Header menu link for other important links
X
AssocGEN: Engine for analyzing metadata based associations in digital evidence
Serugudi V. Raghavan
Published in Institute of Electrical and Electronics Engineers Inc.
2014
Abstract
Traditionally, sources of digital evidence are analyzed by individually examining the various artifacts contained therein and using the artifact metadata to validate authenticity and sequence them. However, when artifacts from forensic images, folders, log files, and network packet dumps have to be analyzed, the examination of the artifacts and the metadata in isolation presents a significant challenge. Ideally, when a source is examined, it is a valuable task to determine correlations between the artifacts and group the related artifacts. Such a grouping can simplify the task of analysis by minimizing the need for human intervention. By virtue of the value that metadata bring to an investigation and its ubiquitous nature, metadata based associations is the first step in realizing such correlations automatically during analysis. In this paper, we present the AssocGEN analysis engine which uses the metadata to determine associations between artifacts that belong to files, logs and network packet dumps, and identifies metadata associations to group the related artifacts. A metadata association can represent any type of value match1 or relationship that is deemed relevant in the context of an investigation. We have conducted preliminary evaluation of AssocGEN on the classical ownership problem to highlight the benefits of incorporating this approach in existing forensic tools. © 2013 IEEE.
About the journal
JournalData powered by TypesetInt. Workshop Syst. Approaches Digit. Forensics Eng., SADFE
PublisherData powered by TypesetInstitute of Electrical and Electronics Engineers Inc.
Open AccessNo
Concepts (11)
  •  related image
    Engines
  •  related image
    FORENSIC ENGINEERING
  •  related image
    Metadata
  •  related image
    DIGITAL EVIDENCE
  •  related image
    FORENSIC TOOLS
  •  related image
    Human intervention
  •  related image
    LOG FILE
  •  related image
    NETWORK PACKETS
  •  related image
    SIMILARITY GROUP
  •  related image
    SIMILARITY POCKET
  •  related image
    DIGITAL FORENSICS