M-health digital evidence taxonomy system (MDETS): Enabling digital forensics readiness with knowledge sharing approach

Enabling a forensically ready environment in an organization may include sharing the knowledge of digital forensics tools, procedures, and guidelines between practitioners. This paper presents a M-health Digital Evidence Taxonomy System (MDETS) as a proof of concept that facilitates the forensic readiness in terms of people, process and technology through knowledge sharing approach. Using mobile health (m-health) applications as a case study, MDETS comprises a knowledge warehouse of forensic artefacts from 34 m-health apps. We adopted four knowledge sharing criteria that are articulation, awareness, access, and guidelines. The effectiveness of MDETS was evaluated using people, process, and technology elements. Interviews were conducted with 7 digital forensics practitioners in Malaysia to examine respondents’ perception about the effectiveness of integrating the digital evidence taxonomy with knowledge sharing approach. Interview findings indicated that sharing the knowledge of digital evidence taxonomy is significantly enables the digital forensics readiness practices from people, process, and technology elements. Furthermore, the use of MDETS could beneficial to provide trainings for new digital forensics investigators.