an Approach to Evidence in Cyberspace”, Proceedings (Vol. II, pp ) of the National Information Systems Security Conference, Baltimore, MD. 1995

Noblett, et al 2000 Ref: Noblett, M., Pollitt, M., Presley, L. “Recovering and Examining Computer Forensic Evidence”, Forensic Science Communications, Volume 2 Number

Digital Forensic Research Workshop 2001 Ref: Digital Forensic Research Workshop (DFRWS) Research Road Map, Utica, NY. (2001)

Reith, Carr and Gunsch 2002 They offer a model comprised of nine steps: ► Identification ► Preparation ► Approach Strategy ► Preservation ► Collection ► Examination ► Analysis ► Presentation ► Returning Evidence. Ref: Reith, M., Carr C. and Gunsch, G. “An Examination of Digital Forensic Models”, IJDE Fall 2002 Volume 1, Issue 3.

Carrier and Spafford 2003 ► Readiness ► Deployment ► Physical Crime Scene Investigation ► Digital Crime Scene Investigation ► Review Phases Ref: Carrier, B. and Spafford, E. “Getting Physical with the Digital Investigation Process”, International Journal of Digital Evidence Fall 2003, Volume 2, Issue 2.

Carrier 2003 ► In Carrier’s outlines the layers of abstraction that constitute Forensic Examination Ref: Carrier, B. “Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers”, International Journal of Digital Evidence Winter 2003, Volume 1, Issue 4.

Mocas 2003 She identified multiple contexts for digital forensics: ► Law Enforcement Context ► A Military Context ► Business System Security Context. Ref: Mocas, S. (2003) “Building Theoretical Underpinnings for Digital Forensics”,

Baryamueeba and Tushabe 2004 They suggested a modification to Carrier and Spafford’s Integrated Digital Investigation Model of ► They describes two additional phases  Trace back  Dynamite They seek to separate the investigation into primary crime scene (the computer) and the secondary crime scene (the physical crime scene). The goal is to reconstruct the two crime scenes concurrently to avoid inconsistencies Ref: Baryamureeba V. and Tushabe, F. “The Enhanced Digital Investigation Process Model”, DFRWS 2004, Baltimore, MD.

Beebe and Clark 2004 He proposes previous models were single tier, in fact the process tends to be multi-tiered. He proposes SEE approach: ► Survey ► Extract ► Examine They introduce the concept of objectives-based tasks. Ref: Beebe, N. and Clark, J. “A Hierarchical, Objectives-Based Framework for the Digital Investigations Process”, DFRWS 2004 Baltimore, MD.

Carrier and Spafford 2004 ► Carrier and Spafford add new elements to the digital forensic framework  Events and  Event Reconstruction Ref: Carrier, B. and Spafford, E. “An Event-based Digital Forensic Investigation Framework”, DFRWS 2004, Baltimore, MD

Ruibin, Yun and Gaertner 2005 Ref: Pollitt, M. “Six Blind Men from Indostan”, DFRWS, 2004, Baltimore, MD.

Erbacher, Christensen and Sundberg Ref: Robert F. Erbacher, Kim Christensen, and Amanda Sundberg, "Visual Forensic Techniques and Processes," Proceedings of the 9th Annual NYS Cyber Security Conference Symposium on Information Assurance, Albany, NY, June 2006, pp

Kent, Chevalier, Grance and Dang 2006 ► Collection ► Examination ► Analysis ► Reporting Ref: Kent, K., Chevalier, S., Grance, T. and Dang, H. “ Guide to Integrating Forensics into Incident Response”, Special Publication , Computer Security Division Information Technology Laboratory, National Institute of Standards and Technology, Gaithersburg, MD August 2006

Project Goals ► Study all existing digital forensic investigation models. ► Capture their timeline and basis for development. ► Compare them for their use in various situations and their pro and cons for those situations. ► Suggest drawbacks and need for further development. ► Evaluate their scalability and growth and technology adaptation. ► Find various important parameters to rate compare the existing and upcoming models. ► Tell their usage in Indian and Global context.