FIA: An Open Forensic Integration Architecture for Composing Digital Evidence

Sriram Raghavan; Andrew Clark; George Mohay

Forensics in Telecommunications, Information and Multimedia. Second International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009, Revised Selected Papers

Research Article

FIA: An Open Forensic Integration Architecture for Composing Digital Evidence

Download

458 downloads

Cite: BibTeX Plain Text

@INPROCEEDINGS{10.1007/978-3-642-02312-5_10,
    author={Sriram Raghavan and Andrew Clark and George Mohay},
    title={FIA: An Open Forensic Integration Architecture for Composing Digital Evidence},
    proceedings={Forensics in Telecommunications, Information and Multimedia. Second International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009, Revised Selected Papers},
    proceedings_a={E-FORENSICS},
    year={2012},
    month={5},
    keywords={},
    doi={10.1007/978-3-642-02312-5_10}
}

Sriram Raghavan
Andrew Clark
George Mohay
Year: 2012
FIA: An Open Forensic Integration Architecture for Composing Digital Evidence
E-FORENSICS
Springer
DOI: 10.1007/978-3-642-02312-5_10

Sriram Raghavan¹^,*, Andrew Clark¹^,*, George Mohay¹^,*

1: Queensland University of Technology

*Contact email: s.raghavan@qut.edu.au, a.clark@qut.edu.au, g.mohay@qut.edu.au

Abstract

The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture () which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.

Published: 2012-05-11

: http://dx.doi.org/10.1007/978-3-642-02312-5_10