## 3 Conceptual Model  
The concept of proactive digital forensics resembles an architecture similar to a security operation centre (SOC), where there is continuous monitoring of the network and endpoint monitoring. Digital forensics and incidence response infrastructure (hardware and software) is installed in advance, anticipating future incidents that may require quick access to electronic evidence artefacts for investigations. Figure 1, below, illustrates the proactive digital forensics concept using a unified modelling language (UML) diagram. The proactive digital forensics investigation begins with network and endpoint monitoring, where a monitoring server assisted by an agent (in the case of an EDR) or a network tap (in the case of NIDS) constantly communicates with the network and host devices over a network in the search for suspicious behaviour. The status corresponds to an alert or notification received, and the forensic investigator verifies whether it is a positive, false positive, negative, or false negative. The investigator checks whether an Indication of Compromise (IOC) or an Indication of Attack (IOA) exists or not. Given that it exists, an investigation is initiated either on the network or the endpoint. The identification of artefacts is automatic in known attacks, which makes it easier for the forensic investigator to extract and preserve the evidence. The investigation is performed on top of security monitoring, where there is increased visibility on both the network and endpoint devices. The security events received are based on the NIDS detection capabilities either using signature-based identification or behavioural analysis. Based on the events on the NIDS, the analyst then performs a digital triage on the endpoint to obtain further details. Unlike the solutions in [11; 14; 21] of taking a virtual snapshot of the computer system, which can be costly in terms of network overhead due to its size, the PDFI concept implements real-time digital forensic triage. The authors in [22] define a digital triage as a technical process that enables efficient identification, verification, and collection of ESIs to prioritise digital artefacts for easier analysis. There are several definitions of digital triage, nonetheless, the researchers have chosen to use the term \"forensic digital triage\" because the subsequent results are to be used for a forensic examination. In addition, the collection is done forensically, as the identified digital artefacts/ESI would be validated and verified through a hash signature calculation and transported over a secure network for further analysis, as recommended by the authors in [19]. Furthermore, unlike the traditional digital  
Figure 1: The deployment model for proactive digital forensics. forensics model, which does not provide pre-incidental information and analysis (normally done in a post-mortem fashion), proactive digital forensics offers a live examination, thus leading to the faster processing of evidential media. In [23], the authors took a study on the use of keystroke logging as a proactive digital forensics digital preservation technique. However, it is not mentioned that the concept is performing a live investigation or triage in near real-time. The advantages of the proposed model are forensic readiness, an increase in organisational security posture, proof of information governance (compliance), lower downtime (continued operations), and increased precision of the identification, collection, and analysis of digital evidence. Proactive digital forensics can provide near real-time results, thereby enhancing resilience to threats and information governance needs. However, the legality of live and/or remote forensics is still of major concern in several jurisdictions, thereby affecting the credibility of digital artefacts obtained in this manner. The concept relies heavily on the principles of information security, which are confidentiality, integrity, availability (CIA), authentication, authorisation, and accountability (AAA).