The Information Security department at the University of North Carolina Wilmington has the responsibility of providing expertise when an incident occurs involving UNCW data. Depending on the incident, it may require data forensic investigation to preserve and extract digital evidence. In order to perform this type of investigation, procedures for data preservation and extraction need to be established. These procedures must ensure data integrity, be compliant with other Information Security procedures, provide a chain of custody, have the ability to hold up in court, and it is recommended that the procedure be easy for Information Security personnel to follow. Hardware and software will also be utilized during a data forensic investigation. The hardware and software must uphold data integrity and be compatible with multiple types of data storage devices as well as multiple operating systems. Additionally, the hardware needs to have a secure configuration and the software should support multiple investigation cases. This capstone project explores all the possible options for data forensic procedures, hardware, and software and evaluates each option based on a set of criteria. The criteria were chosen based on research of industry knowledge and best practices and is the basis for the scoring framework, which is the key to finding the optimal solution. This capstone uses the scoring framework to determine the optimal data forensic solution for UNCW. In addition to assisting UNCW, this scoring framework will also be able to aid other higher education institutions in finding their optimal data forensic solution.

Recommended Citation: Mabe C., Baker E., Layman L., Cummings J., (2019). Data Forensics Solutions for Higher Education Environment: Scoring Framework for Optimal Configuration. UNCW MS CSIS Proceedings. V. 13 , N. 3 .