Skip to main content
Disciplines
Automotive Business IT + Informatics Construction + Real Estate Electrical Engineering + Electronics Energy + Sustainability Insurance + Risk Finance + Banking Management + Leadership Marketing + Sales Mechanical Engineering + Materials
Events
DE
EN
Books
Journals
Topic Page
Marketing
Start single access now
Access for companies
EXTENDED SEARCH
Log in
Top
Published in:
Introduction Read chapter Read first chapter

2018 | OriginalPaper | Chapter

2. Background and Literature Review

Authors : Darren Quick, Kim-Kwang Raymond Choo

Published in: Big Digital Forensic Data

Publisher: Springer Singapore

Log in

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

Big Data has been defined as “high-volume, high-velocity and high-variety information assets that demand cost-effective, innovative forms of information processing for enhanced insight and decision making” (Gartner in IT glossary: big data, 2013).

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

inform now

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

inform now
previous chapter Introduction
next chapter Data Reduction and Data Mining Frame-Work
Footnotes
1
Tarari content processors are designed to distribute processing of data across multiple threads to speed up regular expression search times, and other functions, and are often used in intrusion detection applications (LSI 2011).
 
Literature
Abraham, T. (2006). Event sequence mining to develop profiles for computer forensic investigation purposes. In ACSW Frontiers’06: Proceedings of the 2006 Australasian workshops on Grid computing and e-Research (pp. 145–153).
AccessDataCorporation. (2010). Divide & Conquer: Overcoming computer forensic backlog through distributed processing and division of labor White Paper.
Adelstein, F. (2006). Live forensics: diagnosing your system without killing it first. Communications of the ACM, 49(2), 63–66.CrossRef
Al Fahdi, M., Clarke, N., Li, F., & Furnell, S. (2016). A suspect-oriented intelligent and automated computer forensic analysis. Digital Investigation, 18, 65–76.CrossRef
Alink, W., Bhoedjang, R. A. F., Boncz, P. A., & de Vries, A. P. (2006). XIRAF—XML-based indexing and querying for digital forensics, Digital Investigation, 3, 50–58.CrossRef
Alzaabi, M., Jones, A., & Martin, T. A. (2013). An ontology-based forensic analysis tool. Journal of Digital Forensics, Security & Law, 2013, 121–135. (Conference Supplement).
Ayers, D. (2009). A second generation computer forensic analysis system. Digital Investigation, 6, S34–S42.CrossRef
Baggili, I., & Breitinger, F. (2015). Data sources for advancing cyber forensics: what the social world has to offer. In 2015 AAAI Spring Symposium Series.
Beebe, N. (2009). Digital forensic research: the good, the bad and the unaddressed. In Advances in Digital Forensics (pp. 17–36). Springer.CrossRef
Beebe, N., & Clark, J. (2005). Dealing with terabyte data sets in digital investigations. In Advances in Digital Forensics (pp. 3–16).
Bhoedjang, R. A. F., van Ballegooij, A. R., van Beek, H. M. A., van Schie, J. C., Dillema, F. W., van Baar, R. B., et al. (2012). Engineering an online computer forensic service. Digital Investigation, 9(2), 96–108.CrossRef
Biggs, S., & Vidalis, S. (2009). Cloud computing: the impact on digital forensic investigations. In IEEE International Conference for Internet Technology and Secured Transactions (ICITST 2009) (pp. 1–6). IEEE.
Boyd, C. (2004). Time and date issues in forensic computing-a case study. Digital Investigation, 1(1), 18–23.CrossRef
Brady, O., Overill, R., & Keppens, J. (2015). DESO: addressing volume and variety in large-scale criminal cases. Digital Investigation, 15, 72–82.CrossRef
Breitinger, F., & Roussev, V. (2014). Automated evaluation of approximate matching algorithms on real data. Digital Investigation, 11(Suppl. 1), S10–S17.CrossRef
Breitinger, F., Baier, H., & White, D. (2014). On the database lookup problem of approximate matching. Digital Investigation, 11(Suppl. 1), S1–S9.CrossRef
Brezinski, D., & Killalea, T. (2002). RFC 3227–Guidelines for evidence collection and archiving.
Brown, R., Pham, B., & de Vel, O. (2005). Design of a digital forensics image mining system. In Knowledge-Based Intelligent Information and Engineering Systems (pp. 395–404).
Buchholz, F., & Tjaden, B. (2007). A brief study of time. Digital Investigation, 4, 31–42.CrossRef
Carvey, H. (2011). Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry. Elsevier.
Case, A., Cristina, A., Marziale, L., Richard, G.G., & Roussev, V. (2008). FACE: automated digital evidence discovery and correlation. Digital Investigation, 5, S65–S75.CrossRef
Casey, E. (2009). “Dawn raids” bring a new form in incident response. Digital Investigation, 5(3–4), 73–74.CrossRef
Casey, E. (2010). Digital dust: Evidence in every nook and cranny. Digital Investigation, 6(3–4), 93–94.CrossRef
Casey, E. (2014). Growing societal impact of digital forensics and incident response. Digital Investigation, 11(1), 1–2.MathSciNetCrossRef
Casey, E., Ferraro, M., & Nguyen, L. (2009). Investigation delayed is justice denied: proposals for expediting forensic examinations of digital evidence. Journal of Forensic Sciences, 54(6), 1353–1364.CrossRef
Casey, E., Katz, G., & Lewthwaite, J. (2013). Honing digital forensic processes. Digital Investigation, 10(2), 138–147.CrossRef
Cios, K., & Kurgan, L. (2005). Trends in data mining and knowledge discovery. In Advanced Techniques in Knowledge Discovery and Data Mining (pp. 1–26).
Coughlin, T. (2001). High density hard disk drive trends in the USA. Journal Magnetics Society of Japan, 25(3/1), 111–120.
Craiger, J., Pollitt, M., & Swauger, J. (2005). Law enforcement and digital evidence. Handbook of Information Security, 2, 739–777.
Culley, A. (2003). Computer forensics: past, present and future. Information Security Technical Report, 8(2), 32–36.CrossRef
Dalins, J., Wilson, C., & Carman, M. (2015). Monte-carlo filesystem search–A crawl strategy for digital forensics. Digital Investigation, 13, 58–71.CrossRef
Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996a). From data mining to knowledge discovery in databases. AI magazine, 17(3), 37.
Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996b). The KDD process for extracting useful knowledge from volumes of data. Communications of the ACM, 39(11), 27–34.CrossRef
Fayyad, U., Piatetsky-Shapiro, G., & Smyth, P. (1996c). Knowledge discovery and data mining: Towards a unifying framework. Knowledge Discovery and Data Mining, 82–88.
FBI_RCFL. (2003–2012). FBI Regional Computer Forensic Laboratory Annual Reports 2003–2012, FBI, Quantico.
Ferraro, M. M., & Russell, A. (2004). Current issues confronting well-established computer-assisted child exploitation and computer crime task forces. Digital Investigation, 1(1), 7–15.CrossRef
Fowler, K. (2012). Hadoop Forensics, Tackling the elephant in the room. In SecTor 2012: Security Education Conference Toronto October 1–3, 2012 MTCC Toronto.
Garfinkel, S. (2006). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3, 71–81.CrossRef
Garfinkel, S. (2010). Digital forensics research: The next 10 years. Digital Investigation, 7, S64–S73.CrossRef
Garfinkel, S. (2012a). Lessons learned writing digital forensics tools and managing a 30 TB digital evidence corpus. Digital Investigation, 9, S80–S89.CrossRef
Garfinkel, S. (2012b). Digital forensics XML and the DFXML toolset. Digital Investigation, 8(3–4), 161–174.CrossRef
Garfinkel, S. (2013). Digital media triage with bulk data analysis and bulk_extractor. Computers & Security, 32, 56–72.CrossRef
Garfinkel, S., Farrell, P., Roussev, V., & Dinolt, G. (2009b). Bringing science to digital forensics with standardized forensic corpora. Digital Investigation, 6, S2–S11.CrossRef
Gogolin, G. (2010). The digital crime tsunami. Digital Investigation, 7(1–2), 3–8.CrossRef
Grier, J., & Richard, G. G. (2015). Rapid forensic acquisition of large media with sifting collectors. Digital Investigation, 14(2015), S34–S44.CrossRef
Growchowski, E. (1998). Emerging trends in data storage on magnetic hard disk drives. Datatech (September 1998) (pp. 11–16). ICG Publishing.
Gupta, J. N., Kalaimannan, E., & Yoo, S.-M. (2016). A heuristic for maximizing investigation effectiveness of digital forensic cases involving multiple investigators. Computers & Operations Research, 69, 1–9.MathSciNetCrossRef
Halboob, W., Mahmod, R., Abulaish, M., Abbas, H., & Saleem, K. (2015). Data warehousing based computer forensics investigation framework. In 2015 12th International Conference on Information Technology-New Generations (ITNG).
Hand, D.J., Mannila, H., & Smyth, P. (2001). Principles of data mining. MIT Press.
Hearst, M.A. (1999). Untangling text data mining. In Proceedings of the 37th Annual Meeting of the Association for Computational Linguistics on Computational Linguistics (pp. 3–10). Association for Computational Linguistics.
Hicks, C., Beebe, N., & Haliscak, B. (2016). Extending web mining to digital forensics text mining. In Information Systems Security and Privacy (SIGSEC) AMCIS 2016.
Hitchcock, B., Le-Khac, N.-A., & Scanlon, M. (2016). Tiered forensic methodology model for Digital Field Triage by non-digital evidence specialists. Digital Investigation, 16, S75–S85.CrossRef
Hoelz, B., Ralha, C., & Geeverghese, R. (2009). Artificial intelligence applied to computer forensics. In SAC’09: Proceedings of the 2009 ACM symposium on Applied Computing (pp. 883–888). ACM.
Huang, J., Yasinsac, A., & Hayes, P. J. (2010). Knowledge sharing and reuse in digital forensics. In 2010 Fifth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering (SADFE) (pp. 73–78). IEEE.
INTERPOL. (2004). In Proceedings of the 14th INTERPOL Forensic Science Symposium.
Iqbal, F., Hadjidj, R., Fung, B. C. M., & Debbabi, M. (2008). A novel approach of mining write-prints for authorship attribution in e-mail forensics. Digital Investigation, 5, S42–S51.CrossRef
Iqbal, F., Binsalleeh, H., Fung, B., & Debbabi, M. (2010). Mining writeprints from anonymous e-mails for forensic investigation. Digital Investigation, 7(1), 56–64.CrossRef
Jones, B., Pleno, S., & Wilkinson, M. (2012). The use of random sampling in investigations involving child abuse material. Digital Investigation, 9, S99–S107.CrossRef
Kantardzic, M. (2011). Data mining: concepts, models, methods, and algorithms. John Wiley & Sons.CrossRef
Kenneally, E., & Brown, C. (2005). Risk sensitive digital evidence collection. Digital Investigation, 2(2), 101–119.CrossRef
Khan, M., Chatwin, C., & Young, R. (2007). A framework for post-event timeline reconstruction using neural networks. Digital Investigation, 4(3–4), 146–157.CrossRef
Kohavi, R., Rothleder, N., & Simoudis, E. (2002). Emerging trends in business analytics. Communications of the ACM, 45(8), 45–48.CrossRef
Koopmans, M. B., & James, J. I. (2013). Automated network triage. Digital Investigation, 10(2), 129–137.CrossRef
Koven, J., Bertini, E., Dubois, L., & Memon, N. (2016). InVEST: intelligent visual email search and triage. Digital Investigation, 18, S138–S148.CrossRef
LaVelle, C., & Konrad, A. (2007). FriendlyRoboCopy: a GUI to RoboCopy for computer forensic investigators. Digital Investigation, 4(1), 16–23.CrossRef
Lee, W., & Stolfo, S. J. (2000). Data mining approaches for intrusion detection, Defense Technical Information Center.
Lee, J., Un, S., & Hong, D. (2008). High-speed search using Tarari content processor in digital forensics. Digital Investigation, 5, S91–S95.CrossRef
Leimich, P., Harrison, J., & Buchanan, W. J. (2016). A RAM triage methodology for Hadoop HDFS forensics. Digital Investigation.CrossRef
Lillis, D., Becker, B., O’Sullivan, T., & Scanlon, M. (2016). Current challenges and future research areas for digital forensic investigation. arXiv:​1604.​03850.
Ma, Y., Wang, L., Liu, P., & Ranjan, R. (2014). Towards building a data-intensive index for big data computing–a case study of remote sensing data processing. Information Sciences.
Marrington, A., Baggili, I., Mohay, G., & Clark, A. (2011). CAT Detect (Computer Activity Timeline Detection): a tool for detecting inconsistency in computer activity timelines. Digital Investigation, 8, S52–S61.CrossRef
Marturana, F., & Tacconi, S. (2013). A Machine Learning-based Triage methodology for automated categorization of digital media. Digital Investigation, 10(2), 193–204.CrossRef
Marturana, F., Tacconi, S., & Italiano, G. F. (2015). A machine learning‐based approach to digital triage. In Handbook of Digital Forensics of Multimedia Data and Devices (pp. 94–132).CrossRef
Marziale, L., Richard, G., & Roussev, V. (2007). Massive threading: using GPUs to increase the performance of digital forensics tools. Digital Investigation, 4, 73–81.CrossRef
McKemmish, R. (1999). What is forensic computing?.
Mee, V., Tryfonas, T., & Sutherland, I. (2006). The Windows Registry as a forensic artefact: illustrating evidence collection for internet usage. Digital Investigation, 3(3), 166–173.CrossRef
Nance, K., Hay, B., & Bishop, M. (2009). Digital forensics: defining a research agenda. In 42nd Hawaii International Conference on System Sciences, 2009. HICSS’09 (pp. 1–6). IEEE.
Noel, G. E., & Peterson, G. L. (2014). Applicability of Latent Dirichlet Allocation to multi-disk search. Digital Investigation, 11(1), 43–56.CrossRef
O’Connor, O. (2004). Deploying forensic tools via PXE. Digital Investigation, 1(3), 173–176.CrossRef
Okolica, J. S., Peterson, G. L., & Mills, R. F. (2007). Using author topic to detect insider threats from email traffic. Digital Investigation, 4(3–4), 158–164.CrossRef
Olsson, J., & Boldt, M. (2009). Computer forensic timeline visualization tool. digital investigation, 6, 78–87.CrossRef
Overill, R. E., Silomon, J. A. M., & Roscoe, K. A. (2013). Triage template pipelines in digital forensic investigations. Digital Investigation, 10(2), 168–174.CrossRef
Palmer, G. (2001). A road map for digital forensic research. In Report From the First Digital Forensic Research Workshop (DFRWS), August 7–8, 2001.
Palmer, G. (2002). Forensic analysis in the digital world. International Journal of Digital Evidence, 1(1), 1–6.
Parashar, A., Paliwal, N., & Shelke, R. (2015). Cloud computing based forensic analysis for mobile applications using data mining. International Journal of Advance Research in Computer Science and Management Studies, 3(3), 319–325.
Peisert, S., Bishop, M., & Marzullo, K. (2008). Computer forensics in forensis. SIGOPS Operating Systems Review, 42(3), 112–122.CrossRef
Pollitt, M. M. (2013). Triage: A practical solution or admission of failure. Digital Investigation, 10(2), 87–88.CrossRef
Pringle, N., & Burgess, M. (2014). Information assurance in a distributed forensic cluster. Digital Investigation, 11(Suppl. 1), S36–S44.CrossRef
Pringle, N., & Sutherland, I. (2008). Is a computational grid a suitable platform for high performance digital forensics?. In Proceedings of the 7th European Conference on Information Warfare and Security (p. 175). Academic Conferences Limited.
Pyle, D. (1999). Data preparation for data mining. Morgan Kaufmann.
Quick, D., & Choo, K.-K. R. (2013). Dropbox analysis: Data remnants on user machines. Digital Investigation, 10(1), 3–18.CrossRef
Quick, D., Martini, B., & Choo, K.-K.R. (2014). Cloud storage forensics. Syngress: An Imprint of Elsevier,CrossRef
Quintana, M.,Uribe, S., Sánchez, F., & Álvarez, F. (2015). Recommendation techniques in forensic data analysis: a new approach. In 2015 6th International Conference on Imaging for Crime Prevention and Detection (ICDP-15).
Raghavan, S. (2013). Digital forensic research: current state of the art. CSI Transactions on ICT, 1(1), 91–114.CrossRef
Reyes, A., Oshea, K., Steele, J., Hansen, J., Jean, B., & Ralph, T. (2007). Digital forensics and analyzing data, Cyber Crime Investigations (pp. 219–2590). Elsevier.CrossRef
Richard, G., & Roussev, V. (2006a). Digital forensics tools: the next generation. Digital Crime and Forensic Science in Cyberspace, 75.
Richard, G., & Roussev, V. (2006b). Next-generation digital forensics. Communications of the ACM, 49(2), 76–80.CrossRef
Riley, J. W., Dampier, D. A., & Vaughn, R. (2008). A comparison of forensic hard drive imagers: A time analysis comparison between the ICS image MASSter-Solo III and the logicube talon. Journal of Digital Forensic Practice, 2(2), 74–82.CrossRef
Rogers, M. K. (2004). The future of computer forensics: a needs analysis survey. Computers & Security, 23(1), 12–16.CrossRef
Rogers, M. K., Goldman, J., Mislan, R., Wedge, T., & Debrota, S. (2006). Computer forensics field triage process model. In Proceedings of the conference on Digital Forensics, Security and Law, 1, 19–37.
Roussev, V., & Quates, C. (2012). Content triage with similarity digests: the M57 case study. Digital Investigation, 9, S60–S68.CrossRef
Roussev, V., & Richard, G. (2004). Breaking the performance wall: the case for distributed digital forensics. In Proceedings of the 2004 Digital Forensics Research Workshop.
Roussev, V., Quates, C., & Martell, R. (2013). Real-time digital forensics and triage. Digital Investigation, 10(2), 158–167.CrossRef
Schatz, B., & Clark, A. J. (2006). An open architecture for digital evidence integration. In AusCERT Asia Pacific Information Technology Security Conference, May 21–26, 2006.
Shannon, M. (2004). Forensic relative strength scoring: ASCII and entropy scoring. International Journal of Digital Evidence, 2(4), 151–169.
Shaw, A., & Browne, A. (2013). A practical and robust approach to coping with large volumes of data submitted for digital forensic examination. Digital Investigation, 10(2), 116–128.CrossRef
Sheldon, A. (2005). The future of forensic computing. Digital Investigation, 2(1), 31–35.CrossRef
Shiaeles, S., Chryssanthou, A., & Katos, V. (2013). On-scene triage open source forensic tool chests: Are they effective? Digital Investigation, 10(2), 99–115.CrossRef
Sommer, P. (2004). The challenges of large computer evidence cases. Digital Investigation, 1(1), 16–17.CrossRef
Stevens, M. W. (2004). Unification of relative time frames for digital forensics. Digital Investigation, 1(3), 225–239.CrossRef
Stüttgen, J. (2011). Selective imaging: Creating efficient forensic images by selecting content first. Mannheim University.
Teelink, S., & Erbacher, R. (2006). Improving the computer forensic analysis process through visualization. Communications of the ACM, 49(2), 71–75.CrossRef
Turnbull, B., & Randhawa, S. (2015). Automated event and social network extraction from digital evidence sources with ontological mapping. Digital Investigation, 13, 94–106.CrossRef
Turnbull, B., Taylor, R., & Blundell, B. (2009). The Anatomy of electronic evidence; quantitative analysis of police E-Crime data. In ARES’09. International Conference on Availability, Reliability and Security, 2009 (143–149).
Turner, P. (2005). Unification of digital evidence from disparate sources (digital evidence bags). Digital Investigation, 2(3), 223–228.CrossRef
Turner, P. (2006). Selective and intelligent imaging using digital evidence bags. Digital Investigation, 3, 59–64.CrossRef
van Baar, R. B., van Beek, H. M. A., & van Eijk, E. J. (2014). Digital forensics as a service: A game changer. Digital Investigation, 11(Suppl. 1), S54–S62.CrossRef
van Beek, H., van Eijk, E., van Baar, R., Ugen, M., Bodde, J., & Siemelink, A. (2015). Digital forensics as a service: Game on. Digital Investigation, 15, 20–38.CrossRef
Vidas, T., Kaplan, B., & Geiger, M. (2014). OpenLV: empowering investigators and first-responders in the digital forensics process. Digital Investigation, 11(Suppl. 1), S45–S53.CrossRef
Wang, L., Lu, K., Liu, P., Ranjan, R., & Chen, L. (2014). IK-SVD: dictionary learning for spatial big data via incremental atom update. Computing in Science & Engineering, 16(4), 41–52.CrossRef
Wang, L., Geng, H., Liu, P., Lu, K., Kolodziej, J., Ranjan, R., et al. (2015). Particle Swarm Optimization based dictionary learning for remote sensing big data. Knowledge-Based Systems, 79, 43–50.CrossRef
Weiser, M., Biros, D. P., & Mosier, G. (2006). Development of a national repository of digital forensic intelligence. Glenn S. Dardick, Editor-in-Chief Longwood University Virginia, USA (p. 5).
Wiles, J., Alexander, T., Ashlock, S., Ballou, S., Depew, L., Dominguez, G., et al. (2007). Forensic examination in a terabyte world. Techno Security’s Guide to E-Discovery and Digital Forensics (pp. 129–146). Elsevier.CrossRef
Wong, A. (2010). Explosion of data envelops man in the street, The Australian, February 9, 2010.
Metadata
Title
Background and Literature Review
Authors
Darren Quick
Kim-Kwang Raymond Choo
Copyright Year
2018
Publisher
Springer Singapore
Book
Big Digital Forensic Data

Print ISBN: 978-981-10-7762-3

Electronic ISBN: 978-981-10-7763-0

Copyright Year: 2018

DOI
https://doi.org/10.1007/978-981-10-7763-0_2

Premium Partner

    Image Credits