Unifying computer forensics modeling approaches: a software engineering perspective

As an effort to introduce formalism into computer forensics, researchers have presented various modeling techniques for planning, analysis, and documentation of forensics activities. These modeling techniques provide representations of various forensics subjects such as investigative processes, chain of events, and evidence tests. From a software engineering perspective, it seems that several of these computer forensics modeling approaches may be unified to create a more complete, multi-view modeling methodology for examination planning and analysis. This paper proposes a core set of modeling views for a unified computer forensics modeling methodology: investigative process view, case domain view, and, evidence view. An example email threat case scenario is used as the context for a multi-view modeling example.