A Visual Analytic Framework for Exploring Relationships in Textual Contents of Digital Forensics Evidence
T.J. Jankun-Kelly, David Wilson, Andrew S. Stamps, Josh Franck, Jeffery Carver, and J. Edward Swan II. A Visual Analytic Framework for Exploring Relationships in Textual Contents of Digital Forensics Evidence. In Proceedings of Workshop on Visualization for Cyber Security (VizSec 2009), pp. 39–44, October 2009.
Download
Abstract
We describe the development of a set of tools for analyzing the textual contents of digital forensic evidence for the purpose of enhancing an investigator's ability to discover information quickly and efficiently. By examining the textual contents of files and unallocated space, relationships between sets of files and clusters can be formed based on the information that they contain. Using the information gathered from the evidence through the analysis tool, the visualization tool can be used to search through the evidence in an organized and efficient manner. The visualization depicts both the frequency of relevant terms and their location on disk. We also discuss a task analysis with forensics officers to motivate the design.
Additional Information
Acceptance rate: 43% (10 out of 23)
BibTeX
@InProceedings{VIZSEC09-ertc,
author = {T.J. Jankun-Kelly and David Wilson and Andrew S. Stamps and
Josh Franck and Jeffery Carver and J. Edward {Swan~II}},
title = {A Visual Analytic Framework for Exploring Relationships in
Textual Contents of Digital Forensics Evidence},
booktitle = {Proceedings of Workshop on Visualization for
Cyber Security (VizSec 2009)},
date = {October 11},
month = {October},
year = 2009,
pages = {39--44},
abstract = {
We describe the development of a set of tools for analyzing the
textual contents of digital forensic evidence for the purpose of
enhancing an investigator's ability to discover information quickly
and efficiently. By examining the textual contents of files and
unallocated space, relationships between sets of files and clusters
can be formed based on the information that they contain. Using the
information gathered from the evidence through the analysis tool, the
visualization tool can be used to search through the evidence in an
organized and efficient manner. The visualization depicts both the
frequency of relevant terms and their location on disk. We also
discuss a task analysis with forensics officers to motivate the
design.
},
}