Testing the Comprehensive Digital Forensic Investigation Process Model (the CDFIPM)

The Comprehensive Digital Forensic Investigation Process Model (the CDFIPM), presented in Montasari (IJESDF 8(4)285–301, 2016), provides guidelines for carrying out digital investigations in the UK jurisdiction in a forensically sound manner. The CDFIPM is comprehensive in that it covers the entire digital forensic investigative process; it is generic such that it can be applied in the three fields of law enforcement, incident response and commerce. The model is also formal in that it synthesises, harmonises and extends the existing digital forensic investigation process models. The CDFIPM also needs to be subjected to an evaluation process in order to determine ‘whether the model has been built right’ and ‘whether the right model has been built’. To this end, the CDFIPM is applied to a case study in this paper to determine whether the model meets the two components of ‘utility’ and ‘usability’.