Nitesh Bharadwaj

Upasna Singh

Gaurav Gupta

RESIDENT DATA PATTERN ANALYSIS USING SECTOR CLUSTERING FOR STORAGE DRIVE FORENSICS

Keywords: Large storage drives, random sector sampling, unsupervised clustering

Storage drives are huge reservoirs of digital evidence. The acquisition and examination of storage drives for evidentiary artifacts require enormous amounts of manual effort and computing resources, leading to huge case backlogs. This chapter describes a forensic triage methodology that leverages random sampling and unsupervised clustering to provide insights about the regions of interest on a storage drive. The number of sector samples to be evaluated during triage for legitimate inferences to be drawn about drive content is also discussed. Experiments involving storage drives of various capacities illustrate the effectiveness and utility of the extracted patterns for rapid drive triage.

Introduction

The rapid growth of storage capacity in computers and electronic devices has severely affected the timeliness of digital forensic investigations. The volume of data encountered in investigations is relentlessly advancing beyond the processing capabilities of digital forensic practitioners and traditional forensic tools [START_REF] Roussev | Real-time digital forensics and triage[END_REF]. As a result, huge backlogs of cases exist in forensic laboratories around the world. The immediate solution is not to modify well-defined digital forensic procedures, but to make evidence processing strategies more efficient and effective.

This research leverages random sector sampling and unsupervised clustering in the first step of a forensic examination, namely triage, to render evidence processing more efficient and effective. The idea is to perform a quick forensic survey that provides insights about resident data and data patterns on storage media. The data patterns assist in rapidly identifying forensically-significant and insignificant regions on the media. A region is a collection of similar types of contiguous sectors on a storage drive, which can be broadly classified based on their nonnull (significant) or null (insignificant) content. The significant regions include human-readable, executable, compressed and encrypted content, as well as non-null sectors, all of which are important in investigations. The insignificant regions include negligibly-important null, empty and unallocated sectors. Clearly, the identification, preservation and examination of significant regions and the elimination of insignificant regions from further processing can save enormous amounts of resources.

This chapter describes a forensic triage methodology that leverages random sector sampling and unsupervised clustering to provide insights about the regions of interest on a storage drive. The methodology rapidly explores media for resident data patterns, identifies forensicallysignificant and insignificant regions and makes inferences about the resident data content. The number of sector samples that need to be evaluated to make legitimate inferences about drive content is discussed. Experiments involving storage drives of various capacities illustrate the effectiveness and utility of the extracted patterns for rapid drive triage.

Background and Related Work

Richard and Roussev [START_REF] Richard | Next-generation digital forensics[END_REF] have discussed the difficulties involved in processing large volumes of digital evidence. They highlighted the need for novel techniques for evidence acquisition and analysis. Garfinkel [START_REF] Garfinkel | Digital forensics research: The next 10 years[END_REF] notes that the massive capacity of storage devices, diversity of hardware interfaces, operating systems and file formats, large quantities of devices per case, use of anti-forensic strategies, proliferation of remote cloud storage and legal challenges are contributing to a "coming digital forensic crisis." He also discusses research directions that could help mitigate the coming crisis.

Beebe [START_REF] Beebe | Digital forensic research: The good, the bad and the unaddressed[END_REF] emphasizes the need to address data volume and scalability issues in digital forensics using selective acquisition and effective computational and analytical approaches (e.g., data-mining-based search, file classification and graphical processing units). Quick and Choo [START_REF] Quick | Impacts of the increasing volume of digital forensic data: A survey and future research challenges[END_REF] have identified the need to leverage data reduction, data mining and intelligence analysis to advance digital forensic capabilities. Bharadwaj and Singh [START_REF] Bharadwaj | Efficiently searching for target data traces in storage devices with region-based random sector sampling[END_REF] have highlighted the key challenges and gaps (e.g., evidence examination delays, resource constraints, data heterogeneity, preservation costs, and methods and tool development) that impact digital forensics. It is imperative to develop advanced forensically-sound techniques and tools that can support the rapid and efficient processing of large volumes of digital evidence.

Triage

Triage refers to a partial forensic examination conducted under limited time and resource constraints [START_REF] Roussev | Real-time digital forensics and triage[END_REF].

Garfinkel [START_REF] Garfinkel | Fast disk analysis with random sampling[END_REF] has advocated the use of random sector sampling in a triage method to achieve fast drive analysis. He demonstrated its effectiveness at identifying digital media content and detecting whether or not a drive was wiped properly. Random sampling has been utilized very effectively by the New South Wales Police Force in discovery processes involving child abuse material; the application of random sampling significantly reduced case backlogs [START_REF] Jones | The use of random sampling in investigations involving child abuse material[END_REF].

Random sampling has been used to rapidly assess storage media and identify 4 KiB blocks identical to target data [START_REF] Canceill | Random Sampling Applied to Rapid Disk Analysis[END_REF][START_REF] Taguchi | Optimal Sector Sampling for Drive Triage[END_REF]. Taguchi [START_REF] Taguchi | Optimal Sector Sampling for Drive Triage[END_REF] has developed a confidence model to handle situations where no traces of target data are identified using a sector sampling approach. Canceill [START_REF] Canceill | Random Sampling Applied to Rapid Disk Analysis[END_REF] has provided insights on how sector sampling can assist in storage drive analysis. He demonstrates that random sampling is an adaptive and scalable method for fast drive analysis. Since the selected 4 KiB blocks were evaluated in an overlapping manner, most of the sectors (512 bytes) had to be processed multiple times. Additional sector processing introduces computational loads that result in evidence processing delays. Bharadwaj and Singh [START_REF] Bharadwaj | Efficiently searching for target data traces in storage devices with region-based random sector sampling[END_REF] have identified the number of sector samples that needs to be analyzed on an entire drive or in regions of storage to identify sectors with content identical to the target data. In these and other triaging methodologies, information about the desired target files must be available. However, the methodology proposed in this chapter does not have this constraint. The methodology leverages random sector sampling and clustering to gain insights about the regions of interest on a drive. Prioritizing the consideration of significant regions realizes substantial savings in evidence processing resources.

Data Reduction

An alternative approach to triage is data reduction. Roussev and Quates [START_REF] Roussev | Content triage with similarity digests: The M57 case study[END_REF] have employed similarity digests for forensic triage. They show that the scope of an investigation can be narrowed by ignoring known excludable files during the acquisition and examination phases. Quick and Choo [START_REF] Quick | Big forensic data reduction: Digital forensic images and electronic evidence[END_REF] have presented an approach that enhances the traditional forensic process by imaging a selection of key files such as registry, Internet history, log, picture and video files.

Digital forensic practitioners typically have complete access to suspects' data during investigations. However, Verma et al. [START_REF] Verma | Data privacy perceptions about digital forensic investigations in India[END_REF][START_REF] Verma | DF 2.0: Designing an automated, privacy preserving and efficient digital forensic framework[END_REF] argue that privacy preservation and completeness of investigations are incompatible with each other. They proposed a method for finding the most relevant pieces of evidence while preserving data privacy in a manner that increases investigative efficiency without negatively impacting evidence integrity and admissibility.

Beebe and Clark [START_REF] Beebe | Dealing with terabyte data sets in digital investigations[END_REF] discuss the benefits of applying data mining in digital forensic investigations. However, limited published work incorporates data mining and other techniques to reduce the effort involved in preserving and examining large volumes of digital evidence [START_REF] Quick | Data reduction and data mining framework for digital forensic evidence: Storage, intelligence, review and archival[END_REF].

In contrast, the methodology proposed in this chapter does not rely on the collection of essential files; instead, regions of interest are identified by intelligently evaluating randomly-selected sector samples from a drive. The evaluation draws on clustering techniques that determine the significant regions based on the features selected for each random sector. These significant regions are targeted for selective acquisition and examination instead of processing all the drive sectors.

Clustering

Clustering has been employed in data mining and unsupervised learning applications to identify and understand data patterns in unlabeled, high-dimensional data. Clustering groups data using similarity measures based on centroid, hierarchical, expectation maximization and density techniques. Each clustering technique has its own advantages and disadvantages in terms of cluster quality, efficiency in handling noisy data and computational complexity. The efficiency and effectiveness of clustering techniques are dependent on the features selected for evaluation. This work employs simple centroid and density based clustering techniques to determine forensically-significant regions on evidentiary drives.

Centroid-Based Clustering. The k-means clustering technique computes the centroid of a cluster as the mean of the feature vectors assigned to the cluster. The technique requires the number of clusters to be specified in advance. It divides W samples into k disjoint clusters such that a distance function computed as the sum of squares of the intra-cluster distances to the centroid of the cluster is minimized. The distance function is given by:

Distance F unction = k j=1 W i=1 w (j) i -c j 2 (1)
where c j is the centroid of cluster j and w i ∈ W .

In this work, the distinction between the significant and insignificant regions on a drive is formulated by considering three clusters (k = 3) that broadly represent three distinct types of data.

Density-Based Clustering. The density-based spatial clustering of applications with noise (DBSCAN) technique considers a cluster to be an area of high density separated by low-density samples. The clusters identified using this technique can be of any shape (non-linear boundaries), yielding different results compared with k-means and other linear clustering algorithms.

Two user-defined parameters minimum samples and eps determine the density of samples needed to form a cluster. Higher minimum samples and lower eps values indicate higher densities while lower minimum samples and higher eps values indicate lower densities.

A sample in a dataset is called a core sample when other neighboring samples (minimum samples) exist within a radius or distance of eps. Thus, prior information about the number of clusters is not required. The number of clusters is estimated based on the minimum samples and eps parameter values.

Extracted Features

Extracted features or metrics can provide valuable insights about digital evidence. In this work, insights about forensically-significant regions on storage media are obtained using two derived metrics: (i) ASCII score; and (ii) entropy value. ASCII Score. The greater the amount of text or human-readable ASCII bytes contained in a data unit, the greater the probability of it containing directly understandable information [START_REF] Shannon | Forensic relative strength scoring: ASCII and entropy scoring[END_REF]. A sector is considered to be the smallest data unit on a drive. It is recommended that small sectors or blocks (e.g., 512 bytes) be considered because file blocks should efficiently map to drive sectors [START_REF] Young | Distinct sector hashes for target file detection[END_REF]. Hence, the standard size of a data unit (sector) considered in this research is 512 bytes.

Traditionally, the ASCII score is the ratio of the number of ASCII bytes to the total number of bytes in a file [START_REF] Shannon | Forensic relative strength scoring: ASCII and entropy scoring[END_REF]. However, in this work, the ASCII score is evaluated for every randomly-selected sector instead of a specific file. This may assist a digital forensic practitioner in examining even minute details instantaneously from the drive, such as keywords, credit card details, email, phone numbers and other information that can be directly recorded and understood by the practitioner. Moreover, the ASCII score can help exclude sectors containing little or no human-readable information. If an investigative scenario requires the analysis of plaintext or directly-readable information, then sectors with high ASCII scores should be analyzed first (highest priority) because it becomes much easier to extract useful information that could provide important leads when dealing with a large volume of data.

Entropy Value. Entropy specifies the amount of uncertainty of an unknown or random quantity. It is computed by summing the frequency of each observed byte value in a fixed-length data block and then computing an entropy value. Lyda and Hamrock [START_REF] Lyda | Using entropy analysis to find encrypted and packed malware[END_REF] compute the entropy value based on bytes (00 to FF) in a file using bintropy, a binary-file entropy analysis tool that enables practitioners to conveniently and quickly identify encrypted and packed malware.

In this work, an entropy value is computed for bytes in every randomlyselected sector on a drive. The entropy value is low for sectors that are less compressed (e.g., text files) and high for compressed file fragments [START_REF] Shannon | Forensic relative strength scoring: ASCII and entropy scoring[END_REF]. Encrypted data also has a high entropy value.

The entropy value E(s of a randomly-selected sector s is given by:

E(s) = - m b=1 P (b) log 2 P (b) ( 2 )
where P (b) is the probability of the frequency of the b th byte information in sector s that consists of a series of m bytes. Alternatively, the entropy value can be viewed as considering all the values that a byte b in a sector s can take, and P (b) is the probability of the frequency of each occurring byte in the randomly-selected sector s.

Randomly-selected sectors are easily classified as null or non-null sectors based on their content [START_REF] Bharadwaj | Significant data region identification and analysis using k-means in large storage drive forensics[END_REF]. In this work, the entropy metric is used to identify sectors with human-readable, multimedia (images, audio and video), encoded, compressed, encrypted or executable content. Hence, the entropy value is used in addition to the ASCII score in sector evaluations.

A sector that contains only zero or null bytes is referred to as a nullsector. A null-sector has the lowest entropy value of zero. The ASCII score for a null-sector would be high. However, in this work, a null sector is considered to have an ASCII score of zero due to the absence of relevant information. A sector that contains information other than null bytes is referred to as a non-null sector. Non-null sectors have plaintext (direct human readable), multimedia, encoded, compressed, encrypted or executable content. Lyda and Hamrock [START_REF] Lyda | Using entropy analysis to find encrypted and packed malware[END_REF] statistically evaluated a large set of packed and encrypted malware files based on the entropy of their bytes. They classified them into four categories of files: (i) plaintext; (ii) native; (iii) packed; and (iv) encrypted executable.

Assumptions

The proposed methodology assumes that three categories of data exist: (i) null data; (ii) plaintext data; and (iii) compressed/encrypted data. In general, it is easy to discriminate between null and non-null sectors. However, it is difficult to differentiate between resident and deleted data in the absence of the original filesystem or prior information.

The proposed methodology employs two metrics, ASCII score and entropy value, to determine forensically-significant regions on storage media. Storage media is considered to correspond to a bulk data volume, possibly without a legitimate filesystem and metadata, as in the case of deleted, altered or corrupted filesystem information or a formatted drive. The methodology is also applicable to forensic images with raw formats such as DD, IMG and RAW.

Table 1 shows how ASCII scores and entropy values are used to categorize randomly-selected sectors as containing null, plaintext and compressed/encrypted (encoded) data [START_REF] Lyda | Using entropy analysis to find encrypted and packed malware[END_REF][START_REF] Shannon | Forensic relative strength scoring: ASCII and entropy scoring[END_REF]. As mentioned above, null data has an ASCII score of zero and an entropy value of zero. Since readable (plaintext) file fragments always have high ASCII scores and low entropy values, the ranges for this category are set to [0.6, 1.0] and (0, 4.8], respectively. Finally, the ASCII score and entropy value ranges for compressed/encrypted data are set to (0.0, 0.6) and (4.8, 8.0], respectively.

Many clustering algorithms, including k-means, require the number of clusters to be known a priori. Therefore, the proposed methodology assumes that the maximum number of clusters is three. DBSCAN clustering is highly dependent on the minimum samples and eps parameter values. The proposed methodology typically uses minimum samples = 10 and eps = 0.5. However, explicit mentions are made when different values of these parameters are employed.

Proposed Methodology

Figure 1 presents the proposed methodology for efficient evidence analysis. The storage media drive is assumed to be mounted on the investigator's computer.

The process begins with the random extraction of a specified number of sector samples from across the drive. Important features such as the ASCII score, entropy value and sector category are computed and recorded for each extracted sample. The sector versus feature map is examined using k-means and DBSCAN clustering to gain insights about the significant and insignificant regions on the drive. Although fewer sector samples are examined, it is still possible to obtain a good idea of the distribution and characteristics of data on the drive. When a reasonable quantity of insignificant sectors exist on the drive, their elimination from consideration reduces the subsequent analysis effort. When the drive data patterns reveal that the number of significant sectors is large or the drive is completely filled with data, it is advisable to proceed with a full forensic acquisition followed by the exhaustive examination of artifacts.

The random sector samples are selected based on the accessible sector count. This information can be obtained using utilities such as fdisk and hdparm. In random sampling, an arbitrary number between the first and last sector number is generated, which is then recorded for further evaluation. During analysis, care is taken care to ensure that the random samples are fetched without replacement. Specifically, no sector should be selected multiple times; this is accomplished by maintaining a record of the previously-selected sectors. When a previously-selected sector is identified, it is dropped in favor of a new sector despite an increase in the evaluation load. Therefore, it is important to determine the sample size that provides good outcomes in a timely manner while eliminating the need to conduct an exhaustive examination of the drive.

Sampling theory is engaged to determine the number of sector samples for random extraction. Specifically, random sector sampling without replacement is employed. [START_REF] Bharadwaj | Efficiently searching for target data traces in storage devices with region-based random sector sampling[END_REF] have specified the numbers of random samples that need to be evaluated to identify sectors that are identical to target file fragments on storage media with different probabilities, regardless of the presence or absence of filesystem metadata. However, when the target data of interest is not known, it is difficult to determine the number of random samples that need to be examined.

Sample Size Determination. Bharadwaj and Singh

The determination of the number of sector samples that can provide adequate insights about the resident sectors on a drive resembles the problem of determining the adequate sample size for a finite population [START_REF] Israel | Determining Sample Size, Fact Sheet PEOD-6[END_REF]. Four parameters are needed to determine the sample size: (i) population size (total number of accessible sectors on a drive); (ii) precision (user-specified); (iii) confidence level (user-specified); and (iv) degree of variability (user-specified).

Precision (sampling error) is the range in which the true value of a population is estimated to reside [START_REF] Israel | Determining Sample Size, Fact Sheet PEOD-6[END_REF]. Precision has an inverse relationship with the number of samples -the lower the specified precision, the greater the number of samples required [START_REF] Singh | Sampling techniques and determination of sample size in applied statistics research: An overview[END_REF]. In general, precision is expressed as a percentage (e.g., ±3%, ±5%, ±10%). For example, if 60% of the sector samples were determined to be unallocated with a precision of ±3%, then between 57% and 63% of the sectors on the drive are actually unallocated.

The confidence level, which originates from the central limit theorem, provides the probability that the sample contains the value being estimated. It is expressed as a percentage (e.g., 90%, 95%, 99%). The confidence level generally corresponds to the standard (constant) z-score value [START_REF] Singh | Sampling techniques and determination of sample size in applied statistics research: An overview[END_REF]. Different z-scores based on different confidence levels must be employed when deriving the sample size.

Finally, the degree of variability expresses the distribution of attributes in a population. A more heterogeneous population requires a larger number of samples whereas a more homogeneous population requires fewer samples. A safe decision is to use 0.5 (50%) as the degree of variability because it balances a large sample size against maximal population variability.

According to Cochran [START_REF] Cochran | Sampling Techniques[END_REF], the following equation can be used to obtain a representative sample size n 0 as a proportion of a population:

n 0 = Z 2 pq e 2 (3)
where Z 2 is the abscissa of the normal curve that cuts off the area of the desired confidence level, e is the desired precision or sampling error, p is the estimated proportion of attributes present in the population and q = (1p).

When the population is finite, the desired sample size n is given by:

n = n 0 1 + (n 0 -1) N ( 4
)
where N is the population size. Equations 3 and ( 4) are used to determine the number of sector samples that need to be processed in order to estimate the characteristics of the sectors residing on storage media.

Experiments and Analysis

Experiments were conducted to evaluate the efficacy of the proposed significant region identification methodology for drive triage. A generic eight-core computing system with 4 GB RAM running Kali Linux 2.0 was employed in the experiments. The implementation is available at GitHub (github.com/niteshdiat2014/Resident_Data_Pattern_Analysis). The experiments were conducted on four storage drives, D 1 , D 2 , D 3 and D 4 , with capacities, 4 GB, 8 GB, 16 GB and 1 TB, respectively. Drive D 1 was completely filled with data whereas D 2 , D 3 and D 4 were partially filled with data. The analysis was performed using a custom Python 2.7 script. Clustering was implemented as described in the scikitlearn documentation [START_REF]scikit-learn, Machine learning in Python (scikit-learn.org)[END_REF].

Sector Sample Size

Equations ( 3) and ( 4) were used to estimate the numbers of samples necessary for drive analyses. Table 2 shows the numbers of sector samples for various drive capacities at precision (sampling error) values of ±1%, ±2%, ±3%, ±5% and ±10%, where the estimated proportion of attributes present in the population p = 0.5. The sample sizes in the last column of the table are the upper bounds on the sample sizes used to analyze evidence.

The computed sample sizes are valid for the considered scenario; however, the sample sizes would vary when Equations ( 3) and ( 4) are computed with different parameter values depending on the scenario require-ments. The sample size does not change much for populations larger than 20,000, which implies that the total number of samples should be considered at least during data pattern analysis. Similarly, the computed sample sizes are not very different for different storage media with different numbers of sectors for a particular precision and confidence level.

The computed sample size should guarantee well-distributed sectors from a drive. However, forensic practitioners may use arbitrarily large numbers of samples according to their investigative needs. Obviously, the larger the sample size, the better the ability to make precise decisions about a drive, but this comes with increased analysis effort.

Significant Region Analysis

In order to identify the important regions on the drives, features were recorded for every randomly-selected sector in the retrieved sample set. The features, ASCII score and entropy value, were clustered separately using k-means and DBSCAN. This enabled the sectors with similar feature values to be segregated from sector groups with completely distinct feature values. Finally, the sector samples were mapped based on the computed cluster labels to make inferences about the important regions on the drives.

It was observed that the resident data patterns obtained using the two clustering approaches were very similar. In general, k-means provided better results when drives had fewer null sectors. However, k-means sometimes misclassified sectors because it produces clusters with linear structures; this was mitigated by DBSCAN clustering that handles clusters of arbitrary (non-linear) shapes.

In order to measure the efficacy of the proposed methodology, analysis was performed using the computed number of sector samples (e.g., 17,000 with 99% confidence and ±1% precision).

The k-means clustering technique was first used to segregate the sample set into three clusters. Figure 2 shows the clusters obtained by k-means on the 16 GB drive based on the ASCII scores and entropy values. The three clusters correspond to the different types of data on the drive: (i) null sectors with ASCII scores and entropy values of zero; (ii) sectors with moderate ASCII scores and high entropy values; and (iii) sectors with high ASCII scores and medium entropy values.

The cluster labels were utilized to map the sector numbers with their corresponding feature values from the sample set. Figures 3(a) and3(b) show the resident data pattern analysis using k-means clustering on the 16 GB drive. Figure 3(a) shows the feature maps based on sector samples and ASCII scores. sector samples and entropy values. The two figures clearly illustrate the resident data pattern, revealing the regions on the drive that contain data for a forensic practitioner to prioritize for further analysis. The figures also reveal that the drive contains a reasonable amount of null sectors at the beginning and end whereas a large proportion of implicit information resides between sectors 0.4 × 10 7 and 2 × 10 7 .

The implicit sectors may contain images, videos and other encoded information that are directly understood by a forensic practitioner. Targeting these high entropy regions to analyze multimedia and other files that are usually encoded is more effective than examining the entire drive. Figures 3(a) and 3(b) also indicate that considerable amounts of human-readable plaintext information (with high ASCII scores and low entropy values) exist in the sector range 1.5 × 10 7 to 2 × 10 7 ; these regions can be directly interpreted by a forensic practitioner. Selective file carving and recovery approaches can be used to improve the overall efficiency. On the other hand, regions with large amounts of null data, such as those in the sector range 1.5 × 10 7 to 2 × 10 7 in Figures 3(a) and 3(b), should be excluded from further analysis to enhance performance.

As discussed above, the centroid-based k-means clustering technique causes some misclassifications. Figure 3(a) shows that fewer sectors are labeled incorrectly (e.g., sectors with high ASCII scores labeled as null data and sectors with low ASCII scores labeled as human-readable). However, despite the misclassifications, the extracted data pattern can still provide a digital forensic practitioner with valuable insights that would enhance the efficiency and effectiveness of the analysis.

Figure 4 shows the clusters obtained by DBSCAN on the 16 GB drive based on the ASCII scores and entropy values. The clustering is based on the densities (closeness) of features regardless of the mean values of the clusters. Note that the sectors with similar features are in the same clusters. Although the number of clusters is not required for DBSCAN clustering, the technique still yielded three clusters based on the feature values and the related parameters (minimum samples = 10 and eps = 0.5).

Figures 5(a

Performance Metrics

It is important for forensic practitioners to assess the performance of the proposed methodology to satisfy the scientific testing criterion [START_REF] Garfinkel | Digital forensics research: The next 10 years[END_REF]. The performance measures employed are the true positive rate (TPR) and false positive rate (FPR), along with the receiver operating characteristic (ROC) curve.

The TPR and FPR values associated with each clustering technique were computed by comparing the actual labels against the observed outcomes for arbitrary numbers of samples (e.g., 1,000, 5,000, 10,000, 50,000 and 100,000). Arbitrary sample sizes were chosen to evaluate the efficacy of the proposed methodology in situations where it is needed to evaluate a range of sector samples (few samples to a considerably large number of samples). The sample sizes cover the minimum number of samples (up to 17,000) required to provide a general pattern of the contents of an entire drive.

The

Evaluation Delay

Increasing the sample size increases the evaluation delay. The evaluation delay is also affected by the input/output performance of the storage media and computing system, efficiency of feature value derivation and computational effort associated with the clustering techniques. Increasing the number of features also increases the computational effort.

Figure 8 shows the evaluation delays for various proportions of random sector samples. Increasing the number of random samples increases the evaluation delay. In contrast, the input/output rate is platform centric, implying that different outcomes are expected for different scenarios and computing environments. A small number of samples can be examined at a high input/output rate whereas a large number of samples significantly reduces the input/output rate.

Error Rate

Although random sector sampling is effective for rapid drive analysis, it is difficult to ignore its associated error rate (i.e., evaluation of repeated sectors) in the absence of a perfect random number generator. In order to assess the error rate related to significant region determination and resident pattern analysis, different proportions (0.1% to 50%) of random samples from the four drives were analyzed to measure the extent of repeated sector evaluation. If a previously-generated sector sample is selected, it is dropped from consideration and a new random sector sample is selected in its place.

Conclusions

The proposed triage methodology assists digital forensic practitioners in rapidly evaluating resident data patterns on storage media to narrow the scope of evidence acquisition and examination to forensicallyrelevant data. It leverages random sector sampling and unsupervised clustering to provide insights about the regions of interest on storage media. The proposed methodology is applicable when metadata information or resident data content are not readily available, for example, when filesystem metadata is corrupted, altered, deleted or overwritten, or when drives are formatted, deleted or overwritten. Without the methodology, the only alternative in these situations would be to exhaustively examine every sector for evidentiary artifacts. The methodology is not intended to replace full evidence examination. Instead, it is most effective for conducting visual examinations of drive content layout, intelligence analyses, resident data pattern analyses, rapid reviews, quick forensic surveys, pre-seizure media analyses, drive triage, and partial or selective evidence processing.

Experiments involving storage drives of various capacities illustrate the effectiveness and usability of the extracted patterns for rapid drive triage. However, the performance degrades when large numbers of random sector samples have to be evaluated when processing large-capacity storage media. The methodology is designed to handle three types of clusters corresponding to null, plaintext and compressed/encrypted data; however, the results are negatively impacted when insufficient data is associated with the clusters. The methodology is unable to handle completely encrypted drives where sectors have low ASCII scores and high entropy values; in such cases, it is necessary to decrypt the storage media before applying the methodology. Additionally, the methodology cannot handle advanced and compressed file formats such as the Advanced Forensic Format (AFF) and Encase image file format (E01).

Future research will focus on extending the types of data that can be handled. Also, it will focus on enhancing the efficiency of the methodology and reducing error rates.

Figure 1 .

 1 Figure 1. Proposed methodology for efficient evidence analysis.

Figure 3 (

 3 b) shows the feature map based on

Figure 2 .

 2 Figure 2. Clusters obtained using k-means clustering (16 GB drive).

  (a) Feature map based on sector numbers and ASCII scores. (b) Feature map based on sector samples and entropy values.

Figure 3 .

 3 Figure 3. Resident data pattern analysis using k-means clustering (16 GB drive).

  ) and5(b) show the resident data pattern analysis using DBSCAN clustering on the 16 GB drive.Figures6(a) through 6(d) show the resident data pattern analyses using k-means and DBSCAN clustering on the partially-filled 8 GB drive. A total of 8,000 random samples were selected. Note that different DBSCAN parameter values minimum samples = 8 and eps = 0.18 were employed for the 8 GB drive.

Figure 4 .

 4 Figure 4. Clusters obtained using DBSCAN clustering (16 GB drive).

  (a) Feature map based on sector numbers and ASCII scores. (b) Feature map based on sector samples and entropy values.

Figure 5 .

 5 Figure 5. Resident data pattern analysis using DBSCAN clustering (16 GB drive).

  k-means (ASCII scores).k-means(entropy values).DBSCAN (ASCII scores). DBSCAN (entropy values).

Figure 6 .

 6 Figure 6. Resident data pattern analyses using k-means and DBSCAN (8 GB drive).

Figure 7 .

 7 Figure 7. ROC plots for k-means and DBSCAN based pattern analyses.

Figure 8 .

 8 Figure 8. Evaluation delays for various proportions of random sector samples.

Figure 9 .

 9 Figure 9. Error rates for various proportions of random sector samples.

Figure 9

 9 Figure9presents the error rates for various proportions of random sector samples. The error rate increases at an average rate of approximately 20% as the proportion of random sectors increases. The error rate can be managed by keeping track of previously-generated sector samples.

Table 1 .

 1 Random sector categories based on the ASCII scores and entropy values.

	Range of ASCII Range of Entropy Assumed Sector Category
	Score (x)	Value (y)
	0	0	N u l l d a t a
	0.6 ≤x≤ 1.0	0<y≤ 4.8	Plaintext data
	0 <x< 0.6	4 .8 <y≤ 8.0	Compressed/encrypted data

Table 2 .

 2 Minimum sample sizes for various drive capacities.

	Confidence Precision		Drive Capacity		Sample
			4 GB	8 GB 16 GB	1 TB	Size
		±1%	16,558 16,574	16,582	16,590	17,000
		±2%	4,146	4,147	4,148	4,148	4,500
	99%	±3%	1,844	1,844	1,844	1,844	2,000
		±5%	664	664	664	664	700
		±10%	166	166	166	166	200
		±1%	9,594	9,599	9,602	9,604	10,000
		±2%	2,401	2,401	2,401	2,401	2,500
	95%	±3%	1,068	1,068	1,068	1,068	1,100
		±5%	385	385	385	385	400
		±10%	97	97	97	97	100
		±1%	6,761	6,764	6,765	6,766	7,000
		±2%	1,692	1,692	1,692	1,692	1,800
	90%	±3%	752	752	752	752	800
		±5%	271	271	271	271	300
		±10%	68	68	68	68	80


Nikolai Adderley

Gilbert Peterson

INTERACTIVE TEMPORAL DIGITAL FORENSIC EVENT ANALYSIS

Keywords:

Current digital forensic tools and applications lack the capability to visually present high-level system events and their associated low-level traces in a user interpretable form. This chapter describes the Temporal Analysis Integration Management Application (TAIMA), an interactive graphical user interface that renders graph-based information visualizations for digital forensic event reconstruction. By leveraging correlation and abstraction as core functions, TAIMA reduces the manual, labor-intensive efforts needed to conduct timeline analyses during digital forensic examinations. A pilot usability study conducted to evaluate TAIMA supports the claim that correlation and abstraction of low-level events into high-level system events can enhance digital forensic examinations.

Introduction

The discipline of digital forensics has been under constant pressure as advancements in digital device technology outpace the technical capabilities of digital forensic tools and applications [START_REF] Osborne | The "Explore, Investigate and Correlate" (EIC) conceptual framework for digital forensic information visualization[END_REF]. Exacerbating the issue is the increased use of computers in the commission of crimes [START_REF] Hitlin | Internet, social media use and device ownership in U.S. have plateaued after years of growth, Fact Tank -News in Numbers[END_REF]. Continuous increases in the amount of heterogeneous data involved in investigations have made digital forensic analyses complex and timeconsuming.

Current digital forensic analysis applications are primarily trace-based and force practitioners to rely on manual, labor-intensive practices for performing correlations and reconstructing events [START_REF] Olsson | Computer forensic timeline visualization tool[END_REF][START_REF] Osborne | The "Explore, Investigate and Correlate" (EIC) conceptual framework for digital forensic information visualization[END_REF]. As a result, it is difficult to establish a holistic understanding of an entire system image and to identify patterns and anomalies in a reasonable amount of time.

Information visualization (InfoVis) and abstraction leverage human perceptual and intellectual capabilities to reduce forensic practitioner workload and analysis time [START_REF] Teerlink | Improving the computer forensic analysis process through visualization[END_REF]. Specifically, information visualization takes advantage of human visual and analytical capabilities to explore data; data exploration is conducted using visual displays that offer flexible data encodings in perceptually effective environments [START_REF] Hales | Visualization of device datasets to assist digital forensic investigations[END_REF]. Abstraction reduces the amount of data displayed to users and minimizes the adverse effects of text-based information overload [START_REF] Osborne | Digital forensic infovis: An implementation of a process for visualization of digital evidence[END_REF][START_REF] Shneiderman | The eyes have it: A task by data type taxonomy for information visualizations[END_REF]. Studies that combine information visualization and abstraction reveal that digital forensic practitioners appreciate displays that minimize the number of items for review, but still present relevant information [START_REF] Hibshi | Usability of forensic tools: A user study[END_REF].

This chapter describes the Temporal Analysis Integration Management Application (TAIMA), a proof-of-concept information visualization application that enhances digital forensic investigations with an emphasis on the analysis phase of the digital forensic process. TAIMA leverages temporal system event reconstruction and information visualization to enrich a graphical timeline with discrete high-level system events. The information visualization component enables a practitioner to adjust the focus from a case-wide overview to a detailed view of lowlevel traces. The detailed view enables the practitioner to confirm the accuracy of reconstruction.

A usability study of TAIMA was conducted in which digital forensic practitioners completed a simulated digital forensic analysis task. During the study, all the participants were able to locate all the evidence items. The post-task survey results reveal that all the participants found TAIMA to be intuitive and easy to learn. Additionally, the participants felt that the visualization was effective at helping them complete their tasks. The results demonstrate the power of correlation and abstraction in supporting timeline analyses.

Related Work

Timeline analysis of digital system events helps identify when events occurred and the order in which they occurred. Timestamp data from multiple data sources (e.g., registry files, event logs, link files and prefetch files) help clarify the temporal proximity of system traces, test investigative hypotheses and identify additional system traces of interest that would have been overlooked without timeline examination [START_REF] Inglot | A framework for enhanced timeline analysis in digital forensics[END_REF].

Despite the critical role that timelines play in forensic investigations, most industry-standard digital forensic applications merely focus on data collection. After importing artifacts into their applications, practitioners are left with vast amounts of low-level traces. The majority of industry applications either have limited capabilities for generating timelines or entirely lack the capabilities [START_REF] Carbone | Generating Computer Forensic Super-Timelines under Linux: A Comprehensive Guide for Windows-Based Disk Images[END_REF]. The applications that do generate timelines often provide static timelines or histograms, or simply export digital artifacts as comma-separated value (CSV) reports (Figure 1).

For example, Encase (version 8.07) [START_REF]Guidance Software, EnCase Forensic User Guide, Version 8.07[END_REF] generates a calendar timeline with individual artifacts represented as dots on the calendar (Figure 2). Forensic Toolkit (FTK) [START_REF]services/forensic-toolkit-ftk)[END_REF] generates a histogram timeline (Figure 3).

Previous work in digital forensic visualization has highlighted the difficulty in handling the vast amounts of extracted data involved in timeline analyses [START_REF] Osborne | Digital forensic infovis: An implementation of a process for visualization of digital evidence[END_REF]. Carbone and Bean [START_REF] Carbone | Generating Computer Forensic Super-Timelines under Linux: A Comprehensive Guide for Windows-Based Disk Images[END_REF] describe the lack of intuitive GUIs and integrated timelines when dealing with large heterogeneous datasets. Without careful planning, visualizations quickly become overwhelming; the overcrowded displays cause information overloads. Gudjonsson [START_REF] Gudjonsson | Mastering the Super Timeline with log2timeline[END_REF] notes that practitioners often struggle to complete forensic analyses using timelines that are overcrowded and stresses the importance of reducing the amount of reviewed data to facilitate timeline analyses.

Olsson and Boldt [START_REF] Olsson | Computer forensic timeline visualization tool[END_REF] demonstrate the advantages of using the Cyber-Forensics TimeLab (CFTL) graphical timeline tool over Forensic Toolkit (FTK); the post questionnaire from their study reveals that participants solved a hypothetical case "significantly faster using CFTL than when using FTK." Teelink and Erbacher [START_REF] Teerlink | Improving the computer forensic analysis process through visualization[END_REF] demonstrate that visualization techniques assist practitioners in the forensic data analysis process. The two studies combined interactive capabilities with visualization tools. The combination resulted in practitioners experiencing improvements in the digital forensic process and reductions in the time required to identify suspicious files.

As a visualization tool, TAIMA enhances digital forensic examinations by providing practitioners with an interactive environment integrated with visual representations of digital evidence. The interactive capabilities and visualizations enabled practitioners to answer all the investigative questions posed in a user evaluation study.

TAIMA

TAIMA displays digital evidence on a graph-based timeline to enhance forensic analyses and facilitate event reconstruction. The primary purpose of TAIMA is to provide an overview of the types of system events that exist on a media image. TAIMA's intuitive GUI precludes users from having to learn a programming language or use a command line interface.

At the core of TAIMA is the rendering of a graph-based timeline that overcomes the effects of information overload. Using only a date/time range as a search parameter, a practitioner is able to identify suspicious files and events without labor-intensive manual exploration, or any plugins or code. TAIMA displays high-level system events on a single screen along with the locations of the traces that are related to the high-level events.

User accessibility was a core function goal during the TAIMA design phase. The application was intended to be used by technical as well as non-technical practitioners. Industry tools that provide extensive features and capabilities can be overwhelming. For example, Encase is not user friendly enough for non-technical practitioners. TAIMA, which is backed by the Neo4j graph-based database, provides non-technical users with the ability to issue database queries using only date/time ranges; no programming skills or additional plugins are required.

Design Principles

The development strategy for TAIMA followed Shneiderman's interactive GUI design principles [START_REF] Shneiderman | The eyes have it: A task by data type taxonomy for information visualizations[END_REF]. Shneiderman proposed a user-centered GUI design guide model that supports the use of information visualization in digital forensic applications. He stresses the importance of providing a modern information visualization GUI that supports the processing of large volumes of heterogeneous data.

The TAIMA development process also followed the Visual Information Seeking Mantra (overview first, zoom and filter, details on demand) [START_REF] Osborne | Digital forensic infovis: An implementation of a process for visualization of digital evidence[END_REF]. The mantra specifies information visualization design techniques and interactive controls for presenting data in an organized and intuitive manner that enables easy traversal. To fulfill the mantra requirements, TAIMA first presents an overview of all the high-level system events in a time-span as discrete color-coded tiles on a timeline. The graph-based timeline display enables a practitioner to view the temporal proximity of system events quickly and also provides an easy way to identify (at a glance on a single screen) clusters of system events. Moreover, the practitioner can adjust the point-of-view by zooming in on a timeline to adjust the scale for detailed views of specific time intervals.

TAIMA was designed to minimize the effects of large, complex (heterogeneous) data volumes on the digital forensic investigation process, especially during the analysis phase. Accordingly, TAIMA was built using the GRANDstack (GraphQL, React, Apollo, Neo4j Database) architecture. GRANDstack is an ecosystem of software applications that are used to create full-stack web and mobile GUIs [START_REF] Grandstack | Build Full Stack Graph Applications with Ease[END_REF]. The integration of the applications allows for a scalable JavaScript web application backed by a Neo4j database [START_REF]Neo4j, Introducing Neo4j[END_REF]. An important advantage of the GRANDstack ecosystem is its provision of a modern web browser, which reduces the TAIMA learning time.

GUI Timeline

Graph-based digital forensic timelines mitigate many of the challenges encountered when attempting to analyze vast volumes of data [START_REF] Chabot | Automatic timeline construction and analysis for computer forensic purposes[END_REF][START_REF] Hales | Visualization of device datasets to assist digital forensic investigations[END_REF][START_REF] Olsson | Computer forensic timeline visualization tool[END_REF].

Figure 4 shows the principal TAIMA GUI interactions. The user is presented with the React GUI front-end to enter a time interval of interest (start time and end time). Clicking the submit button sends a GraphQL query via the GraphQL service with the timestamps as search parameters to the Neo4j database. GraphQL is a query language that enables developers to specify schema definitions to express the data to be requested from a datastore. The Apollo client integrates with GraphQL to process and route data requests to the Neo4j database [START_REF]Configuring the Cache, Apollo[END_REF]. The GraphQL server implements the logic for querying the modeled Neo4j database (via the addition of abstraction nodes) to search for high-level events based on their temporal attributes. After fetching the data, the Apollo client sends the results to the GraphQL server. The React GUI integration with the Apollo client is configured to store the results of the query within a React component to render the visualization. The database query results are automatically converted to graphical form and presented to the user on a graph-based timeline.

The TAIMA information visualization timeline component shown in Figure 4 displays discrete high-level system events chronologically. The graph-based timeline enables a practitioner to identify patterns and anomalies during data analysis while providing an overview that facilitates the overall understanding of system events.

Figure 4 also shows the various parts of a timeline: input fields, submit button, high-level events, traces via a tooltip, time grid and dates. The tooltip dialog box satisfies the "details on demand" interactive GUI requirement specified by Shneiderman [START_REF] Shneiderman | The eyes have it: A task by data type taxonomy for information visualizations[END_REF]. This requirement enables a practitioner to view additional information about events by placing the mouse pointer over the event tile. A text-box displays the trace artifacts responsible for the event.

The visualization in Figure 4 shows four abstracted events. These include two program installation events (blue titles), denoted by "Installation Completed Successfully." Additionally, there are two power events (purple titles), denoted by "System Uptime Report/Event Log Service Started." The temporal proximity of the four high-level system events suggests that the system of interest was restarted due to the installation of Microsoft Visual C++ 2008 on 11 April 2017 at approximately 8PM local system time.

Figure 5 shows an overview of the activities on the timeline for the time interval 03 April 2017 12:00 AM to 15 June 2017 12:00 PM. Note that various programs (EXEs) were executed on the system of interest on 3 April 2017 and 11 April 2017.

Abstraction Technique

The abstraction technique implemented by TAIMA leverages the graph database generated via property graph event reconstruction (PGER) [START_REF] Schelkoph | Digital forensic event graph reconstruction[END_REF]. This technique extracts temporal traces from a media image and imports them into a native labeled property graph that stores system events as nodes linked via cause-effect relationships. The links enable the temporal traces to be rapidly correlated and abstracted into a single narrative.

As a proof-of-concept tool, TAIMA supports five high-level abstraction system events: (i) program installation; (ii) power (startup/shutdown); (iii) program execution; (iv) file download; and (v) web history. The overall logic for creating abstraction events and relationships involves searching a time window for the declared low-level events. The time window is subsequently searched for related events. If the declared low-level events are found in the time window, then a high-level system event abstraction node is created; this creates a link. Multiple trace matching enforces the credibility of the high-level system event abstraction event. In addition to creating relationships, the low-level traces are used to enrich the abstracted event.

Program Installation. The Cypher query shown in Figure 6 creates a program installation abstraction node that is a relational correlation of four low-level traces associated with the particular program installation event.

Lines 1 through 5 of the Cypher query find all the action and object nodes associated with the event log entries that occurred within a tensecond window. Line 6 filters the object nodes down to three event log entries: (i) MsiInstaller/11707; (ii) MsiInstaller/1042; and (iii) MsiInstaller/1033. In Lines 7 through 8, the COLLECT command aggregates the action and object nodes based on time, and the DISTINCT commands filter the list to include only unique timestamps. This eliminates having multiple entries for a given timestamp; only unique timestamps Figure 7 shows a graph representation of the query result. The center node is the abstraction node, which is connected to four low-level nodes. High-level system events (i.e., center are only created and added to the graph model if the criteria imposed by expert rules are satisfied. The event logs, MsiInstaller/11707, MsiInstaller/1042 and MsiInstaller/1033, constitute evidence that a program installation event occurred. New relationships (e.g., LVL1 ABSTRACTION LINK) are added to the abstraction node to correlate the low-level traces connected to the program installation event. Aggregating low-level events and linking them to higher-level events reduce the amount of data presented to the practitioner and also increases the efficiency of the application (i.e., lower computational cost).

Power. Power events (shutdown, startup and sleep) are established by tracking the start and stop of the Windows Customer Experience Improvement (CEI) and Windows Event logs. The combination of these two traces is a strong indicator of power events. EventLog/6013 logs the total system running time after system boot-up. EventLog/6005 generates a log entry message that the Windows Event Log service was started.

Program Execution. The program execution abstraction is based on identifying prefetch file artifacts. The prefetch file, which is created every time an application is executed on a Windows system, contains information about the files associated with the application. Windows uses the prefetch information to reduce and optimize the loading time of the application during subsequent executions. Analyzing prefetch files provides insights into the files used by applications and the files that the Windows operating system loads at startup. File Download. The download abstraction event nodes include Firefox and Chrome event log entries. The format string from the parser provides the complete path of the location of the downloaded file on the host.

Web History. The web history abstraction tracks the following traces: (i) source URL; (ii) web history; (iii) complete path of the downloaded file; and (iv) what happened to the file after it was downloaded.

Evaluating User Experience

TAIMA applies novel information visualization concepts and methods to digital forensic investigations. A usability evaluation study was conducted in order to examine their effectiveness. The study followed the user experience evaluation guidelines specified by Lam et al. [START_REF] Lam | Empirical studies in information visualization: Seven scenarios[END_REF]. Such an evaluation includes assessments that analyze individual responses and attitudes towards a visualization [START_REF] Isenberg | A systematic review of the practice of evaluating visualization[END_REF]. The user evaluation performed in this research combined usability testing (UX) and the broadly-used poststudy system usability questionnaire (PSSUQ), thereby drawing on their collective strengths [START_REF] Lewis | Psychometric evaluation of the post-study system usability questionnaire: The PSSUQ[END_REF].

The original PSSUQ comprises 19 items. However, this study employed a modified version that included 15 items. Since error handling was not implemented in TAIMA, the four related questions were removed from the PSSUQ.

Data from the user study included participant performance and openended feedback provided by a post-task questionnaire. The participant performance metrics included the task performance expressed in terms of the task completion time and completion rate (i.e., percentage of the six hacking software traces that were correctly found by a participant). Additionally, a subjective user satisfaction rating, captured via the posttask questionnaire, provided insights into the participants' overall satisfaction with TAIMA. The questionnaire also included an open-ended section for the participants to provide feedback about TAIMA.

Study Participants

According to Nielsen [START_REF] Nielsen | Why you only need to test with 5 users[END_REF], approximately 90% of usability problems are discovered in usability evaluation studies with no more than five participants. This study had five participants, all of whom were either computer crime investigators or digital forensic analysts with one to two years of experience using industry-standard tools to analyze digital evidence.

Statistical analysis of the outcome was not appropriate due to the small sample size. The simulated hacking scenario reflected tasks that are typically performed in a digital forensic investigation. The participants also provided feedback on enhancing TAIMA.

Procedure

The usability testing portion of the evaluation employed a scenario involving an abandoned notebook computer suspected of being used for hacking purposes [15]. The participants were tasked with conducting a digital forensic analysis using TAIMA to identify hacking software applications on the abandoned computer. The task was deemed successful if all six hacking software applications were discovered.

Before starting their tasks, the participants were provided access to TAIMA to explore the visualization features and capabilities. The testing officially started after the participants verbally expressed that they Table 1. Post-study system usability questionnaire (PSSUQ) usability metrics.

Item Rating

1 Overall, I was satisfied with how easy it was to use this system 6.2 2 It was simple to use this system 6.4 3 I was able to complete the tasks and scenarios quickly using this system 5.8

4 I felt comfortable using this system 6.4 5 It was easy to learn to use this system 7.0 6 I believe I could become productive quickly using this system 6.4 7 Whenever I made a mistake using the system, I could recover easily and quickly 6.0 8 It was easy to find the information I needed 6.4 9 The visualization provided by the system was easy to understand 6.6 10 The visualization was effective at helping me complete the tasks and scenarios 6.6

11 The organization of information on the interface was clear 6.2 12 The interface of this system was pleasant 6.0 13 I liked using the interface of this system 6.0 14 This system has all the functions and capabilities I expect it to have 5.0 15 Overall, I was satisfied with this system 6.2

felt comfortable using TAIMA. After completing the task, the participants completed the PSSUQ. The user study assessed two goals:

Effectiveness of TAIMA at assisting forensic analyses by presenting digital evidence using best practice information visualization techniques.

Effectiveness of the TAIMA infrastructure and processes at reducing the challenges associated with the examination and presentation of vast volumes of digital evidence.

The results of the assessment provided insights into the participants' attitudes towards the information visualization. Additionally, the assessment determined if TAIMA improved the analysis and presentation of large volumes of digital evidence.

Results

Table 1 and Figure 8 present the PSSUQ results. Note that higher scores denote better usability. The survey results reveal that the participants were highly satisfied with the usability of TAIMA -as indicated by a 100% (7 out of 7) rating for Item 5 (It was easy to learn to use this system). Item 9 (The visualization provided by the system was easy to understand) and Item 10 (The visualization was effective at helping me complete the tasks and scenarios) received the next highest rating of 94% (6.6 out of 7).

All the participants noted that they enjoyed not having to conduct an extensive search to find relevant artifacts. They also appreciated that important and relevant information was presented to them on one screen. Additionally, the participants found TAIMA to be easy to use due to its straightforward controls and intuitive display. This highlights the visualization effectiveness achieved by the intuitive display that reduces the data presented while still providing the critical information needed to complete the task.

One participant commented that the visualization was "extremely beneficial" and that it made observations of system activity "easy and fast." Another participant noted that it was easy to understand the visualization. This suggests that the integration of exploratory information visualization and abstraction techniques provides an accurate means to reconstruct timelines despite the challenges imposed by data complexity and data volume in digital forensic investigations. Some items received low scores. The lowest score was received by Item 14 (This system has all the functions and capabilities I expect it to have). But this is a reasonable score because TAIMA is a prototype system and the emphasis during development was on data reduction and accuracy.

The participants also provided suggestions on improving TAIMA. The suggestions included adding keyword search and file content viewing functionalities. This is because, during the testing, the participants wanted to search for particular files of interest instead of only using a data/time range. After these files were identified on the timeline, the participants did not want to have to search the timeline again for the files. In addition to viewing the locations of files of interest via a tooltip, participants were also interested in viewing the contents of the files. Also, TAIMA does not provide exporting or printing capabilities. The only option is to use print-screen to generate reports. Reporting is not only a desirable function, but also an essential part of the digital forensic process.

Finally, the participants felt that TAIMA provides limited functionality. They wanted more ways to customize TAIMA and wanted more control over the interface. For example, they wanted more filtering options. Also, after the results are returned and populated on the timeline, the participants wanted the ability to eliminate system events that were not of interest.

Conclusions

Establishing timelines is vital in digital forensic investigations. However, most digital forensic tools and applications merely present timelines as histograms or as raw trace entries in files. Additionally, traditional timeline analysis uses static text-based timelines that force practitioners to employ labor-intensive manual practices that often miss significant pieces of evidence.

The TAIMA prototype described in this chapter was specifically developed to mitigate these challenges. It leverages information visualization concepts and techniques to automate the creation of graph-based timelines of high-level system events. TAIMA enriches timelines with discrete high-level system events by presenting temporal data attributes in a practitioner-focused GUI.

The high usability ratings obtained by TAIMA in the user evaluation study reveal that it is intuitive, easy to learn, effective and accurate. These results satisfy the primary goal of the research -to address the significant challenges introduced by data complexity and data volume in digital forensic investigations.

Much of the future research and development activities related to TAIMA will be driven by the feedback received from the usability study participants. Priorities include providing printing and data export capabilities. Even more important is supporting report generation, which is an essential component of the digital forensic process.

One of strengths of TAIMA is its ability to filter and reduce the numbers of events on timelines. Enabling users to customize filtering according to their needs should make the application even more effective. Future activities will also focus on the robust testing of TAIMA using a large image with real-world activities and complex system events.

Figure 1 .

 1 Figure 1. log2timeline CSV output.

Figure 2 .

 2 Figure 2. Encase timeline view.

Figure 3 .

 3 Figure 3. Forensic Toolkit timeline view.

Figure 4 .

 4 Figure 4. TAIMA GUI.

Figure 5 .

 5 Figure 5. TAIMA global view.

Figure 6 .

 6 Figure 6. Program installation query.

Figure 7 .

 7 Figure 7. Program installation abstraction node linked to four traces.