A cost-effective digital forensic investigation model

Abstract

Computers operate at discrete points in time and hence digital traces are discrete events in temporal logic that re°ect the occurrence of computer processes. From the perspective of a digital investigation, it is the duty of digital investigators or forensic examiners to retrieve digital traces so as to prove or to refute the alleged computer acts. Given the resource constraints of most organizations and the limited time-frame available for the examination, it is not always feasible or indeed necessary for forensic examiners to retrieve all the related digital traces and to conduct a thorough digital forensic analysis. It is therefore the aim of this paper to propose a model that can o®er swift and practical digital examination in a cost-effective manner.