Automated inference of past action instances in digital investigations

Abstract

As the amount of digital devices suspected of containing digital evidence increases, case backlogs for digital investigations are also increasing in many organizations. To ensure timely investigation of requests, this work proposes the use of signature-based methods for automated action instance approximation to automatically reconstruct past user activities within a compromised or suspect system. This work specifically explores how multiple instances of a user action may be detected using signaturebased methods during a post-mortem digital forensic analysis. A system is formally defined as a set of objects, where a subset of objects may be altered on the occurrence of an action. A novel action-trace update time threshold is proposed that enables objects to be categorized by their respective update patterns over time. By integrating time into event reconstruction, the most recent action instance approximation as well as limited past instances of the action may be differentiated and their time values approximated. After the formal theory if signature-based event reconstruction is defined, a case study is given to evaluate the practicality of the proposed method.

Towards Web Usage Attribution via Graph Community Detection in Grouped Internet Connection Records

“…The cause and effect nature of event reconstruction has been studied, and James and Gladyshev [13] have defined action instances, a state transition model where an action produces a trace. If traces can be identified, then actions can be implied because of the causal nature of certain state transitions on computer systems.…”

Battling the digital forensic backlog through data deduplication

“…A number of techniques have been employed to streamline the current digital forensic process, including efficient workflow management [11], DFaaS [12,13], triage [14,4] and automation [9,15]. However, significant resources are being wasted with the current processing model; both in terms of the computer and manpower overheads.…”

Hierarchical Bloom Filter Trees for Approximate Matching

“…The backlogs have grown due to a number of factors including the volume of cases requiring analysis, the number of devices per case, the volume of data on each device, and the limited availability of skilled experts (Quick & Choo, 2014). Automated techniques are in continuous development to aid investigators, but due to the sensitive nature of this work, the ultimate inferences and decisions will always be made by skilled human experts (James & Gladyshev, 2015).…”