DESO: Addressing volume and variety in large-scale criminal cases

Abstract

This paper proposes a mechanism for dealing with the growing variety and volume of digital evidence in a criminal investigation.

The challenges posed by this growth have been long recognised and documented. There have been solutions aimed at processing bulk data and others based on event correlation or time lines. Instead we examine if there is an alternate method: to classify digital evidence artefacts in a way that assists selection of the potentially relevant evidence before processing any material. In so doing we wish to avoid generating bulk data and instead start viewing digital evidence from an investigative perspective – not a technological one.

This paper details the continuing development of an ontology for this purpose – the Digital Evidence Semantic Ontology (DESO). This provides an index to a repository of known digital evidence artefacts which are classified according to the location that they are found and the information they represent. Further, this paper also demonstrates how DESO can be applied to criminal investigations to assist lines of enquiry.

Introduction

With the increasing use of digital devices in modern life, so comes the need to examine them when that use touches on a criminal investigation. The increasing volume and variety of the material from these devices have already been well documented and attempts have been made to address the opportunities and problems caused by these two factors. Fast data extraction, keyword searches and time lining can all contribute when used appropriately. Ontologies have also been proposed as a solution to these problems. But many of these options concentrate on some form of processing across all data to be examined before any correlation is made. Others, such as OpenIOC (Mandiant, 2013) and CybOX (2012), focus on cyber incident response – where some form of IT system is the focus of an attack rather than crimes perpetrated using an IT system.

The Digital Evidence Semantic Ontology (DESO) (Brady et al., 2014), was proposed as a different approach. DESO's primary purpose is to act as a repository and classifier of digital evidence artefacts. The way in which DESO connects these artefacts allows a selective view of the data contained on digital devices and provides for them to be compared in a common format. In making a selection of artefacts before attempting to extract them, processing time and storage space is saved.

The earlier explanation of DESO specified two classes Artefact Location and Artefact Type Identifier to perform these tasks with associated object and data properties.

In this paper we expand on DESO's earlier description and show how it can be implemented. In so doing we:

• provide greater detail on DESO – including the addition of a third class to provide provenance – simplifying the consideration and production of evidential artefacts and their documentation;

• detail how DESO can be practically applied; and

• demonstrate how DESO can be integrated into existing and developing digital evidence methods proposed in the fields of incident response and criminal investigation.