Differentiating the Investigation Response Process of Cyber Security Incident for LEAs

摘要

The number of cybercrime involving digital evidence will continue to increase as Internet become more intertwined in society. As criminals deny committing crime, Law Enforcement Agencies (LEAs) are hindered by the limited processing capabilities of human analysis. This paper presents a practical digital forensics framework of exploring ISO/IEC 27043: 2015 activities to lessen the caseload burden. It provides a suggestion for applying the Helix3 function to meet the need of incident investigation processes at scene or lab. While live investigative response at scene puts emphasis on finding actionable intelligence immediately, dead forensic analysis at lab pays great attention to reconstructing the case and conducting cross-examination to find the truth. Both are critical in the investigation response of cyber security incident.