A unified forensic model applicable to the database forensics field

• Main Authors: Alhussan, Amel Ali, Al-Dhaqm, Arafat, Yafooz, Wael M. S., M. Emara, Abdel-Hamid, Abd. Razak, Shukor, Khafaga, Doaa Sami
• Format: Article
• Language: English
• Published: MDPI 2022
• Subjects: QA75 Electronic computers. Computer science
• Online Access: http://eprints.utm.my/103554/1/ArafatMohammedRashad2022_AUnifiedForensicModelApplicabletotheDatabase.pdf; http://eprints.utm.my/103554/; http://dx.doi.org/10.3390/electronics11091347
• Institution: Universiti Teknologi Malaysia

The Database Forensics Investigation (DBFI) field is focused on capturing and investigating database incidents. DBFI is a subdomain of the digital forensics domain, which deals with database files and dictionaries to identify, acquire, preserve, examine, analyze, reconstruct, present, and document database incidents. Several frameworks and models have been offered for the DBFI field in the literature. However, these specific models and frameworks have redundant investigation processes and activities. Therefore, this study has two aims: (i) conducting a compressive survey to discover the challenges and issues of the DBFI field and (ii) developing a Unified forensic model for the database forensics field. To this end, the design science research (DSR) method was used in this study. The results showed that the DBFI field suffers from many issues such as the lack of standardization, multidimensional nature, heterogeneity, and ambiguity, making it complex for those working in this domain. In addition, a model was proposed in this paper, called the Unified Forensic Model (UFM), which consists of five main stages: initialization stage, acquiring stage, investigation stage, restoring and recovering stage, and evaluation stage. Each stage has several processes and activities. The applicability of UFM was evaluated from two perspectives: completeness and implementation perspectives. UFM is a novel model covering all existing DBFI models and comprises two new stages: the recovering and restoring stage and the evaluation stage. The proposed UFM is so flexible that any forensic investigator could employ it easily when investigating database incidents.