A comprehensive survey and analysis on multi-domain digital forensic tools, techniques and issues

Abstract

Forensics is a term that both the physical and digital worlds can use. In the physical world, forensics can be related to physical science investigations, such as DNA examinations and bloodstains. Conversely, the digital world consists of the seizure, analysis, and safeguarding of digital evidence that can be obtained from physical or virtual storage devices. Forensic investigators retrieve and analyze data using investigative utilities that cover various features and capabilities. However, these applications still require high reliability and accuracy. Given the plethora of tools available to researchers, this survey conducts an extensive assessment of forensic domains, addressing the complex issues and tools pertinent to each domain. Furthermore, this survey presents a comparative analysis of forensic tools, providing a balanced evaluation by considering the features of the tools, alongside their product, performance, and functional metrics. The evaluated tools were ranked using the weighted means of the tool features, specifically focusing on reliability, scalability, and accuracy. These benchmarked results, combined with a description of lingering issues in digital forensics, will direct future research and assist investigators and researchers to choose the most appropriate forensic tool.