CERIAS Tech Report 2004-02 DEFINING AND MODELING DIGITAL EVIDENCE USING DATA FLOWS

In this paper, we define, model, and show the uses of evidence in an investigation, specifically a digital investigation. Digital evidence has been used in the courts to help prove cases, but its characteristics and role in an investigation have not been formally defined or challenged. This paper defines digital evidence by observing the role of evidence in a physical investigation, modeling the role, and applying the model to a digital investigation. The model shows the data flow between objects and how the data can be interpreted to produce information and evidence of the incident. The model can also be used to identify the source of an incident and to find additional evidence at a crime scene. The class and individual characteristics of digital evidence are given and the data flow for the 4.4 BSD kernel is used as a case study.