Summary of Thesis Chapters

1.6Forensic Models

Caches are commonly network data that is stored locally on flash memory and reused when the same data is requested instead of fetching the same data from the network. Nearly all browsers, including mobile browsers cache data. This cached information is a potential source of evidence.In this section, we will review the existing literature for identifying caches, preserving the identified caches, analysing the cache formats and discuss means of presenting the analysed caches to the court.

The McKemmish model is primarily focused on identification, preservation, analysis and presentation of digital evidence. However McKemmish also mentions four rules for forensic computing namely, minimal handling of original, account for any change, comply with rules of evidence and not to exceed our knowledge on the subject . As caches can be a type of electronic evidence, all of McKemmish’s four key elements and the rules applies.

Figure 2 - Model of Forensic Computing (Adapted from McKemmish 1999)

In addition to McKemmish’s (1999) model, a number of forensic models have been proposed. The Computer Forensic Process proposed by is, perhaps, one of the earliest digital forensic models. It has 4 steps, namely: Acquisition, Identification, Evaluation and Admission as evidence. This is comparable to Mckemmish’s model. For example: Identification, Evaluation or Analysis are common across both models. However, the lack of preservation and presentation phases are a major drawback in Pollitt’s model.

The model proposed by during the first Digital Forensic Research Workshop (DFRWS) in 2001 is similar to that of Pollitt’s Model, but it comprises seven steps, namely: Identification, Preservation, Collection, Examination, Analysis, Presentation and Decision.

• 
  Identification step involves event or crime detection, resolving signature, profile detection, anomalous detection, complaints, audit analysis etc.
  
• 
  Preservation step involves case management, imaging technologies, chain of custody and time synchronization.
  
• 
  Collection step involves preservation of evidence, using approved methods, software and hardware, legal authority, using lossless compression, sampling, data reduction and recovery techniques.
  
• 
  Examination step involves preservation of evidence, traceability, validation techniques, filtering techniques, pattern matching, hidden data discovery and hidden data extraction.
  
• 
  Analysis step involves preservation of evidence, traceability, statistical, protocols, data mining, timeline, link and special.
  
• 
  Presentation step involves documentation, expert testimony, clarification, mission impact statement, recommended countermeasure and statistical interpretation.
  
• 
  Finally the decision step.
  

Figure 3 - Palmer's Model (Adapted from Palmer 2001)

It is important to note that Examination and Analysis are separate steps in Palmer’s Model but both these steps are merged as one in the Mckemmish model. The usefulness for the two separate phases Collection and Preservation are also questioned .

Reith, Carr and Gunsch (2002) also proposed a forensic model and the nine phases are as follows:.

1. 
   Identification – To identify the incident.
   
2. 
   Preparation – Preparation of tools and techniques, receiving authorisation, support from management etc.
   
3. 
   Approach – To maximize the collection of evidence.
   
4. 
   Preservation – Preservation of digital evidence
   
5. 
   Collection – Duplicating digital evidence using legally acceptable procedures.
   
6. 
   Examination – Systematic search of evidence.
   
7. 
   Analysis – Analysing the evidences.
   
8. 
   Presentation - Explanation of conclusion or presenting evidence to court
   
9. 
   Returning Evidence – Returning digital property to proper owner
   

The model suggested by Carrier and Spafford (2003) has seventeen phases which are grouped into five. These five groups are Readiness, Deployment, Physical Investigation, Digital Investigation and Review. This model is very different from the other forensic models which were discussed above. This model groups all phases as investigations but divides into physical and digital. It can be viewed as an attempt to also include the non-digital phases to provide a more generalized forensic model.

Methodologies were classified into simple models, advanced models and complex models. Simple models contains Identification, Preservation, Collection, Examination, Analysis, Presentation and Decision . Advanced models was introduced by Carrier and Spafford in getting physical with the digital investigation process, which is based on crime scene theory for physical investigation . This model was also further enhanced .

Figure 4 – Enhanced Digital Investigation Process (Adapted from Baryamureeba & Tushabe 2004)

The above diagram from Integrated Digital Investigation Model explains that the advanced model splits the digital investigation into a separate phase, rather than just one phase as demonstrated in McKemmish’s model, which is a simple model.

The European Cyber-tools Online Search for Evidence (CTOSE) Foundation has developed a high level methodology to assist the companies to do computer forensics. CTOSE is a complex and a comprehensive model that spans across all evidence handling. It is also flexible across different organisations and countries .