Skip to main content

Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes

Mutawa, Noora Al, Bryce, Joanne, Franqueira, Virginia N.L., Marrington, Andrew, Read, Janet C. (2019) Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes. Digital Investigation, 28 . pp. 70-82. ISSN 1742-2876. (doi:10.1016/j.diin.2018.12.003) (KAR id:77169)

PDF Author's Accepted Manuscript
Language: English

Download (942kB) Preview
[thumbnail of not-edited-manuscript.pdf]
This file may not be suitable for users of assistive technology.
Request an accessible format
PDF Publisher pdf
Language: English

Restricted to Repository staff only
Contact us about this Publication
[thumbnail of 1-s2.0-S1742287618301981-main.pdf]
Official URL


The state-of-the-art and practice show an increased recognition, but limited adoption, of Behavioural Evidence Analysis (BEA) within the Digital Forensics (DF) investigation process. Yet, there is currently no BEA-driven process model and guidelines for DF investigators to follow in order to take advantage of such an approach. This paper proposes the Behavioural Digital Forensics Model to fill this gap. It takes a multidisciplinary approach which incorporates BEA into in-lab investigation of seized devices related to interpersonal cases (i.e., digital crimes involving human interactions between offender(s) and victim(s)). The model was designed based on the application of traditional BEA phases to 35 real cases, and evaluated using 5 real digital crime cases - all from Dubai Police archive. This paper, however, provides details of only one case from this evaluation pool. Compared to the outcome of these cases using a traditional DF investigation process, the new model showed a number of benefits. It allowed a more effective focusing of the investigation, and provided logical directions for identifying the location of further relevant evidence. It also enabled a better understanding and interpretation of victim/offender behaviours (e.g., probable offenders' motivations and modus operandi), which facilitated a more in depth understanding of the dynamics of the specific crime. Finally, in some cases, it enabled the identification of suspect's collaborators, something which was not identified via the traditional investigative process.

Item Type: Article
DOI/Identification number: 10.1016/j.diin.2018.12.003
Uncontrolled keywords: Behavioural Evidence Analysis, Reconstruction of digital crime, Digital forensics investigation, Behavioural digital forensics model, Digital evidence interpretation.
Divisions: Divisions > Division of Computing, Engineering and Mathematical Sciences > School of Computing
Depositing User: Virginia Franqueira
Date Deposited: 16 Oct 2019 14:19 UTC
Last Modified: 16 Feb 2021 14:08 UTC
Resource URI: (The current URI for this page, for reference purposes)
Bryce, Joanne:
Franqueira, Virginia N.L.:
Marrington, Andrew:
  • Depositors only (login required):


Downloads per month over past year