Privacy-aware digital forensics

Abstract

Digital forensics and privacy are the two naturally conflicting concepts. While privacy can be defined as the desire of people to decide for themselves when, how and to what extent their personal information is shared with others, digital forensics is aimed at acquiring and analysing relevant data from devices in the scope of digital forensic investigations, following a set of procedures to comply legal proceedings. Digital forensic investigations are usually carried out after seizing the devices from investigated suspects or third parties, who consequently lose control over the data being accessed by the investigator. Moreover, digital forensic tools are even capable of retrieving information which is apparently no longer present in the device because the user decided to delete it. These tools also have the ability of correlating information from different sources giving rise to new actors in the investigation whose privacy can be affected. Also, the lack of context to determine when and why the user intentionally deleted some of the contents may result in wrong accusations. All things considered, even when digital investigations are conducted by responsible professionals, the data collected from personal devices may result in dreadful invasions to individual privacy. Inevitably, this leads to a controversial debate on the need for strong privacy guarantees in the context of digital forensics. This chapter aims to shed some light into this imperative and highly demanded debate given the fundamental role that the user and his/her personal data play in current and future digital investigations.