Forensic Analysis using Text Clustering in the Age of Large Volume Data: A Review

Abstract

Exploring digital devices in order to generate digital evidence related to an incident being investigated is essential in modern digital investigation. The emergence of text clustering methods plays an important role in developing effective digital forensics techniques. However, the issue of increasing the number of text sources and the volume of digital devices seized for analysis has been raised significantly over the years. Many studies indicated that this issue should be resolved urgently. In this paper, a comprehensive review of digital forensic analysis using text-clustering methods is presented, investigating the challenges of large volume data on digital forensic techniques. Moreover, a meaningful classification and comparison of the text clustering methods that have been frequently used for forensic analysis are provided. The major challenges with solutions and future research directions are also highlighted to open the door for researchers in the area of digital forensics in the age of large volume data.

A Survey of Forensic Analysis and Information Visualization Approach for Instant Messaging Applications

“…It has also been widely validated in academic forensic investigation studies, such as those analyzing web URL information [14]. Nowadays, the conventional keyword searching technique might be limited in a large volume of data, as it could lead to false negative or false positive and requires background knowledge about the case [15]. Therefore, studies such as [16] and [17], have examined the use of the semantic-based approach for text clustering with the aim of improving the performance and accuracy of forensic analysis.…”

Research Trends, Challenges, and Emerging Topics in Digital Forensics: A Review of Reviews

“…Considering the increasing amount of IoT technologies and small devices that require live data analysis due to the volatility of the data stored in them, it is crucial to develop new strategies to enhance data acquisition procedures [71]. In the context of database forensics and data acquisition, the challenges of big data analysis and data mining techniques for digital forensics [72], [73], and text clustering [74] were investigated. Moreover, a survey of techniques to perform similarity digest search is provided in [75].…”

“…[58], [61], [66], [67], [69], [75] Lack of standardized tools and technologies [59], [65], [66], [69], [70], [74] Forensic seizure and analysis of proprietary and/or distributed filesystems [58]- [60], [70], [71], [71], [73] Variety of format and content type. Not standard logging features and settings [61], [65]- [70], [73], [75] No validation/verification in real-life scenarios and large datasets [72], [74] Subjectivity of the evaluation of content retrieval algorithms [72], [74] Advanced knowledge and training of analysts and investigators [69], [72] Lack of guidance for investigators regarding selective search and seize.…”

“…[58], [61], [66], [67], [69], [75] Lack of standardized tools and technologies [59], [65], [66], [69], [70], [74] Forensic seizure and analysis of proprietary and/or distributed filesystems [58]- [60], [70], [71], [71], [73] Variety of format and content type. Not standard logging features and settings [61], [65]- [70], [73], [75] No validation/verification in real-life scenarios and large datasets [72], [74] Subjectivity of the evaluation of content retrieval algorithms [72], [74] Advanced knowledge and training of analysts and investigators [69], [72] Lack of guidance for investigators regarding selective search and seize. Subjectivity of search terms based on investigator's experience [69], [74] Difficulty to apply low-level analysis techniques, hindering correctness of the results [62], [70] Sophisticated malware implementing antiforensic techniques [61]- [63], [74] Volatile data acquisition due to hardware constraints [71] Stealthy non-memory-resident malware [64] Handling, execution and monitoring of memory [61], [63], […”

Digital Forensics AI: Evaluating, Standardizing and Optimizing Digital Evidence Mining Techniques

“…SC has been applied in a variety of forensics-related clustering methodologies, including document forensics [173], image source identification [174,175], and text forensics (e.g. authorship) [176,177].…”