Characteristic evidence, counter evidence and reconstruction problems in forensic computing

Andreas Dewald

doi:10.1515/itit-2015-0017

Article

Characteristic evidence, counter evidence and reconstruction problems in forensic computing

Andreas Dewald
Andreas Dewald is senior researcher at the Friedrich-Alexander University (FAU) Erlangen-Nuremberg and is leading the Applied Forensic Computing research group.
University of Erlangen-Nuremberg, Martensstrasse 3, 91058 Erlangen, Germany, Tel.: +49-9131-8569906, Fax: +49-9131-8569919

Published/Copyright: December 1, 2015

Published by

Become an author with De Gruyter Brill

Submit Manuscript Author Information Explore this Subject

From the journal it - Information Technology Volume 57 Issue 6

Abstract

With the ever increasing number of crimes in which computers or other digital devices are used, digital forensics plays an increasingly important role in today's jurisdiction. The acquisition and investigation of the devices is done by forensic experts, whose reports and personal explanations then form the basis of justice. Because of this great responsibility of the experts, the quality of their investigations has to meet the highest standards. Historically, forensic computing (as digital forensics) developed pragmatically, driven by specific technical needs. Indeed, in comparison with other forensic sciences the field still is rather immature and has many deficits, such as the unclear terminology used in court. In this paper, we introduce notions of (digital) evidence, characteristic evidence, and (characteristic) counter evidence, as well as the definitions of two fundamental forensic reconstruction problems. We show the relation of the observability of the different types of evidence to the solvability of those problems. By doing this, we wish to exemplify the usefulness of formalization in the establishment of a precise terminology. While this will not replace all terminological shortcomings, it (1) may provide the basis for a better understanding between experts, and (2) helps to understand the significance of different types of digital evidence to answer questions in an investigation.

Keywords: Digital forensics; forensic computing; terminology; formalization; characteristic evidence; counter evidence; evidence; reconstruction problems

ACM CCS: Applied computing→Computer forensics; Applied computing→Computer forensics→Evidence collection; storage and analyses

About the author

Andreas Dewald

Andreas Dewald is senior researcher at the Friedrich-Alexander University (FAU) Erlangen-Nuremberg and is leading the Applied Forensic Computing research group.

University of Erlangen-Nuremberg, Martensstrasse 3, 91058 Erlangen, Germany, Tel.: +49-9131-8569906, Fax: +49-9131-8569919

Acknowledgement

I thank Felix Freiling for the many valuable discussions on the topic of this article!

Received: 2015-4-7

Revised: 2015-7-21

Accepted: 2015-9-20

Published Online: 2015-12-1

Published in Print: 2015-12-28

You are currently not able to access this content.

Articles in the same Issue

https://doi.org/10.1515/itit-2015-0017

Keywords for this article

Digital forensics; forensic computing; terminology; formalization; characteristic evidence; counter evidence; evidence; reconstruction problems