Application of Case-Oriented Evidence Mining in Forensic Computing

In this paper, we proposed a new digital forensic process model, named COEM (case-oriented evidence mining model), along with its approaches, top-down. The model consists of sets of tasks described at two levels of abstraction: case (from requirement to finding) and data (from general to specific). The COEM facilitates analysis in a viewpoint of case instead of data, and gives investigators a more natural and rational perspective. As an example, we illustrate its application with a digital crime case accused of distributing pornographic materials through WAP sites in China.