Getting Physical with the Digital Investigation Process

TLDR

Physical investigations have existed for millennia, and their experience can inform the increasingly common digital investigations. The paper defines a process model for digital investigations, introducing a digital crime scene with witnesses, evidence, and events that can be examined using the same framework as a physical crime scene. The model integrates physical and digital crime scene investigations to identify the responsible individual and is applicable to law enforcement and corporate contexts. The model successfully identifies the individual responsible for digital activity by integrating physical and digital crime scene investigations.

Abstract

In this paper, a process model for digital investigations is defined using the theories and techniques from the physical investigation world. While digital investigations have recently become more common, physical investigations have existed for thousands of years and the experience from them can be applied to the digital world. This paper introduces the notion of a digital crime scene with its own witnesses, evidence, and events that can be investigated using the same model as a physical crime scene. The proposed model integrates the physical crime scene investigation with the digital crime scene investigation to identify a person who is responsible for the digital activity. The proposed model applies to both law enforcement and corporate investigations.