Using relationship-building in event profiling for digital forensic investigations Batten, Lynn M. and Pan, Lei 2011, Using relationship-building in event profiling for digital forensic investigations. In Lai, Xuejia, Gu, Dawu, Jin, Bo, Wang, Yongsquan and Li, Hui (ed), Forensics in telecommunications, information, and multimedia : third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, revised selected papers, Springer-Verlag, Berlin, Germany, pp.40-52, doi: 10.1007/978-3-642-23602-0_4. Attached Files Name Description MIMEType Size Downloads Title Using relationship-building in event profiling for digital forensic investigations Author(s) Batten, Lynn M. orcid.org/0000-0003-4525-2423 Pan, Lei orcid.org/0000-0002-4691-8330 Title of book Forensics in telecommunications, information, and multimedia : third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, revised selected papers Editor(s) Lai, Xuejia Gu, Dawu Jin, Bo Wang, Yongsquan Li, Hui Publication date 2011 Series Lecture notes of the Institute for Computer Sciences, Social Informatics, and Telecommunications Engineering ; 56 Chapter number 4 Total chapters 30 Start page 40 End page 52 Total pages 13 Publisher Springer-Verlag Place of Publication Berlin, Germany Keyword(s) digital forensics event profiling relation Summary In a forensic investigation, computer profiling is used to capture evidence and to examine events surrounding a crime. A rapid increase in the last few years in the volume of data needing examination has led to an urgent need for automation of profiling. In this paper, we present an efficient, automated event profiling approach to a forensic investigation for a computer system and its activity over a fixed time period. While research in this area has adopted a number of methods, we extend and adapt work of Marrington et al. based on a simple relational model. Our work differs from theirs in a number of ways: our object set (files, applications etc.) can be enlarged or diminished repeatedly during the analysis; the transitive relation between objects is used sparingly in our work as it tends to increase the set of objects requiring investigative attention; our objective is to reduce the volume of data to be analyzed rather than extending it. We present a substantial case study to illuminate the theory presented here. The case study also illustrates how a simple visual representation of the analysis could be used to assist a forensic team. ISBN 3642236022 9783642236020 ISSN 1867-8211 1867-822X Language eng DOI 10.1007/978-3-642-23602-0_4 Field of Research 080109 Pattern Recognition and Data Mining Socio Economic Objective 810107 National Security HERDC Research category B2 Book chapter in non-commercially published book Copyright notice ©2011, Springer Persistent URL http://hdl.handle.net/10536/DRO/DU:30043197 Document type: Book Chapter Collections: Faculty of Science, Engineering and Built Environment School of Information Technology Related Links Link Description Connect to published version (restricted access) Go to link with your DU access privileges     Unless expressly stated otherwise, the copyright for items in DRO is owned by the author, with all rights reserved. Versions Version Filter Type Tue, 13 Mar 2012, 09:53:20 EST Mon, 02 Apr 2012, 13:09:29 EST Mon, 02 Apr 2012, 13:13:26 EST Mon, 02 Apr 2012, 13:13:58 EST Mon, 14 Oct 2013, 11:33:14 EST Tue, 24 Jun 2014, 08:18:55 EST Fri, 17 Oct 2014, 11:24:50 EST Filtered Full Citation counts:   Cited 0 times in TR Web of Science Cited 0 times in Scopus Search Google Scholar Access Statistics: 241 Abstract Views, 9 File Downloads  -  Detailed Statistics Created: Tue, 13 Mar 2012, 09:53:20 EST