A Visualization Jump Lists tool for Digital Forensics of Windows

Abstract

In this paper, a visualization digital forensics tool, called JumpList Analyzer, is implemented. The tool can analyze the complicated Jump Lists files, and then the results are demonstrated by visualization. To compare the proposed tool with the other Jump Lists tools, the proposed tool is the only one can display the analyzed results by visualization. The visualization will help the investigators more easily to find the evidence than the other tools showing the analyzed results by texts only. In the experiment, the proposed JumpList Analyzer is demonstrated its convenience at identifying artifacts for doing digital forensics in a financial fraud case. In addition, the proposed tool can also be used to reveal the computer user's behavior or background.

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…Implementing Windows Jump List, [59] presented a graphical digital forensics tool, known as Jump List Analyzer. The study applied statistical charts (e.g., histogram) to visualize attributes, such as AppID, time, zoom, CustDest file, recorded file, and GUI interface.…”

“…The InfoVis data types were adopted from [53], while the list of visualization techniques was adopted from a survey conducted in [68]. [64], [72], [51], [59], [60], [65], [62] From Table II, we can see that forensic visualization was applied in various case studies, including recent computing trends, such as the Internet of Things. This finding accords with an earlier observation in [52], which showed various applications of InfoVis.…”

“…Therefore, there is a need for benchmarking evaluation methods in this research area. References Technical simulations (e.g., case studies) to evaluate tool usability [56], [59], [60], [61], [63] User testing to evaluate tool functionality and performance [64], [51], [62], [66] Focus group to solve forensic challenges [57], [58], [65] In relation to the automated forensic tools metrics proposed by Ayers [32], speed (absolute and relative), reliability, accuracy, and completeness are the evaluation metrics used in existing studies. This is in line with our finding from automated IM forensic analysis tools, which show that performance and functionality are the most applied metrics.…”