A Model for Hybrid Evidence Investigation

Abstract.

With the advent of Information and Communication Technologies, the means of committing a crime and the crime itself are constantly evolved. In addition, the boundaries between traditional crime and cybercrime are vague: a crime may not have a defined traditional or digital form since digital and physical evidence may coexist in a crime scene. Furthermore, various items found in a crime scene may worth be examined as both physical and digital evidence, which we consider as hybrid evidence. In this paper, a model for investigating such crime scenes with hybrid evidence is proposed. Our model unifies the procedures related to digital and physical evidence collection and examination, taking into consideration the unique characteristics of each form of evidence. Our model can also be implemented in cases where only digital or physical evidence exist in a crime scene.

Download: (PDF file)