CCE Theses and Dissertations
Date of Award
2022
Document Type
Dissertation
Degree Name
Doctor of Philosophy (PhD)
Department
College of Computing and Engineering
Advisor
Sumitra Mukherjee
Committee Member
Michael J. Laszlo
Committee Member
Francisco J. Mitropoulos
Keywords
backlogs, computer forensics, digital forensics, imaging, preview, triage
Abstract
The widespread use of the digital media in committing crimes, and the steady increase of their storage capacity has created backlogs at digital forensic labs. The problem is exacerbated especially in high profile crimes. In many such cases the judicial proceedings mandate full analysis of the digital media, when doing so is rarely accomplished or practical. Prior studies have proposed different phases for forensic analysis, to lessen the backlog issues. However, these phases are not distinctly differentiated, and some proposed solutions may not be practical. This study utilized several past police forensic analyses. Each case was chosen for having five distinct forensic phases, complete with documented amount of time spent in each phase, along with the number and type of recovered evidence. Data from these cases were empirically analyzed using common descriptive statistical analyses along with linear regression. By using linear regression, we tested the factors that determine the number of recovered evidentiary artifacts.
This study provides models by which future forensic analyses could be assessed. It presents distinctive boundaries for each forensics phase, thus eliminating ambiguity in the examination results, while assisting forensic examiners in determining the necessary depth of analysis.
NSUWorks Citation
Kevin Parviz. 2022. An Empirical Investigation of the Evidence Recovery Process in Digital Forensics. Doctoral dissertation. Nova Southeastern University. Retrieved from NSUWorks, College of Computing and Engineering. (1177)
https://nsuworks.nova.edu/gscis_etd/1177.