Increasing Involvement Of Digital Forensics In Criminal Investigations

The increased involvement of electronic devices in criminal actions “has led to the development of Digital Forensics (DF)” [Palmer 2001], a discipline concerning evidence investigation and presentation in an accepted manner upon court. However, the term digital incorporates many categories which cannot be regarded as a whole, therefore requiring further classification. Some of the DF sub-disciplines encountered throughout literature encompass aspects such as Computer, Network, Database,

Audio, Video [Shanableh 2013] and Mobile Forensics.

Despite the fact that mobile device functionality resembles the one of computers, they cannot be handled in the same way during a criminal investigation. Substantial differences in terms of hardware, software,

Fundamentally, MF “is the process of gathering evidence of some type of an incident or crime that has involved mobile devices” [D’ Orazio et al. 2014]. More precisely, MF is in charge of the whole routine of “gathering, retrieving, identifying, storing and documenting” [Marturana et al. 2011] evidence from small scale digital devices.

Mobile device operation has its own specific constrains, being a compromise between processing power usage, storage capabilities and portability/autonomy. In this perspective, the progressive balancing and/or offload of computing resources to external provider entities has provided a solution to deal with device shortcomings, creating an intersection between the mobility and cloud paradigms. While this strategy provides a solution for dealing with device energy, storage and processing power trade-offs, it also brings new challenges, as cloud services can potentially host relevant evidence. For many, cloud computing is the future of mobility: in a recent survey by the Right

Scale company [RightScale 2016], 95% of the surveyed organizations have adopted a private, public or hybrid cloud strategy. In the same survey, security on the

As the amount of valuable data being stored in cloud services increases, traditional MF techniques cannot solely provide the DF needs to deal with mobile devices. As such, forensic investigation started becoming applicable in cloud environments, thus formulating the discipline of Cloud Forensics, which involves

Computer, Network and Mobile Forensics concepts, since mobile devices also host cloud-related applications.

In this paper, we present the elements that characterize MF as a research discipline, while highlighting its most critical and rising challenges. By observing the advances occurring during the last six years, we examine the research trends and analyze their scope and potential, in order to identify aspects in need of further development.

The rest of the paper is structured as follows: section 2 contains the state-of-the art and background knowledge in the MF discipline, as it has evolved during the past few years. Section 3, presents some noteworthy surveys in the field. Section 4 classifies the existing literature in different categories according to the object of research , while

Section 5 performs an analysis of the challenges and literature gaps. Lastly, Section