Building Open and Scalable Digital Forensic Tools

Abstract

We define a digital forensic investigative process as scalable if it can keep the average time per investigation constant in the face of growing target sizes and diversity. In technical terms, we consider scalability in terms of speed, cost, extensibility, and user interface abstractions. We argue that both commercial and open source products are showing a growing disconnect with actual scalability needs of digital forensic practice. In our view, the current technical approaches need to be rethought from the ground up. We put forward the idea that a new generation of technologies developed for the Internet should be adapted as the architectural basis for developing the new generation of open and scalable forensic tools.