Decision Support Tools for Cyber Crime Investigations

Computer forensics is evolving and is still in its infancy when compared to other fields in the world of information technology. Software tools for computer forensics have been developed to automate the manual evidence discovery and capture procedures currently used by investigators. The problem is that these tools only work when "probable cause" has been shown and a search and seizure warrant obtained. Investigators must rely on what is reported to them by victims or bystanders that a possible crime has been committed. Investigators depend on their own experience or that of their peers to determine if a crime has been committed, whose jurisdiction it falls under, and if there is sufficient information to proceed with an investigation. This work describes a decision support methodology that may determine if there is sufficient probable cause. This framework would allow the sharing of information about a crime that was committed amongst investigators from various law enforcement agencies and industry, prosecutors and other litigators, and analysts to track digital evidence of crimes or, through trend analysis, identify when investigative resources need to be reallocated.