Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM)

Reza Montasari, Richard Hill, Victoria Carpenter, Amin Hosseinian-Far

Research output: Chapter in Book/Report/Conference proceedingChapter

Abstract

The existing digital forensic investigation process models (DFIPMs) have often been developed by digital forensic practitioners (DFPs) based on their own personal experience and on an ad-hoc basis, without attention to the establishment of standardisation within the field. This has prevented the institution of both scientific and generic processes that are urgently required within the different fields of law enforcement, commerce and incident response. Therefore, a novel model — the Standardised Digital Forensic Investigation Process Model (the SDFIPM) — was developed to address these shortcomings. Following the selected research methodology, Peffers et al.’s Design Science Research Process (DSRP), the SDFIPM was also subjected to both Demonstration and Evaluation activities to determine how well it would support the solution to the stated research problem. Therefore, this paper presents the results of the Demonstration and Evaluation activities applied to the proposed model. Our study makes three significant and novel contributions to the field of Digital Forensics (DF): First, it implements a process model, the design of which is inclusive of all the advantages of the previous models through their synthesis, harmonisation and extension. No such a model previously existed in the literature. Second, the SDFIPM is generic in that it can be applied within the three fields of law enforcement, commerce and incident response. Third, unlike the majority of the previous models, the effectiveness of which is unknown due to the lack of an evaluation process, the SDFIPM’s efficacy is demonstrated in relation to both components of ‘utility’ and ‘usability.
Original languageEnglish
Title of host publicationCyber Security Practitioner's Guide
PublisherWorld Scientific
Publication statusAccepted/In press - 2019

Fingerprint

Law enforcement
Demonstrations
Digital forensics
Standardization

Cite this

Montasari, R., Hill, R., Carpenter, V., & Hosseinian-Far, A. (Accepted/In press). Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM). In Cyber Security Practitioner's Guide World Scientific.
Montasari, Reza ; Hill, Richard ; Carpenter, Victoria ; Hosseinian-Far, Amin. / Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM). Cyber Security Practitioner's Guide. World Scientific, 2019.
@inbook{b2e53ca624044a73bf8d4789e515e996,
title = "Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM)",
abstract = "The existing digital forensic investigation process models (DFIPMs) have often been developed by digital forensic practitioners (DFPs) based on their own personal experience and on an ad-hoc basis, without attention to the establishment of standardisation within the field. This has prevented the institution of both scientific and generic processes that are urgently required within the different fields of law enforcement, commerce and incident response. Therefore, a novel model — the Standardised Digital Forensic Investigation Process Model (the SDFIPM) — was developed to address these shortcomings. Following the selected research methodology, Peffers et al.’s Design Science Research Process (DSRP), the SDFIPM was also subjected to both Demonstration and Evaluation activities to determine how well it would support the solution to the stated research problem. Therefore, this paper presents the results of the Demonstration and Evaluation activities applied to the proposed model. Our study makes three significant and novel contributions to the field of Digital Forensics (DF): First, it implements a process model, the design of which is inclusive of all the advantages of the previous models through their synthesis, harmonisation and extension. No such a model previously existed in the literature. Second, the SDFIPM is generic in that it can be applied within the three fields of law enforcement, commerce and incident response. Third, unlike the majority of the previous models, the effectiveness of which is unknown due to the lack of an evaluation process, the SDFIPM’s efficacy is demonstrated in relation to both components of ‘utility’ and ‘usability.",
author = "Reza Montasari and Richard Hill and Victoria Carpenter and Amin Hosseinian-Far",
year = "2019",
language = "English",
booktitle = "Cyber Security Practitioner's Guide",
publisher = "World Scientific",
address = "United States",

}

Montasari, R, Hill, R, Carpenter, V & Hosseinian-Far, A 2019, Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM). in Cyber Security Practitioner's Guide. World Scientific.

Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM). / Montasari, Reza; Hill, Richard; Carpenter, Victoria; Hosseinian-Far, Amin.

Cyber Security Practitioner's Guide. World Scientific, 2019.

Research output: Chapter in Book/Report/Conference proceedingChapter

TY - CHAP

T1 - Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM)

AU - Montasari, Reza

AU - Hill, Richard

AU - Carpenter, Victoria

AU - Hosseinian-Far, Amin

PY - 2019

Y1 - 2019

N2 - The existing digital forensic investigation process models (DFIPMs) have often been developed by digital forensic practitioners (DFPs) based on their own personal experience and on an ad-hoc basis, without attention to the establishment of standardisation within the field. This has prevented the institution of both scientific and generic processes that are urgently required within the different fields of law enforcement, commerce and incident response. Therefore, a novel model — the Standardised Digital Forensic Investigation Process Model (the SDFIPM) — was developed to address these shortcomings. Following the selected research methodology, Peffers et al.’s Design Science Research Process (DSRP), the SDFIPM was also subjected to both Demonstration and Evaluation activities to determine how well it would support the solution to the stated research problem. Therefore, this paper presents the results of the Demonstration and Evaluation activities applied to the proposed model. Our study makes three significant and novel contributions to the field of Digital Forensics (DF): First, it implements a process model, the design of which is inclusive of all the advantages of the previous models through their synthesis, harmonisation and extension. No such a model previously existed in the literature. Second, the SDFIPM is generic in that it can be applied within the three fields of law enforcement, commerce and incident response. Third, unlike the majority of the previous models, the effectiveness of which is unknown due to the lack of an evaluation process, the SDFIPM’s efficacy is demonstrated in relation to both components of ‘utility’ and ‘usability.

AB - The existing digital forensic investigation process models (DFIPMs) have often been developed by digital forensic practitioners (DFPs) based on their own personal experience and on an ad-hoc basis, without attention to the establishment of standardisation within the field. This has prevented the institution of both scientific and generic processes that are urgently required within the different fields of law enforcement, commerce and incident response. Therefore, a novel model — the Standardised Digital Forensic Investigation Process Model (the SDFIPM) — was developed to address these shortcomings. Following the selected research methodology, Peffers et al.’s Design Science Research Process (DSRP), the SDFIPM was also subjected to both Demonstration and Evaluation activities to determine how well it would support the solution to the stated research problem. Therefore, this paper presents the results of the Demonstration and Evaluation activities applied to the proposed model. Our study makes three significant and novel contributions to the field of Digital Forensics (DF): First, it implements a process model, the design of which is inclusive of all the advantages of the previous models through their synthesis, harmonisation and extension. No such a model previously existed in the literature. Second, the SDFIPM is generic in that it can be applied within the three fields of law enforcement, commerce and incident response. Third, unlike the majority of the previous models, the effectiveness of which is unknown due to the lack of an evaluation process, the SDFIPM’s efficacy is demonstrated in relation to both components of ‘utility’ and ‘usability.

UR - https://www.worldscientific.com/page/worldscibooks

M3 - Chapter

BT - Cyber Security Practitioner's Guide

PB - World Scientific

ER -

Montasari R, Hill R, Carpenter V, Hosseinian-Far A. Evaluation of the Standardised Digital Forensic Investigation Process Model (ESDFIPM). In Cyber Security Practitioner's Guide. World Scientific. 2019