Digital Forensic Process via Parallel Data Acquisition Technic: Experimental Case Study

Digital Forensics (DF) is an essential tool for solving cases of crimes committed. Based on the type of action performed, DF is classified into static forensics and live forensics. The limitations of static forensics in this method are that data collection is carried out on permanent storage media, while processes in the running system are not obtained. On the other hand, live forensics provides an opportunity to perform data retrieval on the ongoing process. Generally, live forensics is used to acquire Volatile Memory (RAM) data but can be extended on mobile devices, internet/LAN networks, and cloud systems. Browsing in private mode leaves no traces and information about what the user has done during the browsing session. This feature is often used by criminals to hide the crimes committed or at least to slow down the forensic process. To overcome this problem, it is important to do forensics on RAM and Network Forensics to obtain evidence of these crimes. This study aims to conduct DF to obtain potential evidence in criminal cases of misuse of private browsing. The evidence is expected to be used as evidence in court. The parties involved in the crime can be prosecuted in court through such evidence. This research offers Digital Forensics Process Via Parallel Data Acquisition Technic. Parallel data acquisition is a method for retrieving data on a computer or other smart device when the computer or other smart device is on through two different data sources. The first source is RAM and the second is Network Traffic. A case study on a criminal case of misuse of private browsing with Digital Forensics Process Via Parallel Data Acquisition Technic was able to obtain evidence in the form of the website visited, URL, traffic timestamp performed, source address, destination address, transmission protocol, length (size of the packet transmitted), source last node mac address, destination last node mac address, source port, destination port, and detail information. The evidence is expected to be used to reconstruct a crime of misuse of private browsing