Behind the (Digital Crime) Scenes: An MSC Model

TL;DR

The paper tackles the challenge of handling digital evidence in criminal investigations while safeguarding defendants' rights. It introduces a generalised MSC model for Digital Forensics in Crime Investigation (DFCI) that structures three core protocols—Init, Investigation, and Trial—and maps the roles of Prosecutor, Digital Forensics Expert, Suspect/Defendant, and Judge. By synthesising diverse regulatory and standards documents, the authors derive actor definitions, message flows, and functional requirements to support threat modelling and rights verification. The proposed MSC framework offers a baseline for systematic threat analysis and procedural validation across jurisdictions, with future work focusing on non-functional requirements and anti-forensics risks.

Abstract

Criminal investigations are inherently complex as they typically involve interactions among various actors like investigators, prosecutors, and defendants. The pervasive integration of technology in daily life adds an extra layer of complexity, especially in crimes that involve a digital element. The establishment of digital forensics as a foundational discipline for extracting digital evidence further exacerbates the complex nature of criminal investigations, leading to the proliferation of multiple scenarios. Recognising the need to structure standard operating procedures for the handling of digital evidence, the representation of digital forensics as a protocol emerges as a valuable opportunity to identify security and privacy threats. In this paper, we delineate the protocols that compose digital forensics within a criminal case, formalise them as message sequence charts (MSCs), and identify their functional requirements.

Figures (3)

• Figure 1: MSC for Protocol 1: Init.
• Figure 2: MSC for Protocol 2: Investigation.
• Figure 3: MSC for Protocol 3: Trial.