Evidence Collection and Handling Process Model in Mobile Forensic for Malaysian Law Enforcement Agencies

Abstract

The rapid adoption of mobile technology has revolutionized criminal investigations, with mobile devices becoming crucial sources of evidence. The current state of mobile forensics faces challenges from a growing backlog of devices to be analyzed. There have been many initiatives to improve the state of mobile digital forensics. However, most initiatives have focused on relieving the digital forensic analyst on pre-analysis tasks such as triage, extraction workflow and management of cases and evidence. There is still a bottleneck at the actual analysis stage that hampers swift legal resolution. The research objectives include identifying current challenges in mobile forensics, developing an alternative process mobile forensic process model, and evaluating the feasibility of the proposed model. The methodology used in this research is Design Science Research (DSR) as it seeks to enhance knowledge in technology and science through problem-solving and innovative solutions to real-world problems. Through this study, an alternative mobile forensics process model was developed involving a central pseudo air-gapped digital forensics extraction lab with analysis hubs in different locations connected over private networks. The model is validated through surveys with domain experts to offer promising efficiency improvements and feasiblity albeit with potential technical, operational, and security challenges. The significance of this research lies in enriching the knowledge base of digital forensics professionals and legal experts, offering valuable insights for real-world implementation to enhance the efficiency and timelines of mobile forensic analysis, and ultimately contributing to a more just legal system.