Minimal research has been conducted regarding the connection between white collar crime, cybercrime and the effectiveness of digital forensic tools that can assist in combating this new type of crime. The aim of this study is to understand and examine the role that digital forensic tools play during the investigation of white-collar cybercrimes and to evaluate how effective these tools are when implemented in white-collar cybercrime investigations. By conducting in-depth interviews and using a Rational choice theory driven thematic analysis, the findings of this research have revealed how important adaptability of digital forensic tools is to the emerging cybercrime techniques, together with their integration of existing systems, and the adherence to legal and ethical standards. The findings also noted the challenges that are faced by digital investigators when implementing these digital forensic tools in white-collar crimes investigations and the importance of using updated digital forensic tools and skill developed cybersecurity experts to enhance the outcome of investigations. This study concludes by discussing that it is important for digital forensic tools to be continuously updated and skillfully utilized in the investigation of white-collar cybercrimes and that the significant challenges must be addressed for accurate and more reliable investigative outcomes. Various evaluation methodologies should also be developed as different variations of methodological approaches can improve the standards of research and thus provide frameworks that are more reliable for digital forensic studies and white-collar cybercrime investigations.

This study presents challenges and opportunities in Incident Response as a part of Digital Forensic Readiness. For this study, the authors adopted a qualitative approach to identify and analyse challenges and opportunities for companies in Incident Response, specifically from the perspective of cybersecurity consultants in the Swedish market. Semi-structured interviews were conducted to collect data, and thematic coding was performed to analyse the data from interviews. Identifying and analysing these challenges and opportunities can provide valuable insights for cybersecurity practitioners, policymakers, and the academic community. The result of this study is that companies face challenges regarding Incident Response due to a lack of processes and in-house knowledge. The challenges may vary depending on the size of the company. Opportunities for companies with a successful Incident Response capability showed higher trust from customers, vendors, and partners, as well as brand trust due to the competitive nature of IT. Some of the important key factors contributing to successful Incident Response capability were well-established processes and staff training.

The problem encountered by the researcher was that the South African Police Service Cyber-Crimes Unit is experiencing problems in seizing computer evidence. The following problems were identified by the researcher in practice: evidence is destroyed or lost because of mishandling by investigators; computer evidence is often not obtained or recognised, due to a lack of knowledge and skills on the part of investigators to properly seize computer evidence; difficulties to establish authenticity and initiate a chain of custody for the seized evidence; current training that is offered is unable to cover critical steps in the performance of seizing computer evidence; computer seizure as a technique requires specialised knowledge and continuous training, because the information technology industry is an ever-changing area. An empirical research design, followed by a qualitative research approach, allowed the researcher to also obtain information from practice. A thorough literature study, complemented by interviews, was done to collect the required data for the research. Members of the South African Police Cyber-crime Unit and prosecutors dealing with cyber-crime cases were interviewed to obtain their input into, and experiences on, the topic. The aim of the study was to explore the role of computers in the forensic investigation process, and to determine how computers can be seized without compromising evidence. The study therefore also aimed at creating an understanding and awareness about the slippery nature of computer evidence, and how it can find its way to the court of law without being compromised. The research has revealed that computer crime is different from common law or traditional crimes. It is complicated, and therefore only skilled and qualified forensic experts should be used to seize computer evidence, to ensure that the evidence is not compromised. Training of cyber-crime technicians has to be priority, in order to be successful in seizing computers. / Department of Criminology / M.Tech. (Forensic Investigation)

There is a growing global recognition as to the importance of outlawing malicious computer related acts in a timely manner, yet few organisations have the legal and technical resources necessary to address the complexities of adapting criminal statutes to cyberspace. Literature reviewed in this study suggests that a coordinated, public-private partnership to produce a model approach can help reduce potential dangers arising from the inadvertent creation of cybercrime havens. It is against this backdrop that the study seeks to develop a digital forensic readiness model (DFRM) using a coordinated, multidisciplinary approach, involving both the public and private sectors, thus enabling organisations to reduce potential dangers arising from the inadvertent destruction and negating of evidentiary data which, in turn, results in the non-prosecution of digital crimes. The thesis makes use of 10 hypotheses to address the five research objectives, which are aimed at investigating the problem statement. This study constitutes qualitative research and adopts the post-modernist approach. The study begins by investigating each of the 10 hypotheses, utilising a systematic literature review and interviews, followed by a triangulation of findings in order to identify and explore common themes and strengthen grounded theory results. The output from the latter process is used as a theoretical foundation towards the development of a DFRM model which is then validated and verified against actual case law. Findings show that a multidisciplinary approach to digital forensic readiness can aid in preserving the integrity of evidentiary data within an organisation. The study identifies three key domains and their critical components. The research then demonstrates how the interdependencies between the domains and their respective components can enable organisations to identify and manage vulnerabilities which may contribute to the inadvertent destruction and negating of evidentiary data. The Multidisciplinary Digital Forensic Readiness Model (M-DiFoRe) provides a proactive approach to creating and improving organizational digital forensic readiness. This study contributes to the greater body of knowledge in digital forensics in that it reduces complexities associated with achieving digital forensic readiness and streamlines the handling of digital evidence within an organisation. / Information Science / Ph.D. (Information Systems)

A preocupação com a identificação, que é o processo pelo qual se determina a identidade, é bastante antiga. Atualmente, as relações sociais ou exigências civis, penais, administrativas e comerciais necessitam de sua comprovação. A identificação de pessoas mortas é fundamental, não somente para aplacar as necessidades emocionais de seus amigos e familiares, como também para que providências legais relativas ao óbito possam ser tomadas. Infelizmente, amiúde ocorrem situações em que corpos chegam aos Institutos Médico-Legais em estado de putrefação ou esqueletização, e não são identificados. Em tais situações, análises antropométricas para estimar, por exemplo, idade, gênero e estatura, são de grande valia. Nestes casos, a reconstrução facial forense será muito importante, pois pode possibilitar o reconhecimento e, por conseguinte, aumentar consideravelmente as chances de identificação. A reconstrução facial forense tridimensional pode ser manual ou digital. A reconstrução facial forense digital tornou-se possível com o advento da Tecnologia da Informação, imaginologia médica e novos softwares de imagem 3D e de reconstrução. Para a realização da reconstrução facial, são necessários dados relativos à espessura dos tecidos moles da face. Não há na literatura registros de trabalhos de reconstrução facial digital realizados com dados de tecidos moles obtidos a partir de amostras constituídas por sujeitos brasileiros. Há duas tabelas de espessura de tecidos moles publicadas para a população brasileira: uma obtida a partir de medidas realizadas em cadáveres frescos (padrão cadáveres frescos), e outra a partir de medidas em exames de ressonância magnética (padrão ressonância magnética). O objetivo do presente trabalho foi realizar três diferentes reconstruções faciais forenses digitais caracterizadas (com cabelo, cílios e sobrancelha) de um sujeito brasileiro (realizadas a partir de um padrão internacional e dois padrões nacionais de espessura de tecidos moles da face), e avaliar as reconstruções faciais forenses digitais comparando-as com fotografias do próprio indivíduo e de outros nove sujeitos. Para isso, foram utilizadas imagens DICOM de uma Tomografia Computadorizada (TC) cedidas por um voluntário que, uma vez convertidas, foram utilizadas para a efetivação das reconstruções faciais digitais. Uma vez realizadas as três reconstruções, as mesmas foram comparadas com fotografias do voluntário que teve a sua face reconstruída e outros nove sujeitos. Trinta examinadores participaram desta tentativa de reconhecimento. O sujeito-alvo, que teve a sua face reconstruída, foi reconhecido por 26,67% dos examinadores na reconstrução realizada com o Padrão nacional de Ressonância Magnética, 23,33% na reconstrução realizada com o Padrão nacional de Cadáveres Frescos e 20,00% na reconstrução realizada com o Padrão Internacional, tendo sido o sujeito mais reconhecido nos dois primeiros padrões. Os reconhecimentos acertados do sujeito-alvo indicam que a reconstrução facial forense digital, realizada com parâmetros empregados neste trabalho, pode ser ferramenta útil para, havendo um ou vários sujeitos reconhecidos, chegar-se a uma identificação positiva. / The concern with the identification, that is the process by which the identity is determined, is quite old. Currently, the social relations or civil, criminal, administrative and commercial requirements need its evidence. The identification of deceased persons is essential not only to assuage the emotional needs of their friends and family, but also to allow legal actions related to death. Unfortunately, situations often occur when bodies arrive at the Medico-Legal Institutes in a state of putrefaction or skeletonization, and are not identified. In such situations, anthropometric analysis to estimate, for example, age, gender and height, are of great value. In these cases, forensic facial reconstruction is very important because it may serve to recognize and therefore increase the chances of identification. The three-dimensional forensic facial reconstruction can be manual or digital. The digital forensic facial reconstruction was made possible with the advent of Information Technology, medical imaging and new 3D image and reconstruction softwares. To perform facial reconstruction, data on the thickness of the soft tissues of the face are necessary. There is no literature records of facial reconstruction works carried out with digital data of soft tissues obtained from samples of Brazilian subjects. There are two tables of thickness of soft tissue published for the Brazilian population: one obtained from measurements performed in fresh cadavers (fresh cadavers pattern), and another from measurements on magnetic resonance imaging (magnetic resonance pattern). The aim of this study was to perform three different characterized digital forensic facial reconstructions (with hair, eyelashes and eyebrows) of a Brazilian subject (based on an international pattern and two national patterns for soft facial tissue thickness), and evaluate the digital forensic facial reconstructions comparing them to photos of the individual and other nine subjects. We used DICOM images of a computed tomography (CT) donated by a volunteer that, once converted, were used for the realization of the digital facial reconstructions. Once we\'ve performed the three reconstructions, they were compared with photographs of the volunteer who had his face reconstructed and of nine other subjects. Thirty examiners participated in this recognition attempt. The target subject, who had his face reconstructed, was recognized by 26.67% of the examiners in the reconstruction performed with the national Magnetic Resonance Pattern, 23.33% in the reconstruction performed with the national Fresh Cadavers Pattern of and 20.00 % in the reconstruction performed with the International Pattern, and the target-subject was the most recognized subject in the first two patterns. The correct recognitions of the subject indicate that the digital forensic facial reconstruction, carried out with parameters used in this study, may be a useful tool, with one or more subjects recognized to achieve a positive identification.

The problem encountered by the researcher was that the South African Police Service Cyber-Crimes Unit is experiencing problems in seizing computer evidence. The following problems were identified by the researcher in practice: evidence is destroyed or lost because of mishandling by investigators; computer evidence is often not obtained or recognised, due to a lack of knowledge and skills on the part of investigators to properly seize computer evidence; difficulties to establish authenticity and initiate a chain of custody for the seized evidence; current training that is offered is unable to cover critical steps in the performance of seizing computer evidence; computer seizure as a technique requires specialised knowledge and continuous training, because the information technology industry is an ever-changing area. An empirical research design, followed by a qualitative research approach, allowed the researcher to also obtain information from practice. A thorough literature study, complemented by interviews, was done to collect the required data for the research. Members of the South African Police Cyber-crime Unit and prosecutors dealing with cyber-crime cases were interviewed to obtain their input into, and experiences on, the topic. The aim of the study was to explore the role of computers in the forensic investigation process, and to determine how computers can be seized without compromising evidence. The study therefore also aimed at creating an understanding and awareness about the slippery nature of computer evidence, and how it can find its way to the court of law without being compromised. The research has revealed that computer crime is different from common law or traditional crimes. It is complicated, and therefore only skilled and qualified forensic experts should be used to seize computer evidence, to ensure that the evidence is not compromised. Training of cyber-crime technicians has to be priority, in order to be successful in seizing computers. / Department of Criminology / M.Tech. (Forensic Investigation)

A preocupação com a identificação, que é o processo pelo qual se determina a identidade, é bastante antiga. Atualmente, as relações sociais ou exigências civis, penais, administrativas e comerciais necessitam de sua comprovação. A identificação de pessoas mortas é fundamental, não somente para aplacar as necessidades emocionais de seus amigos e familiares, como também para que providências legais relativas ao óbito possam ser tomadas. Infelizmente, amiúde ocorrem situações em que corpos chegam aos Institutos Médico-Legais em estado de putrefação ou esqueletização, e não são identificados. Em tais situações, análises antropométricas para estimar, por exemplo, idade, gênero e estatura, são de grande valia. Nestes casos, a reconstrução facial forense será muito importante, pois pode possibilitar o reconhecimento e, por conseguinte, aumentar consideravelmente as chances de identificação. A reconstrução facial forense tridimensional pode ser manual ou digital. A reconstrução facial forense digital tornou-se possível com o advento da Tecnologia da Informação, imaginologia médica e novos softwares de imagem 3D e de reconstrução. Para a realização da reconstrução facial, são necessários dados relativos à espessura dos tecidos moles da face. Não há na literatura registros de trabalhos de reconstrução facial digital realizados com dados de tecidos moles obtidos a partir de amostras constituídas por sujeitos brasileiros. Há duas tabelas de espessura de tecidos moles publicadas para a população brasileira: uma obtida a partir de medidas realizadas em cadáveres frescos (padrão cadáveres frescos), e outra a partir de medidas em exames de ressonância magnética (padrão ressonância magnética). O objetivo do presente trabalho foi realizar três diferentes reconstruções faciais forenses digitais caracterizadas (com cabelo, cílios e sobrancelha) de um sujeito brasileiro (realizadas a partir de um padrão internacional e dois padrões nacionais de espessura de tecidos moles da face), e avaliar as reconstruções faciais forenses digitais comparando-as com fotografias do próprio indivíduo e de outros nove sujeitos. Para isso, foram utilizadas imagens DICOM de uma Tomografia Computadorizada (TC) cedidas por um voluntário que, uma vez convertidas, foram utilizadas para a efetivação das reconstruções faciais digitais. Uma vez realizadas as três reconstruções, as mesmas foram comparadas com fotografias do voluntário que teve a sua face reconstruída e outros nove sujeitos. Trinta examinadores participaram desta tentativa de reconhecimento. O sujeito-alvo, que teve a sua face reconstruída, foi reconhecido por 26,67% dos examinadores na reconstrução realizada com o Padrão nacional de Ressonância Magnética, 23,33% na reconstrução realizada com o Padrão nacional de Cadáveres Frescos e 20,00% na reconstrução realizada com o Padrão Internacional, tendo sido o sujeito mais reconhecido nos dois primeiros padrões. Os reconhecimentos acertados do sujeito-alvo indicam que a reconstrução facial forense digital, realizada com parâmetros empregados neste trabalho, pode ser ferramenta útil para, havendo um ou vários sujeitos reconhecidos, chegar-se a uma identificação positiva. / The concern with the identification, that is the process by which the identity is determined, is quite old. Currently, the social relations or civil, criminal, administrative and commercial requirements need its evidence. The identification of deceased persons is essential not only to assuage the emotional needs of their friends and family, but also to allow legal actions related to death. Unfortunately, situations often occur when bodies arrive at the Medico-Legal Institutes in a state of putrefaction or skeletonization, and are not identified. In such situations, anthropometric analysis to estimate, for example, age, gender and height, are of great value. In these cases, forensic facial reconstruction is very important because it may serve to recognize and therefore increase the chances of identification. The three-dimensional forensic facial reconstruction can be manual or digital. The digital forensic facial reconstruction was made possible with the advent of Information Technology, medical imaging and new 3D image and reconstruction softwares. To perform facial reconstruction, data on the thickness of the soft tissues of the face are necessary. There is no literature records of facial reconstruction works carried out with digital data of soft tissues obtained from samples of Brazilian subjects. There are two tables of thickness of soft tissue published for the Brazilian population: one obtained from measurements performed in fresh cadavers (fresh cadavers pattern), and another from measurements on magnetic resonance imaging (magnetic resonance pattern). The aim of this study was to perform three different characterized digital forensic facial reconstructions (with hair, eyelashes and eyebrows) of a Brazilian subject (based on an international pattern and two national patterns for soft facial tissue thickness), and evaluate the digital forensic facial reconstructions comparing them to photos of the individual and other nine subjects. We used DICOM images of a computed tomography (CT) donated by a volunteer that, once converted, were used for the realization of the digital facial reconstructions. Once we\'ve performed the three reconstructions, they were compared with photographs of the volunteer who had his face reconstructed and of nine other subjects. Thirty examiners participated in this recognition attempt. The target subject, who had his face reconstructed, was recognized by 26.67% of the examiners in the reconstruction performed with the national Magnetic Resonance Pattern, 23.33% in the reconstruction performed with the national Fresh Cadavers Pattern of and 20.00 % in the reconstruction performed with the International Pattern, and the target-subject was the most recognized subject in the first two patterns. The correct recognitions of the subject indicate that the digital forensic facial reconstruction, carried out with parameters used in this study, may be a useful tool, with one or more subjects recognized to achieve a positive identification.