Proactive System for Digital Forensic Investigation
Year: 2014
Type: dissertation
Abstract: Digital Forensics (DF) is defined as the ensemble of methods, tools and techniques \nused to collect, preserve and analyse digital data originating from any type of digital \nmedia involved in an incident with the purpose of extracting valid evidence for a court \nof law. \nDF investigations are usually performed as a response to a digital crime and, \nas such, they are termed Reactive Digital Forensic (RDF). An RDF investigation \ntakes the traditional (or post-mortem) approach of investigating digital crimes after \nincidents have occurred. This involves identifying, preserving, collecting, analyzing, \nand generating the final report. \nAlthough RDF investigations are effective, they are faced with many challenges, \nespecially when dealing with anti-forensic incidents, volatile data and event reconstruction. \nTo tackle these challenges, Proactive Digital Forensic (PDF) is required. \nBy being proactive, DF is prepared for incidents. In fact, the PDF investigation has \nthe ability to proactively collect data, preserve it, detect suspicious events, analyze \nevidence and report an incident as it occurs. \nThis dissertation focuses on the detection and analysis phase of the proactive \ninvestigation system, as it is the most expensive phase of the system. In addition, \ntheories behind such systems will be discussed. Finally, implementation of the whole \nproactive system will be tested on a botnet use case (Zeus).
Author: Soltan Abed Alharbi
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W2262175984