Data for Digital Forensics: Why a Discussion on “How Realistic is Synthetic Data” is Dispensable

Abstract

Digital forensics depends on data sets for various purposes like concept evaluation, educational training, and tool validation. Researchers have gathered such data sets into repositories and created data simulation frameworks for producing large amounts of data. Synthetic data often face skepticism due to its perceived deviation from real-world data, raising doubts about its realism. This paper addresses this concern, arguing that there is no definitive answer. We focus on four common digital forensic use cases that rely on data. Through these, we elucidate the specifications and prerequisites of data sets within their respective contexts. Our discourse uncovers that both real-world and synthetic data are indispensable for advancing digital forensic science, software, tools, and the competence of practitioners. Additionally, we provide an overview of available data set repositories and data generation frameworks, contributing to the ongoing dialogue on digital forensic data sets’ utility. Keywords: Digital forensic corpora; Data sets; Real-world data; Synthetic data; Data usage; Data synthesis, Types of data; Use cases; Realistic data; Data simulation frameworks

A template for creating and sharing ground truth data in digital forensics

“…GTD for DF is described by Göbel et al [8] as "data whose content is well known and understood by the community, i.e., the exact information or the actual digital traces to be discovered in a data set during the investigation are well documented." While Woodhouse [1] suggests the origins of the term GTD are unclear, it is often linked with both military and cartography domains, and the field of DF has recently sought to adopt this term to describe data that has been methodically created and its content known and documented.…”

“…This is typically achieved using a "black box" approach where test actions are carefully chosen to elicit appropriate responses from any functions or services that a practitioner intends to test [6,7]. The data that is then generated is acquired using forensic methods, and attempts are made to then identify and interpret the presence of any digital traces created as a result of these actions [8]. In essence, these procedures try to establish whether any activity on a device or interactions with a service leave traces that describe a user's course of digital conduct when using any technology or service.…”