Forensic computing dissertation MSc help !

To cut the story short I am thinking of doing a dissertation that involves coming up with new forensic analysis and evidence handling guidelines that can be applied and used as universal.

Do you believe that's a feasible goal? Can you think of any reasons which might make that problematic?

Are there any universal guidelines at the moment? If not, why not?

To cut the story short I am thinking of doing a dissertation that involves coming up with new forensic analysis and evidence handling guidelines that can be applied and used as universal.

Do you believe that's a feasible goal? Can you think of any reasons which might make that problematic?

Are there any universal guidelines at the moment? If not, why not?

Maybe narrow your question (by the way, what is your question) to one or (at most) 2 specific issues with regard to current procedures. With research, its always important to get to the basics…what do you want to know?

I believe it may be a feasible goal because isnt it true every country has their own guidelines like for e.g. the uk has the ACPO guidelines and on the US i found this http//csrc.nist.gov/publications/nistpubs/800-86/SP800-86.pdf. They are many others like hong kong is another example which can be seen here http//www.isfs.org.hk/manual.html.

The point that I am trying to make is every evidence collection and handling is little or majorily different (right?). So the question i am asking is that why cant there be a universal guideline that can be followed by all forensic investigator instead of complying to a set standard.

is that better put?

Okay, so your forensic methodology won't be so much "universal", as LE-specific?

When I was studying my minor in software engineering, one of the major take away points was that you don't reinvent the wheel if you can possibly avoid it. I think you should start your research with Jamie's second point, which is to see what current standards exist, and then see whether you think you are in a position to improve upon those standards with your current level of skill and experience in forensics.

Then going further than that, with the constant state of flux of information technology, how long will those standards be applicable? When I started, the standard was "if the computer is on, pull the plug", but with the increased availability of encryption, changes in how Windows handles swap space at shut down, along with improved memory forensics techniques, that rule is archaic.

There are certain standards which are universal, such as chain of custody handling rules, and general concepts about preservation and reproducibility, but my experience has been that the more I tried to standardise my examinations, the more I had to annotate an exception to those standards in my notes. I feel sorry for anyone working under an ASCLAB or ISO scheme because they'd be constantly filing exception reports or redeveloping their standards.

Sorry if I come off a bit harsh, but I've had to deal with academics trying to proscribe standards to our profession with little or no practical experience, such that they didn't even understand why experienced practitioners might discard some of their suggestions immediately.

I understand your point patrick4n6. But this is a requirement for my dissertation I have to either build an software product (I havent touched java in years and thats the only major one i know), come up with a framework or guideline.

Having this idea in mind is why I thought I could maybe create a more meaningful guideline. But now Im thinking where it would be a good idea after all.

I believe it may be a feasible goal because isnt it true every country has their own guidelines like for e.g. the uk has the ACPO guidelines and on the US i found this http//csrc.nist.gov/publications/nistpubs/800-86/SP800-86.pdf. They are many others like hong kong is another example which can be seen here http//www.isfs.org.hk/manual.html.

Isn't that an argument against it being feasible (if you assume that had it been feasible it would have been implemented by now)?

The point that I am trying to make is every evidence collection and handling is little or majorily different (right?). So the question i am asking is that why cant there be a universal guideline that can be followed by all forensic investigator instead of complying to a set standard.

I think that's the right question to be asking - and I'm assuming that if you're at the dissertation stage of an MSc you can probably already answer it yourself.

To be less opaque for one moment, and hopefully more helpful, a universal set of guidelines which all investigators can adhere to is a tough ask (putting it mildly) for various reasons. The alternative is a looser framework which tries to avoid some of those problems but the question then becomes how much practical use is it?

I actually think the latter does have some value - and as a project it would be a good learning experience - but I'd suggest the key point for you is to be very careful how you word your dissertation's title if you stick with this idea.

* now im thinking whether *

My experience is that research questions usually start out somewhat broad (like this) then tend to refine themselves as one figures out that there were some assumptions made that are not empirically supported. This is not a bad thing…it is the research process. Also, this is not a bad direction, you are just at the beginning and haven't refined your ideas. A review of the existing literature in this area would be a good start. Then, you know what has been done, and what is missing. Fortunately (or not), this area is still very much in its infancy and you shouldn't have problems identifying what has/not been done.

Maybe start with a review of an area on interest (including what you have previously identified), review what's out there and let the questions that you have be your guide.