Visual Analysis for Textual Relationships in Digital Forensic Evidence

Abstract

We present a visual analytics framework for exploring the textual relationships in computer forensics. Based on a task analysis study performed with practitioners, our tool addresses the inefficiency of searching for related text documents on a hard drive. Our framework searches both allocated and unallocated sectors for text and performs some pre-analysis processing; this information is then presented via a visualization that displays both the frequency of relevant terms and their location on the disk. We also present a case study that demonstrates our framework's operation, and we report on an informal evaluation conducted with forensics analysts from the Mississippi State Attorney General's Office and National Forensics Training Center.