Investigating visualisation techniques for rapid triage of digital forensic evidence

Gavin Hales; Ethan Bayne

doi:10.1007/978-3-030-22351-9_19

Investigating visualisation techniques for rapid triage of digital forensic evidence

Gavin Hales, Ethan Bayne

Division of Cybersecurity

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2 Citations (Scopus)

221 Downloads (Pure)

Abstract

This study investigates the feasibility of a tool that allows digital forensics (DF) investigators to efficiently triage device datasets during the collection phase of an investigation. This tool utilises data visualisation techniques to display images found in near real-time to the end user. Findings indicate that participants were able to accurately identify contraband material whilst using this tool, however, classification accuracy dropped slightly with larger datasets. Combined with participant feedback, the results show that the proposed triage method is indeed feasible, and this tool provides a solid foundation for the continuation of further work.

Original language	English
Title of host publication	HCI for cybersecurity, privacy and trust
Subtitle of host publication	first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings
Editors	Abbas Moallem
Place of Publication	Cham
Publisher	Springer
Pages	277-293
Number of pages	17
ISBN (Electronic)	9783030223519
ISBN (Print)	9783030223502
DOIs	https://doi.org/10.1007/978-3-030-22351-9_19
Publication status	Published - 12 Jun 2019
Event	HCI International 2019: 21st International Conference on Human-Computer Interaction - Walt Disney World Swan and Dolphin Resort, Orlando, United States Duration: 26 Jul 2019 → 31 Jul 2019 http://2019.hci.international/

Publication series

Name	Lecture Notes in Computer Series
Publisher	Springer
Volume	11594
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	HCI International 2019
Abbreviated title	HCI International
Country/Territory	United States
City	Orlando
Period	26/07/19 → 31/07/19
Internet address	http://2019.hci.international/

Keywords

Digital forensics
Data visualisation
Computer security
File carving
Digital triage

Access to Document

10.1007/978-3-030-22351-9_19

Hales_InvestigatingVisualisationTechniques_Accepted_2018Accepted author manuscript, 957 KB

Gavin Hales
- G516593abertay.acuk
- Division of Cybersecurity - Lecturer
Person: Academic

Cite this

Hales, G., & Bayne, E. (2019). Investigating visualisation techniques for rapid triage of digital forensic evidence. In A. Moallem (Ed.), HCI for cybersecurity, privacy and trust: first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings (pp. 277-293). (Lecture Notes in Computer Series; Vol. 11594). Springer. https://doi.org/10.1007/978-3-030-22351-9_19

Hales, Gavin ; Bayne, Ethan. / Investigating visualisation techniques for rapid triage of digital forensic evidence. HCI for cybersecurity, privacy and trust: first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings. editor / Abbas Moallem. Cham : Springer, 2019. pp. 277-293 (Lecture Notes in Computer Series).

@inproceedings{cab9c025df364888a13943afe85502e5,

title = "Investigating visualisation techniques for rapid triage of digital forensic evidence",

abstract = "This study investigates the feasibility of a tool that allows digital forensics (DF) investigators to efficiently triage device datasets during the collection phase of an investigation. This tool utilises data visualisation techniques to display images found in near real-time to the end user. Findings indicate that participants were able to accurately identify contraband material whilst using this tool, however, classification accuracy dropped slightly with larger datasets. Combined with participant feedback, the results show that the proposed triage method is indeed feasible, and this tool provides a solid foundation for the continuation of further work.",

author = "Gavin Hales and Ethan Bayne",

year = "2019",

month = jun,

day = "12",

doi = "10.1007/978-3-030-22351-9_19",

language = "English",

isbn = "9783030223502",

series = "Lecture Notes in Computer Series",

publisher = "Springer",

pages = "277--293",

editor = "Abbas Moallem",

booktitle = "HCI for cybersecurity, privacy and trust",

note = "HCI International 2019 : 21st International Conference on Human-Computer Interaction, HCI International ; Conference date: 26-07-2019 Through 31-07-2019",

url = "http://2019.hci.international/",

}

Hales, G & Bayne, E 2019, Investigating visualisation techniques for rapid triage of digital forensic evidence. in A Moallem (ed.), HCI for cybersecurity, privacy and trust: first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings. Lecture Notes in Computer Series, vol. 11594, Springer, Cham, pp. 277-293, HCI International 2019, Orlando, Florida, United States, 26/07/19. https://doi.org/10.1007/978-3-030-22351-9_19

Investigating visualisation techniques for rapid triage of digital forensic evidence. / Hales, Gavin; Bayne, Ethan.

HCI for cybersecurity, privacy and trust: first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings. ed. / Abbas Moallem. Cham : Springer, 2019. p. 277-293 (Lecture Notes in Computer Series; Vol. 11594).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - Investigating visualisation techniques for rapid triage of digital forensic evidence

AU - Hales, Gavin

AU - Bayne, Ethan

PY - 2019/6/12

Y1 - 2019/6/12

N2 - This study investigates the feasibility of a tool that allows digital forensics (DF) investigators to efficiently triage device datasets during the collection phase of an investigation. This tool utilises data visualisation techniques to display images found in near real-time to the end user. Findings indicate that participants were able to accurately identify contraband material whilst using this tool, however, classification accuracy dropped slightly with larger datasets. Combined with participant feedback, the results show that the proposed triage method is indeed feasible, and this tool provides a solid foundation for the continuation of further work.

AB - This study investigates the feasibility of a tool that allows digital forensics (DF) investigators to efficiently triage device datasets during the collection phase of an investigation. This tool utilises data visualisation techniques to display images found in near real-time to the end user. Findings indicate that participants were able to accurately identify contraband material whilst using this tool, however, classification accuracy dropped slightly with larger datasets. Combined with participant feedback, the results show that the proposed triage method is indeed feasible, and this tool provides a solid foundation for the continuation of further work.

U2 - 10.1007/978-3-030-22351-9_19

DO - 10.1007/978-3-030-22351-9_19

M3 - Conference contribution

SN - 9783030223502

T3 - Lecture Notes in Computer Series

SP - 277

EP - 293

BT - HCI for cybersecurity, privacy and trust

A2 - Moallem, Abbas

PB - Springer

CY - Cham

T2 - HCI International 2019

Y2 - 26 July 2019 through 31 July 2019

ER -

Hales G, Bayne E. Investigating visualisation techniques for rapid triage of digital forensic evidence. In Moallem A, editor, HCI for cybersecurity, privacy and trust: first international conference, HCI-CPT 2019, held as part of the 21st HCI international conference, HCII 2019, Orlando, FL, USA, July 26–31, 2019, proceedings. Cham: Springer. 2019. p. 277-293. (Lecture Notes in Computer Series). Epub 2019 Jun 12. doi: 10.1007/978-3-030-22351-9_19

Investigating visualisation techniques for rapid triage of digital forensic evidence

Abstract

Publication series

Conference

Keywords

Access to Document

Fingerprint

Profiles

Gavin Hales

Cite this