Welcome to the InfoSci Platform
Reference Hub16
A Framework for the Forensic Investigation of Unstructured Email Relationship Data

A Framework for the Forensic Investigation of Unstructured Email Relationship Data

John Haggerty, Alexander J. Karran, David J. Lamb, Mark Taylor
Copyright: © 2011 |Volume: 3 |Issue: 3 |Pages: 18
ISSN: 1941-6210|EISSN: 1941-6229|EISBN13: 9781613506479|DOI: 10.4018/jdcf.2011070101
Cite Article Cite Article

MLA

Haggerty, John, et al. "A Framework for the Forensic Investigation of Unstructured Email Relationship Data." IJDCF vol.3, no.3 2011: pp.1-18. http://doi.org/10.4018/jdcf.2011070101

APA

Haggerty, J., Karran, A. J., Lamb, D. J., & Taylor, M. (2011). A Framework for the Forensic Investigation of Unstructured Email Relationship Data. International Journal of Digital Crime and Forensics (IJDCF), 3(3), 1-18. http://doi.org/10.4018/jdcf.2011070101

Chicago

Haggerty, John, et al. "A Framework for the Forensic Investigation of Unstructured Email Relationship Data," International Journal of Digital Crime and Forensics (IJDCF) 3, no.3: 1-18. http://doi.org/10.4018/jdcf.2011070101

Export Reference

Mendeley
Favorite Full-Issue Download

Abstract

The continued reliance on email communications ensures that it remains a major source of evidence during a digital investigation. Emails comprise both structured and unstructured data. Structured data provides qualitative information to the forensics examiner and is typically viewed through existing tools. Unstructured data is more complex as it comprises information associated with social networks, such as relationships within the network, identification of key actors and power relations, and there are currently no standardised tools for its forensic analysis. This paper posits a framework for the forensic investigation of email data. In particular, it focuses on the triage and analysis of unstructured data to identify key actors and relationships within an email network. This paper demonstrates the applicability of the approach by applying relevant stages of the framework to the Enron email corpus. The paper illustrates the advantage of triaging this data to identify (and discount) actors and potential sources of further evidence. It then applies social network analysis techniques to key actors within the data set. This paper posits that visualisation of unstructured data can greatly aid the examiner in their analysis of evidence discovered during an investigation.

Request Access

You do not own this content. Please login to recommend this title to your institution's librarian or purchase it from the IGI Global bookstore.