Forensics in Telecommunications, Information and Multimedia. Second International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009, Revised Selected Papers

Research Article

FIA: An Open Forensic Integration Architecture for Composing Digital Evidence

Download87 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-02312-5_10,
        author={Sriram Raghavan and Andrew Clark and George Mohay},
        title={FIA: An Open Forensic Integration Architecture for Composing Digital Evidence},
        proceedings={Forensics in Telecommunications, Information and Multimedia. Second International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009, Revised Selected Papers},
        proceedings_a={E-FORENSICS},
        year={2012},
        month={5},
        keywords={},
        doi={10.1007/978-3-642-02312-5_10}
    }
    
  • Sriram Raghavan
    Andrew Clark
    George Mohay
    Year: 2012
    FIA: An Open Forensic Integration Architecture for Composing Digital Evidence
    E-FORENSICS
    Springer
    DOI: 10.1007/978-3-642-02312-5_10
Sriram Raghavan1,*, Andrew Clark1,*, George Mohay1,*
  • 1: Queensland University of Technology
*Contact email: s.raghavan@qut.edu.au, a.clark@qut.edu.au, g.mohay@qut.edu.au

Abstract

The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture () which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.