Use of machine learning algorithm on file metadata for digital forensic investigation process

Abstract

File metadata consists of the various file properties like file name, file size, date of access and modifications, date of creation, and hash code of files. This metadata can be useful for detecting various activities performed by a user on a specific system through files. In order to analyze any crime, it is necessary to focus upon the metadata instead of the data of the file. Just acquiring the data from files is not enough, it is equally important to analyze its metadata, which may direct a digital forensic investigator toward the suspicious system. Analyzing the metadata will reveal the evidences of the committed crimes which would be useful in the further phases of the investigation process. Our research paper focuses on analyzing file metadata by applying machine learning algorithms that will be useful for digital forensic investigation.