An Automated Link Analysis Solution Applied to Digital Forensic Investigations

Abstract

The rapid growth of computer storage, new technologies, anti-forensics and hacking tools, as well as cheaper and easily accessible powerful computing equipment, has led to digital crimes becoming more frequent and often more sophisticated. These challenges have led to digital examinations becoming increasingly time-consuming and laborious, resulting in an urgent need for the automation of digital forensic analysis. In addition to in-depth analysis of particular digital devices, it is often necessary to establish that two devices and hence their owners are linked. This need arises, for example, when a suspect is apprehended and the investigator needs to establish grounds for the detention of a suspect. This paper proposes a methodology and a software solution to automate the detection of information linkage between two or more distinct digital devices.

Appendix A – Keyword Comparison Results

Individual	Keyword	Individual	Weight
John Smith	tobysskeeperTobys	P Patterson – Image 2	96
John Smith	novye.denginovye	P Patterson – Image 2	102
John Smith	tobysskeeperN7	P Patterson – Image 2	114
John Smith	runtime.overide@gmail.com	P Patterson – Image 2	380
John Smith	novye.dengi	P Patterson – Image 2	420
John Smith	Tobysskeeper	P Patterson – Image 2	531
John Smith	paeder.patterson@mobileemail.vodafone.ie	P Patterson – Image 3	294
John Smith	paeder.ucd	P Patterson – Image 3	330
John Smith	skype.outbound.ed10.com	P Patterson – Image 3	351
John Smith	lorna.bubbles@gmail.com	P Patterson – Image 3	513
John Smith	paeder.patterson @ucd.ie	P Patterson – Image 3	22644
John Smith	paeder.ucd@gmail.com	P Patterson – Image 3	64005
John Smith	Patterson	P Patterson – Image 3	75504
John Smith	lorna.bubbles.byrne@gmail.com	P Patterson – Image 3	203194
John Smith	john.ucd@gmail.com	P Patterson – Image 3	415692
John Smith	john.smith@ucd.ie	P Patterson – Image 3	44818818
John Smith	smithtoby.smith	Toby Smith	6
John Smith	lorna.bubblesLorna	Toby Smith	6
John Smith	lorna.bubblesA	Toby Smith	6
John Smith	toby.smithToby	Toby Smith	10
John Smith	lorna.bubbles.byrne@gmail.comByrne	Toby Smith	36
John Smith	novye.dengi	Toby Smith	60
John Smith	skype.com	Toby Smith	68
John Smith	TrueCrypt.exe	Toby Smith	80
John Smith	skype.outbound.ed10.com	Toby Smith	80
John Smith	toby.smithN1	Toby Smith	92
John Smith	lorna.bubbles	Toby Smith	220
John Smith	Welcome@email.skype.com	Toby Smith	666
John Smith	toby.smith	Toby Smith	1352
John Smith	TrueCrypt	Toby Smith	5330
John Smith	runtime.overide@gmail.com	Toby Smith	11400
John Smith	lorna.bubbles.byrne@gmail.com	Toby Smith	196954
John Smith	john.ucd@gmail.com	Toby Smith	230971
John Smith	toby.paul.smith@gmail.com	Toby Smith	796500
P Patterson – Image 2	novye.dengi	Toby Smith	1176
P Patterson – Image 2	runtime.overide@gmail.com	Toby Smith	42560
P Patterson – Image 2	skype.outbound.ed10.com	Toby Smith	337
P Patterson – Image 2	lorna.bubbles.byrne@gmail.com	Toby Smith	569204