Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events

by   Xiaoyu Du, et al.

Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems. These can significantly aid investigators in the discovery and prioritisation of evidence. This paper presents one approach for file artefact relevancy determination building on the growing trend towards a centralised, Digital Forensics as a Service (DFaaS) paradigm. This approach enables the use of previously encountered pertinent files to classify newly discovered files in an investigation. Trained models can aid in the detection of these files during the acquisition stage, i.e., during their upload to a DFaaS system. The technique generates a relevancy score for file similarity using each artefact's filesystem metadata and associated timeline events. The approach presented is validated against three experimental usage scenarios.



page 1

page 5


SoK: Exploring the State of the Art and the Future Potential of Artificial Intelligence in Digital Forensic Investigation

Multi-year digital forensic backlogs have become commonplace in law enfo...

Methodology for the Automated Metadata-Based Classification of Incriminating Digital Forensic Artefacts

The ever increasing volume of data in digital forensic investigation is ...

Making Honey Files Sweeter: SentryFS – A Service-Oriented Smart Ransomware Solution

The spread of ransomware continues to cause devastation and is a major c...

Metadata Extraction from Raw Astroparticle Data of TAIGA Experiment

Today, the operating TAIGA (Tunka Advanced Instrument for cosmic rays an...

Metadata-Based Detection of Child Sexual Abuse Material

In the last decade, the scale of creation and distribution of child sexu...

5W1H-based Expression for the Effective Sharing of Information in Digital Forensic Investigations

Digital forensic investigation is used in various areas related to digit...

Enabling the Remote Acquisition of Digital Forensic Evidence through Secure Data Transmission and Verification

Providing the ability to any law enforcement officer to remotely transfe...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.