ISSN: 0022-1198
CODEN: JFSCA
Published Online: 1 November 2004
Page Count: 8

Defining Event Reconstruction of Digital Crime Scenes
Carrier, BD
Purdue University—CERIAS, IN

Spafford, EH
Purdue University—CERIAS, IN

(Received 20 March 2004; accepted 5 June 2004)

Abstract

Event reconstruction plays a critical role in solving physical crimes by explaining why a piece of physical evidence has certain characteristics. With digital crimes, the current focus has been on the recognition and identification of digital evidence using an object's characteristics, but not on the identification of the events that caused the characteristics. This paper examines digital event reconstruction and proposes a process model and procedure that can be used for a digital crime scene. The model has been designed so that it can apply to physical crime scenes, can support the unique aspects of a digital crime scene, and can be implemented in software to automate part of the process. We also examine the differences between physical event reconstruction and digital event reconstruction.

Keywords:
forensic science, computer forensics, digital evidence, crime scene event reconstruction, digital investigation

Paper ID: JFS2004127
DOI: 10.1520/JFS2004127
ASTM International is a member of CrossRef.