A generic smartphone forensic investigation process model

Smartphones are sources of digital evidence and repository for considerable amount of personal and work-related information about the phone users, their network of contacts and activities. Investigations involving various such devices have been identified as growing challenges to digital forensic...

Full description

Saved in:

Bibliographic Details
Main Author:	Farjamfar, Anahita
Format:	Thesis
Language:	English
Published:	2016
Subjects:	Electronic evidence Smartphones Criminal investigation
Online Access:	http://psasir.upm.edu.my/id/eprint/69362/1/FSKTM%202016%2033%20IR.pdf
Tags:	Add Tag No Tags, Be the first to tag this record!

id	my-upm-ir.69362
record_format	uketd_dc
spelling	my-upm-ir.693622019-07-10T01:22:33Z A generic smartphone forensic investigation process model 2016-12 Farjamfar, Anahita Smartphones are sources of digital evidence and repository for considerable amount of personal and work-related information about the phone users, their network of contacts and activities. Investigations involving various such devices have been identified as growing challenges to digital forensic researchers and practitioners. Similar to other areas of digital forensic practice, the process models developed for smartphones do not consider satisfying any scientific requirement of a digital investigation process models to make such models reliable and admissible in court. They have also been criticized for their tendency to focus on one particular type of devices and failure to embrace the level of practicality and generality needed to be applied in the investigation of all smartphones, independent of their platforms. In addition, the common challenge associated with these models is that they tried to encompass all aspects of digital forensic activities in a single-tier, high level process models. This makes such models too unwieldy, impractical and unlikely to be adopted. This research proposes a new forensic process model for digital investigation of smartphones, called Generic Smartphone Forensic Investigation Process Model (GSFIPM), which addresses both the practical needs of practitioners and the expectations of legal domain for a reliable and structured process model to be followed. The proposed model is a multi-tier, objective-based, iterative process model that is generically applicable in investigation of any type of smartphones. GSFIPM is integrated with Encompassing Proceedings as principles that have a wider scope than a single process in the course of an investigation. The second tier of the GSFIPM focuses on the evidence collection and preservation process since this process is arguably the most critical process in the course of a digital investigation. Any doubt cast upon this process makes the output of other processes moot. A two-stage formal model called Formal Evidence Collection Model for Smartphones (FECMS) is designed, comprising of two UML Activity Diagrams, two Implementation Guidelines and the Overarching Principles. This research employed the Design Science Research Process (DSRP) methodology on the basis that it is an ‘ideal approach’ in the problem domain of digital forensic and especially appropriate for creating a new process model. The effectiveness of the GSFIPM and FECMS to satisfy the intended requirements are independently evaluated by a group of digital forensic experts. Feedbacks from these experts are taken into account and amendments are applied as appropriately as possible. The feedbacks received from experts, regarding the GSFIPM, are generally positive in fulfilling the scientific requirements. GSFIPM is also believed to hold new features in the design, namely being multi-tier and iterative, and containing overarching principles and stratification in roles and responsibilities. The feedbacks are also optimist for FECMS, in terms of utility and usability. This research demonstrates how GSFIPM and FECMS can be practically applicable in smartphone investigations and beneficial to the digital forensic practitioners in various environments. Electronic evidence Smartphones Criminal investigation 2016-12 Thesis http://psasir.upm.edu.my/id/eprint/69362/ http://psasir.upm.edu.my/id/eprint/69362/1/FSKTM%202016%2033%20IR.pdf text en public doctoral Universiti Putra Malaysia Electronic evidence Smartphones Criminal investigation
institution	Universiti Putra Malaysia
collection	PSAS Institutional Repository
language	English
topic	Electronic evidence Smartphones Criminal investigation
spellingShingle	Electronic evidence Smartphones Criminal investigation Farjamfar, Anahita A generic smartphone forensic investigation process model
description	Smartphones are sources of digital evidence and repository for considerable amount of personal and work-related information about the phone users, their network of contacts and activities. Investigations involving various such devices have been identified as growing challenges to digital forensic researchers and practitioners. Similar to other areas of digital forensic practice, the process models developed for smartphones do not consider satisfying any scientific requirement of a digital investigation process models to make such models reliable and admissible in court. They have also been criticized for their tendency to focus on one particular type of devices and failure to embrace the level of practicality and generality needed to be applied in the investigation of all smartphones, independent of their platforms. In addition, the common challenge associated with these models is that they tried to encompass all aspects of digital forensic activities in a single-tier, high level process models. This makes such models too unwieldy, impractical and unlikely to be adopted. This research proposes a new forensic process model for digital investigation of smartphones, called Generic Smartphone Forensic Investigation Process Model (GSFIPM), which addresses both the practical needs of practitioners and the expectations of legal domain for a reliable and structured process model to be followed. The proposed model is a multi-tier, objective-based, iterative process model that is generically applicable in investigation of any type of smartphones. GSFIPM is integrated with Encompassing Proceedings as principles that have a wider scope than a single process in the course of an investigation. The second tier of the GSFIPM focuses on the evidence collection and preservation process since this process is arguably the most critical process in the course of a digital investigation. Any doubt cast upon this process makes the output of other processes moot. A two-stage formal model called Formal Evidence Collection Model for Smartphones (FECMS) is designed, comprising of two UML Activity Diagrams, two Implementation Guidelines and the Overarching Principles. This research employed the Design Science Research Process (DSRP) methodology on the basis that it is an ‘ideal approach’ in the problem domain of digital forensic and especially appropriate for creating a new process model. The effectiveness of the GSFIPM and FECMS to satisfy the intended requirements are independently evaluated by a group of digital forensic experts. Feedbacks from these experts are taken into account and amendments are applied as appropriately as possible. The feedbacks received from experts, regarding the GSFIPM, are generally positive in fulfilling the scientific requirements. GSFIPM is also believed to hold new features in the design, namely being multi-tier and iterative, and containing overarching principles and stratification in roles and responsibilities. The feedbacks are also optimist for FECMS, in terms of utility and usability. This research demonstrates how GSFIPM and FECMS can be practically applicable in smartphone investigations and beneficial to the digital forensic practitioners in various environments.
format	Thesis
qualification_level	Doctorate
author	Farjamfar, Anahita
author_facet	Farjamfar, Anahita
author_sort	Farjamfar, Anahita
title	A generic smartphone forensic investigation process model
title_short	A generic smartphone forensic investigation process model
title_full	A generic smartphone forensic investigation process model
title_fullStr	A generic smartphone forensic investigation process model
title_full_unstemmed	A generic smartphone forensic investigation process model
title_sort	generic smartphone forensic investigation process model
granting_institution	Universiti Putra Malaysia
publishDate	2016
url	http://psasir.upm.edu.my/id/eprint/69362/1/FSKTM%202016%2033%20IR.pdf
_version_	1747812688432463872

A generic smartphone forensic investigation process model

Similar Items