A Forensic Evidence Acquisition Model for Data Leakage Attacks

Data leakage attack is a serious threat to daily business operations. Reconstructing scenes after attacks is critical because the reconstructed scenarios help security analysts to understand these attacks and prevent future incidents. In this paper, we have proposed a systematic approach to reconstruct attack scenes based on a forensic evidence acquisition model. We first build the model, i.e., data leakage-evidence tree, from which digital forensic examiners can collect forensic evidence, then we formalize the tree and evaluate the semantics of the tree based on the evidence found on digital devices and their supporting environments. Finally, we reconstruct the data leakage scenarios based on the semantics of the tree. Our empirical study reconstructs a data breach scenario using a real-world example.