Computer Profiling for Preliminary Forensic Examination

Document Type

Conference Proceeding

Source of Publication

Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST

Publication Date

1-1-2014

Abstract

© Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2014. The quantity problem and the natural desire of law enforcement to confront suspects with evidence of their guilt close to the time of arrest in order to elicit a confession combine to form a need for both effective digital forensic triage and preliminary forensic examination. This paper discusses computer profiling, a method for automated formal reasoning about a computer system, and its applicability to the problem domain of preliminary digital forensic examination following triage. It proposes an algorithm for using computer profiling at the preliminary examination stage of an investigation, which focusses on constructing an information model describing a suspect’s computer system in the minimal level of detail necessary to address a formal hypothesis about the system proposed by an investigator. The paper concludes by discussing the expanded utility of the algorithm proposed when contrasted to existing approaches in the digital forensic triage and preliminary examination space.

ISBN

9783319142883

ISSN

1867-8211

Publisher

Springer Verlag

Volume

132

First Page

207

Last Page

220

Disciplines

Computer Sciences

Keywords

Computer profiling, Formal methods, Preliminary examination, Triage

Scopus ID

84943268723

Indexed in Scopus

yes

Open Access

no

Link to Full Text

Share

COinS