CDBFIP: Common Database Forensic Investigation Processes for Internet of Things
Arafat Al-Dhaqm, Shukor Bin Abd Razak, Siti Hajar Othman, Kim‐Kwang Raymond Choo, William Bradley Glisson, Abdulalem Ali, Mohammad Yasir Bin Taleb Abrar · IEEE Access · 2017
Database forensics is a domain that uses database content and metadata to reveal malicious activities on database systems in an Internet of Things environment. Although the concept of database forensics has been around for a while, the investigation of cybercrime activities and cyber breaches in an Internet of Things environment would benefit from the development of a common investigative standard that unifies the knowledge in the domain. Therefore, this paper proposes common database forensic investigation processes using a design science research approach. The proposed process comprises four phases, namely: 1) identification; 2) artefact collection; 3) artefact analysis; and 4) the documentation and presentation process. It allows the reconciliation of the concepts and terminologies of all common database forensic investigation processes; hence, it facilitates the sharing of knowledge on database forensic investigation among domain newcomers, users, and practitioners.