Forensic computing (sometimes also called digital forensics, computer forensics or IT forensics) is a branch of forensic science pertaining to digital evidence, i.e., any legal evidence that is processed by digital computer systems or stored on digital storage media. Forensic computing is a new discipline evolving within the intersection of several established research areas such as computer science, computer engineering and law.

Forensic computing is rapidly gaining importance since the amount of crime involving digital systems is steadily increasing. This involves both more traditional crime in which digital systems are merely used as tools (e.g., different types of fraud, blackmailing, hidden communication) as well as new forms of crime in which digital systems are an enabling technology (e.g., computer abuses, malicious software, malicious remote control networks like botnets). Forensic computing aims to identify, preserve and analyze digital evidence after a security incident has occurred. As in other forensic sciences, investigators attempt to establish hypotheses about previous actions and try to falsify them based on traces of actions left at the scene of the crime. For example, the hypothesis that a hard disk does not contain any particular incriminating data can be refuted by finding such data.

Forensic computing poses many technical and legal challenges. Particularly interesting are the mutual interactions of several well-established research directions in computer science and law. Like in other forensic sciences, the emergence of forensic computing was mainly driven by practitioners trying to satisfy immediate needs within concrete digital investigations. Now that many universities, mainly from North America, have started to establish degree programs and research labs in this area, forensic computing is increasingly profiting from research knowledge and the scientific methods developed in computer science, but there is still a lot of potential. Progress is hindered, for example, by the subtle immaturity of methodology for digital investigations, i.e., the lack of standardized models, file formats, investigative procedures, and abstraction methods, and by the complex (and nontechnical) interactions with law and the differing requirements of different juridical systems, especially comparing continental Europe and the United States/United Kingdom.

This Dagstuhl seminar aims to bring together researchers and practitioners from computer science and law who work in the diverse areas of forensic computing. The goal of the seminar is to further establish forensic computing as a scientific research discipline, to identify the strengths and weaknesses of the research field, and to discuss the foundations of its methodology. Some of the research questions to be discussed are:

• How can we define, identify and classify digital evidence? How can we deal with the volatile nature of many forms of digital evidence like evidence in memory and networks?
• How can a research-driven systematic investigation of computer systems look like?
• Technical and legal possibilities on how to manage enormous amounts of data in digital investigations? How can data be disseminated without contaminating it for later use in a court of law?
• What are good ways to teach forensic computing at research institutions and universities?
• What relations exist between forensic computing and other forensic sciences, and how can they be exploited?
• How can forensic computing procedures relate to different laws worldwide, e.g., law concerning the seizure and confiscation of data?
• How can forensic computing help in fighting cybercrime? Are there important example cases? What are the legal and administrative requirements (Cybercrime convention and its adoption in Germany and the European Union)?
• How can we approach technical and legal questions concerning later use of data obtained by means of state- or privately-run data retention mechanisms in a court of law?

• Andreas Dewald (Universität Erlangen-Nürnberg, DE) [dblp]
• Jan Ellermann (Europol, NL)
• Hannes Federrath (Universität Hamburg, DE) [dblp]
• Felix Freiling (Universität Erlangen-Nürnberg, DE) [dblp]
• Michael Gruhn (Universität Erlangen-Nürnberg, DE) [dblp]
• Christian Hawellek (Leibniz Universität Hannover, DE)
• Dennis Heinson (Hamburg, DE) [dblp]
• Dominik Herrmann (Universität Hamburg, DE) [dblp]
• Gerrit Hornung (Universität Passau, DE) [dblp]
• Sven Kälber (Universität Erlangen-Nürnberg, DE) [dblp]
• Stefan Kiltz (Universität Magdeburg, DE) [dblp]
• Volker Krummel (Wincor-Nixdorf International GmbH - Paderborn, DE) [dblp]
• Radim Polcák (Masaryk University, CZ) [dblp]
• Thomas Schreck (Siemens AG - München, DE) [dblp]
• Erich Schweighofer (Universität Wien, AT) [dblp]
• Tobias Singelnstein (Freie Universität Berlin, DE) [dblp]
• Vaclav Stupka (Masaryk University - Brno, CZ)
• Tatiana Tropina (MPI für Strafrecht - Freiburg, DE) [dblp]
• Nicolas von zur Mühlen (MPI für Strafrecht - Freiburg, DE)
• York Yannikos (Fraunhofer SIT - Darmstadt, DE) [dblp]
• Riha Zdenek (Masaryk University - Brno, CZ)