Interview Methodology for a Digital Forensic Examination - Research Proposal Example

Interview methodology for a digital forensic examination Affiliation Introduction Computer crimes are ever increasing, but little seems to been happening, regarding the conviction of the offenders. This aspect results from the process, methodologies, or approaches adopted when conducting digital forensic examination. The methodology applied is usually crucial to investigation outcomes. When a forensic investigator overlooks one method or even interchanges the steps required to carry out the digital forensic examination, incomplete or inconclusive results could be obtained leading to wrong interpretations and meaningless conclusion. This paper presents the development of an interview methodology for a digital forensic examination. It will depict the instructions and definitions for the forensic examiner. Important Phases To develop an effective interview methodology, various phases need to be considered. These phases include: Collection Phase: This phase involves the search for evidence, recognition of evidence, collection of evidence, and documentation of the obtained evidence. Examination: This phase is meant to facilitate the evidence visibility while providing an explanation regarding its origin and significance. The examination phase also involves the revealing of hidden information and the relevant documentation (Kohn, 2012). Analysis: In this case, the product being examined is observed for its significance as well as the probative value to such digital case. Reporting: In this phase, a report is written. The report outlines the examination process as well as the pertinent data that has been recovered from the forensic information (Kohn, 2012). Developing the Forensic Interview Methodology Developing the interview methodology is very critical in a digital forensic investigation. The major steps involved in the development process include preparation for the interview, selecting/determining participants, establishing a pilot test/study, Constructing the research question, following-up the question, implementation of the interviews, and data interpretation (Selamat, 2008). Interview Preparation The first and one of the most important things to do is to initiate a preparation for the digital forensic examination interview. The interview preparation will help in breaking the forensic investigation process in such a way that any problematic circumstances are alleviated or exacerbated. Such problems usually occur after the investigation is fully implemented (Turner, 2010). The forensic examiner should determine the possible problems and establish a way of evading or dealing with them. The preparation should be done in such a way that unambiguous focus is established. This is meant to enhance the feasibility and the associated benefit of the digital forensic examination (Turner, 2010). To ensure an effective interview preparation, the forensic examiner needs to choose the forensic investigation setting. This choice of forensic investigation setting will ensure that the examination is done within a feasible context. The purpose of the forensic interview should also be explained effectively. Further, the confidentiality terms need to be addressed. This requirement is very important because respondents will require guaranteed safety once they provide their contribution especially given the nature of the research; it can easily expose them to personal security/safety threats from the targeted criminals. The duration of the interview should as well be determined (McNamara, 2009). The investigator/examiner need to work under a strict schedule to enhance time effectiveness and resource management. It is also important to offer the interviewees with the consent of reaching the investigator in future if need arises. Before starting, it is advisable to clarify any questions. A way of maintain the interview responses should be prepared instead of relying on the examiner’s memory to recall the interview answers (Creswell, 2007). Participant Selection Forensic examination requires critical decision regarding who to include in the investigation and who exclude. The inclusion criterion is highly sensitive. The importance of interview candidates is thus equally important. The digital forensic examiner needs to utilize an effective sampling strategy, such as critical case sampling or criterion based sampling (McNamara, 2009). This mode of selection would definite ensure the selection of qualified candidate for the digital forensic examination. Only qualified candidates would be able to provide highly credible information to the digital forensic study. It is highly advisable to acquire participants who are willing to share the required information openly and honestly. A forensic examination cannot be effective without such kind of respondents (Kvale, 2007). The respondents should be assured of security, confidentiality, and that the interviews would be conducted within conformable environments where they do not feel uncomfortable or restricted while sharing their information. Pilot testing Pilot testing needs to be done accordingly and effectively in order to assist the forensic investigator to determine the possibility of flaws, any limitations, or any other weakness. The pilot test allows the forensic examiner to make the necessary adjustments prior to the forensic study implementation (Kvale, 2007). The pilot test needs to be conducted using participants who have similar characteristics/qualifications to who would take part in the main interview. The digital forensic examiner should rely on the pilot test to refine the forensic interview questions. Constructing the Forensic Interview Questions The interview would run smoothly and effectively if effective research questions are structured. The research questions are technically the most crucial elements of the digital forensic examination. The kind of questions structured would determine the forensic information to be gathered. The forensic examiner needs to be highly careful because every created question will allow the digging up into the knowledge of the participants about the digital case being investigated (Kvale, 2007). The questions need to be structured in such a way that the maximum digital information being investigated is gathered. To gather the desired forensic information from the respondents, the questions should be open-ended in that the participants should be allowed to choose their preferred terms in answering the questions. Forensic investigation is just another way of carrying out criminal investigation. This means that the participants may hold some sensitive information under strict terms. The questions also need to be neutral to avoid wordings that could influence their answers. The questions need to be asked one by one. They should also be worded clearly (McNamara, 2009). Question Follow-up When contacting the digital forensic examination, the forensic examiner need to be flexible with the research questions that are be constructed. The respondents in the forensic interview are not like to necessarily answer such questions accordingly. Some questions asked in one question may be answered later during another question in the course of the interview (Creswell, 2007). The digital forensic examiner should thus construct the interview questions in such a way that the participants are kept on focus with their respective responses to the interview questions. The digital forensic examiner should also follow-up the interview questions or the prompts. This would ensure that the digital forensic examiner obtains optimal response from the interview participants (Creswell, 2007). Taking a follow-up to the interview questions ensures that cases of getting off the forensic examination topic following any misunderstanding of the interview questions. It is also good to ensure that all respondent will be willing to answer any given question during the interview. Therefore, the interview questions should be reconstructed to make them clearly assembled in a way to reduce any possible misunderstanding. Further follow-up prompts should be erected to enhance understanding. This would ultimately alleviate most of the common problems and assist the digital forensic examiner to extract the required information (Selamat, 2008). Implementation of the Interview The implementation stage is very important for an effective interview methodology for the digital forensic examination. Regarding the implementation of the interview, the digital forensic examiner needs to verify the working condition of the information recording equipment, such as the tape recorder. This should be always done during the interview to ensure that no information goes without being recorded. He or she need to only ask a single question at a time. The examiner should also try to remain neutral by not showing emotional reactions that are strong to the responses. It is always recommended to get involved by showing your response to the respondents, by occasional nods where necessary. It is critical to ensure that the responses are not provided out of fear or the need to please the digital forensic examiner (Kohn, 2012). Clear transitions should be indicated between topics about the digital forensic issue being examined. It is advisable to avoid losing the interview control once respondents get off the topic or take too long to respond. Data Interpretation The final aspect in the development of the interview methodology is the determination of the data interpretation techniques/methods. In this case, the digital forensic examiner is required to make sense out of the uncovered forensic information about the digital issue being examined, including the main themes and codes (Creswell, 2007). The themes/codes entail consistent interview phrases, ideas, or expressions that have been common among the research participants. A third party consultant, who is legally authorized, could be used to review the themes/codes since determining such themes or codes varies significantly among researchers. Verification would enhance quality and accuracy of the results (Creswell, 2007). Conclusion Developing an effective interview methodology for a digital examination generally involves choosing the right kind of interview design, the right process, and feasible data interpretation techniques (Creswell, 2007). Typically, the digital forensic examination is based on recommendations as well as experiences of qualified digital forensic examiners. The interview is typically designed to collect qualitative data about the digital forensic issue to b examined. Since interview is one of the most effective technique for forensic examinations, it the interview methodology should be developed with great contemplation. References Creswell, J. W. (2007). Qualitative inquiry & research design: Choosing among five approaches (2nd ed.). Thousand Oaks,CA: Sage. Kohn, M. D. (2012). Integrated Digital Forensic Process Model. Pretoria: University of Pretoria. Kvale, S. (2007). Doing interviews. Thousand Oaks, CA: Sage. McNamara, C. (2009). General guidelines for conducting interviews. Retrieved from managementhelp.org: http://managementhelp.org/evaluatn/intrview.htm Selamat, Y. S. (2008). Mapping Process of Digital Forensic Investigation Framework. IJCSNS, 8(10). Smith, D. C., & Petreski, S. (2008). A New Approach to Digital Forensic Methodology And !!BUSTED!! . Case studies, 1-48. Turner, D. W. (2010). Qualitative Interview Design: A Practical Guide for Novice Investigators. The Qualitative Report, 15(3) , 754-760. Read More