![](bg1.png)
A Formal Model for Forensic Storage Media Preparation Tools
Benjamin Aziz
1
, Philippe Massonet
2
and Christophe Ponsard
2
1
School of Computing, University of Portsmouth, Portsmouth, U.K.
2
Centre dExcellence en Technologies de lInformation et de la Communication (CETIC), Charleroi, Belgium
Keywords:
Computer Forensics, Digital Media Preparation Tools, Event-B Language, Refinement Methodology.
Abstract:
This paper defines a model of a special type of digital forensics tools, known as digital media preparation
forensic tools, using the formal refinement language Event-B. The complexity and criticality of many types of
computer and Cyber crime nowadays combined with improper or incorrect use of digital forensic tools calls
for the evidence produced by such tools to be able to meet the minimum admissibility standards the legal
system requires, in general implying that it must be generated from reliable and robust tools. Despite the fact
that some research and effort has been spent on the validation of digital media preparation forensic tools by
means of testing (e.g. within NIST), the verification of such tools and the formal specification of their expected
behaviour remains largely under-researched. The goal of this work is to provide a formal specification against
which the implementations of such tools can be analysed and tested in the future.
1 INTRODUCTION
Computer forensics tools are becoming increasingly
of a critical nature due to the complexity of attacks on
digital assets and the sophisticated roles that comput-
ers and Cyber systems play in modern day crime. As
a result, there is continuous need in the law enforce-
ment community to ensure the high quality of gen-
erated evidence and acceptable reliability levels for
forensic tools used in digital crime investigations, par-
ticularly when such investigations are global and/or
carry significant importance (Friedberg, 2012). Fur-
thermore, it is important to understand properties of
digital forensic tools, in particular, where correctness,
accuracy and completeness of such tools is vital to the
course of justice and the discovering of facts. This
view is supported by research in recent years in the
area of digital forensics modelling (Carrier and Spaf-
ford, 2004; Ciardhu´ain, 2004; Beebe and Clark, 2005;
Ieong, 2006; Cohen, 2009; Casey and Rose, 2010),
where the need for the development of more robust
and rigorous scientific methods is highlighted in this
area by (Garfinkel et al., 2009).
The term computer forensics tools refers to all
software and hardware tools used in a forensically
sound manner to identify, preserve, recover, analyse
and present facts and opinions about information re-
covered from computers involved in criminal and il-
legal cases. The National Institute of Standards and
Technology (NIST) project on the Computer Foren-
sic Tool Testing (CFTT) (NIST, tgov) aims at raising
the assurance of computer forensic tools by providing
informal definitions of the various computer foren-
sic tools and the requirements underlying such tools.
These requirements are then used for the develop-
ment of functional specifications, test procedures, cri-
teria, sets and hardware. We take this assurance pro-
cess here to another level where the functional spec-
ifications and some of the properties of the computer
forensic tools are formally defined and verified us-
ing the well-established refinement framework of the
Event-B method (Abrial, 2010). According to Casey
(Casey, 2011), such formalisation “encouragesa com-
plete, rigorous investigation,en-sures proper evidence
handling and reduces the chance of mistakes created
by pre-conceived theories, time pressures and other
potential pitfalls.”
This paper presents a specification of one class
of digital forensic tools, known as forensic storage
media preparation tools (NIST, 2009), in Event-B
(Abrial, 2010). The aim behind this specification is
to provide the tool implementations a robust basis in
reasoning about their behaviour and to provide more
formal grounds for future generation of test cases.
More importantly, the significance of such work is
that it provides first steps for a new research direction
exploring the much-needed use of well-established,
industrial-scale formal modelling and analysis frame-
works in the critical field of computer and digital
forensics.
165
Aziz B., Massonet P. and Ponsard C..
A Formal Model for Forensic Storage Media Preparation Tools.
DOI: 10.5220/0004996001650170
In Proceedings of the 11th International Conference on Security and Cryptography (SECRYPT-2014), pages 165-170
ISBN: 978-989-758-045-1
Copyright
c
2014 SCITEPRESS (Science and Technology Publications, Lda.)