Digital Forensics

1.1 Overview of Digital Forensics

Digital forensics, sometimes known as digital forensic science is a branch of computer forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer cyber crime. Information and Communications Technology (ICT) working environments are experiencing increased computer use for other than work-related reasons. User activities may include but are not limited to browsing the Internet for private purposes and using online search engines for work-related information.

As ICT has grown at the same time advances in social networking, mobile technology, various cloud computing and storage solutions have increased the information flow within organizations.

Digital forensics is the process of employing scientific principles and processes to analyze electronically stored information and determine the sequence of events which led to a particular incident. In this digital age, it is important for researchers to become aware of the recent developments in this dynamic field and understand scope for the future. The past decade has witnessed significant technological advancements to aid during a digital investigation. Many methodologies, tools and techniques have found their way into the field designed on forensic principles. Digital forensics has also witnessed many innovative approaches that have been explored to acquire and analyze digital evidence from diverse

Some of them focus on different phases or subcomponents of an investigation. However, no integrated approach towards digital forensic investigations has been established yet. The shortcomings of the investigation process are generally exploited in court where both the digital evidence and the digital forensic process are scrutinized by the court and opposing stakeholders. The primary objective of this dissertation is to investigate existing digital forensic models reported on in the known published literature to determine whether these can be integrated into a single digital forensic process model. Evidence produced by implementing this process model in an investigation will ensure that it can withstand legal scrutiny in a court of law. The digital evidence presented is thus the result of a rigorous digital evidence collection process. The dissertation will however be limited to the development of an integrated digital forensic process model and will not include a validation study. A secondary objective is to investigate whether any part of the process model can be automated, without compromising the validity of the process model. The purpose here is to alleviate the time-consuming investigative processes on behalf of the investigators. Such processes are generally aimed at reducing the data to be analyzed during the investigation The key theme of proposed system is to