Building Ontologies for Digital Forensic Terminologies

Abstract

Digital forensics (DF) is a relatively new discipline with a lot of technical and non-technical terminologies that can be hard to comprehend. During a timeintensive digital forensic investigation process, for example, investigators may at times encounter several new terminologies. In such a scenario, the time required to unearth and analyse the root cause of a potential security incident might be influenced by the complexity involved in resolving the meaning of new terminologies encountered. The difficulty lies in the lack of an approach in DF that can help investigators in resolving the meaning of terminologies or even how these terminologies are perceived by individuals especially when used in their domain of expertise. If existing digital forensic tools, for example, were to be designed in such a way as to allow investigators to automatically resolve or incorporate the meaning of new terminologies used or encountered during investigations, then the time required to unearth and analyse the root cause of a security incident might be reduced extensively. The main problem addressed in this paper therefore, is that, there exists no approaches in DF that have the ability to help investigators in reasoning with regard to the perceived meaning of different digital forensic terminologies encountered during a digital forensics investigation process. Existing tools thus needs to incorporate new approaches that can help in resolving or clarifying the meaning of new terminologies used during investigation processes. For this reason, this paper examines the concept of building ontologies for digital forensic terminologies and proposes an ontological approach to resolve the meaning of different digital forensic terminologies. Besides, ontologies are known to provide a form of knowledge in a given discipline of interest. In the authors' opinion, thus, building ontologies for digital forensic terminologies can support the development of future investigative tools as well as new techniques to a degree of certainty.

Digital forensic readiness intelligence crime repository

“…Generally, in a smart intelligent city network, digital or smart devices are connected via ad‐hoc networks and the presence of mobile devices brings about complexities when a digital incident is detected. As a result, one would allow the collection of potential digital evidence 37,38 that can be distributed across the aforementioned CIR, SIR, and MIR databases for purposes of sharing useful investigative forensic knowledge. In this smart city, forensic intelligence could easily be gathered across different connected devices and this form of forensic intelligence could easily be used to link the perpetrator to the crime.…”

Interpol review of digital evidence 2016 - 2019

“…Ontologies are used for representing and reasoning about domain knowledge. Karie and Kebande [ 30 ] propose that existing tools should incorporate new approaches to assist in resolving or clarifying the meaning of new terminologies used during the investigation process. Ontologies will generate a common definition, knowledge and understanding of digital forensics domain terminologies.…”

“…The generation of an ontology comprises four main steps: 1) digital forensics terminology database; 2) develop terminology semantic annotations; 3) reasoning engine; and 4) terminology semantic repository. The critical steps focus on the meaning of digital forensic terminologies during a digital forensic investigation [ 30 ].…”

An Ontology Based on the Timeline of Log2timeline and Psort Using Abstraction Approach in Digital Forensics

“…In the paper [12] the authors stated that digital forensics is a relatively new discipline with various technical and non-technical terminologies that can be hard to comprehend. The main problem addressed by the authors is that there is no approach in digital forensics that can help investigators in reasoning concerning the perceived meaning of different digital forensics terminologies encountered during a digital forensics investigation process.…”