Importance of Digital Forensics Process Models: Some Examples

While generalized models and standards are needed, so too are models for dealing with specific types of technology, as the intricacies of particular devices and types of evidence will inevitably call for specialized handling techniques. Mobile devices, smartphones, IoT devices, and drones are some examples of technological devices that serve as sources of digital evidence but also pose unique problems to investigators, and if responders and investigators are not prepared to deal with these devices the evidence within them can be compromised or lost. Two specific technologies, drones and IoT devices, are used as examples here.

Alotaibi et al. propose a model specifically for dealing with Unmanned Aerial Vehicles (UAVs), also known commonly as drones, when they are involved in an incident [1]. The proposed drone forensics (DRF) model outlines the process of dealing with drones in four stages: 1) preparation, 2) collection, 3) analysis, and 4) documentation [1]. Each of these stages details specific steps and procedures that must be undertaken in order to successfully capture a drone and analyze it for evidence. For example, in the preparation stage, the drone can be at risk of being intercepted by bystanders or perpetrators, and so it is necessary to secure the area where the drone is suspected to be in so as to minimize this possibility; it is also important to visually monitor and record both the area the drone is in and the drone itself, as the location the drone has operated in can provide important contextual information that may affect how evidence is analyzed [1]. It is also important to capture all the hardware associated with the drone so that it may be properly identified and the appropriate tools for data extraction utilized; some drones may utilize cellular towers, Wi-Fi access points, or other external communication equipment for control and data collection, making identification critical to isolating what the drone has interacted with [1].

The increasing ubiquity and diversity of IoT devices means that not only will such devices be more and more commonly involved in cyber incidents, but also that there must be continuous reassessment of how such devices are to be handled. Fagbola and Venter propose a digital forensic readiness model, Shadow Internet of Things Digital Forensic Readiness (SIoTDFR), specifically for dealing with shadow IoT devices [5]. Shadow IoT devices are IoT devices that connect to a network without the knowledge of the network owner/security team, and thus can then be used to facilitate attacks on that network via exploitation of the device itself [5]. Typical modern  digital forensics procedures may not be capable of effectively collecting evidence from IoT devices, often due to the large amount of resources required for data collection from an IoT network, as well as the short lifespan/collection window of evidence stored on them [5]. SIoTDFR is a multistage model, with the stages as follows: A) device connection, B) device identification, C) shadow device monitoring, D) digital evidence gathering, E) digital evidence preservation, and F) digital evidence storage [5]. The critical stages in this model are C and D, where a shadow device has been positively identified and must be observed with regards to how it interacts with the network and other devices on it; special procedures take place at this point to determine in-depth characteristics of the device as well as data capture and logging where possible and necessary [5].