LAUSR

Data breaches are becoming an increasingly prevalent and global concern due to their massive impact. One of the primary challenges in investigating data breach incidents is the unavailability of a specific framework that acknowledges the characteristics of a data breach incident and provides clear steps on how the investigative framework can comprehensively answer what, who, when, where, why, and how (5WH) questions. This paper aims to develop a novel digital forensic investigation framework that can overcome these data breach investigation challenges. The proposed framework utilizes the data breach breakdown phases to analyze data breach incidents according to their characteristics. The main contribution of our work is a novel digital forensic framework for data breach investigation that enhances the 5WH analysis depth by utilizing evidence classification and artifact visualization based on data breach breakdown phases. Furthermore, we design the framework components to provide comprehensive analysis results that make it easier for investigators to summarize the answers to the 5WH questions. To validate the framework, we apply it to a case study of enterprise-level data breach incidents. Based on the case study analysis, the proposed investigation framework successfully provides all the answers to the 5WH questions. This comprehensive answering ability is the study’s fundamental strength compared to other digital forensic investigation frameworks.