FIA : an open foresic integration architecture for composing digital evidence

Raghavan, Sriram, Clark, Andrew J., & Mohay, George M. (2009) FIA : an open foresic integration architecture for composing digital evidence. In Sorell, Matthew (Ed.) Forensics in Telecommunications, Information and Multimedia, Springer Berlin Heidelberg, Adelaide, South Australia, pp. 83-94.

View at publisher


The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture (FIA) which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of integrating evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.

Impact and interest:

Citation counts are sourced monthly from Scopus and Web of Science® citation databases.

These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.

Citations counts from the Google Scholar™ indexing service can be viewed at the linked Google Scholar™ search.

Full-text downloads:

1,163 since deposited on 20 Oct 2009
310 in the past twelve months

Full-text downloads displays the total number of times this work’s files (e.g., a PDF) have been downloaded from QUT ePrints as well as the number of downloads in the previous 365 days. The count includes downloads for all files if a work has more than one.

ID Code: 28073
Item Type: Conference Paper
Refereed: Yes
Additional Information: The proceedings of the 2nd International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009
Additional URLs:
Keywords: Digital Forensics, Digital Evidence, FIA, Evidence Composition, Evidence Correlation
DOI: 10.1007/978-3-642-02312-5_10
ISBN: 9783642023118
ISSN: 1867-8211
Divisions: Past > QUT Faculties & Divisions > Faculty of Science and Technology
Past > Institutes > Information Security Institute
Copyright Owner: Copyright 2009 Springer Berlin Heidelberg
Copyright Statement:

This is the author-version of the work.

Conference proceedings published, by Springer Verlag, will be available via SpringerLink.

Deposited On: 20 Oct 2009 01:06
Last Modified: 25 Oct 2016 23:41

Export: EndNote | Dublin Core | BibTeX

Repository Staff Only: item control page