Relativism digital forensics investigations model: a case for the emerging economies

Digital forensic investigations (DFI) is a process of investigating computers and its associated media to determine whether it has been used to commit a crime or gain unauthorized access. cyberattacks and cybercrimes can be committed globally but reported locally. However, DFI processes vary relative to a particular jurisdiction. Relativism is the perception of universal norms of what is right and wrong or legal and illegal. Although cybercrimes are illegal, what constitutes illegal is relative to a jurisdiction. Cyber espionage attacks may be considered legal or illegal based on economic advantage for someone or as target for attack based on motive and intent. Further, following legal procedures in evidence gathering at a digital crime scene is critical for prosecution. However, there are challenges in gathering evidence using the existing DFI models on all attacks. UNODC, report on the globalization of cybercrimes highlighted the challenges of cybercrime and ranked some emerging economies among the first 10 offending nations globally. There are existing models that are specific to certain jurisdictions and assist the judiciary, law enforcement agencies, and forensic experts. Consequently, presenting digital forensic evidence in court has proved to be challenging, due to a lack of procedures and DFI models specific to emerging economies. In this paper, we identify the phase that is relevant and could facilitate DFI processes from emerging economies' perspective. Further, we review some existing models to determine their relative procedures. This paper does not negate existing models, rather derives a relative model from existing models. We propose a model that will improve the DFI process from the result of the evaluation with inference from international standards