Critical phases in network forensics - a review

• Main Authors: Nik Abdull Malik, Nik Mariza, Yahya, Saadiah, Abdullah @ Selimun, Mohd Taufik
• Format: Conference or Workshop Item
• Language: English
• Published: The Society of Digital Information and Wireless Communications (SDIWC) 2014
• Online Access: http://psasir.upm.edu.my/id/eprint/39825/1/39825.pdf; http://psasir.upm.edu.my/id/eprint/39825/; http://sdiwc.net/digital-library/web-admin/upload-pdf/00001119.pdf
• Institution: Universiti Putra Malaysia

The fragility nature of digital evidence required an adequate investigation procedure to maintain its admissibility. Thus, a Digital Forensic Investigation (DFI) models and frameworks had been proposed by many researchers. These models and frameworks cover all processes involved in investigating digital crimes, from preparation until presentation of the evidence. However, the existing DFI encountered inconsistency in terminologies, sequences and scope of investigation. Therefore, this study reviews the literature on fifteen DFI models and frameworks that has network forensic as a part. This is followed by a proposed conceptual model of two critical phases in network forensics investigation that are, Examination and Analysis.