National Workshop on Redefining Cyber Forensics

该项目提议主办一次关于重新定义网络取证领域的国家研讨会。网络取证在过去十年中遇到了重大障碍，正处于十字路口。传统的计算机取证虽然仍然有效，但并不完全映射到新兴的子领域，如记忆取证、云取证、社交媒体取证、网络取证和移动取证，因为在许多情况下，如果不进行某种形式的修改，可能无法获得数据。数据和存储的数量、速度和种类也在增加，因此需要更有效的分析方法，同时仍要保护收集的数字证据的真实性和私密性。设备安全和加密也得到了改进，现在，网络取证科学家和从业者必须冒险进行道德黑客攻击，以获取潜在的数字证据，就像备受瞩目的苹果-联邦调查局案件所展示的那样。所有这些挑战都对教育和培训、政策、法律、该领域的本体以及整个社会产生了影响。与此同时，在社交网络分析、心理学、数据科学、逆向工程和隐私领域出现了相关的广泛研究领域，而与网络取证没有太多互动。拟议的带有蓝丝带小组的讲习班将促进就该领域的未来进行必要的思想交流和讨论。它将有助于重新定义网络取证的未来议程，并将传播一份进步的国家报告，为该领域设定议程。

The project proposes hosting a national workshop on redefining the domain of cyber forensics. Cyber forensics has encountered major obstacles over the last decade and is at a crossroads. Traditional computer forensics, although still valid, does not fully map to emerging sub-areas such as memory forensics, cloud forensics, social media forensics, network forensics and mobile forensics, since data in many instances may not be acquired without some form of modification. There is also an increase in the volume, velocity and variety of data and storage necessitating the need for more efficient analysis methods while still preserving the authenticity and privacy of the collected digital evidence. Device security and encryption has also improved and now, cyber forensics scientists and practitioners have to venture into ethical hacking to gain access to potential digital evidence as exhibited in the high profile Apple-FBI case. All these challenges have impacts on education and training, policy, law, the domain's ontology, and society as a whole. In parallel, there have been related extensive research areas emerging in social network analysis, psychology, data science, reverse engineering, and privacy without much interaction with cyber forensics. The proposed workshop with a blue-ribbon panel will stimulate the needed intellectual exchange of ideas and discussions on the future of the domain. It will help redefine the agenda for the future of cyber forensics, and will disseminate a progressive national report, setting the agenda for the field.