Abstract
It may not always be possible to conduct a digital (forensic) investigation post-event if there is no process in place to preserve potential digital evidence. This study posits the importance of digital forensic readiness, or forensic-by-design, and presents an approach that can be used to construct a Digital Forensic Readiness Intelligence Repository (DFRIR). Based on the concept of knowledge sharing, the authors leverage this premise to suggest an intelligence repository. Such a repository can be used to cross-reference potential digital evidence (PDE) sources that may help digital investigators during the process. This approach employs a technique of capturing PDE from different sources and creating a DFR repository that can be able to be shared across diverse jurisdictions among digital forensic experts and law enforcement agencies (LEAs), in the form of intelligence. To validate the approach, the study has employed a qualitative approach based on a number of metrics and an analysis of experts' opinion has been incorporated. The DFRIR seeks to maximize the collection of PDE, and reducing the time needed to conduct forensic investigation (e.g., by reducing the time for learning). This study then explains how such an approach can be employed in conjunction with ISO/IEC 27043: 2015.
1 INTRODUCTION
In recent years, the need for digital forensics and digital investigations have increased significantly,1 partly due to the interconnectivity in our society and the exponential growth in the number of digital devices (e.g., Internet of Things (IoT) and related devices).2 Digital forensics is generally defined to be an interdisciplinary area, which combines elements of legal, computer science, computer engineering, and so on, to facilitate the identification, collection, analysis, and reporting of data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law.3-6
6 CONCLUSION AND FUTURE WORK
Digital forensics will be increasingly challenging, due to the constantly advancing technological and threat landscapes. Rather than reinventing the wheel, the authors argued the need for digital forensic repositories that can be used to share case-relevant forensic intelligence. Thus, this study presented our proposed DFRIR, to maximize the potential use of digital evidence collected by different stakeholders.
