Search

Problem statement: The needs of computer forensics investigators have been directly influenced by the increasing number of crimes performed using computers. It is the responsibility of the investigator to ascertain the authenticity of the collected digital evidence. Without proper classification of digital evidence, the computer forensics investigator may ended up investigating using untrusted digital evidence and ultimately cannot be use to implicate the suspected criminal. Approach: The historical methods of verifying the authenticity of a hadith were studied. The similarities between hadith authentication and digital evidence authentication were identified. Based on the similarities of the identified processes, a new method of authenticating digital evidence were proposed, together with the trust calculation algorithm and evidence classification. Results: The new investigation processes and an algorithm to calculate the trust value of a given digital evidence was proposed. Furthermore, a simple classification of evidence, based on the calculated trust values was also proposed. Conclusion/Recommendations: We have successfully extracted the methods to authenticate hadith and mapped it into the digital evidence authentication processes. The trust values of digital evidence were able to be calculated and the evidence can be further classified based on the different level of trust values. The ability to classify evidence based on trust levels can offer great assistance to the computer forensics investigator to plan their works and focus on the evidence that would give them a better chance of catching the criminals. Key words: Computer forensics, digital evidence authentication, hadith authentication, INTRODUCTION We are experiencing the explosive growth of the usage of computers in our daily lives, may it be at the personal or corporate levels. A great deal of companies [...]

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.clsr.2009.09.008 Byline: Da-Yu Kao (a), Shiuh-Jeng Wang (b), Frank Fu-Yuan Huang (c) Abstract: Cyber activity has become an essential part of the general public's everyday life. The hacking threats of Cyber-crime are becoming more sophisticated as internet communication services are more popular. To further confirm the final finding of Cyber-crime, this study proposes three analytical tools to clarify the Cyber-crime issues by means of Ideal Log, M-N model and MDFA (Multi-faceted Digital Forensics Analysis) strategy, where Ideal Log is identified as a traceable element of digital evidence including four elements of IP Address, Timestamp, Digital Action, and Response Message. M-N model applies a formal method for collating and analyzing data sets of investigation-relevant logs in view of connected time with ISP logs. MDFA strategy attempts to outline the basic elements of Cyber-crime using new procedural investigative steps, and combining universal types of evidential information in terms of Evidence, Scene, Victim, and Suspect. After researchers figure out what has happened in Cyber-crime events, it will be easier to communicate with offenders, victims or related people. SoTE (Strategy of Triple-E) is discussed to observe Cyber-crime from the viewpoints of Education, Enforcement and Engineering. That approach is further analyzed from the fields of criminology, investigation and forensics. Each field has its different focus in dealing with diverse topics, such as: the policy of 6W1H (What, Which, When, Where, Who, Why, and How) questions, the procedure of MDFA strategy, the process of ideal Logs and M-N model. In addition, the case study and proposed suggestion of this paper are presented to counter Cyber-crime. Author Affiliation: (a) Information Department, Maritime Patrol Directorate General, Coast Guard Administration, Taipei, Taiwan (b) Department of Information Management, Central Police University, TaoYuan, Taiwan (c) The Examination Yuan of R.O.C Taipei, Taiwan 11601