FIA : an open foresic integration architecture for composing digital evidence
Raghavan, Sriram, Clark, Andrew J., & Mohay, George M. (2009) FIA : an open foresic integration architecture for composing digital evidence. In Sorell, Matthew (Ed.) Forensics in Telecommunications, Information and Multimedia, Springer Berlin Heidelberg, Adelaide, South Australia, pp. 83-94.
The analysis and value of digital evidence in an investigation has been the domain of discourse in the digital forensic community for several years. While many works have considered different approaches to model digital evidence, a comprehensive understanding of the process of merging different evidence items recovered during a forensic analysis is still a distant dream. With the advent of modern technologies, pro-active measures are integral to keeping abreast of all forms of cyber crimes and attacks. This paper motivates the need to formalize the process of analyzing digital evidence from multiple sources simultaneously. In this paper, we present the forensic integration architecture (FIA) which provides a framework for abstracting the evidence source and storage format information from digital evidence and explores the concept of integrating evidence information from multiple sources. The FIA architecture identifies evidence information from multiple sources that enables an investigator to build theories to reconstruct the past. FIA is hierarchically composed of multiple layers and adopts a technology independent approach. FIA is also open and extensible making it simple to adapt to technological changes. We present a case study using a hypothetical car theft case to demonstrate the concepts and illustrate the value it brings into the field.
Impact and interest:
Citation counts are sourced monthly from and citation databases.
These databases contain citations from different subsets of available publications and different time periods and thus the citation count from each is usually different. Some works are not in either database and no count is displayed. Scopus includes citations from articles published in 1996 onwards, and Web of Science® generally from 1980 onwards.
Citations counts from theindexing service can be viewed at the linked Google Scholar™ search.
Full-text downloads displays the total number of times this work’s files (e.g., a PDF) have been downloaded from QUT ePrints as well as the number of downloads in the previous 365 days. The count includes downloads for all files if a work has more than one.
|Item Type:||Conference Paper|
|Additional Information:||The proceedings of the 2nd International Conference, e-Forensics 2009, Adelaide, Australia, January 19-21, 2009|
|Keywords:||Digital Forensics, Digital Evidence, FIA, Evidence Composition, Evidence Correlation|
|Divisions:||Past > QUT Faculties & Divisions > Faculty of Science and Technology
Past > Institutes > Information Security Institute
|Copyright Owner:||Copyright 2009 Springer Berlin Heidelberg|
This is the author-version of the work.
Conference proceedings published, by Springer Verlag, will be available via SpringerLink. http://www.springerlink.com
|Deposited On:||20 Oct 2009 01:06|
|Last Modified:||25 Oct 2016 23:41|
Repository Staff Only: item control page