Improving performance of forensics investigation with parallel coordinates visual analytics

Publisher:
Institute of Electrical and Electronics Engineers Inc.
Publication Type:
Conference Proceeding
Citation:
Proceedings - 17th IEEE International Conference on Computational Science and Engineering, CSE 2014, Jointly with 13th IEEE International Conference on Ubiquitous Computing and Communications, IUCC 2014, 13th International Symposium on Pervasive Systems, Algorithms, and Networks, I-SPAN 2014 and 8th International Conference on Frontier of Computer Science and Technology, FCST 2014, 2014, pp. 1838 - 1843
Issue Date:
2014
Full metadata record
Files in This Item:
Filename Description Size
Thumbnail2014-FCST.pdf Published version946.2 kB
Adobe PDF
Computer forensics investigators aim to analyse and present facts through the examination of digital evidences in short times. As the volume of suspicious data is becoming large, the difficulties of catching the digital evidence in a legally acceptable time are high. This paper proposes an effective method for reducing investigation time redundancy to achieve the normalization of data on hard disk drives (HDD) for computer forensics. We use visualization techniques, parallel coordinates, to analyse data instead of using data analysis algorithms only, and also choose a Red-Black tree structure to de-duplicate data. It reduces the time complexity, including the time spent of searching data, adding data as well as deleting data. We show the advantages of our approach; moreover, we demonstrate how this method can enhance the efficiency and quality of computer forensics task.
Please use this identifier to cite or link to this item: