Inference Model of Digital Evidence Based on cFSA

The inference analysis of digital evidence aims to look for the clues for further crime detection or reconstruct the attack actions scenarios for prosecution in court. However, the inference analysis process of computer forensic is more subjective because too much experiential work and sensory presentation are in it. It is even possible that an event never occurred but that an inference conclusion can be fabricated to misdirect crime detection or implicate an innocent person. Based on the analysis of practical inference analysis, the inference model of digital evidence based on a kind of finite state automata with condition (cFSA) is presented, and an event reconstruction theory based on condition-state transition diagram is introduced for detecting the accidental or malicious modification by the investigator and protecting the relatively reliable inference conclusion.