Digital Forensic is the preservation, identification, recovery, documentation, analysis, and interpretation of digital evidence. Digital evidences are electronically stored records, facts, signs, information of probative value that shows...
moreDigital Forensic is the preservation, identification, recovery, documentation, analysis, and interpretation of digital evidence.
Digital evidences are electronically stored records, facts, signs, information of probative value that shows clearly that an event occurred or that a crime has been committed.
Preservation of Digital Evidence is the crux of Digital Forensics. As such, it must be handled in a way to ensure that it is promptly identified, preserved, collected, examined, analyzed and documented appropriately so that it is evidently weighty, authentic, reliable, believable, complete and that it passes the test of legal admissibility.
Evidence Preservation is being constantly plagued with issues needed to be technically, administratively and legally resolved. Of which is, the rate of standardization of Digital Forensics Processes, particularly evidence preservation, by International standardizing bodies is slower than the challenges and continuously evolving digital technology. Consequently, Proactive, Sustained and Non-fragmented Research and Practitioner Communities must be established, where they do not exist and also supported by national and regional standardization organizations, to see to faster and up-to-date solutions. Such communities have greatly helped to sustain continuous growth and standardization in other fields such as software engineering, web frameworks, and mobile technology.
A consolidated framework, the Enhanced Generic Digital Forensic Investigation Model (EGDFIM), is proposed in this work.