Ali Abdulalem, Abd Razak Shukor, Othman Siti Hajar, Mohammed Arafat, Saeed Faisal
Faculty of Computing, Universiti Teknologi Malaysia, Skudai,Johor, Malaysia.
Faculty of Engineering and Information Technology, Taiz University, Taiz, Yemen.
PLoS One. 2017 Apr 26;12(4):e0176223. doi: 10.1371/journal.pone.0176223. eCollection 2017.
With the rapid development of technology, mobile phones have become an essential tool in terms of crime fighting and criminal investigation. However, many mobile forensics investigators face difficulties with the investigation process in their domain. These difficulties are due to the heavy reliance of the forensics field on knowledge which, although a valuable resource, is scattered and widely dispersed. The wide dispersion of mobile forensics knowledge not only makes investigation difficult for new investigators, resulting in substantial waste of time, but also leads to ambiguity in the concepts and terminologies of the mobile forensics domain. This paper developed an approach for mobile forensics domain based on metamodeling. The developed approach contributes to identify common concepts of mobile forensics through a development of the Mobile Forensics Metamodel (MFM). In addion, it contributes to simplifying the investigation process and enables investigation teams to capture and reuse specialized forensic knowledge, thereby supporting the training and knowledge management activities. Furthermore, it reduces the difficulty and ambiguity in the mobile forensics domain. A validation process was performed to ensure the completeness and correctness of the MFM. The validation was conducted using two techniques for improvements and adjustments to the metamodel. The last version of the adjusted metamodel was named MFM 1.2.
随着技术的飞速发展，手机已成为打击犯罪和刑事调查的重要工具。然而，许多移动取证调查人员在其领域的调查过程中面临困难。这些困难是由于取证领域严重依赖知识，尽管知识是一种宝贵的资源，但却分散且广泛分布。移动取证知识的广泛分散不仅使新调查人员的调查变得困难，导致大量时间浪费，还导致移动取证领域的概念和术语存在模糊性。本文基于元建模开发了一种用于移动取证领域的方法。所开发的方法通过开发移动取证元模型（MFM）有助于识别移动取证的常见概念。此外，它有助于简化调查过程，并使调查团队能够捕获和重用专门的取证知识，从而支持培训和知识管理活动。此外，它还降低了移动取证领域的难度和模糊性。进行了验证过程以确保MFM的完整性和正确性。使用两种技术对元模型进行改进和调整来进行验证。调整后的元模型的最终版本命名为MFM 1.2。
