An Ontology for Digital Forensics in IT Security Incidents - OPUS

Chapter 1
Introduction
"[The] [...] Golden Age of Digital Forensics, [...] is quickly
coming to an end." [Garnkel, 2010]
Ontologie, die Lehre des Seienden.
(von ὄν seiend, Partizip von εἶναι sein, und λόγο(ς) Lehre)
For a long time computers have been utilized for investigating criminal cases.
Computer databases are used to nd information faster than in large paper
document stores. If evidence has to be reconstructed, computers for example
help reconstruct ripped up documents[De Smet, 2009]. As seen in television
series, computers can help identify footprints[Huynh et al., 2003].
But computers and other electronic devices can contain evidence or be
evidence themselves, too. Guidelines for what evidence can be found in which
electronic device, how the evidence can be retrieved and what precautions to
take are available for example in [National Institute of Justice (U.S.), 2001].
Digital forensics has to face several diculties. The solutions for these
do not necessarily go in the same direction. On the one hand the available
data should be processed completely. On the other hand this has to be done
as fast as possible.
One factor that leads to problems is the lately increasing number of
mobile devices. Many of them have dierent structures and require dierent
approaches. An additional point is that the memory of such a device cannot
easily be taken out as it is possible to remove the hard disk from a common
computer. This leads to problems if the memory is used as legal evidence.
Another aspect is the amount of space available for and used by users. Today
they can have large storage built in their computer. Furthermore most of
them have several external storage media.
All these points increase the complexity of retrieving the required information
and the time needed for analysing it. Caused by the fact that the
digital forensic analysis is based on traditional forensics, the rst approach
comprises that the data is acquired rst and analysed later on. Caused by
the rapidly growing amount of data, it is more ecient to rst lter what
7