From IT forensics to forensic computing

Abstract

With the proliferation of digital computers and information systems into all fields of our society the amount of crime involving such systems (cybercrime) is steadily increasing. This involves both more traditional crimes in which digital systems are merely used as tools (e. g., different types of fraud, blackmailing, hidden communication) as well as new forms of crime in which digital systems are the target (e. g., computer abuses, malicious software, malicious remote control networks like botnets). For many years now, computer professionals have attempted to help in fighting cybercrime not only by devising preventive techniques to detect or prevent cyberattacks, but also by supporting the juridical system to investigate cybercrime and (in the long run) to identify, arrest and prosecute cybercriminals. In this feat, computer professionals play various roles: Not only do they support in identifying, preserving and analyzing evidence connected with digital systems, they also have to adapt investigative techniques and tools to the elusive behavior of cybercriminals. This broad field has become known as the field of digital forensics, computer forensics or IT forensics. The emergence of this field was mainly driven by practitioners trying to satisfy immediateneedswithin concretedigital investigations andRogers and Seigfried [3] identified “a disproportional focus on the applied aspects of computer forensics, at the expense of the development of fundamental theories”. Despite the scientific immaturity of the field, many universities (especially in the UK and the US) have started to establish academic degree programs and research labs in this area because of the need of scientific credibility in a court of law, but also partly driven by the enormous popularity of television series like “CSI”. After performing research in this area for almost 10 years, it appears to me as if the field is in many cases pretending to be scientific while it actually is executing best practices. Garfinkel [2] observed a “crisis” of digital forensics, and Casey [1, p. 1],