A Practical Approach for Digital Forensic Triage

Abstract

In order to uncover truths to serve justice, case-related data collected from a digital investigation requires substantial resources to analyze, especially in time-critical situations. At present, however, digital forensics has not evolved to meet this ever-increasing demand. Digital forensic triage is a promising solution, as it is designed to maximize the use of resources according to a system of priorities, and hence the efficiency and effectiveness of forensic examinations can be increased. Nevertheless, the lack of concrete methods limits efforts to implement triage. This paper presents a practical approach that is designed to build a prioritizing solution. In this work a new process model is derived based on the presented approach, and it is particularly suited to scenarios where forensic examiners do not have enough time and resources to conduct a full examination and analysis. An example is described to demonstrate how this approach can be used to meet the requirements of network forensic investigations.