Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events

No ratings

Presented at CyberScience2020 2020 by

Xiaoyu Du

Quan Scanlon

Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in lawenforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensicinvestigation coupled with the growing volume of data to be processed per case. Leveraging previously processeddigital forensic cases and their component artefact relevancy classifications facilitates the opportunity for trainingautomated artificial intelligence based evidence processing systems to aid investigators in the discovery andprioritisation of evidence. This paper presents one approach for file artefact relevancy determination based on thegrowing move towards a centralised, Digital Forensics as a Service (DFaaS) paradigm. This approach enables theuse of previously encountered illegal files to detect pertinent files in an investigation. Trained models can aid in thedetection of these files during the acquisition stage, i.e., during their upload to a DFaaS system. The technique usedis based on a relevancy score determined from file similarity using each artefact's filesystem metadata and associatedtimeline events. The approach presented is validated against three experimental usage scenarios.