Skip to main content

Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes

Mutawa, Noora Al, Bryce, Joanne, Franqueira, Virginia N.L., Marrington, Andrew, Read, Janet C. (2019) Behavioural Digital Forensics Model: Embedding Behavioural Evidence Analysis into the Investigation of Digital Crimes. Digital Investigation, 28 . pp. 70-82. ISSN 1742-2876. (doi:10.1016/j.diin.2018.12.003) (KAR id:77169)

PDF Author's Accepted Manuscript
Language: English


Creative Commons Licence
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.
Download (942kB) Preview
[img]
Preview
PDF Publisher pdf
Language: English

Restricted to Repository staff only
Contact us about this Publication
[img]
Official URL
https://dx.doi.org/10.1016/j.diin.2018.12.003

Abstract

The state-of-the-art and practice show an increased recognition, but limited adoption, of Behavioural Evidence Analysis (BEA) within the Digital Forensics (DF) investigation process. Yet, there is currently no BEA-driven process model and guidelines for DF investigators to follow in order to take advantage of such an approach. This paper proposes the Behavioural Digital Forensics Model to fill this gap. It takes a multidisciplinary approach which incorporates BEA into in-lab investigation of seized devices related to interpersonal cases (i.e., digital crimes involving human interactions between offender(s) and victim(s)). The model was designed based on the application of traditional BEA phases to 35 real cases, and evaluated using 5 real digital crime cases - all from Dubai Police archive. This paper, however, provides details of only one case from this evaluation pool. Compared to the outcome of these cases using a traditional DF investigation process, the new model showed a number of benefits. It allowed a more effective focusing of the investigation, and provided logical directions for identifying the location of further relevant evidence. It also enabled a better understanding and interpretation of victim/offender behaviours (e.g., probable offenders' motivations and modus operandi), which facilitated a more in depth understanding of the dynamics of the specific crime. Finally, in some cases, it enabled the identification of suspect's collaborators, something which was not identified via the traditional investigative process.

Item Type: Article
DOI/Identification number: 10.1016/j.diin.2018.12.003
Uncontrolled keywords: Behavioural Evidence Analysis, Reconstruction of digital crime, Digital forensics investigation, Behavioural digital forensics model, Digital evidence interpretation.
Divisions: Faculties > Sciences > School of Computing
Faculties > Sciences > School of Computing > Security Group
Depositing User: Virginia Franqueira
Date Deposited: 16 Oct 2019 14:19 UTC
Last Modified: 16 Jan 2020 10:02 UTC
Resource URI: https://kar.kent.ac.uk/id/eprint/77169 (The current URI for this page, for reference purposes)
Bryce, Joanne: https://orcid.org/0000-0001-9144-2899
Franqueira, Virginia N.L.: https://orcid.org/0000-0003-1332-9115
Marrington, Andrew: https://orcid.org/0000-0002-3839-6675
  • Depositors only (login required):

Downloads

Downloads per month over past year