E-mails have become the standard for business as well as personal communication. The inherent security risks within e-mail communication present the problem of anonymity. If an author of an e-mail is not known, the digital forensic investigator needs to determine the authorship of the e-mail using a process that has not been standardised in the e-mail forensic field. This research project examines many problems associated with e-mail communication and the digital forensic domain; more specifically e-mail forensic investigations, and the recovery of legally admissible evidence to be presented in a court of law. The Research Methodology utilised a comprehensive literature review in combination with Design Science which results in the development of an artifact through intensive research. The Proposed E-Mail Forensic Methodology is based on the most current digital forensic investigation process and further validation of the process was established via expert reviews. The opinions of the digital forensic experts were an integral portion of the validation process which adds to the credibility of the study. This was performed through the aid of the Delphi technique. This Proposed E-Mail Forensic Methodology adopts a standardised investigation process applied to an e-mail investigation and takes into account the South African perspective by incorporating various checks with the laws and legislation. By following the Proposed E-mail Forensic Methodology, e-mail forensic investigators can produce evidence that is legally admissible in a court of law.

University of Macau / Faculty of Science and Technology. / Department of Computer and Information Science

The aim of this research is to investigate how handwriting as an individualisation technique in fraud investigation can be used by police detectives, SARS investigators and forensic investigation specialists, who are responsible for the investigation and linking the perpetrator, with a view to criminal prosecution. A further intent was to share and introduce a number of important concepts, namely: criminal investigation, identification, individualisation, fraud, evidence and handwriting. The research will explain the sophisticated investigation techniques used to obtain sufficient information to prove the true facts in a court of law. Identification is the collective aspect of the set of characteristics by which an object is definitively recognisable or known, while the individual characteristics establish the individuality of a specific object. Many types of evidence may be used to link an individual with a crime scene, and associate that individual with the performed illegal handling. It also explained that during a cheque/document fraud investigation, it is in most cases the only link to information to trace, identify and individualise the perpetrator, and to obtain a handwriting specimen. It is also discussed how to eliminate a person being a writer of a document, and how to collect, package and mark a disputed document during the investigation. If the investigators use their knowledge of these concepts, it should enhance their investigative skills, and empower them to be become better equipped for the challenges they face in identifying, individualising and linking the perpetrators, in order to ensure successful prosecution and conviction. / Police Practice / M.Tech. (Forensic Investigation)

The aim of this research is to investigate how handwriting as an individualisation technique in fraud investigation can be used by police detectives, SARS investigators and forensic investigation specialists, who are responsible for the investigation and linking the perpetrator, with a view to criminal prosecution. A further intent was to share and introduce a number of important concepts, namely: criminal investigation, identification, individualisation, fraud, evidence and handwriting. The research will explain the sophisticated investigation techniques used to obtain sufficient information to prove the true facts in a court of law. Identification is the collective aspect of the set of characteristics by which an object is definitively recognisable or known, while the individual characteristics establish the individuality of a specific object. Many types of evidence may be used to link an individual with a crime scene, and associate that individual with the performed illegal handling. It also explained that during a cheque/document fraud investigation, it is in most cases the only link to information to trace, identify and individualise the perpetrator, and to obtain a handwriting specimen. It is also discussed how to eliminate a person being a writer of a document, and how to collect, package and mark a disputed document during the investigation. If the investigators use their knowledge of these concepts, it should enhance their investigative skills, and empower them to be become better equipped for the challenges they face in identifying, individualising and linking the perpetrators, in order to ensure successful prosecution and conviction. / Police Practice / M.Tech. (Forensic Investigation)