Improving Performance of Forensics Investigation with Parallel Coordinates Visual Analytics

Abstract

Computer forensics investigators aim to analyseand present facts through the examination of digital evidences in short times. As the volume of suspicious data is becoming large, the difficulties of catching the digital evidence in a legally acceptable time are high. This paper proposes an effective method for reducing investigation time redundancy to achieve the normalization of data on hard disk drives (HDD) for computer forensics. We use visualization techniques, parallel coordinates, to analyse data instead of using data analysis algorithms only, and also choose a Red-Black tree structure to de-duplicate data. It reduces the time complexity, including the time spent of searching data, adding data as well as deleting data. We show the advantages of our approach; moreover, we demonstrate how this method can enhance the efficiency and quality of computer forensics task.

Visual analytics: designing flexible filtering in parallel coordinate graph

“…The aimis to produce speed analysis and discover evidence through interactive visual exploration. [15].…”

“…The main strength of the graph is on its ability to reveal the relationship of multivariate data [15][16]in a single graph through its multi-dimensionalaxes. When compared to other visual technology, parallel coordinate graph is well ahead in term of time taken to analyze its data [17].…”