Overview of Performance Evaluation of Keyword Search Utilities in Forensic/E-Discovery Software

Digital forensics has been modeled into a number of stages, which include examination and analysis. Keyword search is a popular tactic used by investigators during evidence examination and analysis. However, the belief that the success of forensic analysis depends on the examiner’s knowledge and experience has a strong hold in the digital forensic domain. It does imply the adequate awareness of the capabilities and limitations of the tools used by the examiner. Keyword search enables the examiner to quickly locate the existence of data items related to a case. This reduces investigation duration and eases the investigation process. This paper discusses the concepts of keyword search and the various keyword search techniques available. It highlights the algorithms on which they are based. In addition to the overview of, and argument for thorough understanding and evaluation of this technique in forensic utilities, this article also provides evaluation procedures to serve as direction for future evaluation/validation studies to ensure examiners know just how much to trust their software, as far as keyword searching is concerned.