A defensible role-based case management system for remote forensic investigation

The COVID-19 scenario has necessitated various activities to be performed remotely. All kinds of businesses are in resuming mode and they are restarting their jobs in new perspectives all around the world. Corporate and internal investigations also have been impacted because of the lockdown imposed on businesses. Organizations are now increasingly considering remote forensic investigation on the target environment. A novel defensible, role-based case management system is presented in this paper for efficient remote forensic investigation. The proposed method facilitates the remote forensic acquisition of volatile data without making accidental changes. By the use of high-speed networks, the process of acquisition of evidence can be achieved with durability. The system enables evidence collection, preservation and analysis to be performed with minimal disruption to regular operations. The paper presents experimental observation and evaluation of results on remote routing to devices for volatile data collection, providing additional insights to devices, preserving data in the cloud. The system proceeds with virtual machine snapshots based crime scene recreation for cloud forensic investigation of evidence. The proposed system is also compared against the state-of-art techniques for proving its defensible, role-based case management efficiency.