Document Type
Journal Article
Publication Title
Security and Privacy
Volume
4
Issue
e151
Publisher
Wiley
School
School of Science / ECU Security Research Institute
RAS ID
35483
Abstract
It may not always be possible to conduct a digital (forensic) investigation post-event if there is no process in place to preserve potential digital evidence. This study posits the importance of digital forensic readiness, or forensic-by-design, and presents an approach that can be used to construct a Digital Forensic Readiness Intelligence Repository (DFRIR). Based on the concept of knowledge sharing, the authors leverage this premise to suggest an intelligence repository. Such a repository can be used to cross-reference potential digital evidence (PDE) sources that may help digital investigators during the process. This approach employs a technique of capturing PDE from different sources and creating a DFR repository that can be able to be shared across diverse jurisdictions among digital forensic experts and law enforcement agencies (LEAs), in the form of intelligence. To validate the approach, the study has employed a qualitative approach based on a number of metrics and an analysis of experts' opinion has been incorporated. The DFRIR seeks to maximize the collection of PDE, and reducing the time needed to conduct forensic investigation (e.g., by reducing the time for learning). This study then explains how such an approach can be employed in conjunction with ISO/IEC 27043: 2015.
DOI
10.1002/spy2.151
Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License
Comments
Kebande, V. R., Karie, N. M., Choo, K. K. R., & Aladawi, S. (2021). Digital forensic readiness intelligence crime repository. Security and Privacy, 4(3), article e151. https://doi.org/10.1002/spy2.151