Skip to main content
Top

2018 | OriginalPaper | Chapter

3. Data Reduction and Data Mining Frame-Work

Authors : Darren Quick, Kim-Kwang Raymond Choo

Published in: Big Digital Forensic Data

Publisher: Springer Singapore

Activate our intelligent search to find suitable subject content or patents.

search-config
loading …

Abstract

As highlighted in Chap. 2, there is a need for a methodology and framework for data reduction and data mining of digital forensic data. This chapter outlines the digital forensic data reduction and data mining framework, which endeavours to expand the process used for traditional forensic computer analysis to include data reduction, data mining, and input from external source data. This serves to expand common digital forensic frameworks, to be applicable when dealing with a large volume of digital forensic data.

Dont have a licence yet? Then find out more about our products and how to get one now:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

  • über 102.000 Bücher
  • über 537 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Maschinenbau + Werkstoffe
  • Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 390 Zeitschriften

aus folgenden Fachgebieten:

  • Automobil + Motoren
  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Elektrotechnik + Elektronik
  • Energie + Nachhaltigkeit
  • Maschinenbau + Werkstoffe




 

Jetzt Wissensvorsprung sichern!

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

  • über 67.000 Bücher
  • über 340 Zeitschriften

aus folgenden Fachgebieten:

  • Bauwesen + Immobilien
  • Business IT + Informatik
  • Finance + Banking
  • Management + Führung
  • Marketing + Vertrieb
  • Versicherung + Risiko




Jetzt Wissensvorsprung sichern!

Literature
go back to reference Abraham, T. (2006). Event sequence mining to develop profiles for computer forensic investigation purposes. In ACSW Frontiers ‘06: Proceedings of the 2006 Australasian Workshops on Grid Computing and E-Research (pp. 145–153). Abraham, T. (2006). Event sequence mining to develop profiles for computer forensic investigation purposes. In ACSW Frontiers ‘06: Proceedings of the 2006 Australasian Workshops on Grid Computing and E-Research (pp. 145–153).
go back to reference Alink, W., Bhoedjang, R. A. F., Boncz, P. A., & de Vries, A. P. (2006). XIRAF–XML-based indexing and querying for digital forensics. Digital Investigation, 3(Suppl. 0), 50–58.CrossRef Alink, W., Bhoedjang, R. A. F., Boncz, P. A., & de Vries, A. P. (2006). XIRAF–XML-based indexing and querying for digital forensics. Digital Investigation, 3(Suppl. 0), 50–58.CrossRef
go back to reference Alzaabi, M., Jones, A., & Martin, T. A. (2013). An ontology-based forensic analysis tool. Journal of Digital Forensics, Security and Law, 2013(Conference Supplement), 121–135. Alzaabi, M., Jones, A., & Martin, T. A. (2013). An ontology-based forensic analysis tool. Journal of Digital Forensics, Security and Law, 2013(Conference Supplement), 121–135.
go back to reference Beebe, N. (2009). Digital forensic research: The good, the bad and the unaddressed. In Advances in digital forensics (pp. 17–36). Springer.CrossRef Beebe, N. (2009). Digital forensic research: The good, the bad and the unaddressed. In Advances in digital forensics (pp. 17–36). Springer.CrossRef
go back to reference Beebe, N., & Clark, J. (2005). Dealing with terabyte data sets in digital investigations. In Advances in digital forensics (pp. 3–16). Beebe, N., & Clark, J. (2005). Dealing with terabyte data sets in digital investigations. In Advances in digital forensics (pp. 3–16).
go back to reference Bhoedjang, R. A. F., van Ballegooij, A. R., van Beek, H. M. A., van Schie, J. C., Dillema, F. W., van Baar, R. B., et al. (2012). Engineering an online computer forensic service. Digital Investigation, 9(2), 96–108.CrossRef Bhoedjang, R. A. F., van Ballegooij, A. R., van Beek, H. M. A., van Schie, J. C., Dillema, F. W., van Baar, R. B., et al. (2012). Engineering an online computer forensic service. Digital Investigation, 9(2), 96–108.CrossRef
go back to reference Brown, R., Pham, B., & de Vel, O. (2005). Design of a digital forensics image mining system. In Knowledge-based intelligent information and engineering systems (pp. 395–404). Brown, R., Pham, B., & de Vel, O. (2005). Design of a digital forensics image mining system. In Knowledge-based intelligent information and engineering systems (pp. 395–404).
go back to reference Bunting, S., & Wei, W. (2006). EnCase computer forensics: The official EnCE: EnCaseCertified examiner study guide. Indianapolis, IN: Wiley. Bunting, S., & Wei, W. (2006). EnCase computer forensics: The official EnCE: EnCaseCertified examiner study guide. Indianapolis, IN: Wiley.
go back to reference Carrier, B. (2005). File system forensic analysis. NJ: Addison-Wesley Boston. Carrier, B. (2005). File system forensic analysis. NJ: Addison-Wesley Boston.
go back to reference Carvey, H. (2011). Windows registry forensics: Advanced digital forensic analysis of the windows registry. Elsevier. Carvey, H. (2011). Windows registry forensics: Advanced digital forensic analysis of the windows registry. Elsevier.
go back to reference Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet. Elsevier. Casey, E. (2011). Digital evidence and computer crime: Forensic science, computers, and the internet. Elsevier.
go back to reference FBI_RCFL. (2003–2012). FBI Regional Computer Forensic Laboratory Annual Reports 2003–2012, FBI, Quantico. FBI_RCFL. (2003–2012). FBI Regional Computer Forensic Laboratory Annual Reports 2003–2012, FBI, Quantico.
go back to reference Ferraro, M. M., & Russell, A. (2004). Current issues confronting well-established computer-assisted child exploitation and computer crime task forces. Digital Investigation, 1(1), 7–15.CrossRef Ferraro, M. M., & Russell, A. (2004). Current issues confronting well-established computer-assisted child exploitation and computer crime task forces. Digital Investigation, 1(1), 7–15.CrossRef
go back to reference Garfinkel, S. (2006a). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3, 71–81.CrossRef Garfinkel, S. (2006a). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3, 71–81.CrossRef
go back to reference Garfinkel, S. (2006b). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3(Suppl. 0), 71–81.CrossRef Garfinkel, S. (2006b). Forensic feature extraction and cross-drive analysis. Digital Investigation, 3(Suppl. 0), 71–81.CrossRef
go back to reference Garfinkel, S. (2010) Digital forensics research: The next 10 years. Digital Investigation, 7(Suppl. 0), S64–S73.CrossRef Garfinkel, S. (2010) Digital forensics research: The next 10 years. Digital Investigation, 7(Suppl. 0), S64–S73.CrossRef
go back to reference Hoelz, B., Ralha, C., & Geeverghese, R. (2009). Artificial intelligence applied to computer forensics. In SAC ‘09: Proceedings of the 2009 ACM Symposium on Applied Computing (pp. 883–888). ACM. Hoelz, B., Ralha, C., & Geeverghese, R. (2009). Artificial intelligence applied to computer forensics. In SAC ‘09: Proceedings of the 2009 ACM Symposium on Applied Computing (pp. 883–888). ACM.
go back to reference Huang, J., Yasinsac, A., & Hayes, P. J. (2010). Knowledge sharing and reuse in digital forensics. In 2010 fifth IEEE international workshop on systematic approaches to digital forensic engineering (SADFE) (pp. 73–78) IEEE. Huang, J., Yasinsac, A., & Hayes, P. J. (2010). Knowledge sharing and reuse in digital forensics. In 2010 fifth IEEE international workshop on systematic approaches to digital forensic engineering (SADFE) (pp. 73–78) IEEE.
go back to reference Kenneally, E., & Brown, C. (2005). Risk sensitive digital evidence collection. Digital Investigation, 2(2), 101–119.CrossRef Kenneally, E., & Brown, C. (2005). Risk sensitive digital evidence collection. Digital Investigation, 2(2), 101–119.CrossRef
go back to reference Lee, J., Un, S., & Hong, D. (2008). High-speed search using Tarari content processor in digital forensics. Digital Investigation, 5, S91–S95.CrossRef Lee, J., Un, S., & Hong, D. (2008). High-speed search using Tarari content processor in digital forensics. Digital Investigation, 5, S91–S95.CrossRef
go back to reference Marziale, L., Richard, G., & Roussev, V. (2007). Massive threading: Using GPUs to increase the performance of digital forensics tools. Digital Investigation, 4, 73–81.CrossRef Marziale, L., Richard, G., & Roussev, V. (2007). Massive threading: Using GPUs to increase the performance of digital forensics tools. Digital Investigation, 4, 73–81.CrossRef
go back to reference McKemmish, R. (1999), What is forensic computing? McKemmish, R. (1999), What is forensic computing?
go back to reference Nance, K., Hay, B., & Bishop, M. (2009) Digital forensics: Defining a research agenda. In 42nd Hawaii international conference on system sciences, 2009, HICSS’09 (pp. 1–6). IEEE. Nance, K., Hay, B., & Bishop, M. (2009) Digital forensics: Defining a research agenda. In 42nd Hawaii international conference on system sciences, 2009, HICSS’09 (pp. 1–6). IEEE.
go back to reference Palmer, G. (2001). A road map for digital forensic research. In Report from the first digital forensic research workshop (DFRWS), August 7–8, 2001. Palmer, G. (2001). A road map for digital forensic research. In Report from the first digital forensic research workshop (DFRWS), August 7–8, 2001.
go back to reference Pollitt, M. M. (2013). Triage: A practical solution or admission of failure. Digital Investigation, 10(2), 87–88.CrossRef Pollitt, M. M. (2013). Triage: A practical solution or admission of failure. Digital Investigation, 10(2), 87–88.CrossRef
go back to reference Pringle, N., & Sutherland, I. (2008). Is a computational grid a suitable platform for high performance digital forensics? In Proceedings of the 7th European Conference on Information Warfare and Security (p. 175). Academic Conferences Limited. Pringle, N., & Sutherland, I. (2008). Is a computational grid a suitable platform for high performance digital forensics? In Proceedings of the 7th European Conference on Information Warfare and Security (p. 175). Academic Conferences Limited.
go back to reference Quarnby, N., & Young, L. J. (2010). Managing intelligence–The art of influence. Sydney, Australia: The Federation Press. Quarnby, N., & Young, L. J. (2010). Managing intelligence–The art of influence. Sydney, Australia: The Federation Press.
go back to reference Quick, D., & Choo, K. (2013a). Dropbox analysis: Data remnants on user machines. Digital Investigation, 10(1), 3–18.CrossRef Quick, D., & Choo, K. (2013a). Dropbox analysis: Data remnants on user machines. Digital Investigation, 10(1), 3–18.CrossRef
go back to reference Quick, D., & Choo, K. (2013b). Digital Droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems, 29(6), 1378–1394.CrossRef Quick, D., & Choo, K. (2013b). Digital Droplets: Microsoft SkyDrive forensic data remnants. Future Generation Computer Systems, 29(6), 1378–1394.CrossRef
go back to reference Quick, D., & Choo, K.-K. R. (2013c). Forensic collection of cloud storage data: Does the act of collection result in changes to the data or its metadata? Digital Investigation, 10(3), 266–277.CrossRef Quick, D., & Choo, K.-K. R. (2013c). Forensic collection of cloud storage data: Does the act of collection result in changes to the data or its metadata? Digital Investigation, 10(3), 266–277.CrossRef
go back to reference Quick, D., & Choo, K.-K. R. (2014). Google drive: Forensic analysis of data remnants. J. Network and Computer Applications, 40, 179–193.CrossRef Quick, D., & Choo, K.-K. R. (2014). Google drive: Forensic analysis of data remnants. J. Network and Computer Applications, 40, 179–193.CrossRef
go back to reference Quick, D., Martini, B., & Choo, K.-K. R. (2014). Cloud storage forensics. Syngress: An Imprint of Elsevier. Quick, D., Martini, B., & Choo, K.-K. R. (2014). Cloud storage forensics. Syngress: An Imprint of Elsevier.
go back to reference Raghavan, S. (2013). Digital forensic research: Current state of the art. CSI Transactions on ICT, 1(1), 91–114.CrossRef Raghavan, S. (2013). Digital forensic research: Current state of the art. CSI Transactions on ICT, 1(1), 91–114.CrossRef
go back to reference Raghavan, S., Clark, A., & Mohay, G. (2009). FIA: An open forensic integration architecture for composing digital evidence. In Forensics in telecommunications, information and multimedia (pp. 83–94). Springer. Raghavan, S., Clark, A., & Mohay, G. (2009). FIA: An open forensic integration architecture for composing digital evidence. In Forensics in telecommunications, information and multimedia (pp. 83–94). Springer.
go back to reference Ratcliffe, J. (2003). Intelligence-led policing. Trends and Issues in Crime and Criminal Justice, 248, 1–6. Ratcliffe, J. (2003). Intelligence-led policing. Trends and Issues in Crime and Criminal Justice, 248, 1–6.
go back to reference Reyes, A., Oshea, K., Steele, J., Hansen, J., Jean, B., & Ralph, T. (2007). Digital forensics and analyzing data (pp. 219–259). Cyber Crime Investigations: Elsevier. Reyes, A., Oshea, K., Steele, J., Hansen, J., Jean, B., & Ralph, T. (2007). Digital forensics and analyzing data (pp. 219–259). Cyber Crime Investigations: Elsevier.
go back to reference Richard, G., & Roussev, V. (2006). Next-generation digital forensics. Commun ACM, 49(2), 76–80.CrossRef Richard, G., & Roussev, V. (2006). Next-generation digital forensics. Commun ACM, 49(2), 76–80.CrossRef
go back to reference Roussev, V., & Richard, G. (2004). Breaking the performance wall: The case for distributed digital forensics. In Proceedings of the 2004 Digital Forensics Research Workshop. Roussev, V., & Richard, G. (2004). Breaking the performance wall: The case for distributed digital forensics. In Proceedings of the 2004 Digital Forensics Research Workshop.
go back to reference Schatz, B., & Clark, A. J. (2006). An open architecture for digital evidence integration. In AusCERT Asia Pacific information technology security conference, 21–26 May 2006. Schatz, B., & Clark, A. J. (2006). An open architecture for digital evidence integration. In AusCERT Asia Pacific information technology security conference, 21–26 May 2006.
go back to reference Shannon, M. (2004). Forensic relative strength scoring: ASCII and entropy scoring. International Journal of Digital Evidence, 2(4), 151–169. Shannon, M. (2004). Forensic relative strength scoring: ASCII and entropy scoring. International Journal of Digital Evidence, 2(4), 151–169.
go back to reference Sheldon, A. (2005). The future of forensic computing. Digital Investigation: The International Journal of Digital Forensics and Incident Response, 2(1), 31–35.CrossRef Sheldon, A. (2005). The future of forensic computing. Digital Investigation: The International Journal of Digital Forensics and Incident Response, 2(1), 31–35.CrossRef
go back to reference Shiaeles, S., Chryssanthou, A., & Katos, V. (2013). On-scene triage open source forensic tool chests: Are they effective? Digital Investigation, 10(2), 99–115.CrossRef Shiaeles, S., Chryssanthou, A., & Katos, V. (2013). On-scene triage open source forensic tool chests: Are they effective? Digital Investigation, 10(2), 99–115.CrossRef
go back to reference Teelink, S., & Erbacher, R. (2006). Improving the computer forensic analysis process through visualization. Communication of ACM, 49(2), 71–75.CrossRef Teelink, S., & Erbacher, R. (2006). Improving the computer forensic analysis process through visualization. Communication of ACM, 49(2), 71–75.CrossRef
go back to reference Turner, P. (2005). Unification of digital evidence from disparate sources (Digital Evidence Bags). Digital Investigation, 2(3), 223–228.CrossRef Turner, P. (2005). Unification of digital evidence from disparate sources (Digital Evidence Bags). Digital Investigation, 2(3), 223–228.CrossRef
go back to reference Turner, P. (2007). Applying a forensic approach to incident response, network investigation and system administration using Digital Evidence Bags. Digital Investigation, 4(1), 30–35.CrossRef Turner, P. (2007). Applying a forensic approach to incident response, network investigation and system administration using Digital Evidence Bags. Digital Investigation, 4(1), 30–35.CrossRef
go back to reference UNODC. (2011). United Nations office on drugs and crime–Criminal intelligence manual for analysts. New York, Vienna, Austria: United Nations. UNODC. (2011). United Nations office on drugs and crime–Criminal intelligence manual for analysts. New York, Vienna, Austria: United Nations.
go back to reference van Baar, R.B., van Beek, H. M. A., & van Eijk, E. J. (2014). Digital forensics as a service: A game changer. Digital Investigation, 11(Suppl. 1, no. 0), S54–S62.CrossRef van Baar, R.B., van Beek, H. M. A., & van Eijk, E. J. (2014). Digital forensics as a service: A game changer. Digital Investigation, 11(Suppl. 1, no. 0), S54–S62.CrossRef
go back to reference Vidas, T., Kaplan, B., & Geiger, M. (2014). OpenLV: Empowering investigators and first-responders in the digital forensics process. Digital Investigation, 11(Suppl. 1, no. 0), S45–S53.CrossRef Vidas, T., Kaplan, B., & Geiger, M. (2014). OpenLV: Empowering investigators and first-responders in the digital forensics process. Digital Investigation, 11(Suppl. 1, no. 0), S45–S53.CrossRef
Metadata
Title
Data Reduction and Data Mining Frame-Work
Authors
Darren Quick
Kim-Kwang Raymond Choo
Copyright Year
2018
Publisher
Springer Singapore
DOI
https://doi.org/10.1007/978-981-10-7763-0_3

Premium Partner