Several works have been carried out in the domain of cybercrime investigation. Each of the resulting models is based on a set of activities that should be performed in order to obtain the required evidences that are needed in the court for prosecution. In the literature, three processes have been highlighted for the digital forensic investigation based on a current situation; they include proactive, active and reactive processes. However, none of the defined approaches for investigation has taken into consideration the three perspectives despite the fact that they are linked together in the management of cybercrime within an organization. Moreover, there is no agreement in the definition of different tasks to be performed for each process in the achievement of the associated investigation goal. Each researcher comes with a specific set of activities based on the case under studies. In the same manner, the ordering of activities for a given process is not clearly specified; therefore, in different cases using the same process with the same activities, the associated executions are sometimes very different. There is a lack of standards in the cybercrime investigation processes. As the cybercrime increases in the modern society based on the use and the growth of ICTs (Information and Communication Technologies), there is an urgent need to set up a standard which takes into account the above issues. This paper proposes a multi-perspective cybercrime investigation process modeling that can be considered as a basis for standardization. The proposed model is constructed by extending and unifying the existing approaches.

Computer Forensics Cybercrime Investigation Forensic Process Models Proactive Forensic Investigation Active And Reactive Forensic Investigation