From the Computer Incident Taxonomy to a Computer Forensic Examination Taxonomy

Abstract

Forensic investigations are usually conducted to solve crimes committed using IT-systems as pertetrator and/or victim. However, depending on the size of IT-system, also non-malicious incidents can be investigated using the same, methodological and proven techniques. Based upon the principles contained in the well-known Computer Incident Taxonomy [1], this paper proposes the establishment a common language for the description of computer forensic examinations, both in malicious and non-malicious incidents. Additionally this taxonomy helps performing a forensic examination in establishing answers to a set of well-definied questions during such an examination. The usefulness of the proposed Forensic Examination Taxonomy is shown using a malicious and a non-malicious example.