Digital Forensics in Small Devices: RFID Tag Investigation

3.1.7 FORZA – Digital Forensics Investigation Framework that Incorporate
Legal Issues
Digital Forensics is defined in many different ways and there is no standard definition
(Politt, 2004, cited in Ieong, 2006). Likewise, there are several different digital
forensic investigation (DFI) procedures mentioned in the previous literature. Some
papers discuss the technical aspects in potential evidence data acquisition cases while
others focus on the analysis of the acquired data (Brill and Pollitt, 2006, cited in
Ieong, 2006).
However, different DFI procedures are being developed in order to challenge
various technologies used in the compromised systems or the devices under
investigation (Ieong, 2006). As a result of the complicated technical procedures, the
author (Ieong, 2006, p. S29) mentions that a technical-independent framework is
required to thwart the technical gap between legal practitioners, investigators and
information technologists.
In this paper, “FORZA (FORensics ZAchman framework)”; Ieong (2006)
firstly emphasizes the three basic principles of DFI such as Reconnaissance,
Reliability, and Relevancy (3R; see Figure 3. 6).
Figure 3.6: Digital Forensics Investigation Fundamentals (Ieong, 2006, p. S31)
Reconnaissance is one of the principles of DFI, in which a forensic investigator has
to use different methods, practices and tools in order “to collect, recover, decode,
discover, extract, analyse, and convert data that are kept on different storage media
to readable evidence”, whereas Reliability is concerned with the digital evidence that
could be non-repudiated and acceptable to a court of law (Ieong, 2006, p. S30).
53