A Framework for Examining the Human Side of Anti-Forensic Measures

摘要

The need for forensic computing and the legitimacy of anti-forensic computing have been examined in literature. However, the majority of existing research in forensic and anti-forensic computer is primarily based around the technology and processes for or against gathering as well as presenting evidence. In this work, we examine the topic through a different lens by exploring the dilemma of why users employ anti-forensic technology in the first place. Our work provides an early conceptual framework based on the theory of reasoned action and the theory of planned behavior to assist researchers and practitioners to understand why computing users employ anti-forensic tools and techniques. If organizations can determine the reasons forensic counter measures are applied, then improved policies and procedures can be put in place to address the computing users' concerns while retaining the ability to enact forensic measures when a violation of policy or illegal activity occurs.