Sage Journals: Discover world-class research

Abstract

We present a visual analytics framework for exploring the textual relationships in computer forensics. Based on a task analysis study performed with practitioners, our tool addresses the inefficiency of searching for related text documents on a hard drive. Our framework searches both allocated and unallocated sectors for text and performs some pre-analysis processing; this information is then presented via a visualization that displays both the frequency of relevant terms and their location on the disk. We also present a case study that demonstrates our framework's operation, and we report on an informal evaluation conducted with forensics analysts from the Mississippi State Attorney General's Office and National Forensics Training Center.

Keywords

computer forensics visualization visual analytics treemaps tag clouds

Get full access to this article

View all access options for this article.

References

Bequai

(2002) Syndicated crime and international terrorism. Computers and Security 21(4): 333–337.

Kessler

Schirling

(2002) Computer forensics: Cracking the books, cracking the case. Information Security April: 68–81.

Wolfe

(2003) Computer forensics. Computers and Security 22(1): 26–28.

Householder

Houle

Dougherty

(2002) Computer attack trends challenge internet security. IEEE Computer 35(4): 5–7.

Thompson

(1999) Chasing after ‘petty' computer crime. IEEE Potentials 18(1): 20–22.

EnCase. http://www.guidancesoftware.com/products/ef_index.aspx, accessed May 2009.

AccessData. Forensic toolkit 2.0. http://www.accessdata.com/forensictoolkit.html, accessed May 2009.

Carrier

Autospy forensic browser. http://www.sleuthkit.org/autopsy/, accessed May 2009.

Carrier

(2004) Know Your Enemy, 2nd edn. Computer Forensics Basics. Chapter 11. Addison Wesley: Boslon, Chapter 11.

10.

Foundstone bintext, http://www.foundstone.com/us/resources/proddesc/bintext.htm, accessed October 2010.

11.

Jankun-Kelly

T. J.

Wilson

Stamps

Franck

Carver

Swan

J. E.

II (2009) A visual analytic framework for exploring relationships in textural contents of digital forensics evidence. Proceedings of the 6th International Workshop on Visualization for Computer Security, pp. 39–44.

12.

Goodall

J. R.

(2009) Visualization is better! a comparative evaluation. Proceedings of the 6th International Workshop on Visualization for Computer Security, pp. 57–67.

13.

Teelink

Erbacher

R.F.

(2006) Improving the computer forensic analysis process through visualization. Communications of the ACM 49(2): 71–75.

14.

Teelink

Erbacher

R. F.

(2006) Foundations for visual forensic analysis. Proceedings of the 7th IEEE SMC Workshop on Information Assurance, pp. 192–196.

15.

Bederson

B.B.

Shneiderman

Wattenberg

(2002) Ordered and quantum treemaps: Making effective use of 2D space to display hierarchies. ACM Transactions on Graphics 21(4): 833–854.

16.

Shneiderman

(1992) Tree visualization with treemaps: A 2-d space-filling approach. ACM Transactions on Graphics 11(1): 92–99.

17.

Schwartz

Liebrock

L.M.

(2008) A term distribution visualization approach to digital forensic string search. In: Goodall

J.R.

Conti

G.J.

K.-L.

(eds.), Proceedings of the Fifth International Workshop on Visualization for Computer Securit Vol. 5210. Berlin: Springer, pp. 36–43.

18.

Hearst

M.A.

(1995) Tilebars: Visualization of term distribution information in full text information access. CHI, pp. 59–66.

19.

Hackos

J.T.

Redish

J.C.

(1998) User and Task Analysis for Interface Design. New York: John Wiley & Sons Inc.

20.

Hix

Hartson

H.R.

(1993) Developing User Interfaces: Ensuring Usability through Product & Process. New York: John Wiley & Sons Inc..

21.

Mayhew

(1999) The Usability Engineering Lifecycle: A Practitioner's Handbook for User Interface Design. San Fancisco: Morgan Kaufmann Publishers.

22.

Jankun-Kelly

T.J.

Franck

Wilson

Carver

Dampier

Swan

J.E.

II (2008) Show me how you see: Lessons learned from studying computer forensics experts for visualization. In: Goodall

Conti

K.-L.

(eds.), Proceedings of the Fifth International Workshop on Visualization for Computer Security Vol. 5210. Berlin: Springer, pp. 80–86.

23.

Ericsson

K.A.

Simon

H.A.

(1993) Protocol Analysis: Verbal Reports as Data. Cambridge: Bradford Books/MIT Press.

24.

van Someren

M.W.

Bernard

Y.F.

Sandberg

J.A.C.

(1994) The Think Aloud Method: A Practical Guide to Modeling Cognitive Processes. New York: Academic Press.

25.

Bruls

Huizing

van Wijk

J. J.

(2000) Squarified treemaps. Proceedings of the Joint Eurographics/IEEE TVCG Symposium on Visualization 2000, pp. 33–42.

26.

Collins

Viéagas

F.B.

Wattenberg

(2009) Parallel tag clouds to explore and analyze faceted text corpora. In: Stasko van

Wijk

J.J.

(eds.), IEEE Symposium on Visual Analytics Science and Technology 2009, pp. 91–98.

27.

Porter

M.F.

(1980) An algorithm for suffix stripping. Program 14(3): 130–137.

28.

Carrier

(2005) File System Forensic Analysis. Addison Wesley: Boston.

29.

Carrier

The Sleuth Kit. http://sleuthkit.org/sleuthkit/, accessed May 2009.

30.

Dandass

Y.S.

(2007) Hardware-assisted scanning for signature patterns in image file fragments. 40th Annual Hawaii International Conference on System Sciences. IEEE Computer Society, p. 268.

31.

Wattenberg

Viégas

F.B.

(2008) The word tree, an interactive visual concordance. IEEE Transactions on Visualization and Computer Graphics 14(6): 1221–1228.

32.

van Ham

Watenberg

Viéagas

F.B.

(2009) Mapping text with phrase nets. IEEE Transactions on Visualization and Computer Graphics 15(6): 1169–1176.

Visual Analysis for Textual Relationships in Digital Forensic Evidence

Abstract

Keywords

Get full access to this article

References