Evidence Traceable Capability Alignment of Digital Forensic Frameworks for Data Breach Investigation

Alih R Hamda; Bisyron Wahyudi

doi:10.63922/ijeter.v4i03.5710

Alih R Hamda Cyber Defense Engineering, Faculty of Defense Engineering and Technology, Indonesian Defense University, Bogor, Indonesia
Bisyron Wahyudi Lecturer in Cyber Defense Engineering, Faculty of Defense Engineering and Technology, Indonesian Defense University, Bogor, Indonesia

DOI: https://doi.org/10.63922/ijeter.v4i03.5710

Keywords: digital forensics, data breach, capability alignment, framework selection, incident response

Abstract

Digital forensic frameworks vary in scope, procedural depth, evidence organization, and incident specificity, making framework selection difficult for data-breach investigations. This study develops an Evidence-Traceable Capability Alignment Index (ET-CAI) and applies it to five framework archetypes: IDFPM, SRDFIM, CFFTPM, D4I, and KARAFFE. Reproducible discovery used seven Scopus Advanced Search blocks. F1 returned 160 records, F2 returned 84, and the five named-verification searches returned nine. After six duplicate records were removed, 247 unique publications remained. Rule-based title-abstract mapping identified 134 records without a framework/process-model title signal, 49 without explicit proposal language, and 64 candidate publications requiring manual or primary-source verification. A purposive maximum-variation sample was then selected to represent integrated process, systematic investigation, field triage, artifact-centered reconstruction, and data-breach-specific designs. Six binary capabilities were scored using traceable evidence and exact locators where available. KARAFFE achieved 100% documented alignment, D4I 50.0%, SRDFIM and CFFTPM 33.3%, and IDFPM 16.7%. Sensitivity tests preserved the ordering. The 100% score denotes alignment with the selected documented capabilities, not perfect operational effectiveness, legal admissibility, or organizational readiness.

References

Agarwal, A., Gupta, M., Gupta, S., & Gupta, S. C. (2011). Systematic digital forensic investigation model. International Journal of Computer Science and Security, 5(1), 118-131.
Ariffin, K. A. Z., & Ahmad, F. H. (2021). Indicators for maturity and readiness for digital forensic investigation in the era of Industrial Revolution 4.0. Computers & Security, 105, 102237. https://doi.org/10.1016/j.cose.2021.102237
Bankole, F. O., Taiwo, A. A., & Claims, I. P. (2022). An extended digital forensic readiness and maturity model. Forensic Science International: Digital Investigation, 40, 301348. https://doi.org/10.1016/j.fsidi.2022.301348
Breitinger, F., Hilgert, J.-N., Hargreaves, C., Sheppard, J., Overdorf, R., & Scanlon, M. (2024). DFRWS EU 10-year review and future directions in digital forensic research. Forensic Science International: Digital Investigation, 48, 301685. https://doi.org/10.1016/j.fsidi.2023.301685
Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet (3rd ed.). Academic Press.
Casino, F., Dasaklis, T. K., Spathoulas, G., Anagnostopoulos, M., Ghosal, A., Borocz, I., Solanas, A., Conti, M., & Patsakis, C. (2022). Research trends, challenges, and emerging topics in digital forensics: A review of reviews. IEEE Access, 10, 25464-25493. https://doi.org/10.1109/ACCESS.2022.3154059
Dimitriadis, A., Ivezic, N., Kulvatunyou, B., & Mavridis, I. (2020). D4I - Digital forensics framework for reviewing and investigating cyber attacks. Array, 5, 100015. https://doi.org/10.1016/j.array.2019.100015
Hakim, A. R. (2025). Pengembangan kerangka kerja forensik digital dan metode baru berbasis machine learning untuk investigasi insiden kebocoran data [Doctoral dissertation, Universitas Indonesia].
Hakim, A. R., Ramli, K., Gunawan, T. S., & Windarta, S. (2023). A novel digital forensic framework for data breach investigation. IEEE Access, 11, 42644-42659. https://doi.org/10.1109/ACCESS.2023.3270619
Horsman, G., & Sunde, N. (2022). Unboxing the digital forensic investigation process. Science & Justice, 62(2), 171-180. https://doi.org/10.1016/j.scijus.2022.01.002
International Organization for Standardization. (2012). ISO/IEC 27037:2012: Guidelines for identification, collection, acquisition and preservation of digital evidence. ISO.
Kent, K., Chevalier, S., Grance, T., & Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST Special Publication 800-86). National Institute of Standards and Technology.
Kohn, M. D., Eloff, M. M., & Eloff, J. H. P. (2013). Integrated digital forensic process model. Computers & Security, 38, 103-115. https://doi.org/10.1016/j.cose.2013.05.001
Krippendorff, K. (2018). Content analysis: An introduction to its methodology (4th ed.). SAGE Publications.
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29). https://doi.org/10.6028/NIST.CSWP.29
Reddy, K., & Venter, H. S. (2013). The architecture of a digital forensic readiness management system. Computers & Security, 32, 73-89. https://doi.org/10.1016/j.cose.2012.09.008
Rogers, M. K., Goldman, J., Mislan, R., Wedge, T., & Debrota, S. (2006). Computer forensics field triage process model. Journal of Digital Forensics, Security and Law, 1(2), 19-38. https://doi.org/10.15394/jdfsl.2006.1004