使用取证要求进行工程适应性数字调查
Engineering Adaptive Digital Investigations using Forensics Requirements
摘要：
数字取证调查旨在收集和分析必要的证据，以证明数字犯罪的潜在假设。尽管有几种数字取证工具可用，但调查人员仍然从头开始处理每个犯罪案件，提出潜在的假设并分析大量数据。本文提出了明确建模取证要求，以工程软件系统的取证准备和指导活动的数字调查。法医要求将犯罪的一些推测性假设与应在犯罪现场收集和分析的证据联系起来。与现有的方法相比，我们建议根据犯罪发生的风险，采取积极主动的行动，以保存重要的-可能是短暂的-证据。一旦调查开始，就对主动收集的证据进行分析，以评估对犯罪的一些推测性假设是否成立，以及需要哪些进一步证据来支持这些假设。对于每一个得到满足的假设，都会生成一个结构化的论点，以证明收集到的证据如何支持该假设。我们的评估结果表明，该方法提供了正确的调查结果，大大减少了收集的证据和分析的假设。
英文摘要：
A digital forensic investigation aims to collect and analyse the evidence necessary to demonstrate a potential hypothesis of a digital crime. Despite the availability of several digital forensics tools, investigators still approach each crime case from scratch, postulating potential hypotheses and analysing large volumes of data. This paper proposes to explicitly model forensic requirements in order to engineer software systems that are forensic-ready and guide the activities of a digital investigation. Forensic requirements relate some speculative hypotheses of a crime to the evidence that should be collected and analysed in a crime scene. In contrast to existing approaches, we propose to perform proactive activities to preserve important - potentially ephemeral - evidence, depending on the risk of a crime to take place. Once an investigation starts, the evidence collected proactively is analysed to assess if some of the speculative hypotheses of a crime hold and what further evidence is necessary to support them. For each hypothesis that is satisfied, a structured argument is generated to demonstrate how the evidence collected supports that hypothesis. Our evaluation results suggest that the approach provides correct investigative findings and reduces significantly the amount of evidence to be collected and the hypotheses to be analysed.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
