Improving results of forensics analysis by semantic-based suggestion system

Abstract

Nowadays, more than ever, digital forensics activities are involved in any criminal, civil or military investigation and they are primary to support cyber-security. Detectives use a many techniques and proprietary forensic software to analyze (copies of) digital devices, in order to discover hidden, deleted, encrypted, and damaged files or folders. Any evidence found is carefully analysed and documented in “finding reports” that are used during lawsuits. Forensics aim at discovering and analysing patterns of fraudulent activities. In this work, we propose a methodology that supports detectives in correlating evidences found by different forensic tools and we apply it to a framework able to semantically annotate data generated by forensics tools. Annotations enable more effective access to relevant information and enhanced retrieval and reasoning.