Storage and exchange formats for digital evidence

Digital evidence is becoming increasingly important in a wide variety of criminal investigations. The formats used to store and exchange evidence can have a large impact on both the trustworthiness of evidence and the efficiency of the tools processing the evidence. Many digital evidence formats exist today, and it is important to evaluate the suitability of these formats based on their technical capabilities. We perform a comparative evaluation of the suitability of different formats by evaluating them against a set of evaluation criteria. Further, we discuss research based storage and exchange formats that aim to improve the representation, processing, and presentation of the evidence. These formats are key initiatives in developing new and more intelligent forensic analysis tools that take advantage of cloud computing and service oriented systems. (C) 2011 Elsevier Ltd. All rights reserved.