The Research Of Electronic Evidence Forensics Model

The electronic evidence forensics model is an interdisciplinary research field,and it is the standardization process of electronic obtaining of evidence. Inforeign countries, the study of the electronic evidence forensics model has beenrelatively mature, and many countries have absorbed those reasonable componentsfrom the electronic evidence forensics model when formulating and perfectinglegislative. This has played a very good regulation effect to the electronicsforensics procedures.Until now, there are still few domestic scholars’ studies on electronicevidence forensics model in our country, especially for the construction of thelegal system according to the research is almost a blank.Based on these conditions, this paper tries to put forward an idea of legalrules from a comprehensive electronic evidence forensics model which is suitablefor our country after looking up a lot of dates.The paper includes four chapters. Chapter one clears about the concept andcharacteristic of electronic evidence forensics model, as well as the conceptsrelevant to it; chapter two introduces several major foreign electronic evidenceforensics models and also compares and evaluates those models, this will providea reference for construction of electronic evidence forensics model of our country;Chapter three, and four are the focuses of this paper. They will not only establish asuitable comprehensive electronic evidence forensics model of our country, butalso try to make clear the content of the rule of law under the model are as follows.Chapter one introduces the definition of the electronic evidence forensicsmodel. The electronic evidence forensics model has been defined as “Astandardization process which has been independent of any particular technologyand the organizational environment,and typed generalization and abstraction forthe purpose of scientifically derived and proven methods toward the preservation,collection, validation, identification, analysis, interpretation, documentation,and presentation of digital evidence facilitation or furthering the reconstructionof events found to be criminal, or helping to anticipate unauthorized actions shownto be disruptive to planned operations. The characteristics of the electronicevidence forensics model are reflected in the standardization of independence and guidance.” There are some differences between the electronic evidence forensicsmodel and the electronic evidence forensics procedure, as well as the evidenceforensics investigation.Chapter two presents the overseas investigations on some electronic evidenceforensics models. Overall, the electronic evidence forensics model research hasexperienced from theory foundation to the theory of maturi ty. Main electronicevidence forensics model abroad are: a basic process model, an incident responseprocess model, law enforcement process model, an abstract process model, theintegrated digital investigation model, an extended model of cybercrimeinvestigations, and harmonized digital forensic investigation process model. Theirapplicable scope and the specific contents are different; these differences alsoreflect the advantages and disadvantages of those models.Chapter three introduces the establishment of the electronic evidenceforensics model in our country. This paper will put forward an integratedelectronic evidence forensics model through analyzing the present situation anddeficiencies of research on the electronic evidence forensics model in our country,referring to those main electronic evidence forensics models abroad, Combiningwith the factors such as the idea of law, legislation and judicature in our country.This model has three successive phases: Preparation phase, investigation phaseand subsequent phase, and also must consider building chain of custody. Forensicsinvestigation phase has four links as preservation Thereinto, Preparation phasemainly refers to the preparation of investigators and investigation equipment.According to the different key point of investigation. Investigation phase isdivided into two sub phases: incident investigation phase and forensicsinvestigation stage. Investigation phase only includes a link called detection,evidence collection and perpetuating testimony, inspection and analysis, andpresentation. Subsequent phase are some of the aftermath of forensics work,including two links such as post-processing (return, transfer and return electronicevidence) and information feedback.Chapter four introduces the content of statutory rules under thecomprehensive electronic evidence forensics model, and it specifically discussessome legal questions involved in this paper.