TY - GEN
T1 - A digital forensic framework for automated user activity reconstruction
AU - Kang, Jungin
AU - Lee, Sangwook
AU - Lee, Heejo
PY - 2013
Y1 - 2013
N2 - User activity reconstruction is a technique used in digital forensic investigation. Using this technique, digital forensic investigators extract a list of user activities from digital artifacts confiscated at the crime scene. Based on the list, explicit knowledge about the crime, such as motive, method, time, and place, can be deduced. Until now, activity reconstruction has been conducted by manual analysis. This means that the domain of the reconstructed activities is limited to the personal knowledge of the investigators, so the result exhibits low accuracy due to human errors , and the process requires an excessive amount of time. To solve these problems, this paper proposes a digital forensic framework SigDiff for automated user activity reconstruction. This framework uses a signature-based approach. It comprises an activity signature generation module, signature database, digital artifact collection module, and activity reconstruction module. Using SigDiff, the process of user activity reconstruction can be performed accurately with a high retrieval rate and in a reduced time span.
AB - User activity reconstruction is a technique used in digital forensic investigation. Using this technique, digital forensic investigators extract a list of user activities from digital artifacts confiscated at the crime scene. Based on the list, explicit knowledge about the crime, such as motive, method, time, and place, can be deduced. Until now, activity reconstruction has been conducted by manual analysis. This means that the domain of the reconstructed activities is limited to the personal knowledge of the investigators, so the result exhibits low accuracy due to human errors , and the process requires an excessive amount of time. To solve these problems, this paper proposes a digital forensic framework SigDiff for automated user activity reconstruction. This framework uses a signature-based approach. It comprises an activity signature generation module, signature database, digital artifact collection module, and activity reconstruction module. Using SigDiff, the process of user activity reconstruction can be performed accurately with a high retrieval rate and in a reduced time span.
KW - activity reconstruction
KW - digital forensic framework
KW - signature-based forensics
UR - http://www.scopus.com/inward/record.url?scp=84883425004&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-38033-4_19
DO - 10.1007/978-3-642-38033-4_19
M3 - Conference contribution
AN - SCOPUS:84883425004
SN - 9783642380327
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 263
EP - 277
BT - Information Security Practice and Experience - 9th International Conference, ISPEC 2013, Proceedings
T2 - 9th International Conference on Information Security Practice and Experience, ISPEC 2013
Y2 - 12 May 2013 through 14 May 2013
ER -
