Tools
Tools
Haggerty, J, Haggerty, S and Taylor, MJ (2014) Forensic triage of email network narratives through visualisation. Information Management and Computer Security, 4 (22). pp. 358-370. ISSN 1758-5805
|
Text
IMCSv1postrefereedversion.pdf - Accepted Version Download (510kB) | Preview |
Abstract
Purpose
– The purpose of this paper is to propose a novel approach that automates the visualisation of both quantitative data (the network) and qualitative data (the content) within emails to aid the triage of evidence during a forensics investigation. Email remains a key source of evidence during a digital investigation, and a forensics examiner may be required to triage and analyse large email data sets for evidence. Current practice utilises tools and techniques that require a manual trawl through such data, which is a time-consuming process.
Design/methodology/approach
– This paper applies the methodology to the Enron email corpus, and in particular one key suspect, to demonstrate the applicability of the approach. Resulting visualisations of network narratives are discussed to show how network narratives may be used to triage large evidence data sets.
Findings
– Using the network narrative approach enables a forensics examiner to quickly identify relevant evidence within large email data sets. Within the case study presented in this paper, the results identify key witnesses, other actors of interest to the investigation and potential sources of further evidence.
Practical implications
– The implications are for digital forensics examiners or for security investigations that involve email data. The approach posited in this paper demonstrates the triage and visualisation of email network narratives to aid an investigation and identify potential sources of electronic evidence.
Originality/value
– There are a number of network visualisation applications in use. However, none of these enable the combined visualisation of quantitative and qualitative data to provide a view of what the actors are discussing and how this shapes the network in email data sets.
| Item Type: | Article |
|---|---|
| Additional Information: | This article is (c) Emerald Group Publishing and permission has been granted for this version to appear here http://dx.doi.org/10.1108/IMCS-11-2013-0080. Emerald does not grant permission for this article to be further copied/distributed or hosted elsewhere without the express permission from Emerald Group Publishing Limited. |
| Subjects: | Q Science > QA Mathematics > QA76 Computer software R Medicine > RA Public aspects of medicine > RA1001 Forensic Medicine. Medical jurisprudence. Legal medicine T Technology > T Technology (General) |
| Divisions: | Computer Science & Mathematics |
| Publisher: | Emerald |
| Date Deposited: | 14 Nov 2014 10:54 |
| Last Modified: | 04 Sep 2021 14:47 |
| URI: | https://researchonline.ljmu.ac.uk/id/eprint/192 |
 |
View Item |