Abstract Digital Forensic Model

Abstract Digital forensic model which is abbreviated as ADFM is a tool for digital forensic investigation. This model provides a clear and structured and structured way to proceed with particular evidence. It contains 9 phases which are Identification, Preservation, Collection, Examination, Analysis, Reconstruction, Documentation, Presentation, and Returning Evidence. Because of these phases, investigators can increase the likelihood of successfully identifying and prosecuting crimes.

Pre-requisites: Introduction to Computer Forensics

Phases of Abstract Digital Forensic Model 

1. Identification– In this phase Identification of evidence takes place. Here evidence can be a computer, server, mobile, cloud service, etc.
2. Preservation– Maintenance of integrity and security of evidence is performed in this phase.
3. Collection– Recording the evidence and making a duplicate copy of the main evidence.
4. Examination– Identification of relevant information and finding more related hints from this information.
5. Analysis– Linking of data and recovering and identifying the damaged and deleted files.
6. Reconstruction– In this phase, a model of the evidence or a situation when the evidence was found is constructed.
7. Documentation– The result or the information found from the above phases is combined together in a form of a document which helps in legal proceedings.
8. Presentation– The investigator plays the role of a presenter and provides graphs, reports, and visual aids for the further investigation process.
9. Returning evidence– After a complete examination, the evidence which is used for investigation is returned to the original owner of the evidence.
   

Drawbacks of ADFM

• It is not flexible enough to modify it according to the situation.
• The result produced from the model is difficult to understand. 
• It has a very limited scope.
• It is dependent on technology, if technology fails model may not be able to complete tasks.
• Difficult to maintain and ensure the consistency of investigation as it lacks standardizations.