Development and validation of a Database Forensic Metamodel (DBFM)

Area of Science:

• Computer Science
• Digital Forensics
• Information Security

Background:

• Database Forensics (DBF) is a critical field for investigators.
• Existing DBF models are often specialized for specific incident types.
• There's a need for a unified understanding of DBF activities.

Purpose of the Study:

• To analyze existing DBF models and identify common activities.
• To develop a unified abstract view of DBF through a metamodel.
• To ensure the metamodel is comprehensive and consistent.

Main Methods:

• Analysis of 60 existing Database Forensics models.
• Identification and extraction of common DBF concepts.
• Reconciliation of concept definitions.
• Application of a metamodelling process.

Main Results:

• Identified numerous commonalities in DBF activities despite varying incident types.
• Developed a unified metamodel representing abstract DBF concepts.
• Proposed reconciled definitions for common DBF concepts.

Conclusions:

• A unified metamodel provides a comprehensive and consistent view of DBF.
• This metamodel can enhance knowledge-sharing and standardize DBF practices.
• The findings support a generalized approach to Database Forensics.