Content area
Full text
ABSTRACT
The analysis of forensic investigation results has generally been identified as the most complex phase of a digital forensic investigation. This phase becomes more complicated and time consuming as the storage capacity of digital devices is increasing, while at the same time the prices of those devices are decreasing. Although there are some tools and techniques that assist the investigator in the analysis of digital evidence, they do not adequately address some of the serious challenges, particularly with the time and effort required to conduct such tasks. In this paper, we consider the use of semantic web technologies and in particular the ontologies, to assist the investigator in analyzing digital evidence. A novel ontology-based framework is proposed for forensic analysis tools, which we believe has the potential to influence the development of such tools. The framework utilizes a set of ontologies to model the environment under investigation. The evidence extracted from the environment is initially annotated using the Resource Description Framework (RDF). The evidence is then merged from various sources to identify new and implicit information with the help of inference engines and classification mechanisms. In addition, we present the ongoing development of a forensic analysis tool to analyze content retrieved from Android smart phones. For this purpose, several ontologies have been created to model some concepts of the smart phone environment.
Keywords: digital forensic investigation, digital forensic analysis tool, semantic web, ontology, android
1. INTRODUCTION
As a result of the ongoing trends towards larger storage capacities for digital devices, the digital forensics domain is facing a number of serious challenges with the increased time and effort required to analyze data from these devices. Such trends have influenced the process of identifying relevant traces which is usually surrounded by a vast volume of irrelevant traces. Additionally, the complexity of data formats and their diversity have made the investigator spend much of the time in understanding the structure of the data rather than locating relevant evidence.
The existing forensic tools, which have been referred to as First Generation (FG) forensic tools by Daniel Ayers (Ayers, 2009), have shown a number of limitations in addressing the increasing complexity and volumes of data. Popular FG forensic tools such as EnCase and FTK tend to have...