Digital provenance - interpretation, verification and corroboration

Authors:
Philip Turner
Affiliations:
QinetiQ, Digital Investigation Services, UK and School of Technology, Oxford Brookes University, Oxford OX33 1HX, UK
Venue:
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Year:
2005

Citing 0
Cited 3

Evidential notions of defensibility and admissibility with property preservation

iNetSec'10 Proceedings of the 2010 IFIP WG 11.4 international conference on Open research problems in network security
Improving evidence acquisition from live network sources

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Selective and intelligent imaging using digital evidence bags

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Quantified Score

Hi-index	0.00

Visualization

Abstract

This paper defines the attributes that are required to provide 'good' provenance. The various sources that may be used to verify the provenance of digital information during the investigation of a Microsoft^(R) Windows^(R) based computer system are presented. This paper shows how provenance can be corroborated by artefacts which indicate how a computer system was connected to the outside world and the capabilities that it provided to a user. Finally consideration is given to a number of commonly used forensic tools and shows how they represent the provenance of information to an investigator.