A variable scale case-based reasoning method for evidence location in digital forensics

Abstract

With the increasing usage of information technology on the criminal side, the digital forensic analysis, especially multimedia forensics, becomes an emerging technique for cybercrime investigators to improve examination efficiency. The study focuses on the digital triage problem for evidence location during the automatic forensic process. After defining the multi-scale knowledge base for storing digital forensic investigators’ prior knowledge, a variable scale case-based reasoning method (VSCBR) is proposed to support investigators predicting evidential areas. The variable-scale clustering algorithm based on the scale transformation strategy (VSC-STS) is also put forward, which could identify highly similar past cases containing candidate evidence in the case reuse and revise phase. A case study is established using a real 15.9 GB bidding case dataset, which contains both text bidding documents and image technical drawings. Numerical experimental results show that the validation of the proposed VSC-STS is significantly improved compared with the traditional single-scale clustering algorithm, and it is insensitive to the initial parameter threshold. Moreover, the proposed method VSCBR is able to help investigators locate suspicious rule-violating evidences in practice.