A Digital Forensic Framework for Automated User Activity Reconstruction

摘要: User activity reconstruction is a technique used in digital forensic investigation. Using this technique, investigators extract list of user activities from artifacts confiscated at the crime scene. Based on list, explicit knowledge about crime, such as motive, method, time, and place, can be deduced. Until now, has been conducted by manual analysis. This means that domain reconstructed limited to personal investigators, so result exhibits low accuracy due human errors , process requires an excessive amount time. To solve these problems, paper proposes framework SigDiff for automated reconstruction. uses signature-based approach. It comprises signature generation module, database, artifact collection module. SigDiff, performed accurately with high retrieval rate reduced time span.