Challenges Faced by Digital Forensics

Get Complete Project Material File(s) Now! »

CHAPTER 3 DIGITAL FORENSIC CHALLENGES – A TAXONOMY

INTRODUCTION

The evolution in digital technology has greatly influenced the way we conduct our daily lives and our business. The use of computers and other digital devices has grown exponentially to the point where almost one and all have their own personal data device that they carry with them continuously. However, as this evolution in the use of computers and other digital devices continues, numerous challenges emerge that are to be faced by the digital forensic domain.
This chapter therefore aims at reviewing existing digital forensics literature and highlighting the different challenges that digital forensics have encountered to date. This chapter also forms the background section of this research study. A taxonomy of the various digital forensic challenges is, however, proposed as a contribution in this field. Note that the term taxonomy is used in this thesis to mean, the practice and science of classifying things according to shared qualities or concepts, including the fundamental truth that underlie such classification (Adam, 2015). From this definition, therefore, the taxonomy proposed in this chapter classifies the large number of digital forensic challenges into a few well-defined and easily understood categories that cover a large number of digital forensic challenges. In fact, the taxonomy was accepted and published by the Journal of Forensic Sciences (Vol. 60, No.4, pp.885-893) after undergoing a peer review process. Note also that Semantic disparity is, however, exclusively selected among the many challenges discussed in this chapter and forms the primary focus of this research study.
The discussion of the taxonomy presented in this chapter can thus be useful in future developments of automated digital forensic tools, as well as in explicitly describing processes and procedures that focus on addressing the individual digital forensic challenges identified in this study. Institutions of higher learning should find the proposed taxonomy in this study constructive, especially when they develop curricula and educational material for different undergraduate courses, as well as research projects for postgraduate studies.
Furthermore, the presentation of the taxonomy in this chapter offers a comprehendible categorisation that may shed more light on existing digital forensic challenges. The taxonomy has been designed in a way to accommodate new categories of digital forensic challenges that may crop up as a result of technological change or domain evolution.
Finally, this chapter is meant to show that semantic disparity is a challenge among many other challenges in digital forensics and, hence, the motivation for this study to resolve it. Chapter 3 is also meant to spark discussion in the development of methodologies and specifications for resolving the other identified challenges in digital forensics. This implies that the contributions in this chapter can be used as a stepping stone towards resolving any other identified disparities in digital forensics.
Section 3.2 of this chapter provides a brief overview of challenges faced by digital forensics, while Section 3.3 explains the scope of the taxonomy proposed in this chapter. The taxonomy of challenges for digital forensics is discussed in Section 3.4 and the chapter is concluded in Section 3.5.

 CHALLENGES FACED BY DIGITAL FORENSICS

Since its establishment over a decade ago the digital forensic domain has encountered several challenges. These include challenges such as the vast volumes of data (Kara et al., 2009), education and certification, lack of unified formal representation of domain knowledge, legal system challenges, semantic disparities, etc.
Despite different stakeholders having examined and analysed several existing digital forensic challenges, there is still a need for a formal classification of such challenges. This section of the chapter therefore evaluates existing digital forensic literature and points out the different challenges that digital forensics has encountered over the past decade or so. A taxonomy of challenges faced by digital forensics is then proposed and explained. The taxonomy feeds into this research study by highlighting semantic disparities as a challenge in the field of digital forensics, thus, forming the primary focus of this study, which is to resolve semantic disparities in digital forensics.
Note also that some of the challenges currently experienced in the digital forensic domain are as a result of unresolved disparities and the lack of standardised methods and procedures in the domain. For example, after an investigation process has been conducted, based on a particular investigation process model, there may still remain disparities in the evidence interpretation, description and representation of the data or information. As an example to support this study, the researcher considered a court case between Smith vs. Groover, 468 F.Supp. 105 (N.D.Ill.1979) in the United States (Smith vs. Groover, 1979). Although this case was not purely based on digital crimes, it is however in line with the problem of semantic disparity addressed in this thesis. After an investigation was conducted, the district court noted an important semantic disparity over the meaning of the terminology “regulatory umbrella”. The court, noting its proximity in the Committee report to the admitted concerns over private actions against markets, understood the term “regulatory umbrella” to mean that the Congress was replacing private actions with a powerful, pervasive new regulatory agency that, unlike those in the past, had all of the tools required to enforce the exchanges’ obligations. The district court, on the other hand, felt that the term “regulatory umbrella” was meant to signify the new agency’s ability to impose duties on the markets notwithstanding the resultant legal exposure for the exchanges in private suits.
Considering the Smith vs. Groover (1979) court case, this problem is not unique to digital forensics, hence, developing practical methods that can aid in resolving the different challenges and disparities in digital forensics is inevitable and as important as the research itself. For digital forensics to remain effective and relevant to the law enforcement agencies, the academic field as well as the private sectors, the domain experts must constantly endeavour to address existing challenges and disparities in the domain. The scope of the taxonomy proposed in this thesis is explained first in the section to follow.

SCOPE OF THE PROPOSED TAXONOMY

There are many different challenges in digital forensics. In addition, several attempts to address specific or individual challenges in the domain were made by different researchers in the past. However, the presentation in this chapter is an effort by the researcher to propose a taxonomy of digital forensic challenges, based on the review of existing literature in the field of digital forensics.
The boundaries of the taxonomy are restricted to the extent of the literature set for review by the researcher (not more than ten years old at the time of writing this thesis). The researcher also acknowledges that the various challenges presented in this chapter shown in Table 3.1 do not purport to be an exhaustive list due to the limits set on the literature surveyed. An exhaustive list is in most cases also hard to create and, even if created, it would not be easy to handle or manage because of its size. This also implies that the bigger the size of the list, the more difficult it becomes to manage it effectively. For this reason the sub-categories of the challenges listed in column two of Table 3.1 were merely selected as common examples to facilitate this study and not to serve as an exhaustive list. More specific sub-categories of the challenges in each named category can and should be added as the need arises in future.
The taxonomy has also been designed taking into consideration only the major challenges that digital forensics has faced over the past decade as identified in the literature surveyed. The researcher did not draw a precise distinction between the old and the most recent digital forensic challenges in this chapter, because some of the challenges captured in the taxonomy are inherent to digital forensics, e.g. the vast volumes of data. Future research will, however, consider the possibility of developing an extensive taxonomy with distinctions between the old and the most recent challenges. The next section explains in detail the proposed taxonomy of challenges for digital forensics.

THE TAXONOMY OF CHALLENGES FOR DIGITAL FORENSICS

In this section, the researcher presents a detailed explanation of the taxonomy of challenges for digital forensics. Table 3.1 shows the structure of the proposed taxonomy.
The taxonomy consists of four rows arranged from top to bottom with the first row depicting the technical challenges faced by digital forensics. This is followed by the legal systems or law enforcement challenges in the second row, the personnel-related challenges in the third row and finally the operational challenges faced by digital forensics in the fourth row.
However, the various sub-categories of the challenges presented in each of the different rows of the taxonomy shown in Table 3.1 focus more on areas that can be considered when developing for instance new curricula and education materials for different undergraduate programmes as well as research projects for postgraduate studies.
The sub-categories can also be useful when developing dynamic digital forensic tools that focus on addressing specific identified digital forensic challenges. Organising the taxonomy into categories and sub-categories was necessary to simplify the understanding of the taxonomy as well as to present specific finer details of the taxonomy.
The major categories of the various digital forensics challenges as found in various surveyed literatures (with their details and sub-categories as shown in Table 3.1) include the following: technical challenges; legal systems or law enforcement challenges; personnel-related challenges; and operational challenges. The taxonomy shown in Table 3.1 was developed, based on the literature survey, as a way to show the different challenges faced by digital forensics of which difficulties in managing semantic disparities is one of the challenges listed under Personnel-related challenges (Karie and Venter, 2015). Note also from the literature survey carried out during the time of this study, it was evident that, many of the challenges listed in Table 3.1 have been addressed by different researchers. However, no attempt was made to resolve the semantic disparity problems that occur in digital forensics. For this reason, resolving semantic disparities became the primary focus of the study presented in this research thesis.
In the solution approach, however, there are different ways to resolve the semantic disparities in digital forensics including:

• Resolving semantic disparities through the use of ontologies, this is discussed in chapter 5 and 6 of this research thesis.
• The second approach to resolving semantic disparities is by using a sematic reconciliation model which is discussed in chapter 7 and tested in chapter 8 of this research thesis.

The ontology and the model therefore are the two different ways discussed in this thesis which can be used to resolve semantic disparities in Digital forensics. In the sub-sections to follow, the various categories and sub-categories of the challenges faced by digital forensics as identified in Table 3.1 are explained in more detail.

Technical Challenges

Technical challenges can be described as those challenges that can be addressed with existing expertise, protocols and operations. Implementing solutions to address any of the identified technical challenges often falls to someone with the authority to do so. Hence, digital forensics needs a good mixture of both technical skills as well as ethical conduct. Some of the identified technical challenges faced by digital forensics are explained in the sub-sections to follow.

DEDICATION 
TABLE OF CONTENTS 
LIST OF TABLES 
LIST OF FIGURES 
ABSTRACT 
LIST OF ABBREVIATIONS USED 
ACKNOWLEDGEMENT 
CHAPTER 1 : INTRODUCTION 
1.1 Introduction
1.2 Problem Statement
1.3 Motivation for this Study
1.4 Objectives
1.5 Thesis Layout
1.6 Chapter Conclusion
CHAPTER 2 : BACKGROUND OF DIGITAL FORENSICS 
2.1 Introduction
2.2 Digital Forensics
2.3 Digital Forensic Investigation Process Models .
2.4 Chapter Conclusion
CHAPTER 3 : DIGITAL FORENSIC CHALLENGES – A TAXONOMY 
3.1 Introduction
3.2 Challenges Faced by Digital Forensics
3.3 Scope of the Proposed Taxonomy
3.4 The Taxonomy of Challenges for Digital Forensics
3.5 Chapter Conclusion
CHAPTER 4 : BACKGROUND OF ONTOLOGIES
4.1 Introduction .
4.2 Ontology Definition
4.3 Ontology Development Methodologies
4.4 Types of Ontologies
4.5 Ontology Development Tools
4.6 Chapter Conclusion
CHAPTER 5 : SEMANTIC DISPARITIES IN DIGITAL FORENSICS 
5.1 Introduction
5.2 Defining Semantic Disparity in Digital Forensics
5.3 Advances in Semantic Disparity Research .
5.4 Potential Causes of Semantic Disparity in Digital Forensics
5.5 Managing Semantic Disparities in Digital Forensics
5.6 Approaches to Manage Semantic Disparities in Digital Forensics
5.7 Advantages of Semantic Reconciliation in Digital Forensics
5.8 Chapter Conclusion
CHAPTER 6 : DEVELOPING ONTOLOGIES FOR DIGITAL FORENSICS
6.1 Introduction
6.2 Related Work on Developing Ontologies for Digital Forensics
6.3 A General Ontology for Digital Forensic Disciplines
6.4 An Ontology for A Cloud Forensic Environment
6.5 Benefits for Developing Ontologies for Digital Forensics
6.6 Chapter Conclusion
CHAPTER 7 : A DIGITAL FORENSIC SEMANTIC RECONCILIATION (DFSR) MODEL
7.1 Introduction
7.2 Related work
7.3 The Need to Develop a Digital Forensic Semantic Reconciliation Model
7.4 The Proposed Digital Forensic Semantic Reconciliation (DFSR) Model
7.5 A Discussion of the Proposed DFSR Mode
7.6 Chapter Conclusion
CHAPTER 8 : TESTING THE FEASIBILITY AND IMPLEMENTATION OF THE PROPOSED DFSR MODEL
8.1 Introduction
8.2 The Objectives of the DFSR Prototype
8.3 The Feasibility and Implementation of the DFSR Prototype
8.4 Experimental Results Based on the Proposed DFASSV Method
8.5 More Experimental Results Based on the DFSR Prototype
8.6 Chapter Conclusion
CHAPTER 9 : CONCLUSIONS AND FUTURE WORK 
9.1 Introduction
9.2 Revisiting the Problem Statement
9.3 Accomplishments
9.4 Future Research
9.5 Chapter Conclusion .
BIBLIOGRAPHY 
APPENDIX
GET THE COMPLETE PROJECT