Extension and Evaluation of Guideline Total Support System for Digital Forensics

The recent rise in disputes relating to electromagnetic computer records has prompted the demand for digital forensic tools that can be used to preserve, investigate, and analyze digital evidence. Among the currently available digital forensic publications are the Guidelines for Preservation of Evidence published by the Institute of Digital Forensics, a non-profit organization. However, in the field of digital evidence preservation, speed and accuracy are fundamental requirements. Under such circumstances, working with guidelines in paper media form is difficult for investigators. Therefore, we have developed an application program that supports evidence preservation work by displaying contents based on the Guidelines for Preservation of Evidence on the Android operating system. The system consists of three components: the first is the creation of contents for display on an Android terminal from the paper guidelines, the second is a guideline execution section for first responders, and third is a function that allows the system to generate an output report based on the first two components. In this paper, the authors report on improvements to the first and second components, and the development of the third. Additionally, after applying the complete system to a small trial scenario based on an actual incident, an evaluation of the utility and effectiveness of the system was conducted.