Evaluation of Digital Forensic Process Models with Respect to Digital Forensics as a Service

TL;DR

This paper evaluates existing digital forensic process models to determine their suitability for cloud-based digital forensics, aiming to enhance efficiency and reduce costs in investigations.

Contribution

It provides an analysis of how current forensic process models can be adapted for Digital Forensics as a Service in cloud environments.

Findings

Existing models vary in suitability for cloud integration.

Cloud-based models can significantly reduce investigation time.

Adapting models for cloud requires addressing specific challenges.

Abstract

Digital forensic science is very much still in its infancy, but is becoming increasingly invaluable to investigators. A popular area for research is seeking a standard methodology to make the digital forensic process accurate, robust, and efficient. The first digital forensic process model proposed contains four steps: Acquisition, Identification, Evaluation and Admission. Since then, numerous process models have been proposed to explain the steps of identifying, acquiring, analysing, storage, and reporting on the evidence obtained from various digital devices. In recent years, an increasing number of more sophisticated process models have been proposed. These models attempt to speed up the entire investigative process or solve various of problems commonly encountered in the forensic investigation. In the last decade, cloud computing has emerged as a disruptive technological concept, and most leading enterprises such as IBM, Amazon, Google, and Microsoft have set up their own cloud-based services. In the field of digital forensic investigation, moving to a cloud-based evidence processing model would be extremely beneficial and preliminary attempts have been made in its implementation. Moving towards a Digital Forensics as a Service model would not only expedite the investigative process, but can also result in significant cost savings - freeing up digital forensic experts and law enforcement personnel to progress their caseload. This paper aims to evaluate the applicability of existing digital forensic process models and analyse how each of these might apply to a cloud-based evidence processing paradigm.