The Use of Visualizaton in Forensic Studies

Forensic Designs Assessments

The goal of every digital forensic (DF) investigation is the rapid reconstruction of a sequence of events and user actions from the (frequently large) volumes of available evidence. Whilst tools, techniques and methodological support for the early stages of investigation (acquisition, preservation, searching) are maturing, the analysis and reconstruction stages have lagged behind. The resulting paucity of tool support leaves the execution of these activities largely dependent on the experience and intuition of the investigator.

The particular problem facing DF investigators is the need to explore large volumes of low-level recovered data and synthesize them into high-level information and a hypothesis of an offender's behavior.

The authors seek to exploit the synergies that exist between the problem domain and the strengths of interactive 3D computer graphics (CG) and information visualization to provide a means of exploring, analyzing and structuring the large, complex volumes of data associated with DF. The knowledge gained will be embodied in a prototype visualization tool known as Insight.

As a first stage of this work a review of existing uses of data visualization within the security field and of the existing techniques for supporting digital forensic analysis/reconstruction has been undertaken. This paper presents the results of this survey, analyses the strengths and weaknesses of existing tools and techniques and Suggests potential avenues for further exploitation of visualization techniques within the field of digital forensics.

The techniques employed in the stage are not defined at the methodological level, suggests that the activities which form equivocal analysis (i.e. resulting in hypotheses that may be either inculpatory or exculpatory) can be categorized as temporal analysis, relational analysis and functional analysis.

Temporal analysis is concerned with ordering recovered evidence by time to provide a narrative sequence of events. Many items of digital forensic data are naturally amenable to this (e.g. file MAC times, events logs with timestamps, email timestamps etc.).

Relational analysis attempts to show the links between entities in a case, e.g. the existence of a phone number in a mobile phone contacts database shows a link between the phone's owner and the owner of the phone number. Functional analysis is the act of determining which entities could have performed any of the events which are related to the case.

Various attempts have been made to formalize the process of analysis. Typical are those of based on state machines. It is unclear from the literature how widespread the adoption of such formal approaches has been but Pollit and Whitledge  suggests that the core act of analysis, i.e. reconstructing a testable high level description of what was done by whom, is, in many case left to the experience of the individual analysts and investigating officers.

Currently data recovered by the early stages of a digital forensics investigation is analyzed manually which is a time-consuming process. Some existing products attempt to make the investigative process more efficient through the use of filtering and by providing facilities for overview of the data; however, most of these tools still necessitate the investigators working through large quantities of qualitative information.

Some tools attempt to alleviate this problem by presenting the data in a way which it is intended to be more readily understood by the analyst than a 'raw' format. For example, Zeitline allows the investigator to group information taken from the target computer such as MAC timestamps and event logs into a hierarchical structure of atomic and complex events. This structure is then displayed visually to the user as a tree interface which they will be familiar with from tools such as Microsoft Explorer. This tool increases efficiency by ensuring that the investigator has a way to structure the data they find, and keep it in chronological order, whilst structuring it in an easy to understand format to use as evidence.

Analysis

In this section we attempt to draw some conclusions from the preceding review as to the extent to which the key activities of analysis are supported by tools and as to how this situation might be improved by the use of data-visualization techniques.

Temporal Analysis

If our working definition of “analysis” is accepted, then the key activities are those of organizing and structuring of low-level evidence into a testable hypothesis. Of the three types of analysis (temporal, relational and functional) the only one in which such organization receives tool support is temporal analysis: Tools such as Zeitline, fls, CyberForensic TimeLab and Webscavator.

It seems reasonable to conjecture that temporal analysis has been favored by the toolmakers because of the simplicity of its underlying formalism – i.e. sorting by timestamp. In terms of allowing structuring and organization, Zeitline alone acknowledges the “layers of abstraction” approach by allowing the grouping of events into higher level events. Fls and associated tools whilst indispensable for obtaining and converting low-level data offer few facilities for “analysis”.

The presentation of the results of Zeitline and fls is however tabular and thus still requires significant effort on the part of the interpreter. Webscavator and CyberForensic TimeLab place emphasis on the graphical display of low-level data and as such represent a step towards easier comprehension of low- level data, but lack the “grouping” concept of Zeitline. No one tool thus provides facilities for low-level manipulation, structuring into high-levels and use of data-visualization techniques to enhance comprehensibility.

Relational Analysis

There exist many tools designed for social network analysis (perhaps because computer scientists love playing around with graph theory and layout algorithms) but few are designed to work specifically within a digital forensic context. Meng's VAIE system demonstrates that well-known data-visualization graph rendering techniques can be applied to social networks recovered from forensic data. It is not clear however how this can be integrated with an overall investigation.

Relational analysis can be used in a broader sense to identify significant correlations between low level data items. Currently such SOM tools are not well integrated with the digital forensic process.

Functional Analysis

Our survey was unable to find any visualization software that explicitly supports functional analysis. The use of debugging software in the analysis of malware certainly aids the comprehensibility of such problems, but does not fall within the usual definition of data visualization. It could possibly be argued that the use of Treemaps (as exemplified by the “Digital Forensics Visualization Tool”) constitutes functional analysis as it is helping to gain an understanding of the use to which a system has been put.

Proposed Solution

Due to the multiple attributes of data contained on a device, it is difficult to map these to a 2D visualization. However, by using a 3D visualization technique, there is 'space'. This is the approach we aim to take in our research, to allow as much information to be provided to the end user in a logical visual format, to allow patterns to be recognised which can highlight areas of interest which may merit further investigation. In taking this approach, Osborne and Turnbull   note that as there is an extra dimension in a 3D diagram, not only does the complexity increase, but there is a chance for data to become unintentionally obscured; an issue which we will attempt to address.

No single tool or technique yet provides the analyst with the means to vary the focus of their attention from low-level detail to case-wide overview nor provides the means to organize evidence into reconstruction of activity by linking related/correlated low-level data items.

Conclusion

It can be seen that current usage of visualization tools in computer security has shown promising results, with end users becoming consistently more productive when using a tool which provides them with a visual representation of the data, in comparison to a textual representation. As most of the existing tools and research primarily target network security, there is a lack of focus on the use of visualization in digital forensics.

We intend to develop a tool called Insight which will provide the end user with an exploratory 3D visualization which represents the contents of a computer. In doing so, we intend to examine whether using 3D visualization software in a digital forensic investigation significantly increases productivity when compared to commonly used text based tools. This will include a comprehensive usability study to ensure that users find the software easy to use and quick to learn. We will also assess whether the software is likely to suffer from any form of data occlusion, and if so we will attempt to mitigate this risk.

Ideally, the tool will be able to use output formats from common existing text-based tools. In doing so, the user does not have to switch from tools which they are used to using for capturing the data, and then they are free to analyze it in the visualization environment. Forcing users to use a new data capture system can be problematic for them and could potentially hamper uptake of the tool and productivity.