Digital Forensic Principles

Since time immemorial, crime has had a direct association with human civilization. This association generated a need for proper and thorough investigation, leading to the evolution of various investigation techniques and methodologies and in turn forensic science. The relationship of forensic science with law and pure science is very clear and they influence each other. Traditional forensic science uses pure science to answer questions pertaining to investigation in an admissible manner primarily using physicochemical and biological characteristics. The properties (physicochemical and biological) of entities (matter) change as a result of an incidence (events/ actions). This fundamental framework of entities and events along with their ever-changing physicochemical and biological properties (states) strongly influences the forensic principles, investigation process models, guidelines, standards, best practices and administrative/ legal requirements of forensic knowledge. The change to an entity due to any incidence leads to the transition of the entire system to a new state where the physicochemical and biological characteristics of entities (some/ all) gets transformed. The quantification of these state transformations before and after the crime results into potential evidences leading to reconstruction of the sequence of events of the incident. In today‟s world, digital realm is proving a ripe and ready stomping ground for crooks of all kinds and the evidence against them that may be used in a court of law, now mostly comes in digital format. Unlike other conventional forensic science branches (physical, chemical and biological), which have admissible and well defined principles, guidelines and methodologies, the digital forensics science is still evolving. As a result of this ongoing evolution, the IT Laws still treat digital forensic evidence as only corroborative evidence; so evaluating and enhancing forensics principles and forensic knowledge will help digital forensic science to acquire its rightful status in the eyes of the Court of Law. In this research work, we evaluated the established traditional forensic knowledge and principles in digital realm. These famous principles of traditional forensic science have yet to be evaluated in the realm of digital forensics. This evaluation leads to the evolution of new constraints and enhancement of existing traditional forensic science principles. This will help in the development of investigative framework and model for tackling computer frauds and cyber crimes by standardizing the digital evidences to be presented in the court of Law. It will also help in evidence dynamics and reconstruction of sequence of events (time-lining digital evidence) by realizing the properties of Individuality, Repeatability, Reliability, Performance, Testability, Scalability, Quality and Standards in analysis of computer frauds and cyber crimes. The evaluated and enhanced principle and knowledge will help in developing new solutions for unsolved problems and in scaling existing solutions to tackle rapid change of digital technology. The enhanced principles encompass the traditional crimes as well as the computer fraud and cyber crime (CFCC).

TRANSFORMABILITY PRINCIPLE
The division of matter due to forces of various kinds is a fundamental event of nature. In material world, force or action can produce deformations other than division. In the digital world, in most cases, there is no division or deformation of matter, but there may be complete or partial division or copying of information in the form of content and traits. Thus, due to some action, transformation(s) of information or shape, size, volume or appearance of entities takes place in both the physical and digital world. This transformation serves the same purpose as the divisibility of matter does in traditional world. This transformed information or trait becomes evidence by the virtue of its connection with criminal act. The Transformability principle can thus be derived from the Divisibility principle as follows:

“An entity gets transformed into one or more components due to specific actions. The components will acquire the properties traceable to the properties of the original entity or the process of transformation or both”.
 
GENERALIZED EXCHANGE PRINCIPLE
In the material world, every contact and the consequent interplay of forces between the contacting objects result in the exchange of matter or trait. Even in some cases involving digital objects, the above phenomenon takes place. But CFCC constitutes of more generic type of exchanges and transfer, viz., exchange or transfer of information or digital traits. Not only that, the exchange or transfer in many cases involve transfer of even whole object or a large part of the object, instead of only a trace. Thus a generalized restatement of Locard‟s Exchange principle is

“Action involving an entity will result in the exchange of information or matter between the components or properties of the entity and the environment”.

This generalized exchange principle covers both conventional as well as digital realm. The transfer in the Generalized Exchange principle relies not only on physicochemical and biological transfer but it also includes transfer of information.