6th European Conference - Academic Conferences

Jose Mas y Rubi et al.
As we can see within the network architecture, the originating point of the calls for our analysis will be
the Internet cloud, the establishment path and signaling is the following:
a. Connection to the SIP server, which contains the database of all the users in the VoIP network.
b. After the validation of the destination user, which is part of the VoIP network, the SIP server sends
the corresponding signaling for call establishment with the VoIP network.
The rest of the article is organized as follows: In section II we introduce all the information related to
our work, which offers a clear base about the DFRWS general analysis model and the technology
behind VoIP service. In section III we describe the CALEA and REN-JIN models, offering a theoretical
basis and techniques that will allow us to understand in a better way the proposal of this work. In
section IV we develop a comparative analysis between CALEA and REN-JIN models, taking into
account the DFRWS general model as study base for both of them. In section V we propose a new
forensic model which is the result of the previous analysis, and we study its preliminary architecture
and basic operation. Finally we present our conclusions and possible future works.
2. Theoretical basis
To start our investigation, it is necessary that we study our referential general model for forensic
analysis of the DFRWS and the technical concepts of the VoIP technology, in order to contextualize
our analysis in a suitable environment.
2.1 Digital Forensics Research Workshop (DFRWS) model
Several forensic investigators have analyzed multiple digital forensic models. Within those models,
they found that the DFRWS model is rigid and linear but is particularly suitable where necessary
investigative activities are well-understood (Ray 2007). Also, they highlight the fact that in the
development of this model, for the first time, academic entities were involved, which didn’t happen
with other forensic models in its time. All other models were more focused on guidelines established
by law enforcement (Reith 2002).
Therefore, we choose the DFRWS model because allows a comprehensive approach and is more
goal-oriented to the objectives of this academic article. To proceed, we show the step sequence
followed by this model for an adequate forensic analysis:
Table 1: Steps for a digital forensic analysis (DFRWS 2001)
2.2 Voice over IP (VoIP)
The important point to keep in mind about the VoIP technology is concerning the shared information
between the terminal devices and the data itself, which will enable us to discriminate the calls and
their types. Those elements are presented in the following list (Pelaez 2010):
a) Terminal device information:
161