Most forensics models focus on the investigative process and its different phases and are characterized by a rather informal and intuitive approach. When a formalized process been introduced, in 1984, a new and improved computer forensics investigation processes have been developed. A digital forensics investigation is a process that used science and technology to examine digital objects and te...

Nowadays we all are surrounded by big data. The term ‘Big Data’ itself indicates huge volume, high velocity, variety and veracity i.e. uncertainty of data which gave rise to new difficulties and challenges. Hadoop is a framework which can be used for tremendous data storage and faster processing. It is freely available, easy to use and implement. Big data forensic is one of the challenges of bi...

Digital forensics comprises the set of techniques to recover, preserve, and examine digital evidence and has applications in a number of important areas, including investigation of child exploitation, identity theft, counter-terrorism, and intellectual property disputes. Digital forensics tools must exhaustively examine and interpret data at a low level, because data of evidentiary value may ha...

This paper discusses the critical need for instructors to bring aspects of computing forensics into Information Technology courses and posits that we make computer forensics a course—or a major portion of a course—offered under the auspices of IT security across all IT-related disciplines, but especially those with a business orientation. To facilitate computer forensics implementation in IT co...

We have developed a distributed computing capability, Digital Forensics Compute Cluster (DFORC2) to speed up the ingestion and processing of digital evidence that is resident on computer hard drives. DFORC2 parallelizes evidence ingestion and file processing steps. It can be run on a standalone computer cluster or in the Amazon Web Services (AWS) cloud. When running in a virtualized computing e...

The goal of this paper is to introduce a new area of computer forensics: process forensics. Process forensics involves extracting information from a process’s address space for the purpose of finding digital evidence pertaining to a computer crime. The challenge of this sub-field is that the address space of a given process is usually lost long before the forensic investigator is analyzing the ...