A novel digital forensic framework for data breach investigation

Hakim, Arif Rahman and Ramli, Kalamullah and Gunawan, Teddy Surya and Windarta, Susila (2023) A novel digital forensic framework for data breach investigation. IEEE Access, 11. pp. 42644-42659. E-ISSN 2169-3536

	PDF - Published Version Restricted to Repository staff only Download (4MB) | Request a copy
Preview	PDF - Supplemental Material Download (175kB) | Preview

Abstract

Data breaches are becoming an increasingly prevalent and global concern due to their massive impact. One of the primary challenges in investigating data breach incidents is the unavailability of a specific framework that acknowledges the characteristics of a data breach incident and provides clear steps on how the investigative framework can comprehensively answer what, who, when, where, why, and how (5WH) questions. This paper aims to develop a novel digital forensic investigation framework that can overcome these data breach investigation challenges. The proposed framework utilizes the data breach breakdown phases to analyze data breach incidents according to their characteristics. The main contribution of our work is a novel digital forensic framework for data breach investigation that enhances the 5WH analysis depth by utilizing evidence classification and artifact visualization based on data breach breakdown phases. Furthermore, we design the framework components to provide comprehensive analysis results that make it easier for investigators to summarize the answers to the 5WH questions. To validate the framework, we apply it to a case study of enterprise-level data breach incidents. Based on the case study analysis, the proposed investigation framework successfully provides all the answers to the 5WH questions. This comprehensive answering ability is the study’s fundamental strength compared to other digital forensic investigation frameworks.

Item Type:	Article (Journal)
Uncontrolled Keywords:	Data breach, digital forensics, framework, investigation
Subjects:	T Technology > TK Electrical engineering. Electronics Nuclear engineering > TK7800 Electronics. Computer engineering. Computer hardware. Photoelectronic devices > TK7885 Computer engineering
Kulliyyahs/Centres/Divisions/Institutes (Can select more than one option. Press CONTROL button):	Kulliyyah of Engineering Kulliyyah of Engineering > Department of Electrical and Computer Engineering
Depositing User:	Prof. Dr. Teddy Surya Gunawan
Date Deposited:	27 Jun 2023 15:34
Last Modified:	27 Jun 2023 15:34
URI:	http://irep.iium.edu.my/id/eprint/105245

Actions (login required)

View Item