Abstract: The recent popularity of research on topics of multimedia forensics justifies reflections on the definition of the field. This paper devises an ontology that structures forensic disciplines by their primary domain of evidence. In this sense, both multimedia forensics and computer forensics belong to the class of digital forensics, but they differ notably in the underlying observer model that defines the forensic investigator's view on (parts of) reality, which itself is not fully cognizable. Important consequences on the reliability of probative facts emerge with regard to available counter-forensic techniques: while perfect concealment of traces is possible for computer forensics, this level of certainty cannot be expected for manipulations of sensor data. We cite concrete examples and refer to established techniques to support our arguments.

  publisher    = {Springer Verlag},
  author       = {Rainer B\"{o}hme and Felix Freiling and Thomas Gloe and Matthias Kirchner},
  url          = {http://www.inf.tu-dresden.de/~rb21/publications/BFGK2009_Multimedia_Forensics_Is_Not_Computer_Forensics_IWCF.pdf},
  series       = {Lecture Notes in Computer Science},
  booktitle    = {Computational Forensics, Third International Workshop, IWCF 2009, The Hague, Netherlands, August 2009, Proceedings},
  volume       = {LNCS 5718},
  year         = {2009},
  editor       = {Zeno J. Geradts and Katrin Y. Franke and Cor. J. Veenman},
  address      = {Berlin, Heidelberg},
  title        = {Multimedia forensics is not computer forensics},
  pages        = {90--103},