Towards ‘Crime Specific’ Digital Investigation Frameworks

The wide development of the mobile and virtualised technologies in the past decade has further destabilized the already fragile balance between the defenders and the attackers of computing infrastructures. Criminals employ state of the art techniques for exploiting Information Environments that are making use of these new mediums. Alas, the resources that are available to Law Enforcement Agencies for prosecuting computer criminals are finite and existing investigative methodologies cannot address change in the means and mediums of crime. Coupled with the facts that (a) criminals have the initiative, and (b) they are well aware of the investigative procedures, it is understandable why computer crime, cyber-crime and e-Crime activities continue to be an issue in today’s socially-driven knowledge-based computing era. We argue that it is time to slightly change the focus of the digital forensic investigation from following static methodologies to actively trying to identify evidence of criminal activities. We propose ‘crime-specific’ frameworks that allow transparent extraction of knowledge from evidence, while ensuring chain of custody and evidential integrity. In this paper we critically discuss existing frameworks and build up the case for this new investigative approach.