Keywords

Introduction

Nowadays, the nature of evidence presented in courts of law tends to be less likely paper-based considering the ubiquitous nature of information technology [1, 16]. Evidence of computer crime differs from that related to traditional crimes for which there are well established standards and procedures [1, 16, 17]. There does not exist a comprehensive digital investigation process model that is widely accepted by the digital forensic community and courts of law and which covers the entire lifecycle of digital forensic investigation processes. In many cases, digital forensic practitioners rely mainly on ad-hoc tools to carry out digital investigation. Examples of ad-hoc models include models developed by authors in [1–6]. The lack of a standardized digital investigation process model is not an isolated flaw within the field of digital forensic science. Cohen [7] states that the entire field of digital forensic still lacks agreements in fundamental areas. This might be due to the fact that the digital forensic field is still a very new discipline. A study conducted by Cohen [7, 8] on the level of consensus in foundational elements of digital evidence investigation revealed that the use of common definitions and common language are lacking.

The fact that there exists a lack of common definitions and language is also pointed out by other researchers such as [1–3, 9, 10]. Moreover, many other researchers in the field have increasingly been calling for scientific approaches and formal methods for describing the computer investigation processes [8, 11–14]. By implementing an integrated and comprehensive computer investigation process model, this paper will be of great value to the computer forensic practitioners. Moreover, as Adams et al. [1] state, the development of such a model will establish a starting point from which other investigators and researchers in the field will be able to continue to advance the field’s scientific credentials.

Related Work

Background

The main objective of a Computer Forensic Investigation Process Model or CFIPM is to assist the investigator in explaining how particular digital evidence is found on a device [1, 9, 20]. Although various CFIPMs exist in the current literature, the CFIPM processes and terminology have not been formally standardized up to date. Previously attempts to standardize the computer investigation process models appear to have failed due to various reasons. The main rationale behind these failed attempts is the fact that the authors have utilised their own terminology without attempting to identify the most common language that can be accepted unanimously by the digital forensic investigators.

The Table 1 describes the phases covered within the conducted research up to date. Like any other types of evidence, courts of law do not assume that digital evidence is valid and reliable without some empirical testing in relation to theories and techniques associated with its production [1, 18]. Courts of law take a careful notice of the way and process in which the digital evidence acquisition and storage were carried out [7, 18, 19]. The concept of admissibility refers to the fact that the courts need to verify whether the digital evidence is sound to be placed before a jury and will help to deliver a solid base in terms of making a decision in the case [20]. Courts in the U.K. and U.S. require the investigators and “proponent” of digital evidence to lay the proper foundation for its admissibility. They are concerned with the reliability and authenticity of such digital evidence [20, 21]. However, if forensic investigator is not able to present his/her evidence in a coherent and understandable way to the layperson such as judge and jury, the case may be lost [22]. The complexity of methodologies and software used to extract digital evidence requires the digital investigator to explain the evidence in such a way that judge and jury understand it [19].

Table 1. Analysis of the existing digital investigation process models up to date.
Full size table

Authors in [20, 23, 24] argue that while the actual mechanics of digital forensics are different from the better-known physical and medical forensics, the processes of all forensic sciences are fundamentally the same. Cohen [7, 8] states that judges need to keep out the poor-quality digital evidence from the courtroom. Regardless of the digital evidence or physical evidence, a forensic report must contain conclusions that can be reproduced by independent third parties. Reports based on accurately documented digital sources are much more likely to withstand the judicial scrutiny than opinions based on less reliable sources [25]. In the absence of something better, judicial systems might apply methods used to test scientific evidence into digital evidence presented before them [19, 26]. The digital forensic discipline was developed without any initial research required for a thorough scientific ground essential for permitting digital forensic evidence [27–29]. In 2004, Meyers et al. [28] warned that digital forensics is branded as “junk science” because of the absence of certifications, standards or peer-reviewed methods. Although this reference dates back to 2004, the issue of the lack of standardisation and consensus concerning process models regarding terminology, phases and types of activities within a process model still remain. This is pointed out by the latest reference such as [1, 7–10].

A careful and detailed examination of the literature has revealed a gap that there does not exist a comprehensive digital investigation process model which is widely accepted by the digital forensic community and courts of the law. The existing models are considered to be ad-hoc tools as opposed to formal models [1–3, 7, 8, 23, 24, 30–35]. For instance, Beebe et al. [33] state that a more comprehensive and generally accepted framework is needed to enhance scientific rigor and to facilitate education, application and research. Referring to the level of consensus in foundational elements of digital investigation process amongst researchers in the field, Cohen [8] states that the use of common language is lacking, and the consensus can be found present only after the definitions are made explicit. The United States Computer Emergency Readiness Team [30] states, “Because computer forensics is a new discipline, there is little standardization and consistency across the courts and industry.” Ciardhuáin [34] states that a complete and inclusive model should have general advantages for IT managers, auditors and others who are not necessarily implicated with the legal process because of growing occurrences of crimes implicating computers. Ciardhuáin [34] further states, “A comprehensive model of cybercrime investigations is important for standardising terminology, defining requirements, and supporting the development of new techniques and tools for investigators”. This is further supported by the authors in [1, 9]. Moreover, Zainudin et al. [10] state that one of the most significant problems that digital investigators encounter is the absence of standardisation in the field of computer forensics. Karyda et al. [36] state that utilising ad-hoc methods and tools for the extraction of digital evidence can undermine the reliability and credibility of digital evidence.

Therefore, to deal with these shortcomings and to fill the gap, we propose an Integrated Computer Investigation Process Model ICFIPM which deals with the process of digital evidence in computer crime investigations. Very few researchers have previously attempted to develop standardised computer investigation process models. These attempts have failed due to various reasons [1–3, 9, 10]. One of the reasons is due to the fact that researchers tend to use their own terminology and different types of activities in the models. Moreover, the existing models are not complete by covering the entire processes involved in a computer crime investigation. For example, the model developed by Adams et al. [1] is based only on the “Analysis” phase and partially on the “Preparation” phase. The model does not include phases related to Preparation, Incident Response or Documentation.

Review of the Existing Models

Due to the space constraint, it is not possible to present a description of all the previously developed Computer Forensics Process Models which were reviewed by the authors prior to developing the proposed model. Although a description of only four reviewed models is provided in this paper, it should not be denoted that the proposed model is based on only these four models. On the contrary, the proposed model is the integration of almost all the existing developed models. Nevertheless, a comprehensive analysis of these models is represented in Table 1.

Carrier et al. (2003).

The model proposed by Carrier et al. [15] is called “An Integrated Digital Investigation Process”. This model is organised into 5 groups consisting of Readiness, Deployment, Physical Crime Scene Investigation, Digital Crime Scene Investigation and Review. Although this model dates back to 2003, it is still one of the most prominent DFPMs to date [1, 9]. This is due to the fact that it included physical crime scene investigation in the model and drew a clear distinction between physical crime scene and digital crime scene investigation. However, the model’s practicality in real life has been challenged by other digital forensic experts such as authors in [9, 37]. This model has not differentiated the primary crime scene (where the digital crime initiates) from the secondary crime scene (the target computer). This is not part of the physical or digital forensic investigation in this model. Therefore, computer forensic investigation based on this model will not consist of the outcome of the nefarious activity; this will affect the reconstruction of events and subsequently results in incomplete findings in the presented report [9].

Baryamureeba er al. (2004).

Baryamureeba et al. [37] proposed “The Enhanced Integrated Digital Investigation Process (EIDIP)”. This model is built upon the previous model proposed by Carrier et al. [15]. The phases of this model include: Readiness, Deployment, Traceback, Dynamite and Review phases. In their model, Baryamureeba et al. [37] aim to address the flaw in Carrier et al.’s [15] model by including an investigation of the primary and secondary crime scenes. Baryamureeba et al. [37] adds a new sub-phase in which the primary crime scene is identified in the Traceback phase [9]. Moreover, in this model, reconstruction is conducted after all the evidences have been collected. Apart from differentiating between primary and secondary crime scene, this model offers no other contributions.

Beebe et al. (2005).

Beebe et al. [33] proposed a model, “A Hierarchal, Objectives-Based Framework for the Digital Investigation Process”. This model consists of Preparation, Incident Response, Data Collection, Data Analysis, Findings Presentation and Incident Closure Phases. Beebe et al. [33] suggest the concept of objectives-based tasks in which the investigative goals are utilised to select the analysis tasks.

Although in contrast with other models, this model is more detailed by introducing sub-phases and objectives-task hierarchical structures, it still has various shortcomings. These include the fact that its first-layer phases are mainly non-iterative not allowing the investigators to return to the previous phases. Moreover, as the authors themselves state, the model’s low level details is not complete as the model includes sub-tasks only for the Analysis phase. Beebe et al. [33] call for their model to be extended by including sub-phases for other first-layer phases included in the model.

Ciardhuain (2004).

The model developed by Ciardhuain [34] is considered to be the most comprehensive model proposed to date [1, 7, 9, 13]. This model consists of Awareness, Authorisation, Planning, Notification, Search for and identify evidence, Collection of evidence, Transport of evidence, Storage of evidence, Examination of evidence, Hypothesis, Presentation of hypothesis, Defense of hypothesis, Dissemination of information phases. The terminology used in this model is similar to the terminology used in the previously proposed models. Although this model is considered to be the most comprehensive model proposed to date, it has various shortcomings. The model is mainly aimed at information flow and the digital investigations within the field of commerce. It is not designed in a way which can be implemented in different settings. Moreover, the model does not allow the investigators to return to the previous phases.

Discussion of the Existing Models

The existing DFIPMs are not complete in that they do not cover the entire digital investigation processes. Moreover, they have differing approaches by lacking common terminology, language and the types of activities that are widely agreed upon by the digital forensic community. For example, a comparison of the set of activities included under Examination phase in Casey’s [20] model and Cohen’s [9] model respectively revels the problem in terms of standardization.

Casey:

Examination: Recovery → Harvesting → Reduction → Classification

Cohen

Examination: Analysis → Attribution → Reconstructing

As seen, clearly not a single sub-process within the two identified sets has the same meaning. A possible explanation for this discrepancy is that the interpretations of the terms examine and analysis has been exchanged by the authors [9]. Therefore, in order to acquire the digital evidence in a forensically sound manner, it essential to develop a model based on scientific and formal methods.

Methodology

In order to create a consistent research environment and to carry out a successful research, various methodologies were considered. The reason for selecting Design Science Research Process (DSRP) methodology over other alternatives lies in the fact that it is especially suited for the task of designing and developing a new process model. Armstrong [38] states that design science is an ideal approach in the problem domain of digital forensic evidence with its focus on designing solutions [1]. Researchers within information system research have been widely applying the DSRP. Moreover, this methodology has been previously adopted by other researchers in similar situations and has proved to be effective [1, 39, 40]. The DSRP is related to the development and subsequent evaluation of IT artefacts within an organisational environment in order to solve specific problems [39, 41]. The artefacts in question can consist of models, constructs and methods [1].

Also, in order to represent the proposed Integrated Computer Forensic Investigation Process Model (ICFIPM) discussed in this paper in a uniform and consistent manner, we considered various visual and formal representations. These consisted of UML Activity, Use Case Diagrams and Finite State Machines. However, we decided to use Sequential Logic formulated by More et al. [42]. The reason for choosing this representation is due to the fact that ordering of the phases and sub-phases are critical in the proposed model. Kohn et al. [9] state, “In order for the circuit to evaluate true, all the conditions of the previous states must be true.” This means that the circuit will fail if the current state is not positively completed [9, 42]. This will enable the investigator to revisit previous steps in the process; however, he or she will not be able to continue if a step is not complete or fails. The ordering of the phases and sub-phases are critical in the proposed model. This is because the circuit outcome is dependent on the input and the current internal state – note that in this context, we refer to a phase or sub-phase as a circuit. This methodology has been previously applied in Kohn et al. [9] work and has proved to be effective. In their work, Kohn et al. [9] adapt the sequential logic notation formulated by More et al. [42] in order to represent each of the DFPMs in which Kohn et al. [9] replace the list values with the process steps. We aim to utilize the sequential logic notation adapted by Kohn et al. [9].

Contribution of the Paper

This paper proposes a computer forensics process model which rationalizes terminology as well as synthesizes phases and activities included in a process model. The model is simple enough to use, by having generalised methods that the judicial members or company management can use to relate technology to non-technical observers.

Proposed Computer Forensics Model

All the prominent models developed since 1997 up to 2014 have been critically analysed. This was to identify and integrate the essential components and terminology agreed upon by the digital forensic community to include in the proposed model. The rationale in doing so is multifaceted. Firstly, we aimed to leverage the benefits and advantages of previously proposed models. Secondly, in any type of community, it is important to create synergic interaction between different points of view. As the authors in [1, 7–9, 33] state, any framework institutionalized through subsequent intellectual discourse and practical use must take into account differing perspectives, approaches and vernacular. Therefore, we have integrated the previously proposed models to the new uniform model. The soundness of a digital investigation process model is “a function of usability and acceptability” [33]. Therefore, in order to acquire usability and acceptability, we integrated phases, sub-phases, principles and objectives. Phases and sub-phases are obvious; they are individually separate steps in the process which can sometimes be a function of time and are inevitably sequential or sometimes iterative approach. In contrast, principles are encompassing procedures, guidelines and methodological approaches that encompass some or all the eight specified main phases of the proposed model as well as its sub-phases. Principles as opposed to phases are not distinct and discrete steps in the process. Rather, they are aims and objectives needed to be achieved throughout the process. Chain of custody and proper documentations are examples of principles. The phases of a model are tied together through the process model flow accompanied by its investigative principles such as information flow and case management [15, 20, 33, 34].

The proposed model (Fig. 1) shows information flow through phases. Case management and investigative objective are the general factors defining the nature of the phases within the model. First layer phases are distinct and discrete. They are clearly defined, and obvious delineation exists between them. In other words, each given phase has a clear event which initiates it and clear output as the conclusion of the phase [33]. Phases occur in order and are chronological. Some first layer phases are non-iterative within the extent of a single accident.

Fig. 1.
figure 1

The proposed integrated computer forensic investigation process model

Full size image

Readiness Phase

Forensic Readiness is the ability of an organisation to maximise its potential to use digital evidence whilst minimising the costs of an investigation [9, 43, 44]. Organisations need to take certain important steps to prepare to use digital evidence. These include: improved system and staff monitoring, physical and procedural equipment and means to preserve data to evidential standards of admissibility, processes and procedures to ensure that the staff recognise the importance and legal activities of evidence, and appropriate legal advice and interfacing with law enforcement.

Identification Phase

Identification phase is where the incident or a digital crime is detected and reported either to the incident response team in an organisational context or to the police in the case of ordinary individuals.

Incident Response Phase

Various activities are involved in this phase. It is the first responders who typically arrive at the crime scene. Every investigation is different, and it is unlikely to decide what the first responders will encounter at the crime scene. In this phase, the potential suspects need to be detained. The first responders will then need to assess and confirm the incident and notify the incident to the right authority i.e. management in the company or police. Based on the result of this phase right equipment and personnel are deployed and a response strategy is drawn.

Collection Phase

The collection phase involves searching the physical crime scene and identifying the digital media containing potential digital evidence. Upon the identification, the examiner performs a live digital data acquisition by imaging the volatile data and authenticating it using checksum verifications (MD5 and SHA1). This is to ensure the legal validity of the digital evidence. If the digital media cannot be seized in cases of server in large organisations, then the examiner also needs to perform a live digital data acquisition of the logical drive of the server. If the search warrant permits the removal of the digital media, the media is seized and taken away for laboratory digital data acquisition.

Examination Response

In this phase, the digital forensic examiner conducts the laboratory static digital data acquisitions on the seized digital media. He/she then performs a detailed examination of the images of the volatile and static data already collected. Examination is the process where the digital investigator makes the digital evidence visible or extracts the data into human readable form [9]. Files such as partially deleted files are identified from the original digital media through the Examination phase. Obscured data which might be hidden or deleted is processed by utilizing sound digital forensic techniques and tools such as FTK or Encase to carry out effective investigation. After the data is rendered visible, it is then harvested by giving a logical structure to the entire data set. The deleted files processed during the examination will become visible to the extent that they were discovered during examination [7, 9, 15, 20]. The investigator will then need to authenticate the raw data to ensure that the copied raw data is the same as the original data. The harvested data can then be mounted and read by the original file system such as NTFS.

Analysis Phase

After the examination has been carried out, the digital investigator needs to construct a hypothesis of what occurred. The extent of the formality of the hypothesis is dependent on the type of investigation. The digital investigator should expect to backtrack to the Examination phase because the investigator develops more detailed understanding of the events resulting in investigation in the first place. During this phase, the digital evidence is organised to accelerate the digital forensic investigation by concentrating on identified incident type and data categorised. Moreover, during this phase, the investigator should perform a detailed investigation of the organised data and test it against the hypothesis which he/she has formulated. During this phase, the legal validity of potential digital evidence is questioned by taking into account admissibility, weight and relevance [9, 15, 20, 34].

Presentation Phase

The developed hypothesis needs to be presented to people other than the investigators. For a law enforcement case, the hypothesis will be placed before a jury whereas as an internal company investigation puts the presentation before the management for a decision to be taken. Other activities involved in this phase include proof and defence. Often the hypothesis will be challenged; the defence will provide a contrary hypothesis before the jury. The investigators will need to prove the validity of their hypothesis and defend it against criticism and challenge. If the challenges are successful, the digital investigator will then need to backtrack to earlier stages in order to acquire and examine more evidence and to develop a better hypothesis.

Incident Closure

The final phase of the proposed model is the Incident Closure phase, where the case is officially closed. The result of the investigation is utilised to review the existing policies and procedures of the organisation. The original digital evidence either must be destroyed or must be returned to its rightful owner. In this phase, lessons should be learnt, and recommendations be made. A case study should be developed to assist future investigations. The case study can consist of i.e. the type of attack and perpetrator’s skills set etc. Dissemination is an important activity in this phase; some information might be made available within the organisation whereas other information might be more widely disseminated. This information also will influence future investigations as well as policies and procedures.

Conclusions and Future Work

Various digital investigation process models in the literature were identified and compared. The results revealed that none could be considered standard since they all have differing approaches. The essential and most agreed-upon components of the existing models were identified and incorporated into the new model. Although the model is represented in its first-layer phases, the final product of this research will be a model which represents the detailed model consisting of sub-phases and activities. We contend that our model is not just a merging of the existing models. We have clarified the terminology and have added further essential phases to the model.

The proposed model will be standardized by identifying and incorporating into the proposed model the terminology and activities that the researchers and practitioners in the field of digital forensic community agree upon. Similarly, in order to make the model generic in a way which it can be used in different fields of digital forensic and for any type of cybercrime, we will combine different models developed separately for different fields of digital forensic including law enforcement, third party providers of digital forensic services and incident response. The proposed model in this paper has been presented in its high level phases (first-layer). As a future work, the authors are in the process of extending the proposed model to consist of the lower lever sub-phases. This is to conduct further research in order to determine components and activities which are widely accepted by the computer forensics experts for inclusion in the extended process model.

After the extension of the proposed model, it will then be evaluated and tested in two stages in order to assess its usability and utility. The first stage involves using two sets of digital forensic experts within academia and industry, and the second stage involves carrying out a closed network attack and apply the proposed process model to a case study.