“Scaffolding” responses to digital forensic inquiries

Abstract As part of their role, digital forensic practitioners are often faced with case‐specific investigative inquiries which they must attempt to address and provide an appropriate answer to their client. Such investigative questions can take many forms wherein every instance, any response they offer must be reliable. To be reliable, any response to an inquiry must be derived from justifiable and robust processes and information, coined here as the underpinning “scaffolding.” This work offers a discussion of response scaffolding, what it is and why it is required in digital forensics with the three ways that this can be achieved outlined—via “past experience,” “targeted testing” or through reference to appropriate “existing bodies of knowledge.” Each one is examined in turn and their use is demonstrated via an overarching hypothetical example which is deployed and utilized throughout the analysis narrative for illustrative purposes. This article is categorized under: Digital and Multimedia Science > Cybercrime Investigation