Identifying Forensically Uninteresting Files Using a Large Corpus

Rowe, Neil C.

doi:10.1007/978-3-319-14289-0_7

Cited by 7 publications

(6 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Therefore, they are not suitable for datasets with a large volume of data. From a similar perspective, [17] carried out an examination for clustering digital forensics text string search output. Four clustering techniques were evaluated, including K-Means, Kohonen Self-Organizing Map (SOM), LDA followed by K-Means, and LDA followed by SOM.…”

Section: Related Workmentioning

confidence: 99%

Evidence Identification in Heterogeneous Data Using Clustering

Mohammed

Clarke

2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Digital forensics faces several challenges in examining and analyzing data due to an increasing range of technologies at people's disposal. The investigators find themselves having to process and analyze many systems manually (e.g. PC, laptop, Smartphone) in a single case. Unfortunately, current tools such as FTK and Encase have a limited ability to achieve the automation in finding evidence. As a result, a heavy burden is placed on the investigator to both find and analyze evidential artifacts in a heterogenous environment. This paper proposed a clustering approach based on Fuzzy C-Means (FCM) and K-means algorithms to identify the evidential files and isolate the non-related files based on their metadata. A series of experiments using heterogenous reallife forensic cases are conducted to evaluate the approach. Within each case, various types of metadata categories were created based on file systems and applications. The results showed that the clustering based on file systems gave the best results of grouping the evidential artifacts within only five clusters. The proportion across the five clusters was 100% using small configurations of both FCM and K-means with less than 16 % of the non-evidential artifacts across all casesrepresenting a reduction in having to analyze 84% of the benign files. In terms of the applications, the proportion of evidence was more than 97%, but the proportion of benign files was also relatively high based upon small configurations. However, with a large configuration, the proportion of benign files became very low less than 10%. Successfully prioritizing large proportions of evidence and reducing the volume of benign files to be analyzed, reduces the time taken and cognitive load upon the investigator.

show abstract

Section: Related Workmentioning

confidence: 99%

Evidence Identification in Heterogeneous Data Using Clustering

Mohammed

Clarke

2018

Proceedings of the 13th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

show abstract

“…On a file level, any hash values would match, but the hard drive image in its entirety would not match the original. Evidence deduplication (based on a software reference database, such as the NSRL database) can greatly improve the imaging of enterprise machines by avoiding the waste of resources for handling harmless files [28], [29].…”

Section: A Evidence Handlingmentioning

confidence: 99%

Overview of the Forensic Investigation of Cloud Services

Farina

Scanlon

Le-Khac

et al. 2015

2015 10th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Abstract-Cloud Computing is a commonly used, yet ambiguous term, which can be used to refer to a multitude of differing dynamically allocated services. From a law enforcement and forensic investigation perspective, cloud computing can be thought of as a double edged sword. While on one hand, the gathering of digital evidence from cloud sources can bring with it complicated technical and cross-jurisdictional legal challenges. On the other, the employment of cloud storage and processing capabilities can expedite the forensics process and focus the investigation onto pertinent data earlier in an investigation. This paper examines the state-of-the-art in cloud-focused, digital forensic practises for the collection and analysis of evidence and an overview of the potential use of cloud technologies to provide Digital Forensics as a Service.

show abstract

“…Other methods attempt to focus on the identification of where related digital evidence is likely to be located (or not) in a system (Garfinkel, 2006;Rowe, 2014;Rogers, Goldman, Mislan, Wedge, & Debrota, 2006). These approaches help guide an investigator during the investigation, making more efficient use of available resources.…”

Section: Introductionmentioning

confidence: 99%

Multi-Stakeholder Case Prioritization in Digital Investigations

James¹

2014

JDFSL

View full text Add to dashboard Cite

This work examines the problem of case prioritization in digital investigations for better utilization of limited criminal investigation resources. Current methods of case prioritization, as well as observed prioritization methods used in digital forensic investigation laboratories are examined. After, a multi-stakeholder approach to case prioritization is given that may help reduce reputational risk to digital forensic laboratories while improving resource allocation. A survey is given that shows differing opinions of investigation priority between Law Enforcement and the public that is used in the development of a prioritization model. Finally, an example case is given to demonstrate the practicality of the proposed method.

show abstract

Identifying Forensically Uninteresting Files Using a Large Corpus

Cited by 7 publications

References 11 publications

Evidence Identification in Heterogeneous Data Using Clustering

Evidence Identification in Heterogeneous Data Using Clustering

Overview of the Forensic Investigation of Cloud Services

Multi-Stakeholder Case Prioritization in Digital Investigations

Contact Info

Product

Resources

About