Automation for digital forensics: Towards a definition for the community

Area of Science:

• Digital Forensics
• Computer Science

Background:

• The increasing volume of digital evidence necessitates automation in digital forensics.
• A lack of foundational definitions, classification, and terminology creates a fragmented landscape for automation in this field.
• Current interpretations of digital forensics automation vary widely, from simple keyword searches to complex autonomous systems.

Purpose of the Study:

• To address the absence of a clear foundation for automation in digital forensics.
• To propose a standardized definition and classification for automation within the discipline.
• To foster a common understanding to promote the advancement of digital forensics automation.

Main Methods:

• A comprehensive review of automation literature from digital forensics and related domains.
• Conducting interviews with three digital forensics practitioners.
• Engaging in discussions with academic domain experts.

Main Results:

• A proposed definition for automation in the context of digital forensics.
• A classification framework distinguishing between no/basic automation and full (autonomous) automation.
• Identification of key considerations for implementing automation in digital forensics.

Conclusions:

• Foundational discussions on definition, classification, and terminology are essential for digital forensics automation.
• A shared understanding is critical for the promotion and progression of the digital forensics discipline.
• Standardizing automation concepts will enable more effective management of digital evidence.