Integrated timeline analysisSearch word analysis Restoration of deleted web browser information URL decoding a b s t r a c t A Web browser is an essential application program for accessing the Internet. If a suspect uses the Internet as a source of information, the evidence related to the crime would be saved in the log file of the Web browser. Therefore, investigating the Web browser's log file can help to collect information relevant to the case. After considering existing research and tools, this paper suggests a new evidence collection and analysis methodology and tool to aid this process.

Eye tracking technology has been continuously researched for application in various fields. In the past, studies have been conducted to interpret eye movements in 3D space in order to solve the problem of not being able to find the centre of rotation of the eye. In this paper, we propose a novel pre-processing method for eye-gaze tracking by monitoring the front of the face with a camera. Our method works regardless of the distance between the eye and the camera. The proposed method includes an analysis technique that simplifies conventional three-dimensional space analysis to two dimensions. The contribution this work presents is a method to simplify gaze direction detection. The errors in our model’s estimations appear to be under 1 pixel. In addition, our approach has an execution time of less than 1 s, enabling an adaptive model that responds to user movements in real time. The proposed method was able to overcome various problems that methods in existing studies still suffer from, including accurately finding the rotational centre of the user’s eye-ball. Moreover, even when a user’s pupil can only be monitored from a distance, our approach still makes it possible to produce accurate estimations.

No abstract

While traditional digital investigation is limited to cyber crimes, now it is an essential procedure on most of civil and criminal case. With the proliferation of the digital investigation in this situation, the need for the timely identification, analysis and interpretation of digital evidence is becoming more crucial. The general method of investigating the suspect's computer is laborious, time-consuming, complicated tasks and requires specialty on the part of forensic experts. In particular cases, such as child abduction, missing or exploited persons, time is of the essence and rapid incident response is necessary. But the increase in capacity of storage media made this method to take much longer time. Therefore, we need new process model to collect crucial evidence quickly and investigate these cases rapidly. The Stepwise Forensic Process Model (SFPM) provides stepwise and in-situ approach for providing incident identification, acquisition, analysis. The SFPM suggest a new investigational model for selecting the target and analyzing the relevant evidences only.

In digital forensics investigation, a general method of investigating the suspect's computer was to duplicate storage media or image and then obtain the case-related data from these. However, the increase in the capacity of storage media made this method take much longer time. Also, this implies that more data can exist in the suspect's computer so that finding relevant data will take a lot of time and efforts. Moreover, in case where imaging of the entire disk is not possible due to legal matters, selective acquisition of data is needed. In this paper, we propose methods for selective acquisition of file system metadata, registry & prefetch files, web browser files, specific document files without duplicating or imaging the storage media. Furthermore, we suggest a method to analyze the acquired data stepwise and quickly and effectively trace the use of computer in the crime scene.