Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers

Research Article

Using Relationship-Building in Event Profiling for Digital Forensic Investigations

Download
418 downloads
  • @INPROCEEDINGS{10.1007/978-3-642-23602-0_4,
        author={Lynn Batten and Lei Pan},
        title={Using Relationship-Building in Event Profiling for Digital Forensic Investigations},
        proceedings={Forensics in Telecommunications, Information, and Multimedia. Third International ICST Conference, e-Forensics 2010, Shanghai, China, November 11-12, 2010, Revised Selected Papers},
        proceedings_a={E-FORENSICS},
        year={2012},
        month={10},
        keywords={digital forensics relation event profiling},
        doi={10.1007/978-3-642-23602-0_4}
    }
    
  • Lynn Batten
    Lei Pan
    Year: 2012
    Using Relationship-Building in Event Profiling for Digital Forensic Investigations
    E-FORENSICS
    Springer
    DOI: 10.1007/978-3-642-23602-0_4
Lynn Batten1,*, Lei Pan1,*
  • 1: Deakin University
*Contact email: lmbatten@deakin.edu.au, l.pan@deakin.edu.au

Abstract

In a forensic investigation, computer profiling is used to capture evidence and to examine events surrounding a crime. A rapid increase in the last few years in the volume of data needing examination has led to an urgent need for automation of profiling. In this paper, we present an efficient, automated event profiling approach to a forensic investigation for a computer system and its activity over a fixed time period. While research in this area has adopted a number of methods, we extend and adapt work of Marrington et al. based on a simple relational model. Our work differs from theirs in a number of ways: our object set (files, applications etc.) can be enlarged or diminished repeatedly during the analysis; the transitive relation between objects is used sparingly in our work as it tends to increase the set of objects requiring investigative attention; our objective is to reduce the volume of data to be analyzed rather than extending it. We present a substantial case study to illuminate the theory presented here. The case study also illustrates how a simple visual representation of the analysis could be used to assist a forensic team.