The Gap between Theory and Practice in Digital Forensics

Joseph C. Sremack
LECG
Washington, DC USA

ABSTRACT

Digital forensics is a young field that is being defined by the reactive nature of its development – in terms of both research and practice. As technology develops, digital forensics is forced to react and adapt. The rapid development of technology and the lack of an established theoretical foundation has led to a disconnect between the theory and practice of digital forensics. While the base theoretical issues are being worked on by researchers, practitioners are dealing with entirely new sets of issues. The complexity of investigations is increasing, and anti-forensics techniques are advancing as well. The disconnect will be resolved by economic and legal factors, as well as each side understanding their role in the development of this field and improving their channels of communication. This understanding will lead to digital forensics becoming a more mature and effective field. 

Keywords: digital forensics, theory, research, practice