Search results

Digital forensic investigators experience a need for support in their everyday struggle to overcome boundary problems associated with cyber crime inves-tigations. Traditional methods are socio-culturally and physically localised and dependent on strict and historically prescriptive political management. The new internet-worked cyber-world creates unprecedented difficulties for digital forensic investigations. This is directly linked with the inherently complex uncertainties and ambiguities related to a constant need for framing and re-framing of problem spaces under investigation. As such, in this paper we propose the recruitment of the discipline of Informing Systems in the context of digital discovery. Early findings of such an exercise indicate that informing systems approaches can assist the investigation process by offering means for structuring uncertainty. As it is accepted that uncertainty is an inherent element in a crime scene, not least in a cyber crime scene, we consider the contribution of Informing Systems vital for the effectiveness of digital forensic investigation practices.

This article considers the challenges faced by digital evidence specialists when collaborating with other specialists and agencies in other jurisdictions when investigating cyber crime. The opportunities, operational environment and modus operandi of a cyber criminal are considered, with a view to developing the skills and procedural support that investigators might usefully consider in order to respond more effectively to the investigation of cyber crimes across State boundaries.

In this article, a DFR framework is proposed focusing on the prioritization, triaging and selection of Indicators of Compromise (IoC) to be used when investigating of security incidents. A core component of the framework is the contextualization of the IoCs to the underlying organization, which can be achieved with the use of clustering and classification algorithms and a local IoC database.