Cyber forensics is a vital branch of cybersecurity that focuses on the identification, collection, analysis, and preservation of digital evidence to investigate cybercrimes. It supports law enforcement and legal proceedings by ensuring the reliability and admissibility of digital evidence. However, existing surveys on forensic tools and techniques are often limited to specific domains such as memory, cloud, or mobile forensics, leaving a gap in comprehensive coverage. This research contributes by presenting an integrated taxonomy of tools and techniques across the end-to-end forensic process, including data recovery, data acquisition, examination and analysis, and evidence preservation. A systematic review of recent literature was conducted using databases such as IEEE Xplore, Scopus, and Web of Science. The selected works were categorized according to the forensic phases, enabling a structured classification of tools and methodologies. The taxonomy not only highlights the capabilities of existing techniques but also identifies their limitations and challenges. The findings further reveal emerging trends such as AI-driven forensic automation, blockchain-based evidence integrity, and forensic readiness for cloud and IoT environments. This study provides researchers, investigators, and practitioners with a comprehensive reference framework, while also outlining future research directions to strengthen digital forensic investigations against evolving cyber threats.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Taxonomy of Tools and Techniques for Cyber Forensic Investigations

  • Baysah Guwor,
  • Sridaran Rajagopal,
  • S. Silvia Priscila

摘要

Cyber forensics is a vital branch of cybersecurity that focuses on the identification, collection, analysis, and preservation of digital evidence to investigate cybercrimes. It supports law enforcement and legal proceedings by ensuring the reliability and admissibility of digital evidence. However, existing surveys on forensic tools and techniques are often limited to specific domains such as memory, cloud, or mobile forensics, leaving a gap in comprehensive coverage. This research contributes by presenting an integrated taxonomy of tools and techniques across the end-to-end forensic process, including data recovery, data acquisition, examination and analysis, and evidence preservation. A systematic review of recent literature was conducted using databases such as IEEE Xplore, Scopus, and Web of Science. The selected works were categorized according to the forensic phases, enabling a structured classification of tools and methodologies. The taxonomy not only highlights the capabilities of existing techniques but also identifies their limitations and challenges. The findings further reveal emerging trends such as AI-driven forensic automation, blockchain-based evidence integrity, and forensic readiness for cloud and IoT environments. This study provides researchers, investigators, and practitioners with a comprehensive reference framework, while also outlining future research directions to strengthen digital forensic investigations against evolving cyber threats.