Advancing coordinated cyber-investigations and tool interoperability using a community developed specification language
Eoghan Casey, Sean Barnum, Ryan Griffith, Jonathan Snyder, Harm van Beek, Alexander J. Nelson · Digital Investigation (Elsevier) · Digital Investigation, volume 22, September 2017 · 2017
Identifier: doi:10.1016/j.diin.2017.08.002
Access and status
Cost
Partly free
Part of it is free and part is not. The entry says which part; read that before you plan around it.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
The paper that introduced CASE, the Cyber-investigation Analysis Standard Expression, an open community-developed specification language aligned with the Unified Cyber Ontology for representing and exchanging cyber-investigation information. It is co-authored by a NIST researcher and supersedes the earlier DFAX approach.
Who it is for, and when
Read it if you are building or integrating tooling that has to move findings between systems, or if you need to understand the provenance and ontology model behind CASE-compatible output. It is also the citation for arguing that investigative findings should carry structured provenance rather than being locked in one vendor's report format.
What it does not cover
It is a specification rationale paper from 2017, not current CASE documentation: the ontology and bindings have moved on since publication, so use the CASE community site for the live schema. It contains no forensic technique and no guidance on interpreting artefacts.
Go to the source
Open at nist.gov (opens in a new tab)https://www.nist.gov/publications/advancing-coordinated-cyber-investigations-and-tool-interoperability-using-community
Details
- Type
- Paper or report
- Written for
- AdvancedAdvanced
- Author
- Eoghan Casey, Sean Barnum, Ryan Griffith, Jonathan Snyder, Harm van Beek, Alexander J. Nelson
- Publisher
- Digital Investigation (Elsevier)
- Version verified
- Digital Investigation, volume 22, September 2017
- Year
- 2017
- Identifier
- doi:10.1016/j.diin.2017.08.002
- Topics
- standards-development, research-publishing, reporting, scripting, community
- Checked at source
Related entries
The post-conference edited volumes of the annual IFIP Working Group 11.9 International Conference on Digital Forensics, published by Springer as the numbered Advances in Digital Forensics series. Volume XX covers the twentieth conference and appeared in 2025; the working group's site lists the twenty-third conference for January 2027, so the series is live.
The research conference series for digital forensics, running as DFRWS USA (July), a European edition renamed the Digital Forensics Conference Europe from 2027 (formerly DFRWS EU), DFRWS APAC in the autumn, and a Digital Forensics Doctoral Symposium alongside the European event. Papers are peer-reviewed and published, and the workshop format puts authors in front of practitioners.
DFRWS Conference Proceedings
Partly freeThe peer-reviewed paper track of the DFRWS conferences, which have run since the first workshop in 2001 and now cover three regions — DFRWS USA, DFRWS EU (rebranding as the Digital Forensics Conference Europe) and DFRWS APAC. DFRWS's own submission rules confirm accepted research papers are published as special issues of Forensic Science International: Digital Investigation.
The main peer-reviewed research journal for digital forensics. It was called Digital Investigation from 2004 through 2019 and was folded into Elsevier's Forensic Science International family in 2020, when the new title and ISSN 2666-2817 took over; the DFRWS USA, EU and APAC conferences publish their accepted research papers here as special issues.
A fully open-access journal in Elsevier's Forensic Science International family, indexed in DOAJ under Creative Commons licences and funded by article processing charges rather than subscriptions. It deliberately takes the cross-cutting material — policy, quality management, education, interpretation and reporting — that the discipline-specific FSI titles do not.