Abstract:An issue that continues to impact digital forensics is the increasing volume of data and the growing number of devices. One proposed method to deal with the problem of “big digital forensic data”: the volume, variety, and velocity of digital forensic data, is to reduce the volume of data at either the collection stage or the processing stage. We have developed a novel approach which significantly improves on current practice, and in this paper we outline our data volume reduction process which focuses on imaging a selection of key files and data such as: registry, documents, spreadsheets, email, internet history, communications, logs, pictures, videos, and other relevant file types. When applied to test cases, a hundredfold reduction of original media volume was observed. When applied to real world cases of an Australian Law Enforcement Agency, the data volume further reduced to a small percentage of the original media volume, whilst retaining key evidential files and data. The reduction process was applied to a range of real world cases reviewed by experienced investigators and detectives and highlighted that evidential data was present in the data reduced forensic subset files. A data reduction approach is applicable in a range of areas, including: digital forensic triage, analysis, review, intelligence analysis, presentation, and archiving. In addition, the data reduction process outlined can be applied using common digital forensic hardware and software solutions available in appropriately equipped digital forensic labs without requiring additional purchase of software or hardware. The process can be applied to a wide variety of cases, such as terrorism and organised crime investigations, and the proposed data reduction process is intended to provide a capability to rapidly process data and gain an understanding of the information and/or locate key evidence or intelligence in a timely manner.

A Method to Automatically Filter Log Evidences for Intrusion Forensics

Automated Analysis of Multi-Source Logs for Network Forensics

Technical Study of Reducing Redundant Data for Intrusion Detection and Intrusion Forensics

A digital evidence fusion method in network forensics systems with Dempster-shafer theory

High Fidelity Data Reduction for Big Data Security Dependency Analyses.

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

A Transductive Scheme Based Inference Techniques for Network Forensic Analysis

Intrusion Detection and Forensic Analysis for Network Security Incidents

Network Intell: Enabling the Non-Expert Analysis of Large Volumes of Intercepted Network Traffic

Intrusion Detection Based on Parallel Intelligent Optimization Feature Extraction and Distributed Fuzzy Clustering in WSNs.

Proactive Forensics Method Based on Intrusion Detection System

Application Layer Information Forensics Based on Packet Analysis

Big forensic data reduction: digital forensic images and electronic evidence

Fuzzy Decision Tree Based Inference Techniques for Network Forensic Analysis

Data Correlation-Based Analysis Methods for Automatic Memory Forensic

Learning Automata Based Feature Selection for Network Traffic Intrusion Detection

Multi-datasource machine learning in intrusion detection: Packet flows, system logs and host statistics

Unifying Intrusion Detection and Forensic Analysis Via Provenance Awareness

A Method to Extract Network Intrusion Detection Feature

Alert reduction for network intrusion detection

Extraction of Fingerprint from Regular Expression for Efficient Prefiltering