Unboxing the digital forensic investigation process.

As digital forensics continues to play an important role in criminal investigations, its investigative work must be underpinned with well-defined and robust methodologies. Over the last 20 years, a substantial body of research has been produced to define and codify the digital forensic investigation process and the stages/sub-processes involved. Whilst current digital forensic investigation process models provide a solid foundation, it is argued that existing attempts often only focus on those physical tasks, which a practitioner must carry out at any given stage of an examination, omitting to identify those core thought processes, decisions and behaviours that form part of effective investigative practices. This work presents the Digital Forensic Workflow Model (DFWM), a novel approach to the structuring and definition of the procedures and tasks involved in the digital forensic investigation process starting from the initial 'Review of Client Requirements & Planning' stage, right through to the 'Evaluation of Deployed Workflow' stage. The DFWM contributes to the digital forensic management toolbox, where it enables the identification and management of risk and supports error mitigation at each stage of the workflow. The paper demonstrates how the DFWM functions as a framework for unboxing the digital forensic investigation process based on the investigative strategy of the particular case, providing a detailed structure and depiction of the physical and investigative tasks and decisions. From a research perspective, DFWM is a descriptive starting point, and future empirical studies may expand and provide further detail to the various physical and cognitive tasks and associated risks during the DF workflow.

What does a digital forensics opinion look like? A comparative study of digital forensics and forensic science reporting practices.

This study explores digital forensics (DF) reporting practices and compares the results with other forensic science disciplines. Forty reports were obtained from a quasi-experiment involving DF examiners, and a quantitative content analysis was performed to determine which conclusion types they applied and which content they included with relevance to the credibility of the reported results. A qualitative analysis was performed to examine the certainty expressions used in the conclusions. The results were compared to a study of eight forensic science disciplines performed by Bali et al. [24,26]. The results show that the DF examiners tend to present their conclusions either as Categorical conclusion or Strength of support (SoS) conclusion types and that they address source, activity, and offence level issues in their conclusions. The content analysis indicates deficiencies in DF reporting practices, and several of the challenges seem to be shared with other FS disciplines. The analysis of certainty expressions showed that a plethora of expressions was used, and that they lacked reference to an established framework. The results indicate that more research on DF evaluation and reporting practices is necessary and justifies a need for enhanced focus on quality control and peer review within the DF discipline.