Using relationship-building in event profiling for digital forensic investigations
Batten, Lynn M. and Pan, Lei 2011, Using relationship-building in event profiling for digital forensic investigations, in Forensics in telecommunications, information, and multimedia : third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, revised selected papers, Springer-Verlag, Berlin, Germany, pp.40-52.
In a forensic investigation, computer profiling is used to capture evidence and to examine events surrounding a crime. A rapid increase in the last few years in the volume of data needing examination has led to an urgent need for automation of profiling. In this paper, we present an efficient, automated event profiling approach to a forensic investigation for a computer system and its activity over a fixed time period. While research in this area has adopted a number of methods, we extend and adapt work of Marrington et al. based on a simple relational model. Our work differs from theirs in a number of ways: our object set (files, applications etc.) can be enlarged or diminished repeatedly during the analysis; the transitive relation between objects is used sparingly in our work as it tends to increase the set of objects requiring investigative attention; our objective is to reduce the volume of data to be analyzed rather than extending it. We present a substantial case study to illuminate the theory presented here. The case study also illustrates how a simple visual representation of the analysis could be used to assist a forensic team.
9783642236020 3642236022 9783642236020
Field of Research
080109 Pattern Recognition and Data Mining
Socio Economic Objective
810107 National Security
HERDC Research category
B2 Book chapter in non-commercially published book