Dakota State University Beadle Scholar Masters Theses & Doctoral Dissertations Spring 4-2020 Digital Forensic Readiness: An Examination of Law Enforcement Agencies in the State of Maryland James B. McNicholas III Dakota State University Follow this and additional works at: https://scholar.dsu.edu/theses Part of the Data Science Commons, Forensic Science and Technology Commons, Law Enforcement and Corrections Commons, and the Other Computer Sciences Commons Recommended Citation McNicholas, James B. III, "Digital Forensic Readiness: An Examination of Law Enforcement Agencies in the State of Maryland" (2020). Masters Theses & Doctoral Dissertations. 350. https://scholar.dsu.edu/theses/350 This Dissertation is brought to you for free and open access by Beadle Scholar. It has been accepted for inclusion in Masters Theses & Doctoral Dissertations by an authorized administrator of Beadle Scholar. For more information, please contact [email protected]. 1 DIGITAL FORENSIC READINESS: AN EXAMINATION OF LAW ENFORCEMENT AGENCIES IN THE STATE OF MARYLAND A dissertation submitted to Dakota State University in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Cyber Operations April, 2020 By James B. McNicholas III Dissertation Committee: Dr. Wayne E. Pauli Dr. Ashley Podhradsky Gerald Maye Trevor Jones 2 © Copyright 2020 by James B. McNicholas III ALL RIGHTS RESERVED DocuSign Envelope ID: C488AC4C-372D-44F3-A665-257DDB0CB1CB DISSERTATION APPROVAL FORM This dissertation is approved as a credible and independent investigation by a candidate for the Doctor of Philosophy degree and is acceptable for meeting the dissertation requirements for this degree. Acceptance of this dissertation does not imply that the conclusions reached by the candidate are necessarily the conclusions of the major department or university. Student Name: James McNicholas Dissertation Title: Digital Forensic Readiness: An Examination_______________________________________ of Law Enforcement Agencies in the State of Maryland _________________________________________________________________________________ Dissertation Chair/Co-Chair: Date: April 17, 2020_____ Name: Wayne Pauli Dissertation Chair/Co-Chair: Date: _____ Name: Committee member: ______ Date: April 17, 2020_____ Name: Ashley Podhradsky Committee member: ______ Date: April 17, 2020_____ Name: Trevor Jones Committee member: ______ Date: April 20, 2020_____ Name: Gerald L Maye Committee member: ______ Date: _____ Name: Original to Office of Graduate Studies and Research Acid-free copies with written reports to library 4 ACKNOWLEDGMENT This work is dedicated to those individuals that provided the support, knowledge, understanding, patience, and love that provided me the strength to see this process through. To my family, you have been my foundation and the driving force. Despite the missed events, missed meals, and lost time, you always stood by me. This work and all that comes after is truly for you. To my parents, who never stopped believing in me, you will never know how grateful I am for all you have done and the sacrifices you have made. To Dr. Wayne Pauli -- the voice of wisdom and reason. I am honored and grateful beyond words for all you have done. To Dr. Ashley Podhradsky, who generously offered critical perspective and insight that assisted in stitching this work together. To Gerald Maye, whose support and encouragement throughout the years has inspired me to try to make a lasting impact on the field. To Trevor Jones, who recognized the potential in this endeavor and provided the encouragement and insight to ensure that it all stayed on track. To the faculty and support staff at Dakota State University, your professionalism, caring, and enthusiasm for student success is what makes all this possible. To my friends and fellow classmates, you were always there for me despite being a total curmudgeon. Thank you! Finally, a special thank you to the law enforcement agencies that participated in this research. Without your participation, this research would not have been possible. As a result of your participation, a donation of $310.00 was made to the National Center for Missing and Exploited Children (www.missingkids.org). 5 ABSTRACT Digital forensic readiness within the law enforcement community, especially at the local level, has gone mostly unexplored. As a result, a current lack of data exists that examines the digital forensic readiness of individual agencies, the possibility of proximity relationships, and correlations between readiness and backlogs. This quantitative, cross- sectional research study sought to explore these issues by focusing on the state of Maryland. The study resulted in the creation of a digital forensic readiness scoring model that was then used to assign digital forensic readiness scores to thirty (30) of the one-hundred-forty-one (141) law enforcement agencies throughout Maryland. It was found that an agency’s proximity to a major resource center (hub) did not positively or negatively influence readiness. It was also found that agencies with higher digital forensic readiness scores may be more likely to exhibit backlogs as a result of external agency dependencies. It should be noted, however, that digital forensic readiness scores should not be viewed as a reliable predictive indicator for the existence of backlogs. These findings establish a baseline for the state of Maryland that can be used to monitor, sustain, or improve levels of digital forensic readiness within the state or in a broader national context; it has the potential of enhancing public safety and the field at large. 7 TABLE OF CONTENTS DISSERTATION APPROVAL FORM ................................................................................................. 3 ACKNOWLEDGMENT ......................................................................................................................... 4 ABSTRACT ............................................................................................................................................. 5 DECLARATION ..................................................................................................................................... 6 TABLE OF CONTENTS ........................................................................................................................ 7 LIST OF TABLES ................................................................................................................................. 11 LIST OF FIGURES ............................................................................................................................... 12 INTRODUCTION ................................................................................................................................. 13 MOTIVATION ....................................................................................................................................... 13 Maryland ........................................................................................................................................ 15 BACKGROUND OF THE PROBLEM ......................................................................................................... 17 Digital Forensic Process Models ................................................................................................... 18 Digital Forensics Tools .................................................................................................................. 18 STATEMENT OF THE PROBLEM ............................................................................................................. 19 OBJECTIVES OF THE PROJECT .............................................................................................................. 19 Assumptions ................................................................................................................................... 20 SIGNIFICANCE OF THE APPROACH ........................................................................................................ 21 DISSERTATION ORGANIZATION ........................................................................................................... 21 LITERATURE REVIEW ..................................................................................................................... 22 DIGITAL FORENSICS MODELS & PHASES ............................................................................................. 23 Preparation & Extraction .............................................................................................................. 23 Identification .................................................................................................................................. 25 Analysis .......................................................................................................................................... 26 Initial Staging & Final Stages ........................................................................................................ 27 SUPPORTING TOOLS ............................................................................................................................. 28 Software ......................................................................................................................................... 28 Hardware ....................................................................................................................................... 30 NEEDS ANALYSIS ...............................................................................................................................