Toward Models for Forensic Analysis

The existing solutions in the field of computer forensics are largely ad hoc. This paper discusses the need for a rigorous model of forensics and outlines qualities that such a model should possess. It presents an overview of a forensic model and an example of how to apply the model to a real-world, multi-stage attack. We show how using the model can result in forensic analysis requiring a much smaller amount of carefully selected, highly useful data than without the model.

• Type: Conference
• Year: 2007
• Where: SADFE
• Authors: Sean Peisert, Matt Bishop, Sidney Karin, Keith Marzullo
• Keywords: Digital Forensic Engineering, Forensic, Forensic Engineering, Model, Rigorous Model, SADFE 2007