A Digital Forensic Investigative Model for Business Organisations

When a digital incident occurs there are generally three courses of actions that are taken, generally dependant on the type of organisation within which the incident occurs, or which is responding the event. In the case of law enforcement the priority is to secure the crime scene, followed by the identification of evidentiary sources which should be dispatched to a specialist laboratory for analysis. In the case of an incident military (or similar critical infrastructures) infrastructure the primary goal becomes one of risk identification and elimination, followed by recovery and possible offensive measures. Where financial impact is caused by an incident, and revenue earning potential is adversely affected, as in the case of most commercial organisations), root cause analysis, and system remediation is of primary concern, with in-depth analysis of the how and why left until systems have been restored. Traditional investigative models follow the general process of: identify the incident, secure the scene and/or evidence, analyse the evidence, generate a report on the findings and present the outcome. This approach is more suited towards law enforcement than to the business world. The business environment lends itself to an approach similar to that of the military, namely to be able to identify the incident, patch the necessary system(s) and continue earning revenue. The only addition is that the business is more likely to want to press charges in a court of law than launch a counter offensive. In the generic investigative model, there is little leeway for a business’s incident responders to satisfy the need to return the systems to operational status as quickly as possible whilst preserving the necessary evidence and has to be able to mount a successful prosecution. These two goals can be mutually exclusive as a thorough investigation needs time and during this time the business will loose revenue by not having its system live. The model presented in this paper builds on the traditional investigative model as prepared by the Digital Forensic Research Workshop (DFRWS) and provides a mechanism to conduct the two potentially mutually exclusive processes in parallel.