Model Derivation System to Manage Database Forensic Investigation Domain Knowledge

Many specific database forensic investigation models have been proposed in the literature to solve database incidents, but these models have various redundant investigation processes, concepts, activities, and tasks which make database forensic investigation domain unstructured, heterogeneous, and complex among domain practitioners. Recent works on database forensic investigation domain are motivated due to the successes of combining shared metadata in one platform called metamodel to facilitate in managing, sharing, and reusing the shared metadata (knowledge) in different database scenarios. In this paper, a novel model derivation system called Model Driven Database Forensic Investigation System (MDDBFIS) was proposed to work with existing database forensic investigation metamodel to facilitate in managing the domain knowledge amongst domain practitioners. The Design Science Research Methodology (DSRM) has been adapted to design and develop the MDDBFIS. The effectiveness of the MDDBFIS was demonstrated in deriving a solution model from database forensic investigation metamodel to solve a real case study and the results were evaluated by fully digital forensic experts at CyberSecurity Malaysia.