A framework for the forensic investigation of unstructured email relationship data

International Journal of Digital Crime and Forensics

Volumn 3, Issue 3, 2011, Pages 1-18

  Haggerty, John ^a   Karran, Alexander J ^b   Lamb, David J ^b   Taylor, Mark J ^b  

^a UNIVERSITY OF SALFORD   (United Kingdom)

^b LIVERPOOL JOHN MOORES UNIVERSITY   (United Kingdom)

Author keywords

Digital forensics; Email; Framework; Social network analysis; Structured and unstructured data

Indexed keywords

AS RELATIONSHIPS; DATA SETS; DIGITAL FORENSIC; DIGITAL INVESTIGATION; E-MAIL NETWORKS; EMAIL COMMUNICATION; FORENSIC ANALYSIS; FORENSIC INVESTIGATION; FRAMEWORK; KEY ACTORS; POTENTIAL SOURCES; POWER RELATIONS; QUALITATIVE INFORMATION; RELATIONSHIP DATA; SOCIAL NETWORK ANALYSIS; SOCIAL NETWORKS; STRUCTURED DATA; UNSTRUCTURED DATA;

COMPUTER CRIME; ELECTRONIC CRIME COUNTERMEASURES; VISUALIZATION;

ELECTRONIC MAIL;

EID: 80053018646     PISSN: 19416210     EISSN: 19416229     Source Type: Journal    
DOI: 10.4018/jdcf.2011070101     Document Type: Conference Paper

References (36)

1. Access Data. (2011). FTK forensic tool kit. Retrieved from http://www.accessdata.com
2. Bird, C., Gourley, A., Devanbu, P., Gertz, M., & Swaminathan, A. (2006). Mining e-mail social networks. In Proceedings of the International Workshop on Mining Software Repositories (pp. 137-143).
3. Carenini, G., Ng, R., Zhou, X., & Zwart, E. (2005). Discovery and regeneration of hidden emails. In Proceedings of the ACM Symposium on Applied Computing (pp. 503-510).
4. Cohen, W. W. (2009). Enron email dataset. Retrieved from http://www.cs.cmu.edu/~enron/
5. Collingsworth, B., Menezes, R., & Martins, P. (2009). Assessing organizational stability via network analysis. In Proceedings of the IEEE Symposium on Computational Intelligence for Financial Engineering (pp. 43-50).
6. de Nooy, W., Mrvar, A., & Batagelj, V. (2005). Exploratory social network analysis with Pajek. Cambridge, UK: Cambridge University Press.
7. st International Workshop on Information Forensics and Security (pp. 101-105).
8. Falkowski, T., Bartelheimer, J., & Spiliopoulou, M. (2006). Mining and visualizing the evolution of subgroups in social networks. In Proceedings of the International Conference on Web Intelligence (pp. 52-58).
9. Freeman, L. C. (1978/79). Centrality in social networks. Social Networks, 1, 215-239. doi:10.1016/0378-8733(78)90021-7
10. Granovetter, M. S. (1973). The strength of weak ties. American Journal of Sociology, 78 (6), 1360-1380. doi:10.1086/225469
11. Guidance Software. (2011). Encase. Retrieved from http://www. guidancesoftware.com
12. Hadjidj, R., Debbabi, M., Lounis, H., Iqbal, F., Szporer, A., & Benredjem, D. (2009). Towards an integrated e-mail forensic analysis framework. Digital Investigation, 5 (3-4), 124-137. doi:10.1016/j.diin.2009.01.004
13. Haggerty, J., Lamb, D., & Taylor, M. (2009). Social network visualization for forensic investigation of e-mail. In Proceedings of the 4th Annual Workshop on Digital Forensics and Incident Analysis (pp. 81-92).
14. rd Annual Workshop on Digital Forensics and Incident Analysis (pp. 12-20).
15. Henseler, H. (2010). Network-based filtering for large email collections in e-discovery. Artificial Intelligence and Law, 18 (4), 413-430. doi:10.1007/s10506-010-9099-3
16. Hu, B., & Gong, J. (2010). Modeling individual-based social network with spatial-temporal information. In Proceedings of the International Conference on Management and Service Science (pp. 1-4).
17. Kalamaras, D. B. (2011). SocNetV. Retrieved from http://socnetv. sourceforge.net
18. Kim, U. (2007). Analysis of personal email networks using spectral decomposition. International Journal of Computer Science and Network Security, 7 (4), 185-188.
19. Klensin, J. (2008a). RFC 5321: Simple mail transfer protocol. Retrieved from http://tools.ietf.org/html/rfc5321
20. Klensin, J. (2008b). RFC 5322: Internet message format. Retrieved from http://tools.ietf.org/html/rfc5322
21. Lawler, E. J., & Yoon, J. (1996). Commitment in exchange relations: Test of a theory of relational cohesion. American Sociological Review, 61, 89-108. doi:10.2307/2096408 (Pubitemid 126590173)
22. Lee, B., Parr, C. S., Plaisant, C., Bederson, B. B., Veksler, V. D., Gray, W. D., & Kotfila, C. (2006). Tree Plus: Interactive exploration of networks with enhanced tree layouts. IEEE Transactions on Visualization and Computer Graphics, 12 (6), 1414-1426. doi:10.1109/TVCG.2006.106 (Pubitemid 44523086)
23. th International Conference on Genetic and Evolutionary Computing (pp. 264-267).
24. Orloff, J. (2011). 35 interesting statistics about email. Retrieved from http://www.theemailadmin.com/2011/05/35-interesting-statistics-about-email/
25. Perer, A., & Schneiderman, B. (2009). Integrating statistics and visualization for exploratory power: From long-term case studies to design guidelines. IEEE Computer Graphics and Applications, 39-51. doi:10.1109/MCG. 2009.44
26. Powers, W. C., Jr., Troubh, R. S., & Winokur, H. S., Jr. (2002). Report of investigation by the special investigative committee of the Board of Directors of Enron Corp. Retrieved from http://news.findlaw.com/wsj/docs/enron/ sicreport/index.html
27. Richard, G. G. III, & Roussev, V. (2006). Next-generation digital forensics. Communications of the ACM, 49 (2), 76-80. doi:10.1145/1113034.1113074
28. Snasel, V., Horak, Z., Kocibova, J., & Abraham, A. (2009). Reducing social network dimensions using matrix factorization methods. In Proceedings of the Conference on Advances in Social Network Analysis and Mining (pp. 348-351).
29. United States Department of Justice (UDOJ). (2006). Kenneth L. Lay and Jeffrey K. Skilling Jury trial - Government exhibits. Retrieved from http://www.justice.gov/enron/exhibit/04-18/index.htm
30. th Hawaii International Conference on System Sciences (pp. 1-10).
31. Vlado, A. (2011). Pajek. Retrieved from http://vlado.fmf.uni-lj.si/pub/ networks/pajek/default.htm
32. Wang, W., & Daniels, T. E. (2008). A graph based approach toward network forensic analysis. ACM Transactions on Information and System Security, 12 (1), 401-433. doi:10.1145/1410234.1410238
33. Wasserman, S., & Faust, K. (1994). Social network analysis: Methods and applications. Cambridge, UK: Cambridge University Press.
34. Wei, C., Sprague, A., Warner, G., & Skjellum, A. (2008). Mining spam e-mail to identify common origins for forensic application. In Proceedings of the ACM Symposium on Applied Computing (pp. 1433-1437).
35. Wiil, U. K., Gniadek, J., & Memon, N. (2010). Measuring link importance in terrorist networks. In Proceedings of the International Conference on Social Networks Analysis and Mining (pp. 225-232).
36. rd Hawaii International Conference of System Sciences (pp. 1-10).