Establishing Findings in Digital Forensic Examinations: A Case Study Method

Abstract

In digital forensics, examinations are carried out to explain events and demonstrate the root cause from a number of plausible causes. Yin’s approach to case study research offers a systematic process for investigating occurrences in their real-world contexts. The approach is well suited to examining isolated events and also addresses questions about causality and the reliability of findings. The techniques that make Yin’s approach suitable for research also apply to digital forensic examinations. The merits of case study research are highlighted in previous work that established the suitability of the case study research method for conducting digital forensic examinations. This research extends the previous work by demonstrating the practicality of Yin’s case study method in examining digital events. The research examines the relationship between digital evidence – the effect – and its plausible causes, and how patterns can be identified and applied to explain the events. Establishing these patterns supports the findings of a forensic examination. Analytic strategies and techniques inherent in Yin’s case study method are applied to identify and analyze patterns in order to establish the findings of a digital forensic examination.