Crosby-Signed Thesis - Alliance Digital Repository

IMPACT OF IPV6 TRANSITION MECHANISMS ON THE NETWORK FORENSIC
10
Table 1. Comparison of Digital Forensic Framework Processes
Co- Ciard- Incident DFR- Carr-
Process Carr hen huáin Shin Response DOJ WS ier Lee Casey
Identify legal issue X X X X X
Provide training and tools X X X X
Seek authorization
X
Create hypothesis X X
Plan investigation X X X
Notify stakeholders
X
Search for evidence X X X X X
Collect evidence X X X X X X X
Preserve evidence X X X X X X X
Examine and verify evidence X X X X X X X X
Classify and individualize X X X
Prioritize evidence
X
Reconstruct events X X X
Consult external experts
X
Analyze and document X X X X X X X X
Verify available resources
X
Determine schedule
X
Decide on course of action
X
Profile and summon suspects
X
Presentation and reporting X X X X X X X
Proof and defense of case
X
Restore and recovery X X
Dissemination of knowledge X X
The available research presented a fractured and ad-hoc approach to forensic frameworks
for digital investigations despite the importance of unifying under a single comprehensive model.
By merging a number of frameworks into one procedural model, we begin to see an integration
of ideas that could be used by both academia and the legal community. While these approaches
serve forensics in general, they do not adequately address the complex nature and unique
requirements of network forensic investigations. The processes that are most impacted by this