Abstract
In this paper, a process model for digital investigations is defined
using the theories and techniques from the physical investigation
world. While digital investigations have recently become more common,
physical investigations have existed for thousands of years and the
experience from them can be applied to the digital world. This paper
introduces the notion of a digital crime scene with its own witnesses,
evidence, and events that can be investigated using the same
model as a physical crime scene. The proposed model integrates
the physical crime scene investigation with the digital crime scene
investigation to identify a person who is responsible for the digital
activity. The proposed model applies to both law enforcement and
corporate investigations.
