Impacts of increasing volume of digital forensic data: A survey and future research challenges

Digital Investigation

Volumn 11, Issue 4, 2014, Pages 273-294

  Quick, Darren ^a   Choo, Kim Kwang Raymond ^a  

^a UNIVERSITY OF SOUTH AUSTRALIA   (Australia)

Author keywords

Data mining; Data volume; Digital forensics; Evidence discovery; Forensic computer analysis; Intelligence analysis; Knowledge management

Indexed keywords

ARTIFICIAL INTELLIGENCE; COMPUTER CRIME; DATA MINING; DIGITAL STORAGE; ELECTRONIC CRIME COUNTERMEASURES; KNOWLEDGE MANAGEMENT; STORAGE AS A SERVICE (STAAS); SURVEYS;

CLOUD STORAGE SERVICES; COMPUTER ANALYSIS; CONTINUING DEVELOPMENT; DATA VOLUME; DIGITAL FORENSIC ANALYSIS; DISTRIBUTED PROCESSING; EVIDENCE DISCOVERY; INTELLIGENCE ANALYSIS;

DIGITAL FORENSICS;

EID: 84916888408     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2014.09.002     Document Type: Article

References (119)

1. T. Abraham Event sequence mining to develop profiles for computer forensic investigation purposes ACSW frontiers '06: proceedings of the 2006 Australasian workshops on grid computing and e-research 2006 145 153
2. ACC aCC Board of the Australian Crime Commission, chair annual report 2012-13 2013 Commonwealth of Australia
3. AccessDataCorporation Divide & conquer: overcoming computer forensic backlog through distributed processing and division of labor white paper 2010
4. ACPO Good practice guidelines for computer based evidence v4.0 2006 Association of Chief Police Officers www.7safe.com/electronic-evidence [viewed 05.03.14]
5. F. Adelstein Live forensics: diagnosing your system without killing it first Commun ACM 49 2006 63 66
6. R. Al-Zaidy, B.C.M. Fung, A.M. Youssef, and F. Fortin Mining criminal networks from unstructured text documents Digit Investig 8 2012 147 160
7. W. Alink, R.A.F. Bhoedjang, P.A. Boncz, and A.P. de Vries XIRAF - XML-based indexing and querying for digital forensics Digit Investig 3 Suppl. 2006 50 58
8. M. Alzaabi, A. Jones, and T.A. Martin An ontology-based forensic analysis tool J Digit Forensics, Secur Law 2013 Conference Suppl. 2013 121 135
9. D. Ayers A second generation computer forensic analysis system Digit Investig 6 2009 S34 S42
10. N. Beebe Digital forensic research: the good, the bad and the unaddressed 2009 Springer 17 36
11. N. Beebe, and J. Clark Dealing with terabyte data sets in digital investigations Adv Digit Forensics 2005 3 16
12. L. Bell Seagate launches 4TB hard disk engineered for video content The Inquirer 2013 http://www.theinquirer.net/inquirer/news/2269518/seagate-launches-4tb-hard-disk-engineered-for-video-content [viewed 22 June]
13. R.A.F. Bhoedjang, A.R. van Ballegooij, H.M.A. van Beek, J.C. van Schie, F.W. Dillema, and R.B. van Baar Engineering an online computer forensic service Digit Investig 9 2012 96 108
14. S. Biggs, and S. Vidalis Cloud computing: the impact on digital forensic investigations IEEE international conference for internet technology and secured transactions (ICITST 2009) 2009 IEEE 1 6
15. C. Boyd Time and date issues in forensic computing - a case study Digit Investig 1 2004 18 23
16. F. Breitinger, H. Baier, and D. White On the database lookup problem of approximate matching Digit Investig 11 Suppl. 1 2014 S1 S9
17. F. Breitinger, and V. Roussev Automated evaluation of approximate matching algorithms on real data Digit Investig 11 Suppl. 1 2014 S10 S17
18. D. Brezinski, and T.R.F.C. Killalea 3227-Guidelines for evidence collection and archiving 2002
19. R. Brown, B. Pham, and O. de Vel Design of a digital forensics image mining system Knowl-Based Intell Inf Eng Syst 2005 395 404
20. F. Buchholz, and B. Tjaden A brief study of time Digit Investig 4 2007 31 42
21. H. Carvey Windows Registry forensics: advanced digital forensic analysis of the Windows Registry 2011 Elsevier
22. A. Case, A. Cristina, L. Marziale, G.G. Richard, and V.F.A.C.E. Roussev Automated digital evidence discovery and correlation Digit Investig 5 Suppl. 2008 S65 S75
23. E. Casey "Dawn raids" bring a new form in incident response Digit Investig 5 2009 73 74
24. E. Casey Digital dust: evidence in every nook and cranny Digit Investig 6 2010 93 94
25. E. Casey Growing societal impact of digital forensics and incident response Digit Investig 11 2014 1 2
26. E. Casey, M. Ferraro, and L. Nguyen Investigation delayed is justice denied: proposals for expediting forensic examinations of digital evidence J Forensic Sci 54 2009 1353 1364
27. E. Casey, G. Katz, and J. Lewthwaite Honing digital forensic processes Digit Investig 10 2013 138 147
28. K. Cios, and L. Kurgan Trends in data mining and knowledge discovery Adv Tech Knowl Discov Data Min 2005 1 26
29. T. Coughlin High density hard disk drive trends in the USA J Magn Soc Jpn 25 2001 111 120
30. J. Craiger, M. Pollitt, and J. Swauger Law enforcement and digital evidence Handbook of information security vol. 2 2005 739 777
31. A. Culley Computer forensics: past, present and future Inf Secur Tech Rep 8 2003 32 36
32. DFI-News Guidance software announces EnCase forensic version 7 2011 http://www.dfinews.com/product-releases/2011/06/guidance-software-announces-encase-forensic-version-7#.UuR2hLRe6Uk [viewed 26 January]
33. U. Fayyad, G. Piatetsky-Shapiro, and P. Smyth From data mining to knowledge discovery in databases AI Mag 17 1996 37
34. U. Fayyad, G. Piatetsky-Shapiro, and P. Smyth The KDD process for extracting useful knowledge from volumes of data Commun ACM 39 1996 27 34
35. FBI-RCFL RCFL FBI regional computer forensic laboratory annual reports 2003-2012 2003-2012 FBI Quantico
36. M.M. Ferraro, and A. Russell Current issues confronting well-established computer-assisted child exploitation and computer crime task forces Digit Investig 1 2004 7 15
37. S. Garfinkel Forensic feature extraction and cross-drive analysis Digit Investig 3 2006 71 81
38. S. Garfinkel Digital forensics research: the next 10 years Digit Investig 7 Suppl. 2010 S64 S73
39. S. Garfinkel Digital forensics XML and the DFXML toolset Digit Investig 8 2012 161 174
40. S. Garfinkel Lessons learned writing digital forensics tools and managing a 30TB digital evidence corpus Digit Investig 9 Suppl. 2012 S80 S89
41. S. Garfinkel, Farrell, Roussev, and Dinolt Bringing science to digital forensics with standardized forensic corpora DFRWS 2009 2009 Montreal, Canada http://digitalcorpora.org/corpora/disk-images [viewed 9 September]
42. G. Gogolin The digital crime tsunami Digit Investig 7 2010 3 8
43. L. Greiner Sniper forensics netWorker 13 2009 8 10
44. E. Growchowski Emerging trends in data storage on magnetic hard disk drives Datatech September 1998 ICG Publishing 11 16
45. D.J. Hand, H. Mannila, and P. Smyth Principles of data mining 2001 MIT Press
46. M.A. Hearst Untangling text data mining Proceedings of the 37th annual meeting of the Association for Computational Linguistics on computational linguistics 1999 Association for Computational Linguistics 3 10
47. B. Hoelz, C. Ralha, and R. Geeverghese Artificial intelligence applied to computer forensics SAC '09: proceedings of the 2009 ACM symposium on applied computing 2009 ACM Honolulu, Hawaii 883 888
48. J. Huang, A. Yasinsac, and P.J. Hayes Knowledge sharing and reuse in digital forensics Systematic approaches to digital forensic engineering (SADFE), 2010 fifth IEEE international workshop on 2010 IEEE 73 78
49. INTERPOL Proceedings of the 14th INTERPOL forensic science symposium Lyon, France 2004
50. F. Iqbal, H. Binsalleeh, B. Fung, and M. Debbabi Mining writeprints from anonymous e-mails for forensic investigation Digit Investig 7 2010 56 64
51. F. Iqbal, R. Hadjidj, B.C.M. Fung, and M. Debbabi A novel approach of mining write-prints for authorship attribution in e-mail forensics Digit Investig 5 Suppl. 2008 S42 S51
52. B. Jones, S. Pleno, and M. Wilkinson The use of random sampling in investigations involving child abuse material Digit Investig 9 Suppl. 2012 S99 S107
53. E. Kenneally, and C. Brown Risk sensitive digital evidence collection Digit Investig 2 2005 101 119
54. M. Khan, C. Chatwin, and R. Young A framework for post-event timeline reconstruction using neural networks Digit Investig 4 2007 146 157
55. R. Kohavi, N. Rothleder, and E. Simoudis Emerging trends in business analytics Commun ACM 45 2002 45 48
56. M.B. Koopmans, and J.I. James Automated network triage Digit Investig 10 2013 129 137
57. C. LaVelle, and A. Konrad FriendlyRoboCopy: a GUI to RoboCopy for computer forensic investigators Digit Investig 4 2007 16 23
58. J. Lee, S. Un, and D. Hong High-speed search using Tarari content processor in digital forensics Digit Investig 5 2008 S91 S95
59. W. Lee, and S.J. Stolfo Data mining approaches for intrusion detection 2000 Defense Technical Information Center
60. LSI, LSI Tarari Content Processor Family Enhanced with High-Performance, Low-Latency Solution, http://www.lsi.com/about/newsroom/Pages/20100426apr.aspx, viewed 26.01.11.
61. A. Marrington, I. Baggili, G. Mohay, and A. Clark CAT detect (computer activity timeline detection): a tool for detecting inconsistency in computer activity timelines Digit Investig 8 Suppl. 2011 S52 S61
62. F. Marturana, and S. Tacconi A machine learning-based triage methodology for automated categorization of digital media Digit Investig 10 2013 193 204
63. L. Marziale, G. Richard, and V. Roussev Massive threading: using GPUs to increase the performance of digital forensics tools Digit Investig 4 2007 73 81
64. R. McKemmish What is forensic computing? Trends and issues in crime and criminal justice 1999 Australian Institute of Criminology 1 6
65. V. Mee, T. Tryfonas, and I. Sutherland The Windows Registry as a forensic artefact: illustrating evidence collection for internet usage Digit Investig 3 2006 166 173
66. K. Nance, B. Hay, and M. Bishop Digital forensics: defining a research agenda System sciences, 2009 HICSS'09 42nd Hawaii international conference on 2009 IEEE 1 6
67. NIJ Forensic examination of digital evidence: a guide for law enforcement 2004 http://nij.gov/nij/pubs-sum/199408.htm
68. G.E. Noel, and G.L. Peterson Applicability of latent Dirichlet allocation to multi-disk search Digit Investig 11 2014 43 56
69. N. Nykodym, R. Taylor, and J. Vilela Criminal profiling and insider cyber crime Digit Investig 2 2005 261 267
70. O. O'Connor Deploying forensic tools via PXE Digit Investig 1 2004 173 176
71. J.S. Okolica, G.L. Peterson, and R.F. Mills Using author topic to detect insider threats from email traffic Digit Investig 4 2007 158 164
72. J. Olsson, and M. Boldt Computer forensic timeline visualization tool Digit Investig 6 2009 S78 S87
73. R.E. Overill, J.A.M. Silomon, and K.A. Roscoe Triage template pipelines in digital forensic investigations Digit Investig 10 2013 168 174
74. G.A. Palmer Road map for digital forensic research Report from the First Digital Forensic Research Workshop (DFRWS) 2001
75. G. Palmer Forensic analysis in the digital world Int J Digit Evid 1 2002 1 6
76. H. Parsonage Computer forensics case assessment and triage - some ideas for discussion http://computerforensics.parsonage.co.uk/triage/triage.htm 2009 [viewed 4 August]
77. S. Peisert, M. Bishop, and K. Marzullo Computer forensics in forensis SIGOPS Oper Syst Rev 42 2008 112 122
78. M.M. Pollitt Triage: a practical solution or admission of failure Digit Investig 10 2013 87 88
79. N. Pringle, and M. Burgess Information assurance in a distributed forensic cluster Digit Investig 11 Suppl. 1 2014 S36 S44
80. N. Pringle, and I. Sutherland Is a computational grid a suitable platform for high performance digital forensics? Proceedings of the 7th European conference on information warfare and security 2008 Academic Conferences Limited 175
81. D. Quick, and K.-K.R. Choo Dropbox analysis: data remnants on user machines Digit Investig 10 2013 3 18
82. D. Quick, and K.-K.R. Choo Data reduction and data mining framework for digital forensic evidence: storage, intelligence, review and archive Trends Issues Crime Crim Justice 480 September 17, 2014 1 11
83. D. Quick, B. Martini, and K.-K.R. Choo Cloud storage forensics 2014 Syngress: An Imprint of Elsevier
84. S. Raghavan Digital forensic research: current state of the art CSI Trans ICT 1 2013 91 114
85. S. Raghavan, A. Clark, and G. Mohay FIA: an open forensic integration architecture for composing digital evidence Forensics in telecommunications, information and multimedia 2009 Springer 83 94
86. J. Ratcliffe Integrated intelligence and crime analysis: enhanced information management for law enforcement leaders 2nd ed. 2007 Police Foundation Washington, DC
87. A. Reyes, K. Oshea, J. Steele, J. Hansen, B. Jean, and T. Ralph Digital forensics and analyzing data. Cyber crime investigations 2007 Elsevier 219 259
88. O. Ribaux, A. Baylon, C. Roux, O. Delémont, E. Lock, and C. Zingg Intelligence-led crime scene processing. Part I: forensic intelligence Forensic Sci Int 195 2010 10 16
89. O. Ribaux, S. Walsh, and P. Margot The contribution of forensic science to crime analysis and investigation: forensic intelligence Forensic Sci Int 156 2006 171 181
90. G. Richard, and V. Roussev Digital forensics tools: the next generation Digital crime and forensic science in cyberspace 2006 75
91. G. Richard, and V. Roussev Next-generation digital forensics Commun ACM 49 2006 76 80
92. J.W. Riley, D.A. Dampier, and R. Vaughn A comparison of forensic hard drive imagers: a time analysis comparison between the ICS image MASSter-Solo III and the Logicube Talon J Digit Forensic Pract 2 2008 74 82
93. M.K. Rogers The future of computer forensics: a needs analysis survey Comput Secur 23 2004 12 16
94. M.K. Rogers, J. Goldman, R. Mislan, T. Wedge, and S. Debrota Computer forensics field triage process model J Digit Forensics, Secur Law 1 2006 19 37
95. V. Roussev, and C. Quates Content triage with similarity digests: the M57 case study Digit Investig 9 Suppl. 2012 S60 S68
96. V. Roussev, C. Quates, and R. Martell Real-time digital forensics and triage Digit Investig 10 2013 158 167
97. V. Roussev, and G. Richard Breaking the performance wall: the case for distributed digital forensics Proceedings of the 2004 digital forensics research workshop 2004
98. B. Schatz, and A.J. Clark An open architecture for digital evidence integration AusCERT Asia Pacific information technology security conference 21-26 May 2006, Gold Coast, Queensland 2006
99. B. Schatz, G. Mohay, and A. Clark A correlation method for establishing provenance of timestamps in digital evidence Digit Investig 3 Suppl. 2006 98 107
100. M. Shannon Forensic relative strength scoring: ASCII and entropy scoring Int J Digit Evid 2 2004 151 169
101. A. Shaw, and A. Browne A practical and robust approach to coping with large volumes of data submitted for digital forensic examination Digit Investig 10 2013 116 128
102. E. Shaw The role of behavioral research and profiling in malicious cyber insider investigations Digit Investig 3 2006 20 31
103. A. Sheldon The future of forensic computing Digit Investig 2 2005 31 35
104. S. Shiaeles, A. Chryssanthou, and V. Katos On-scene triage open source forensic tool chests: are they effective? Digit Investig 10 2013 99 115
105. P. Sommer The challenges of large computer evidence cases Digit Investig 1 2004 16 17
106. M.W. Stevens Unification of relative time frames for digital forensics Digit Investig 1 2004 225 239
107. S. Teelink, and R. Erbacher Improving the computer forensic analysis process through visualization Commun ACM 49 2006 71 75
108. B. Turnbull, R. Taylor, and B. Blundell The anatomy of electronic evidence; quantitative analysis of police e-crime data ARES '09 international conference on availability, reliability and security 2009 143 149
109. P. Turner Unification of digital evidence from disparate sources (digital evidence bags) Digit Investig 2 2005 223 228
110. P. Turner Selective and intelligent imaging using digital evidence bags Digit Investig 3 Suppl. 2006 59 64
111. UNODC United Nations Office on Drugs and Crime - criminal intelligence manual for analysts 2011 United Nations Vienna, Austria New York
112. R.B. van Baar, H.M.A. van Beek, and E.J. van Eijk Digital forensics as a service: a game changer Digit Investig 11 Suppl. 1 2014 S54 S62
113. T. Vidas, B. Kaplan, and M. Geiger OpenLV: empowering investigators and first-responders in the digital forensics process Digit Investig 11 Suppl. 1 2014 S45 S53
114. Walmart Western Digital Green 4TB desktop internal hard-drive http://www.walmart.com/ip/WD-Green-4TB-Desktop-Internal-Hard-Drive/30579528 2014 [viewed 21 June]
115. C. Walter Kryder's law Sci Am 293 2 2005 32 33
116. M. Weiser, D.P. Biros, and G. Mosier Glenn S. Dardick, Development of a national repository of digital forensic intelligence 2006 Longwood University Virginia USA 5
117. J. Wiles, T. Alexander, S. Ashlock, S. Ballou, L. Depew, and G. Dominguez Forensic examination in a terabyte world Techno security's guide to e-discovery and digital forensics 2007 Elsevier 129 146
118. A. Wong Explosion of data envelops man in the street The Australian 2010 Australia
119. E. Zimmerman Imaging test results https://docs.google.com/spreadsheet/lv?key=0Al7os14ND-cFdGp1NDR2WGwyakR2TkJtNUFXa29pNXc&type=view&gid=0&f=true&sortcolid=11&sortasc=true&rowsperpage=250 2013 [viewed 18 June]