8 International Journal of Digital Crime and Forensics, 5(2), 1-22, April-June 2013

such as a forensic computer system, tool or
software. Figure 1 shows the conceptual view
of the proposed approach. Goals are derived
from the forensic process, tools and evidence,
and obstacles are derived from anti-forensic
situations, tools and obstruction of the digital
evidence.
Levels of Abstraction
The proposed goal-driven digital forensics
investigation model supports different levels
of abstraction from goals to obstacles and
finally to forensics actions. Figure 2 gives an
overview of the different levels of abstraction
using exemplary questions that symbolize the
characteristics of the method (Islam, 2011).
We divide the levels of abstraction into three
main areas. These levels build the bridge from
the goals of a forensics investigation to the
obstacles, which obstruct the goals to be satis-
fied, and finally to the actions that oppose the
obstacles in order to achieve the goals. On the
top level, there are the goals, i.e. objectives,
IGI GLOBAL PROOF
Figure 1. Conceptual view of digital forensics investigation using the goal-driven approach
expectations, and constraints for the forensics
investigation, which map to the processes in-
volved within the forensics investigation. The
root goal is refined into sub-goals through AND/
OR refinement links.
In the middle level, obstacles obstruct the
goals of a forensic investigation by destroying,
hiding, manipulating and preventing the creation
of evidence. Obstacles are the different types of
anti-forensics, which confront the availability
and usefulness of the evidence for the foren-
sics investigation. Therefore, for a successful
forensics investigation, we need to address the
obstacles related to anti-forensics; in particular,
it is necessary to completely prevent, or if not
feasible then reduce the effectiveness of the
anti-forensic methods. An identified obstacle
is refined by AND/OR refinements through the
obstruction of crime evidence or the forensic
investigation process.
In the bottom level, forensic actions support
goal fulfillment and obstacle opposition. These
actions operationalize the requirements for the

Copyright © 2013, IGI Global. Copying or distributing in print or electronic forms without written permission of IGI Global is prohibited.