6th European Conference - Academic Conferences

Jose Mas y Rubi et al.
Another pending point in the improvement is the preservation function, and this can be improved
through data duplication techniques like RAID disc structures, or by redundant servers; this
modification must be implemented specifically in the Network Forensics Server, which can send the
backup data to a medium describe above, after the data is previously analyzed.
For the presentation function, the purpose of this element is to generate reports which will be
presented to the competent authorities, for this is necessary to count with specialized personal that
can adequately identify the proofs and validate them as possible evidences. For this purpose, we
consider that an element that can fulfill this function is the Legal Enforcement Agency (LEA), which is
a fundamental part of the CALEA model. Some of the basic parameters to be considered would be
the ones presented in section II under the VoIP topic.
5.2 Proposed network basic operation
The operation of the network architecture and the relevant states for our analysis are appointed in the
following lines:
1) A call is generated from the Internet; it wants to communicate with some user on the network,
for which it uses a number, for example, 4981791.
2) Once the Gateway received the internet user communication petition, it will interact with the
IMS core, which will interact at the same time with ENUM, and will return the user identification of
the called number, according to SIP signaling.
3) The CAESMA network will intercept the IMS core response and identify the affected user for
the criminal acts which is being communicated.
4) CAESMA will connect the capture network and starts the real time forensic process.
5) The called user acts and proceeds with the communication normally.
6) When the communication is finalized, the forensic process of recollecting proofs is also
finished.
Figure 6: Relevant states in CAESMA network operation
6. Conclusions
The current trend of widespread use of VoIP communications make indispensable to the forensic
investigators to count with the necessary tools to study and prevent all the possible vulnerability
threats in the communications.
Possible applicable tools to this problematic issue, according to the investigation made in this paper,
are the REN-JIN model and the CALEA model. Both were thought as network forensic models and
are not fully adequate for evidence recollection in VoIP communications, due to the special
parameters of the evidence, that allow the network forensic investigators to identify and capture
specific data from the crime.
167