Abstract:An issue that continues to impact digital forensics is the increasing volume of data and the growing number of devices. One proposed method to deal with the problem of “big digital forensic data”: the volume, variety, and velocity of digital forensic data, is to reduce the volume of data at either the collection stage or the processing stage. We have developed a novel approach which significantly improves on current practice, and in this paper we outline our data volume reduction process which focuses on imaging a selection of key files and data such as: registry, documents, spreadsheets, email, internet history, communications, logs, pictures, videos, and other relevant file types. When applied to test cases, a hundredfold reduction of original media volume was observed. When applied to real world cases of an Australian Law Enforcement Agency, the data volume further reduced to a small percentage of the original media volume, whilst retaining key evidential files and data. The reduction process was applied to a range of real world cases reviewed by experienced investigators and detectives and highlighted that evidential data was present in the data reduced forensic subset files. A data reduction approach is applicable in a range of areas, including: digital forensic triage, analysis, review, intelligence analysis, presentation, and archiving. In addition, the data reduction process outlined can be applied using common digital forensic hardware and software solutions available in appropriately equipped digital forensic labs without requiring additional purchase of software or hardware. The process can be applied to a wide variety of cases, such as terrorism and organised crime investigations, and the proposed data reduction process is intended to provide a capability to rapidly process data and gain an understanding of the information and/or locate key evidence or intelligence in a timely manner.

Study on the Platform for Digital Forensics

A Survey of Digital Passive Lossless Forensics on Forged and Altered Document

Design and deployment of a digital forensics service platform for online videos.

Cloud-based Architecture for Media Forensics

: a digital forensics service platform for internet videos.

Digital Forensic Tools And Techniques For Handling Digital Evidence

A Novel Large-Scale Digital Forensics Service Platform for Internet Videos

Improving Digital Forensic Security: A Secure Storage Model With Authentication and Optimal Key Generation Based Encryption

Towards the Leveraging of Data Deduplication to Break the Disk Acquisition Speed Limit

Study of Memory Forensics Technology Oriented to Windows Operating System

Credibility Management of Cloud-based Digital Forensic Data: A Decentralized Verification Mechanism

Digital Forensic Investigation of Cloud Storage Services

Current Challenges and Future Research Areas for Digital Forensic Investigation

Cloud Storage Forensics: BaiduNetDisk, WeiYun, and 115yun on a Wireless Network

Big forensic data reduction: digital forensic images and electronic evidence

A Feature Comparison of Modern Digital Forensic Imaging Software

Towards a practical usage for the Sleuth Kit supporting file system add-ons

A Crowdsourcing Digital Forensics Platform for IoT Environments Powered by Blockchain

Cloud Storage Forensics: Analysis of Data Remnants on SpiderOak, JustCloud, and pCloud

Enabling the Remote Acquisition of Digital Forensic Evidence through Secure Data Transmission and Verification

An Insightful Analysis of Digital Forensics Effects on Networks and Multimedia Applications